- Freeradius-Users - lists.freeradius.org

Re: MS 8021.x PEAP failing - new info...
by Gary Gatten 21 Aug '09

21 Aug '09

I've tried MANY different confs, including those in docs and suggested here. I have new debug output that leads me to believe its a bug in the Xsupplicant. Ill post that output after lunch. And ill try Alans conf again. BUT, if my conf was wrong why does it work when I manually enter the exact same info as the Xsupplicant is supposed to pull from the GINA / windows login? ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Fri Aug 21 11:14:05 2009 Subject: RE: MS 8021.x PEAP failing - new info... > Check this out... I entered the Domain Name manually and it worked! > So, now I have no freaking clue... I thought it was something with the > "//" in the DomainName//UserName - but doesn't look like it. > > Here's some debug output. I snipped all the stuff before this output - > from what I can tell it's exactly the same, but I guess I'll save it to > a file and diff it to make sure. In the mean time: > > ** Here's using Windows logon info automatically, NOT working ** > You haven't modified the ntlm_auth line in mschap module the way Alan suggested (and is also mentioned above the line in mschap module). Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Re: your mail
by Irina 21 Aug '09

21 Aug '09

Hello Allan, Thank you for your reply. >>ensure your netmask etc are correct :-)) I hope so. I was giving it like this (IP address plus slash 29: 10.1.1.112/29) My trouble was I did not know if I could use 10.1.1.112/29 as nasname. Thank you all. Cheers Irina ============== Hi, > Hello, > > Could someone let me know if I can insert a new NAS in the following > format > > insert into nas values('','xx.xx.xx.112/29','shortname',....) you can use sucha netmask to cover a range....but they'll all then use the same secret and be identified by the same shortname. ...jyst ensure your netmask etc are correct :-) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 8

radius server 2.1.6 not storing data in radacct table..help
by shivashankar 21 Aug '09

21 Aug '09

hi, I have installed freeradius2.1.6 recently. Radius server was started successfully. But when i sent a packet using NTRadping its stored in file but not writing in oracle. when i run radiusd-X --few lines here ---------- [sql] expand: %{User-Name} -> free [sql] sql_set_user escaped user --> 'free' [sql] expand: INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{X-Ascend-Session-Svr-Key}') -> INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAu rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_oracle: execute query failed in sql_query: ORA-01400: cannot insert NULL into ("RADIUSUSER"."RADACCT"."GROUPNAME") rlm_sql_oracle: OCI_SERVER_NORMAL [sql] Couldn't insert SQL accounting START record - ORA-01400: cannot insert NULL into ("RADIUSUSER"."RADACCT"."GROUPNAME") [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details in radacct table we have GROUPNAME is not null.. i entered data in all tables except radgroupcheck table. i need to enter ....data in this table also. plz help me. -- View this message in context: http://www.nabble.com/radius-server-2.1.6-not-storing-data-in-radacct-table… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Re: NAS IPs
by Irina 21 Aug '09

21 Aug '09

Hello Johan and everyone else. Thank you very much Johan for your short answer. Some posts have confused me even more than I was when posted to the list. I was blaming on my English, could be I was asking it a wrong way. Anyway, thank you all again. I am pretty sure you know what you are talking about :-)) Irina ============== Gary Gatten wrote: > If I understand you correctly I respectfully submit you are > incorrect. When using VLSM / classless masks to define a NETWORK, you > are correct (I havent checked the math just assuming you are > correct). However, when defining ACL type stuff, the proposed /29 > would be perfectly OK. That said, Im speaking strictly of my > experience with routers, firewalls, etc. If FR supports this I cant say for sure. > > > > ---------------------------------------------------------------------- > -- > > > you can not to use /29 for 8 IPs because 3 bits have exactly 8 > combination ,..x000 is the network and ...x111 is the difusion ,then > really you have 6 IPs with /29, you need /28 16 combinations minus > two,min 14 IPs for 8 numbers. > I think we should stop the TCPIP training. This is the freeradius list. The user wants to know if /29 can be used. The answer is yes. -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: NAS IPs
by Gary Gatten 21 Aug '09

21 Aug '09

Agreed. Since the OP was presented with conflicting info I simply provided a little "training" to let the OP know that I actually know WTF I'm talking about (sometimes) and that /29 will work. When all else fails, try it and see what happens! ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Fri Aug 21 02:15:31 2009 Subject: Re: NAS IPs Gary Gatten wrote: > If I understand you correctly – I respectfully submit you are > incorrect. When using VLSM / classless masks to define a NETWORK, you > are correct (I haven’t checked the math – just assuming you are > correct). However, when defining ACL type stuff, the proposed /29 would > be perfectly OK. That said, I’m speaking strictly of my experience with > routers, firewalls, etc. If FR supports this I can’t say for sure. > > > > ------------------------------------------------------------------------ > > > you can not to use /29 for 8 IPs because 3 bits have exactly 8 > combination ,..x000 is the network and ...x111 is the difusion ,then > really you have 6 IPs with /29, you need /28 16 combinations minus > two,min 14 IPs for 8 numbers. > I think we should stop the TCPIP training. This is the freeradius list. The user wants to know if /29 can be used. The answer is yes. -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

RE: NAS IPs
by Magui 21 Aug '09

21 Aug '09

escuse me, you are correct .is only to range, for 8 IPs is OK, then the network for this (stuff /29) must be >= /27.the signification of /x in VLSM and ACL type stuff is the same ,no changes in the x first bits. -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

1 0

Using user-defined variables in %{sql: } clause?
by George 21 Aug '09

21 Aug '09

I am using FR v2.1.6. I tried to use clause like `%{sql: SELECT ...}`. But length of SQL-query is so large for using as field of SQL-table. And I thought that I can create variable like myquery = "SELECT ..." as entry of configuration file, and to use this as `%{sql:${myquery}}`. But it didn't work. I looked into log: [sql] expand: ${myquery} -> {myquery} rlm_sql_postgresql: Status: PGRES_FATAL_ERROR What's wrong?

1 0

Re:NAS IPs
by Magui 21 Aug '09

21 Aug '09

you can not to use /29 for 8 IPs because 3 bits have exactly 8 combination ,..x000 is the network and ...x111 is the difusion ,then really you have 6 IPs with /29, you need /28 16 combinations minus two,min 14 IPs for 8 numbers. -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

3 2

Re: MAX-Monthly-Traffic V2 Post
by Neville 21 Aug '09

21 Aug '09

Hi Alex, > You are expecting an interim update to send session-timeout to your nas > so it disconnect your user? > If so, two things seems incorrect to me. > > 1- You're measuring traffic volume and want disconnection to set > based on time (session-timout)... a bit tricky isn't it? So VERY True, Too many late nights and I really do appreciate your input as this gave me food for thought and I now have EVERYTHING Working. Both for Traffic & Session USAGE. For Usage, I still had to use Max-Monthly-Traffic as a Check := and based on sqlcounter calc, do a Reply = Sessions-Octets-Limit = XXXXXX on the Access-Accept as this is supported by the ppp 2.4.4 NAS. What I would like to know now, is how I can use sqlcounter to do a Month Calculation based on the date of the account being registered and NOT the Calander Month? Anyone? > 2- I think the attribute "Session-Timeout" cannot be found in > interim-updates packets (maybe I'm wrong), rfc 2869 specify that: "It > is envisioned that an Interim Accounting record (with Acct-Status-Type = > Interim-Update (3)) would contain all of the attributes normally found > in an Accounting Stop message with the exception of the > Acct-Term-Cause attribute." > > What you would need is an attribute known by your nas and representing > remaining traffic. That attrbute should be sent at acct-start time and > would trigger a disconnection from the NAS when traffic limit is > reached. If such a attribute does not exists for your NAS, you should > take a look at CoA server. > Maybe someone have better idea...? > > Le mercredi 19 ao?t 2009 ? 15:56 +0100, Neville a ?crit : > Cheers Nev ================ CentOS 5.3 pptpd 1.3.4 / ppp 2.4.4 freeradius2 2.1.6 radiusclient-ng 0.5.6 daloRadius 0.9-8-SVN ================

2 2

Re: MS 8021.x PEAP failing
by Gary Gatten 20 Aug '09

20 Aug '09

Yup, that line is there. Much of the doc online is WAY out of date, so I'm wondering if by actually RTFM first I broke something? ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'FreeRadius users mailing list' <freeradius-users(a)lists.freeradius.org> Sent: Thu Aug 20 14:09:31 2009 Subject: RE: MS 8021.x PEAP failing > I've been playing around with conf/module files trying to strip the > DOMAIN out of my login request - but no luck! Have you tried "with_ntdomain_hack = yes" in the mschap module config? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 2