- Freeradius-Users - lists.freeradius.org

How to desactivate freeradius to open the network ?
by via.lej＠free.fr 31 Aug '09

31 Aug '09

Hello, I use Freeradius on Debian with mac-based authentification along with a MySQL database containing the mac addresses (as Login & Password). I would like to open the network to everyone, so I wonder how to make freeradius to authorize any mac address to open the network ? Regards, RedVivi

1 0

user without profile in database
by Marcin S. 30 Aug '09

30 Aug '09

Hello Is there a way to auth user with bad password, or user that doesn't exists in database?? What I need? Let's say we have a 'userX' with password 'userXpassword' and that user try to log in to service, but he try to use wrong password, I want to auth him anyway but when he log in I will give him ip addres that have can contact only with a web where will be a message that will tell him that he use the wrong password, o second example there is a client that haven't got a profile in database and he want to log in to service using username and password that he create I want to auth him anyway and give him address and then redirect all traffic from him to web with message. Thanks!!

3 5

Max-All-Session counter module problem[SOLVED]
by Bishal Pun 30 Aug '09

30 Aug '09

Hello all, Problem is solved. Actually it was due to radgroupcheck table. There I have inserted Max-All-Session as 90000. I deleted it and now the user can log in. Thank you Bishal Hi, I am posting the debug of another user who has same problem: rad_recv: Access-Request packet from host 202.79.xx.XX port 65050, id=12, length=189 NAS-Identifier = "pppoe-bhw." Acct-Session-Id = "1633129-mpd-pppoe-70" NAS-Port = 70 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0016768aaa28" Called-Station-Id = "WIFITEST" NAS-Port-Id = "rl0" Vendor-12341-Attr-12 = 0x6d70642d7070706f652d3730 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:16:76:8a:aa:28" User-Name = "sneha" User-Password = "123" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sneha", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> sneha [sql] sql_set_user escaped user --> 'sneha' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sneha' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sneha' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sneha' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Prepaid Hours' ORDER BY id [sql] User found in group Prepaid Hours [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Prepaid Hours' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [ldap] performing user authorization for sneha [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=sneha) [ldap] expand: ou=users,ou=radius,dc=resunganet,dc=com,dc=np -> ou=users,ou=radius,dc=resunganet,dc=com,dc=np rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=resunganet,dc=com,dc=np, with filter (cn=sneha) [ldap] checking if remote access for sneha is allowed by dialupAccess [ldap] Added User-Password = {SSHA}zG7/cgoBWWNIVo7WtLMria1ui7GJAztI in check items [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user sneha authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> sneha [noresetcounter] sql_set_user escaped user --> 'sneha' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' rlm_sql (sql): Reserving sql socket id: 0 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 0 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha'} -> 90001 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user sneha, check_item=90000, counter=90001 ++[noresetcounter] returns reject Invalid user (rlm_sqlcounter: Maximum never usage time reached): [sneha] (from client pppoe-bhw port 70 cli 0016768aaa28) Using Post-Auth-Type Reject +- entering group REJECT {...} =================== check_item shows 90000 whereas I have updated the radcheck Max-All-Session Value by 180000 but still Reject with Maximum never usage time reached? radcheck table output of user sneha: 2901 | sneha | Max-All-Session | := | 180000 | Thank you Bishal

1 0

Max-All-Session counter module problem
by Bishal Pun 30 Aug '09

30 Aug '09

Hi, I am posting the debug of another user who has same problem: rad_recv: Access-Request packet from host 202.79.xx.XX port 65050, id=12, length=189 NAS-Identifier = "pppoe-bhw." Acct-Session-Id = "1633129-mpd-pppoe-70" NAS-Port = 70 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0016768aaa28" Called-Station-Id = "WIFITEST" NAS-Port-Id = "rl0" Vendor-12341-Attr-12 = 0x6d70642d7070706f652d3730 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:16:76:8a:aa:28" User-Name = "sneha" User-Password = "123" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sneha", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> sneha [sql] sql_set_user escaped user --> 'sneha' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sneha' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sneha' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sneha' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Prepaid Hours' ORDER BY id [sql] User found in group Prepaid Hours [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Prepaid Hours' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [ldap] performing user authorization for sneha [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=sneha) [ldap] expand: ou=users,ou=radius,dc=resunganet,dc=com,dc=np -> ou=users,ou=radius,dc=resunganet,dc=com,dc=np rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=radius,dc=resunganet,dc=com,dc=np, with filter (cn=sneha) [ldap] checking if remote access for sneha is allowed by dialupAccess [ldap] Added User-Password = {SSHA}zG7/cgoBWWNIVo7WtLMria1ui7GJAztI in check items [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user sneha authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> sneha [noresetcounter] sql_set_user escaped user --> 'sneha' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha' rlm_sql (sql): Reserving sql socket id: 0 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 0 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='sneha'} -> 90001 rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user sneha, check_item=90000, counter=90001 ++[noresetcounter] returns reject Invalid user (rlm_sqlcounter: Maximum never usage time reached): [sneha] (from client pppoe-bhw port 70 cli 0016768aaa28) Using Post-Auth-Type Reject +- entering group REJECT {...} =================== check_item shows 90000 whereas I have updated the radcheck Max-All-Session Value by 180000 but still Reject with Maximum never usage time reached? radcheck table output of user sneha: 2901 | sneha | Max-All-Session | := | 180000 | Thank you Bishal > I am using Freeradius 2.1.6 with LDAP for authentication and mysql for > accounting in FreeBSD 7.2. radcheck table for user is like below. > However when user tries to connect radius log shows: Maximum never usage > time has reached for this user. > > id | username | attribute | op | value | > +------+-----------+--------------------+----+-------------- > | 2002 | shrinagar | Max-All-Session | :=3D | 180000| > > > While calculating the total accounting time in radacct table it stil > shows 90000 seconds left for user shrinagar but still the user can't > connect. What's wrong with freeradius can anybody tell me what I have > done wrong. If I delete all the accounting session from radacct table > for that user then he can connect. > > mysql> select 180000 - sum(acctsessiontime) from radacct where > username=3D'shrinagar'; > +-------------------------------+ > | 180000 - sum(acctsessiontime) | > +-------------------------------+ > | 90000 | > +-------------------------------+ Post the debug. Ivan Kalik Kalik Informatika ISP

1 0

Web Management
by Diego 30 Aug '09

30 Aug '09

hello list can someone give me a step by step manual to configure freeradius with web interface -- ^^^^^^^^^^^^^^^^^^^| |Linux band wagon|"""";...,___ |_...._....____===|___|__|...,] "(@)'(@)""""*|(@)(@ )****(@)

3 3

(no subject)
by bishal＠baayu.com.np 29 Aug '09

29 Aug '09

Hello All, I am using Freeradius 2.1.6 with LDAP for authentication and mysql for accounting in FreeBSD 7.2. radcheck table for user is like below. However when user tries to connect radius log shows: Maximum never usage time has reached for this user. id | username | attribute | op | value | +------+-----------+--------------------+----+-------------- | 2002 | shrinagar | Max-All-Session | :=3D | 180000| While calculating the total accounting time in radacct table it stil shows 90000 seconds left for user shrinagar but still the user can't connect. What's wrong with freeradius can anybody tell me what I have done wrong. If I delete all the accounting session from radacct table for that user then he can connect. mysql> select 180000 - sum(acctsessiontime) from radacct where username=3D'shrinagar'; +-------------------------------+ | 180000 - sum(acctsessiontime) | +-------------------------------+ | 90000 | +-------------------------------+ -------------------------------------------------------------------- myhosting.com - Premium Microsoft® Windows® and Linux web and application hosting - http://link.myhosting.com/myhosting

2 1

Re: Freeradius-Users Digest, Vol 52, Issue 138
by wlanmac 29 Aug '09

29 Aug '09

There is also : http://www.coova.org/JRadius/Simulator > Don't forget radperf from http://networkradius.com/ > > Ivan Kalik wrote: > >> Hello ,some body know if exist a software platform for simulation of the > >> radius out of an production envairoment. > >> I configure radius in my first upon with pgsql an "freeradius -X" give me > >> freeradius listen 1813 1815 1817 ports for auth pass an proxy and waiting > >> request > >> seemingly ok. > >> But i need to prove it without a NAS ,for work reason i can not affect the > >> services with a prove > >> Some body know if i can use for a prove with radius a modem, a software or > >> some thing thus > >> > > > > radtest, radclient (included with rhe server) and eapol_test (from > > wpa_supplicant). > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > >

1 0

Re: BASIC question, but still having conceptual issues
by Gary Gatten 29 Aug '09

29 Aug '09

Seems like with FR this can be accomplished numerous ways. The virtual server sounds like what I'm looking for, ill read up on it. Thanks! Gary ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sat Aug 29 04:02:03 2009 Subject: Re: BASIC question, but still having conceptual issues Gary Gatten wrote: > I have several different type's of clients/NAS's that will be using FR > as the Front End to perform AAA - mostly Authentication, but the Author > and Acct are close behind. Use virtual servers. See raddb/sites-available/README > Anyway, each of these clients need to perform slightly different backend > queries to determine if Authenticate should pass or fail: > > So, how do I go about this? Configure completely different virtual servers, even if the contents of those servers are mostly the same. This lets you work like each type of NAS has it's own RADIUS server, with it's own policies. > I'm currently using NTLM_Auth and that's > all working fine, I'm just not sure how to say in FR config: if request > of type 1, run this NTLM_Auth command and check for this group; If > request of type 2 run this other NTLM_Auth command and check for this > other group. You'll also need to configure different instances of the MSCHAP module, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Some users getting duplicate "NULL" acctstoptime records in radacct
by Kanwar Ranbir Sandhu 29 Aug '09

29 Aug '09

Hi All, I have a weird problem with my freeradius 2.1.6 setup which I have not yet been able to fix. Actually, the problem is I don't understand what the hell is going on. I'm using mysql for storing auth and acct info. I'm also using sql based simultaneous use checking to prevent a user from logging in more than once. For the most part, things are working well. However, we see some people with an already active session (acctstoptime is set to NULL) get logged in again and then get a NEW row added to radacct with the acctstoptime set to NULL. So, effectively, freeradius shows TWO live sessions for the same user. When we check the NASes, we see two sessions for the same user there as well. I've run radius in debug mode, reviewed the logs, checked the configs, and I'm still lost on this. I do see people getting rejected when they try to log in more than once, which tells me the simultaneous checking is working. I don't understand why this is happening. What I'd expect to happen if accounting stop packets got lost would be the user getting rejected if he/she tried to log in again, but definitely would NOT expect seeing a NEW record in radacct with acctstoptime set to NULL. So, how could this happen? If it helps, I'm not using an ippool at the moment. I have IPs assigned to the user with entries in radreply (framed-ip-address). Regards, Ranbir -- Kanwar Ranbir Sandhu Linux 2.6.27.29-170.2.78.fc10.x86_64 x86_64 GNU/Linux 19:43:28 up 3 days, 20:40, 3 users, load average: 0.21, 0.39, 0.76

4 8

VMPS Problem with similar requests
by Michael Bryant 29 Aug '09

29 Aug '09

Hi, If two vmps requests are sent in close succession (within cleanup_delay), with the same source port, from the same switch (which does in fact seem to be common, as the cisco switch I'm using for testing sends *all* requests with a source port picked on startup), they are detected as identical by freeradius as identical, even if they are for different mac addresses. This means the second request gets the same response as the first, even when they should be different. For example, testing with the vqpcli tool: Close together: server:/etc/freeradius/tests# ./vqpcli.pl -s 127.0.0.1 -v tc.example.com -w 192.168.248.32 -i Fa0/17 -m 0016.4111.0bfe Vlan: BRIDGE MAC Address: 001641110bfe Status: ALLOW server:/etc/freeradius/tests# ./vqpcli.pl -s 127.0.0.1 -v tc.example.com -w 192.168.248.32 -i Fa0/17 -m 0016.4111.0bff Vlan: BRIDGE MAC Address: 001641110bfe Status: ALLOW then a short time later (outside cleanup_delay) server:/etc/freeradius/tests# ./vqpcli.pl -s 127.0.0.1 -v tc.example.com -w 192.168.248.32 -i Fa0/17 -m 0016.4111.0bff Vlan: MAC Address: Status: DENY Which is the correct response Cheers --Mike

2 1