- Freeradius-Users - lists.freeradius.org

Session resumption problem
by David Mitchell 20 Oct '09

20 Oct '09

I was searching back in the archives, and in September there was a user who reported a problem with session resumption. I'm seeing the exact same symptoms I believe, also on Debian 5.0 with OpenSSL 0.9.8g. I never saw any follow up? Is there a fix known for this? I am using a locally compiled version of FreeRadius 2.1.7. It's linked against the system OpenSSL libraries though. Building a local 0.9.8k or even 1.0.0 is certainly an option if there is a chance it will help. Here's a snippet from the original thread. I think it was about Sept. 1st 2009. I get similar errors. Sometimes the client (an Ubuntu 9.04 Jaunty laptop) connects, but sometimes I get this resumption error. My other clients (XP, iPhone, etc.) don't seem to ever exhibit the problem. > [peap] Success > [peap] FAIL: Forcibly stopping session resumption as it is not allowed. > [eap] Freeing handler Arg. FreeRADIUS tells OpenSSL to *not* allow session resumption, and it still negotiates session resumption. Which OS are you using? Which version of OpenSSL? -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

3 5

{control:SQL-Group} in post-auth
by Anton Borisov 20 Oct '09

20 Oct '09

Hello! My user is inserted in group = my_pool in sql DB. I try to use in my sites-enabled/default something like this post-auth { ... ... if ( SQL-Group == my_pool ) { ... ... } } when my user comes I can see it : Tue Oct 20 18:49:23 2009 : Info: [sqlauth] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id ... Tue Oct 20 18:49:23 2009 : Info: [sqlauth] expand: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE (usergroup.Username = '%{SQL-User-Name}' OR usergroup.CLID = '%{Calling-Station-Id}') AND usergroup.GroupName = radgroupcheck.GroupName AND usergroup.GroupName = '%{SQL-Group}' ORDER BY usergroup.PRIORITY,radgroupcheck.id ... Tue Oct 20 18:49:23 2009 : Info: [sqlauth] User found in group my_pool ... Ok, we can see that user is in my_pool group - this it ## point 1 #### ... Tue Oct 20 18:49:23 2009 : Info: +- entering group post-auth {...} Tue Oct 20 18:49:23 2009 : Info: ++[exec] returns noop Tue Oct 20 18:49:23 2009 : Info: ++? if (SQL-Group == pool ) Tue Oct 20 18:49:23 2009 : Info: sql_groupcmp Tue Oct 20 18:49:23 2009 : Debug: rlm_sql (sqlacct): Reserving sql socket id: 24 Tue Oct 20 18:49:23 2009 : Info: expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' OR CLID='%{Calling-Station-Id}' order by priority -> SELECT GroupName FROM usergroup WHERE UserName='bebebeb' OR CLID='bebebeb' order by priority Tue Oct 20 18:49:23 2009 : Info: sql_groupcmp finished: User is a member of group pool Tue Oct 20 18:49:23 2009 : Debug: rlm_sql (sqlacct): Released sql socket id: 24 Tue Oct 20 18:49:23 2009 : Info: ? Evaluating (SQL-Group == pool ) -> TRUE Tue Oct 20 18:49:23 2009 : Info: ++? if (SQL-Group == pool ) -> TRUE Tue Oct 20 18:49:23 2009 : Info: ++- entering if (SQL-Group == pool ) {...} Ok, we can see that because ###if ( SQL-Group == my_pool ) ### - so, radius try to use new SQL query to sql DB.. But why? In this point radius knows that user had been found in group my_pool - see ###point 1###. Can I use another world for this check?, for example if ( '%{control:SQL-Group}' == my_pool ) { .... } because in this point I know exactly that my user belong to group my_pool (see ####point 1####). If I can use previous sql-select (###point 1####), I do not have to make another SQL query every time when I use "if (SQL-Group == my_pool)" . -- Yours faithfully, Anton Borisov.

2 1

Question about Max-All-Session vs. Expiration attributes
by Cory Hill 20 Oct '09

20 Oct '09

I have a successful wifi captured portal system running with FreeRadius and HP Procurve equipment. When I originally started learning how to build it, I used WiFiGator as my first test case. When they set up that system, they used both the Max-All-Session and the Expiration attributes for all users, so I am still doing this now. We sell our time in Day, Week and Month increments, and the users are free to used the system as much as they want during their time. My Question is, do I really need to use Max-All-Session if all I really need is a hard expiration date for my users? Thank you in advance.

2 1

Re: Clear Text PAP passwords - how to enable
by Alex M 20 Oct '09

20 Oct '09

My SQL include and module authorization is enabled in instantiate section Im not 100% sure what "virtual server" do in new radius. I guess you are probably right about that fact that my radius is not accsesing SQL to see the users there,.. so since my Include is enabled i guess i need to figure out what those virtual servers are and how to use them tnx for helping! On Sun, Oct 18, 2009 at 5:04 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > Sql is not enabled in 2.x by default. Enable INCLUDE in radiusd.conf and > sql entries you need in default virtual server > (raddb/sites-enabled/default). > > Ivan Kalik > Kalik Informatika ISP > > > Password is in SQL table raddcheck > > Also will take a look at that FAQ > > > > I know i had the same problem w. FR 1.5 and there I just had to take out > > DEFAULT Auth-Type: system so that we don't look for system password but I > > didnt find anything like that on FR 2 > > > > > > > > > > On Sun, Oct 18, 2009 at 10:43 AM, Ivan Kalik <tnt(a)kalik.net> wrote: > > > >> > hey all > >> > we keep upgrading FR servers and i got stuck with problem where I need > >> PAP > >> > (I think) well i need clear text password and its not working for my > >> user. > >> > When i send request through NTRAdping w/ CHAP all works well but when > >> I'm > >> > using device as NAS nothing works :( > >> > > >> > I hope some one can point me out in right direction. Here is my > >> output: > >> > >> Where is password supposed to be? It wasn't found in users (files) or > >> system (unix) file. > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > >

3 5

how to call an external script one the users is expired?
by aangles 20 Oct '09

20 Oct '09

hello, please i need to know how to call an external script one the users is expired. I got radius call an external script once the user is authenticated with success by using the echo module, but now I need to call another script when the user tries to connect after expiration date. Any ideas? thanks a lot -- View this message in context: http://www.nabble.com/how-to-call-an-external-script-one-the-users-is-expir… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Windows client MS-chap auto-reauthentication
by Vieri 20 Oct '09

20 Oct '09

Hello, I'm connecting Windows clients to a LAN via Linksys access points and a Freeradius server. I'm using EAP/TLS with certificates installed on the clients and in modules/mschap I defined: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=DOMAIN --require-membership-of=DOMAIN\\WIFI_DATA --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" So the Windows clients must have a certificate and login with the credentials of an Active Directory user member of the WIFI_DATA group. This setup works fine. However, I'm seeing a major difference between a Windows XP pro SP2 client and a Windows Vista: if the Vista client (laptop) reboots the OS then access to the LAN via WIFI requires the user to re-enter login username and password, as expected. If the XP client reboots the OS then user credentials seem to be automatically sent to the Radius server again, as if they were stored on the system (no user interaction). Can I change this behavior and require the user to re-send their login data each time the Windows session is closed or the OS reboots? I realize this is a "client-only" issue and that freeradius can't possibly detect the difference between the 2 cases (or can it?) but I am concerned that if, for example, the XP laptop is stolen (or unauthoritatively lent) then all the "unwanted" user needs to do to access our LAN is boot the OS, unless the legitimate user's password has expired. The laptop is for a hospital's Emergency department so it's easy to imagine that it cannot be under 24-hour surveillance (but usually, the legitimate users switch the device off when done working or the laptop automatically turns off after an inactivity timeout). Does anyone know: why XP re-authenticates automatically and how to disable it? why Vista doesn't behave the same way? if installing SP3 on XP removes this feature? if somethng can be done on freeradius to discriminate manual logins from auto-logins? I'm running freeradius 2.0.5 on Linux. Thank you, Vieri

6 9

Re: Re: IP address assignment for the authenticated users in Free
by David Mitton 20 Oct '09

20 Oct '09

1 0

Proxy based on Multiple Realms
by Bob Brandt 20 Oct '09

20 Oct '09

What I want to do is proxy requests based on being in multiple realms. For example: Realm1/username.Realm2 Where is Realm1 is "host" AND Realm2 is "some.fqdn" then proxy to xxx.xxx.xxx.xxx Specifically what I am doing is trying to use FreeRadius to proxy for AD Domains. I want to enable host based authentication (i.e. host/ workstation.domain.name ) but for multiple domains. I believe proxying is the only why to accomplish this. All I can find are references/warnings to making sure that I DON'T do this by mistake. Problem is I believe this is what I must do. Is this even possible with FreeRadius? Thanks Bob

3 10

EAP (RFC- 3579) under GPL with FreeRadius1.1.8?
by Divyank Rastogi 20 Oct '09

20 Oct '09

Hi, I was going through FreeRadius1.1.8 code when i saw that unlike the SRC code which is LGPL, EAP code is under GPL. As per my understanding LGPL (and not GPL) is applicable to be freely distributes as statically linked libraries and the files in ‘module’ folder are protected by GPL as against the ‘lib’ files which are protected by LGPL. I am planning to use the source code in the lib folder as well as that in the module folder (for supporting rfc-3579) in FreeRadius. Are there going to be issues in statically linking this code? If so, can anyone please help out with ideas on how to circumvent the issue (including other (licensed) vendor recommendations as well). Thanks, Divyank

2 1

Radius 2.1.7 disponible for freebsd?
by Alisson 20 Oct '09

20 Oct '09

Radius 2.1.7 disponible for freebsd? -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

1 0