- Freeradius-Users - lists.freeradius.org

usergroup and radgroupcheck problem!
by Hamid Reza Hasani 14 Nov '09

14 Nov '09

Hi, (Salam) I'm using last version of freeradius. when my users are going to connect, I see this message: [sql] expand: %{User-Name} -> myuser [sql] sql_set_user escaped user --> 'myuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'myuser' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM usergroup WHERE username = 'myuser' ORDER BY priority [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'myuser' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'myuser' ORDER BY id [sql] User found in group test [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop ++[expiration] returns noop ++[logintime] returns noop if you look at them carefully, you can see there is a bit problem! my freeradius is read radgroupcheck before usergroup table, so it can't recognize user's group name for radgroupcheck query! so it can't read radgroupcheck attributes! where is my fault? can I change it priority? thanks Ya Ali Hamid Reza Hasani

2 3

How to store multiple Cisco-AVPair to sql database
by Mark Jones 14 Nov '09

14 Nov '09

As you can see in the below accounting packet there are multiple cisco-avpsir entries. how can i referecne the second and seccussive entries when trying to store them in and sql database. Fri Nov 13 10:56:23 2009 Acct-Session-Id = "004D8A64" Cisco-AVPair = "client-mac-address=0024.016f.3054" Framed-Protocol = PPP Framed-IP-Address = User-Name = "downs(a)mnsi.net" Acct-Authentic = RADIUS Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=37500000" Cisco-AVPair = "nas-rx-speed=37500000" Acct-Session-Time = 300 Acct-Input-Octets = 666 Acct-Output-Octets = 708 Acct-Input-Packets = 52 Acct-Output-Packets = 53 Acct-Terminate-Cause = User-Request Cisco-AVPair = "disc-cause-ext=PPP Receive Term" Acct-Status-Type = Stop NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "1/0/0/3.33" Service-Type = Framed-User NAS-IP-Address = Acct-Delay-Time = 1 Client-IP-Address = Hint = "" Acct-Unique-Session-Id = "f60485a6cb583511" Stripped-User-Name = "dow" Realm = "" Timestamp = 1258127783 Mark Jones London Operations Managed Network Systems Desk 519-679-5207

2 1

WiMAX-Capabilty proxy issue
by Ramon J. Castillo 14 Nov '09

14 Nov '09

Dear all; I'm having an issue when proxying an access-request message between two WiMAX networks. I recently downloaded FR 2.1.8 and I'm in the middle of the messaging path. The home network is using EAP-TLS but it should be transparent for the proxy right? The issue is with the AVP WiMAX-Capability(1) please see below the packets captured (shown as in WireShark) Sending network AVP before FR proxy as arrived: AVP: l=17 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=11 t=WiMAX-Capability(1) C=0x00: 2 TLV(s) inside TLV: l=5 t=WiMAX-Release(1): 1.4 WiMAX-Release: 1.4 TLV: l=3 t=WiMAX-Accounting-Capabilities(2): No-Accounting(0) WiMAX-Accounting-Capabilities: No-Accounting (0) After proxy from FR to the Home network AVP: l=17 t=Vendor-Specific(26) v=WiMAX(24757) VSA: l=11 t=WiMAX-Capability(1) C=0x00: TLV: l=7 t=WiMAX-Release(1): 1.4\002\005 WiMAX-Release: 1.4\002\005 [Not enough room in packet for TLV header] The home network AAA complains with the error message that can not decode the AVP WiMAX-Capabilty. Any ideas why and what can I do to fix it are very much appreciated Merci Thanks a lot Vielen Dank! Gracias Ramon

2 2

Compiling freeradius server with static libraries
by kachin Agarwal 13 Nov '09

13 Nov '09

Hi, How to compile the freeradius server using static library function?? Thanx & Regards, kachin Add whatever you love to the Yahoo! India homepage. Try now! http://in.yahoo.com/trynew

2 1

Microsoft: SmardCard or Certificate Auth
by swatzy 13 Nov '09

13 Nov '09

Hi: I'm trying to configure a FreeRadius server to perform a certification authentication from a Windows Laptop. I have follow the steps at http://wiki.freeradius.org/WPA_HOWTO#HOWTO_Do_It:_An_Outline But when I try to do the connection, it never ends... and I get peridical messeges at the FreeRadius server ouput in this way... rad_recv: Access-Request packet from host 160.103.180.252:32769, id=0, length=176 User-Name = "radiusserv" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x0202000f0172616469757373657276 Message-Authenticator = 0x978d232412c863306539d3ad92c9d6b8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "radiusserv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 179 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 160.103.180.252 port 32769 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc321c12ede0c59624273d465195058be Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 160.103.180.252:32769, id=1, length=300 User-Name = "radiusserv" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020300790d800000006f160301006a0100006603014af93134b45308b2252422bb395d6ce641bfdc48695e46696178ab4d4b407442000018002f00350005000ac009c00ac013c0140032003800130004010000250000000f000d00000a72616469757373657276000a00080006001700180019000b00020100 State = 0xc321c12ede0c59624273d465195058be Message-Authenticator = 0x209186e1eb149efd3ce2e8796100a977 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "radiusserv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 users: Matched entry DEFAULT at line 179 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 006a], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0283], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0085], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 160.103.180.252 port 32769 EAP-Message = 0x0104036b0d8000000361160301004a0200004603014af93134a0ad2fc9103447a6a53e1bd7b8e1a2581b8e10093af80ed2eb04a3b420561e9f8d80da1f899a98dce9e25e4ee70e780ba01becdc9ba1deb915f60224a4002f0016030102830b00027f00027c00027930820275308201dea003020102020100300d06092a864886f70d01010505003074310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a130445535246311330110603550403130a72616469757373657276311e301c06092a864886f70d010901160f6e6574776f726b40657372662e6672 EAP-Message = 0x301e170d3039313130333136353833315a170d3130313130333136353833315a3074310b3009060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a130445535246311330110603550403130a72616469757373657276311e301c06092a864886f70d010901160f6e6574776f726b40657372662e667230819f300d06092a864886f70d010101050003818d0030818902818100b8fd3330a5f8ed59944b0ab8f162332223f749059609e5dd68c5efeced0434e500b7178aa3d9ffe32679034200952f14c64f321c851ee7254e78210ad1b8b0420980fb43fa1adf2f89b8 EAP-Message = 0x56fadc8092ef42b1f507a02fc81ab60ed258c3fb079f8d709d8821164011516b7d4d4589ff86306ce61f98130a360ebb3182983900c30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810091d8dca090d57b08a7731dd90db757ed0da0e534cfda5565b6220528e37edadf12944d2fc1c6398e418a99b636904e2b1c4152f614bc5f0b3c4309cf264f27b794e28242ee02bb6ea48d0e3b1440b69ad926bb080ccebc20c3f1ef3b23a9e7868b2a86303b82ee891e9829dd1d6750837c8d533df59899ddaf9c2350b46992ae16030100850d00007d020102007800763074310b3009 EAP-Message = 0x060355040613024652310e300c0603550408130549736572653111300f060355040713084772656e6f626c65310d300b060355040a130445535246311330110603550403130a72616469757373657276311e301c06092a864886f70d010901160f6e6574776f726b40657372662e66720e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa8f213a60ac152b2e7e42048e94461f9 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 160.103.180.252:32769, id=2, length=185 User-Name = "radiusserv" Calling-Station-Id = "00-1d-e0-7f-c7-bd" Called-Station-Id = "00-26-cb-4c-f7-c0:Bidon" NAS-Port = 13 NAS-IP-Address = 160.103.180.252 NAS-Identifier = "wlc01" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "82" EAP-Message = 0x020400060d00 State = 0xa8f213a60ac152b2e7e42048e94461f9 Message-Authenticator = 0xe9f04c151b954deb2b5e5c1ca7032f53 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "radiusserv", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 179 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 160.103.180.252 port 32769 EAP-Message = 0x0105000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x09770a67d71842c41d63756db81b29fc Finished request 2 Going to the next request Waking up in 6 seconds... ------------------------------------- Any ideas what i'm doing wrong? -- View this message in context: http://old.nabble.com/Microsoft%3A-SmardCard-or-Certificate-Auth-tp26280525… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Proxy to multiple servers in FR 2.1.7
by Patric 13 Nov '09

13 Nov '09

Hi again all :) I am attempting to proxy all accounting packets to 2 servers. In my proxy.conf I am using a default realm. realm DEFAULT { acct_pool = my_acct_failover nostrip } I create a home_server entry for each server, and add them to the home_server_pool for that realm: home_server copy-acct-to-home-server { } home_server copy-acct-to-home-server2 { } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server home_server = copy-acct-to-home-server2 } If I have site-enable/copy-acct-to-home-server it then appears to work in a fail-over method, where it will send to the first server until it is not reachable, then it sends to the second server. Is there a way I can configure this to send to both at once? Do I need a second site-enable/copy-acct-to-home-server1 file that reads from a different detail file? I am using the default realm so I dont know how to setup a second home_server_pool either... Any help is much appreciated, Im going in circles :) Many thanks Patric

3 6

operator !* in update {}
by Jakob Hirsch 13 Nov '09

13 Nov '09

Hi, according to unlang: > !* Delete all occurances of the named attribute, no matter what the value. but when I want to use it like that: post-auth { Post-Auth-Type REJECT { update reply { Idle-Timeout !* 0 Session-Timeout !* 0 } } } but freeradius (2.1.7) does not seem to like it: > /etc/freeradius2//sites/ui.site.conf[205]: Parse error after "Idle-Timeout" other operators work, e.g. ... update reply { Idle-Timeout -= 7200 Session-Timeout -= 86400 } ... but that's not handy... Regards, Jakob

3 3

Learning Freeradius Server
by kachin Agarwal 13 Nov '09

13 Nov '09

Hi all, I m new to freeradius server. I jus want to understand the flow of freeradius server and how does it run. So somebody could help me start with it on how to read the code. which is the program code to start with. Thanx & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

3 3

Re: Freeradius-Users Digest, Vol 55, Issue 58
by Gilbert Lo 13 Nov '09

13 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

[Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]]
by Wagner Pereira 12 Nov '09

12 Nov '09

3 5