- Freeradius-Users - lists.freeradius.org

question about session resumption and reply attributes
by Anatoli Logvinski 28 May '09

28 May '09

Hi We are using dynamic VLAN assignment with freeradius 2.1.6 and tried to test session resumption. It looks like that freeradius doesn't cache all reply attributes and upon session resumption the VLAN assignment attributes don't get send. Is there any way to cache these attributes? The attributes are generated by rlm_perl in post-auth section of inner-tunnel virtual server

4 7

next
by jon jon 28 May '09

28 May '09

I have my freeradius working, I running slackware 12.1 with freeradius version 2.1.5. I used NTRAping utility to send packets to my freeradius server. I also used radtest and that was successful. So now I want to set freeradius with backend mysql database. I am looking for the script db_mysql.sql and cannot find this file. I installed mysql as a package, when I installed slackware. So, does that file even exist anymore? I have the radius book and the directory it shows doesn't contain any file with that name.

4 7

Windows XP SP2 and SP3 EAP problem followup
by Balgansuren Batsukh 28 May '09

28 May '09

Hello, Any suggestion Windows XP EAP problem? Balgaa

2 14

Accounting responce question.
by lamersons 28 May '09

28 May '09

Hello there, i have posted here few times and got very helpfull answers, so i desided to try my luck once more. Im using FreeRADIUS Version 2.0.4(slackware+postgre) on powerfull x86 server with alot of RAM, connected with gigabit to NAS. Load is about 5-15record/sec Once in a while we get double accounting records. I started to take traces at NAS side and saw that sometimes AAA doesnt responce to accounting record, NAS thinks that AAA didnt get it and sends it one more time. But AAA gets the first one even if it doesnt responce to request, therefore we get double record.(debug info is below) I have made debug trace at AAA side. Is it somehow possible to see from that trace that AAA did respond and that is NASes(or network) problem that it did not recieve responce ?(debug info is below) p.s. ------------------------------------------------------------------- I sent information to NAS vendor: Dear, Yesterday at 02:27:38 PDSN sent the "Accounting request start" message and then PDSN sent the same Accounting request start massage at 02:27:43 (see in traces of PI interface). Thanks Best regards, They answered me: • The AAA can’t start the new accounting session, until it stops the first one, so the AAA doesn’t reply to the Accounting Request Start. • The PDSN wait for TIMEOUT which is 5 seconds, and resend the Accounting message again. • When the PDSN resend the Accounting message, the AAA replies to it. ----------------------------------------------------------------------- ########################### First start record : request 11309 Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:27:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('0000000', '33187f91caa26b34', '247033715823092', 'Jul 18 2008 02:27:39 EEST', NULL,'0', '0', '0', '192.168.172.128', trim('triatel(a)triatel.lv'), '0', '0', '17934924', '0', '192.168.145.1') rlm_sql (sql): Reserving sql socket id: 18 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 18 ++[sql] returns ok Finished request 11309. Cleaning up request 11309 ID 18 with timestamp +769 Going to the next request ##################### second Start record : request 11380 Acct-Status-Type = Start User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:27:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 5 Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Calling-Station-Id}', '%{Event-Timestamp}', NULL,'0', '0', '0', '%{Framed-IP-Address}', trim('%{SQL-User-Name}'), '0', '0', '%{3GPP2-Correlation-Id}', '0', '%{NAS-IP-Address}') -> INSERT into radacct (AcctSessionId, AcctUniqueId, CallingStationId, AcctStartTime, AcctStopTime, CDMAActiveTime, AcctInputOctets, AcctOutputOctets, FramedIPAddress, UserName, ReleaseIndicator, CDMABadPPPFrameCount, CDMACorrelationId, AcctSessionTime, NASIPAddress) values('0000000', '33187f91caa26b34', '247033715823092', 'Jul 18 2008 02:27:39 EEST', NULL,'0', '0', '0', '192.168.172.128', trim('triatel(a)triatel.lv'), '0', '0', '17934924', '0', '192.168.145.1') rlm_sql (sql): Reserving sql socket id: 43 rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error duplicate key value violates unique constraint "radacct_acctuniqueid" rlm_sql_postgresql: Postgresql Fatal Error: [23505: UNIQUE VIOLATION] Occurred!! rlm_sql (sql): Couldn't insert SQL accounting START record - ERROR: duplicate key value violates unique constraint "radacct_acctuniqueid" expand: -> rlm_sql (sql): Released sql socket id: 43 ++[sql] returns ok Finished request 11380. ############################## Interim record ################### Ready to process requests. Acct-Status-Type = Interim-Update User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:42:39 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Acct-Session-Time = 900 Acct-Output-Octets = 0 Acct-Input-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Multi-Session-Id = "17934924" Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Session-Continue = 1 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-Bad-PPP-Frame-Count = 0 3GPP2-Active-Time = 33 3GPP2-Number-Active-Transitions = 0 3GPP2-Received-HDLC-Octets = 0 3GPP2-Inbound-Mobile-IP-Sig-Octets = 0 3GPP2-Outbound-Mobile-IP-Sig-Octets = 0 3GPP2-Last-User-Activity-Time = 1216337292 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: -> rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok Finished request 21837. ##########################################STOP record ########## Acct-Status-Type = Stop User-Name = "triatel(a)triatel.lv" Calling-Station-Id = "247033715823092" Framed-IP-Address = 192.168.172.128 NAS-IP-Address = 192.168.145.1 Event-Timestamp = "Jul 18 2008 02:43:01 EEST" Acct-Session-Id = "0000000\000" NAS-Port-Type = Virtual NAS-Port = 1813 Acct-Delay-Time = 0 Acct-Session-Time = 922 Acct-Output-Octets = 0 Acct-Input-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Terminate-Cause = Idle-Timeout Acct-Multi-Session-Id = "17934924" Service-Type = Framed-User Acct-Authentic = RADIUS 3GPP2-ESN = "\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" 3GPP2-Attr-116 = 0x0000000000000000000000000000 3GPP2-Correlation-Id = "17934924" 3GPP2-Session-Continue = 0 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-PCF-IP-Address = 129.11.17.230 3GPP2-BSID = "2A2100021102" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 0 3GPP2-Reverse-FCH-Mux-Option = 0 3GPP2-Service-Option = 59 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 0 3GPP2-Forward-FCH-RC = 0 3GPP2-Reverse-FCH-RC = 0 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-Release-Indicator = 7 3GPP2-DCCH-Frame-Size = 0 3GPP2-Attr-78 = 0x00000000 3GPP2-Forward-PDCH-RC = 0 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Attr-114 = 0x00000000 3GPP2-Bad-PPP-Frame-Count = 0 3GPP2-Active-Time = 33 3GPP2-Number-Active-Transitions = 0 3GPP2-Received-HDLC-Octets = 0 3GPP2-Inbound-Mobile-IP-Sig-Octets = 0 3GPP2-Outbound-Mobile-IP-Sig-Octets = 0 3GPP2-Last-User-Activity-Time = 1216337292 3GPP2-IP-QoS = 10 3GPP2-Airlink-Priority = 0 +- entering group preacct rlm_realm: Looking up realm "triatel.lv" for User-Name = "triatel(a)triatel.lv" rlm_realm: No such realm "triatel.lv" ++[suffix] returns noop +- entering group accounting rlm_acct_unique: Hashing '3GPP2-Correlation-Id = "17934924",Acct-Session-Id = "0000000\000",Calling-Station-Id = "247033715823092"' rlm_acct_unique: Acct-Unique-Session-ID = "33187f91caa26b34". ++[acct_unique] returns ok expand: %{User-Name} -> triatel(a)triatel.lv rlm_sql (sql): sql_set_user escaped user --> 'triatel(a)triatel.lv' expand: UPDATE radacct SET AcctStopTime = '%{Event-Timestamp}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', OutputPacket = '%{Acct-Output-Packets}', InputPacket = '%{Acct-Input-Packets}', AcctOutputOctets = '%{Acct-Output-Octets}', ReleaseIndicator = '%{Acct-Terminate-Cause}', CDMABadPPPFrameCount = '%{3GPP2-Bad-PPP-Frame-Count}', CDMACorrelationId = '%{3GPP2-Correlation-Id}', CDMAActiveTime = '%{3GPP2-Active-Time}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' -> UPDATE radacct SET AcctStopTime = 'Jul 18 2008 02:43:01 EEST', AcctSessionTime = '922', AcctInputOctets = '0', OutputPacket = '0', InputPacket = '0', AcctOutputOctets = '0', ReleaseIndicator = 'Idle-Timeout', CDMABadPPPFrameCount = '0', CDMACorrelationId = '17934924', CDMAActiveTime = '33' WHERE AcctUniqueId = '33187f91caa26b34' rlm_sql (sql): Reserving sql socket id: 25 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 25 ++[sql] returns ok Finished request 22102. -- View this message in context: http://www.nabble.com/Accounting-responce-question.-tp23756895p23756895.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

How to enter users in sql?
by Just E. Mail 27 May '09

27 May '09

I have successfully setup a freeRADIUS server with PostgreSQL backend (separate) server. When I start freeRADIUS in test mode 'radiusd -X', it connects to the sql server and there is no error. I have two general questions: 1. I need to add one or two test UID & PW in the SQL database. Is there a GUI application available to accomplish that or I have to do it manually entering the data? 2. When the freeRADIUS server is live (on-line) how does user authentication data gets added into the database? In MD5, LINUX has an application to add USER Name & Group (created automatically) which both email program (such as Postfix) and freeRADIUS authenticate against. How is it done in PostgreSQL? I have tried to post this question as clearly as I can. Please ask and clarification! Jennifer K.

2 1

Assigning IP address from RADIUS to Cisco PPTP users
by up＠3.am 27 May '09

27 May '09

Hi: I've used Livingston and Cistron radiusd's in the past with dialup ppp users and Cisco/Lucent NASes and have been able to do this with no problems. Users are currently authenticating fine and getting assigned IPs from the IP pool as defined in the Cisco NAS. However, I'd like to have a few, select users assigned static IPs from outside that pool, but the Cisco (2811) is simply ignoring the raddb/users file entry for that user and assigning an IP from the pool on the NAS. Here is my Cisco config:: -------------------- aaa new-model aaa authentication login default local group radius aaa authentication ppp default group radius local aaa authorization exec default local aaa authorization network default if-authenticated aaa session-id common vpdn-group 1 accept-dialin protocol pptp virtual-template 1 interface Loopback0 ip address 99.99.99.99 255.255.255.255 ip nat inside ip virtual-reassembly interface Virtual-Template1 ip unnumbered FastEthernet0/0 ip policy route-map VPN-Client peer match aaa-pools peer default ip address pool vpnpool no keepalive ppp encrypt mppe auto ppp authentication pap chap ms-chap ms-chap-v2 ! ip local pool vpnpool 172.16.30.2 172.16.30.254 --------- Here is the raddb/users file entry: --------- testuser Service-Type == Framed-User Framed-Protocol == PPP, Framed-IP-Address = 172.16.1.2, Framed-IP-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP -------------- The DEFAULT entry allows users in /etc/passwd to authenticate fine, but "testuser" still gets an IP from the NAS pool instead of the one above.. Any pointers appreciated! James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

3 5

wired 802.1x for desktops (offtopic)
by Mikael Kermorgant 27 May '09

27 May '09

Hello, Sorry for this off-topic message, I have a question about 802.1x deployment and don't know where to ask. As freeradius is one of the element I think of, maybe someone here can help me find the solution ? My Goals : 1) authenticate access to the network from Open Public Access Catalog (OPAC) desktop machines available to every user of a biblioteque. 2) have a guest account with limited LAN access (no access to internet, or just a very short whitelist) 3) Keep the machines reachable from some servers (ghost server, monitoring, etc). (this criteria eliminates the solution of a captive portal) I thought 802.1x with dynamic vlans would be a nice solution as it should permit to put the guest account in a specific vlan. But how would it be possible to reach the machine from the management servers before someone authenticates ? Is it possible to have a default vlan activated on startup of the machine ? Or do you know where I should ask this question ? Regards, -- Mikael Kermorgant

4 4

Authenticating usernames with spaces using MySQL
by Justin Menga 27 May '09

27 May '09

Hi I have an issue where I authenticate incoming DHCP requests on a broadband aggregation router using the Option 82 Port ID information as the username attribute within the RADIUS authentication request. Unfortunately the Port ID information includes spaces - and this is causing an issue where authentication fails using MySQL database, even though a username with spaces is configured in the MySQL database. If I use the /etc/raddb/users file it works OK, but I want to use MySQL accounting etc... Any ideas on how to work around this issue? Thanks Justin

2 1

Re: Assigning IP address from RADIUS to Cisco PPTP users
by Neville 26 May '09

26 May '09

> Message: 1 > Date: Tue, 26 May 2009 18:56:42 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: Assigning IP address from RADIUS to Cisco PPTP users > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <52973.87.194.16.13.1243360602.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > >> I've used Livingston and Cistron radiusd's in the past with dialup ppp >> users and Cisco/Lucent NASes and have been able to do this with no >> problems. >> >> Users are currently authenticating fine and getting assigned IPs from the >> IP pool as defined in the Cisco NAS. However, I'd like to have a few, >> select users assigned static IPs from outside that pool, but the Cisco >> (2811) is simply ignoring the raddb/users file entry for that user and >> assigning an IP from the pool on the NAS. >> >> Here is my Cisco config:: >> -------------------- >> aaa new-model >> aaa authentication login default local group radius >> aaa authentication ppp default group radius local >> aaa authorization exec default local >> aaa authorization network default if-authenticated >> aaa session-id common >> >> vpdn-group 1 >> accept-dialin >> protocol pptp >> virtual-template 1 >> >> interface Loopback0 >> ip address 99.99.99.99 255.255.255.255 >> ip nat inside >> ip virtual-reassembly >> >> interface Virtual-Template1 >> ip unnumbered FastEthernet0/0 >> ip policy route-map VPN-Client >> peer match aaa-pools >> peer default ip address pool vpnpool >> no keepalive >> ppp encrypt mppe auto >> ppp authentication pap chap ms-chap ms-chap-v2 >> ! >> ip local pool vpnpool 172.16.30.2 172.16.30.254 >> --------- >> Here is the raddb/users file entry: >> --------- >> testuser Service-Type == Framed-User >> Framed-Protocol == PPP, >> Framed-IP-Address = 172.16.1.2, >> Framed-IP-Netmask = 255.255.255.255, >> Framed-Compression = Van-Jacobson-TCP-IP >> >> DEFAULT Framed-Protocol == PPP >> Framed-Protocol = PPP, >> Framed-Compression = Van-Jacobson-TCP-IP >> -------------- >> The DEFAULT entry allows users in /etc/passwd to authenticate fine, but >> "testuser" still gets an IP from the NAS pool instead of the one above.. >> Any pointers appreciated! > > http://wiki.freeradius.org/index.php/FAQ#It_still_doesn.27t_work.21 > > Post the debug of the authentication attempt. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 2 > Date: Tue, 26 May 2009 14:15:44 -0500 > From: jon jon <free9360(a)gmail.com> > Subject: Re: next > To: tim.sylvester(a)networkradius.com, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <c1efadb10905261215n4c0a4cdbw143227509a69c594(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > ok so after reading the admin.sql it looks like it is telling me what to > type into my mysql, to create a default admin for radius,and so freeradius > can read any table in sql, does it matter what I change localhost to or > can > it be anyname I want. guess I am seeing what I have to do but not fully > understanding it. I am using a mysql book also but think that might be > getting me more confused. > jon > > On Tue, May 26, 2009 at 12:02 PM, Tim Sylvester < > tim.sylvester(a)networkradius.com> wrote: > >> Read the SQL HOWTO at: http://wiki.freeradius.org/SQL_HOWTO. Also, look >> at the sql.conf file in the raddb directory and the mysql files in >> raddb/sql/mysql. You will want to read the information in admin.sql and >> schema.sql. >> >> >> >> Tim >> >> >> >> *From:* freeradius-users-bounces+tim.sylvester=networkradius.com@ >> lists.freeradius.org >> [mailto:freeradius-users-bounces+tim.sylvester<freeradius-users-bounces%2Btim.sylvester> >> =networkradius.com(a)lists.freeradius.org] *On Behalf Of *jon jon >> *Sent:* Tuesday, May 26, 2009 9:51 AM >> *To:* FreeRadius users mailing list >> *Subject:* next >> >> >> >> I have my freeradius working, I running slackware 12.1 with freeradius >> version 2.1.5. I used NTRAping utility to send packets to my freeradius >> server. I also used radtest and that was successful. So now I want to set >> freeradius with backend mysql database. I am looking for the script >> db_mysql.sql and cannot find this file. I installed mysql as a package, >> when >> I installed slackware. So, does that file even exist anymore? I have the >> radius book and the directory it shows doesn't contain any file with that >> name. >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

3 2

Preventing outer EAP id from going through auth
by John Doppke 26 May '09

26 May '09

I have a fairly standard config, using EAP/TTLS and an LDAP back end. Both EAP and non-EAP requests need to do LDAP lookups. It's working well (I did very little customizing), except I see a lot of the anonymous outer id's getting sent to the LDAP servers. I moved EAP above LDAP in the config, and it seems to have eliminated those when EAP returns 'ok', but I'm still seeing some. It looks like when EAP returns 'updated' it still runs anonymous through LDAP. I noticed the eap def has ok = return, should I add updated = return to avoid the anonymous LDAP lookups? -John

2 1