- Freeradius-Users - lists.freeradius.org

Radius Logs in database (It was Re: rlm_ldap logs)
by Sergio Belkin 31 Aug '09

31 Aug '09

2009/8/28 Sergio Belkin <sebelk(a)gmail.com>: > Hi I am using Version 2.1.1 with openldap on Centos 5 > I wonder if is feasible dumping to logs when user gets login incorrect > if due to non-existance of that uid on Ldap. > > Thanks in advance! > > -- > -- Shame on me! That's is something that already logs do: Fri Aug 28 18:48:08 2009 : Auth: Login incorrect (rlm_ldap: User not found): [zzzzz(a)zzzzzz.zzz] (from client ZZZZ port 0 via TLS tunnel) Thanks y Sorry Even so I'd like to find a way to store radius logs on a database. Does exist such a tool? I need to perform some queries on them, for example, what users that had an incorrect login (eg bad password or certificate) after some time they could get an OK. Perhaps, some of you have an idea about how can I do that. Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Re: How to desactivate freeradius to open the network ?
by Gary Gatten 31 Aug '09

31 Aug '09

Check out the users file and the DEFAULT directive. ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Mon Aug 31 04:32:32 2009 Subject: How to desactivate freeradius to open the network ? Hello, I use Freeradius on Debian with mac-based authentification along with a MySQL database containing the mac addresses (as Login & Password). I would like to open the network to everyone, so I wonder how to make freeradius to authorize any mac address to open the network ? Regards, RedVivi - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

How to desactivate freeradius to open the network ?
by via.lej＠free.fr 31 Aug '09

31 Aug '09

Hello, I use Freeradius on Debian with mac-based authentification along with a MySQL database containing the mac addresses (as Login & Password). I would like to open the network to everyone, so I wonder how to make freeradius to authorize any mac address to open the network ? Regards, RedVivi

1 0

user without profile in database
by Marcin S. 30 Aug '09

30 Aug '09

Hello Is there a way to auth user with bad password, or user that doesn't exists in database?? What I need? Let's say we have a 'userX' with password 'userXpassword' and that user try to log in to service, but he try to use wrong password, I want to auth him anyway but when he log in I will give him ip addres that have can contact only with a web where will be a message that will tell him that he use the wrong password, o second example there is a client that haven't got a profile in database and he want to log in to service using username and password that he create I want to auth him anyway and give him address and then redirect all traffic from him to web with message. Thanks!!

3 5

Max-All-Session counter module problem[SOLVED]
by Bishal Pun 30 Aug '09

30 Aug '09

Hello all, Problem is solved. Actually it was due to radgroupcheck table. There I have inserted Max-All-Session as 90000. I deleted it and now the user can log in. Thank you Bishal Hi, I am posting the debug of another user who has same problem: rad_recv: Access-Request packet from host 202.79.xx.XX port 65050, id=12, length=189 NAS-Identifier = "pppoe-bhw." Acct-Session-Id = "1633129-mpd-pppoe-70" NAS-Port = 70 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0016768aaa28" Called-Station-Id = "WIFITEST" NAS-Port-Id = "rl0" Vendor-12341-Attr-12 = 0x6d70642d7070706f652d3730 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:16:76:8a:aa:28" User-Name = "sneha" User-Password = "123" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sneha", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> sneha [sql] sql_set_user escaped user --> 'sneha' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sneha' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sneha' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sneha' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Prepaid Hours' ORDER BY id [sql] User found in group Prepaid Hours [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Prepaid Hours' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [ldap] performing user authorization for sneha [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=sneha) [ldap] expand: ou=users,ou=radius,dc=resunganet,dc=com,dc=np -> ou=users,ou=radius,dc=resunganet,dc=com,dc=np rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=resunganet,dc=com,dc=np, with filter (cn=sneha) [ldap] checking if remote access for sneha is allowed by dialupAccess [ldap] Added User-Password = {SSHA}zG7/cgoBWWNIVo7WtLMria1ui7GJAztI in check items [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user sneha authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> sneha [noresetcounter] sql_set_user escaped user --> 'sneha' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' rlm_sql (sql): Reserving sql socket id: 0 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 0 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha'} -> 90001 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user sneha, check_item=90000, counter=90001 ++[noresetcounter] returns reject Invalid user (rlm_sqlcounter: Maximum never usage time reached): [sneha] (from client pppoe-bhw port 70 cli 0016768aaa28) Using Post-Auth-Type Reject +- entering group REJECT {...} =================== check_item shows 90000 whereas I have updated the radcheck Max-All-Session Value by 180000 but still Reject with Maximum never usage time reached? radcheck table output of user sneha: 2901 | sneha | Max-All-Session | := | 180000 | Thank you Bishal

1 0

Max-All-Session counter module problem
by Bishal Pun 30 Aug '09

30 Aug '09

Hi, I am posting the debug of another user who has same problem: rad_recv: Access-Request packet from host 202.79.xx.XX port 65050, id=12, length=189 NAS-Identifier = "pppoe-bhw." Acct-Session-Id = "1633129-mpd-pppoe-70" NAS-Port = 70 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0016768aaa28" Called-Station-Id = "WIFITEST" NAS-Port-Id = "rl0" Vendor-12341-Attr-12 = 0x6d70642d7070706f652d3730 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:16:76:8a:aa:28" User-Name = "sneha" User-Password = "123" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sneha", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> sneha [sql] sql_set_user escaped user --> 'sneha' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sneha' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sneha' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sneha' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Prepaid Hours' ORDER BY id [sql] User found in group Prepaid Hours [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Prepaid Hours' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [ldap] performing user authorization for sneha [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=sneha) [ldap] expand: ou=users,ou=radius,dc=resunganet,dc=com,dc=np -> ou=users,ou=radius,dc=resunganet,dc=com,dc=np rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=resunganet,dc=com,dc=np, with filter (cn=sneha) [ldap] checking if remote access for sneha is allowed by dialupAccess [ldap] Added User-Password = {SSHA}zG7/cgoBWWNIVo7WtLMria1ui7GJAztI in check items [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user sneha authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> sneha [noresetcounter] sql_set_user escaped user --> 'sneha' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' rlm_sql (sql): Reserving sql socket id: 0 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 0 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha'} -> 90001 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user sneha, check_item=90000, counter=90001 ++[noresetcounter] returns reject Invalid user (rlm_sqlcounter: Maximum never usage time reached): [sneha] (from client pppoe-bhw port 70 cli 0016768aaa28) Using Post-Auth-Type Reject +- entering group REJECT {...} =================== check_item shows 90000 whereas I have updated the radcheck Max-All-Session Value by 180000 but still Reject with Maximum never usage time reached? radcheck table output of user sneha: 2901 | sneha | Max-All-Session | := | 180000 | Thank you Bishal > I am using Freeradius 2.1.6 with LDAP for authentication and mysql for > accounting in FreeBSD 7.2. radcheck table for user is like below. > However when user tries to connect radius log shows: Maximum never usage > time has reached for this user. > > id | username | attribute | op | value | > +------+-----------+--------------------+----+-------------- > | 2002 | shrinagar | Max-All-Session | :=3D | 180000| > > > While calculating the total accounting time in radacct table it stil > shows 90000 seconds left for user shrinagar but still the user can't > connect. What's wrong with freeradius can anybody tell me what I have > done wrong. If I delete all the accounting session from radacct table > for that user then he can connect. > > mysql> select 180000 - sum(acctsessiontime) from radacct where > username=3D'shrinagar'; > +-------------------------------+ > | 180000 - sum(acctsessiontime) | > +-------------------------------+ > | 90000 | > +-------------------------------+ Post the debug. Ivan Kalik Kalik Informatika ISP

1 0

Web Management
by Diego 30 Aug '09

30 Aug '09

hello list can someone give me a step by step manual to configure freeradius with web interface -- ^^^^^^^^^^^^^^^^^^^| |Linux band wagon|"""";...,___ |_...._....____===|___|__|...,] "(@)'(@)""""*|(@)(@ )****(@)

3 3

(no subject)
by bishal＠baayu.com.np 29 Aug '09

29 Aug '09

Hello All, I am using Freeradius 2.1.6 with LDAP for authentication and mysql for accounting in FreeBSD 7.2. radcheck table for user is like below. However when user tries to connect radius log shows: Maximum never usage time has reached for this user. id | username | attribute | op | value | +------+-----------+--------------------+----+-------------- | 2002 | shrinagar | Max-All-Session | :=3D | 180000| While calculating the total accounting time in radacct table it stil shows 90000 seconds left for user shrinagar but still the user can't connect. What's wrong with freeradius can anybody tell me what I have done wrong. If I delete all the accounting session from radacct table for that user then he can connect. mysql> select 180000 - sum(acctsessiontime) from radacct where username=3D'shrinagar'; +-------------------------------+ | 180000 - sum(acctsessiontime) | +-------------------------------+ | 90000 | +-------------------------------+ -------------------------------------------------------------------- myhosting.com - Premium Microsoft® Windows® and Linux web and application hosting - http://link.myhosting.com/myhosting

2 1

Re: Freeradius-Users Digest, Vol 52, Issue 138
by wlanmac 29 Aug '09

29 Aug '09

There is also : http://www.coova.org/JRadius/Simulator > Don't forget radperf from http://networkradius.com/ > > Ivan Kalik wrote: > >> Hello ,some body know if exist a software platform for simulation of the > >> radius out of an production envairoment. > >> I configure radius in my first upon with pgsql an "freeradius -X" give me > >> freeradius listen 1813 1815 1817 ports for auth pass an proxy and waiting > >> request > >> seemingly ok. > >> But i need to prove it without a NAS ,for work reason i can not affect the > >> services with a prove > >> Some body know if i can use for a prove with radius a modem, a software or > >> some thing thus > >> > > > > radtest, radclient (included with rhe server) and eapol_test (from > > wpa_supplicant). > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > >

1 0

Re: BASIC question, but still having conceptual issues
by Gary Gatten 29 Aug '09

29 Aug '09

Seems like with FR this can be accomplished numerous ways. The virtual server sounds like what I'm looking for, ill read up on it. Thanks! Gary ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sat Aug 29 04:02:03 2009 Subject: Re: BASIC question, but still having conceptual issues Gary Gatten wrote: > I have several different type's of clients/NAS's that will be using FR > as the Front End to perform AAA - mostly Authentication, but the Author > and Acct are close behind. Use virtual servers. See raddb/sites-available/README > Anyway, each of these clients need to perform slightly different backend > queries to determine if Authenticate should pass or fail: > > So, how do I go about this? Configure completely different virtual servers, even if the contents of those servers are mostly the same. This lets you work like each type of NAS has it's own RADIUS server, with it's own policies. > I'm currently using NTLM_Auth and that's > all working fine, I'm just not sure how to say in FR config: if request > of type 1, run this NTLM_Auth command and check for this group; If > request of type 2 run this other NTLM_Auth command and check for this > other group. You'll also need to configure different instances of the MSCHAP module, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0