- Freeradius-Users - lists.freeradius.org

RADIUS attributes: acctoutputoctects and acctinputoctect in mikrotik
by Santiago Balaguer García 19 May '09

19 May '09

7 7

check-item NAS-IP-ADdress & Calling-Station-ID with openldap
by François Mehault 19 May '09

19 May '09

Hi All, I want to use FreeRadius to administer network equipement. I use also OpenLDAP to stock information about users. FreeRADIUS and OpenLDAP are installed on the same server FreeBSD 7.0. I contact a Network equipement (like catalyst cisco 2950 v12.1) with putty (ssh/telnet). To resume : Windows XP -> ssh or telnet -> Cisco 2950 (client radius/authenticator/NAS) -> EAPoRadius (I suppose) -> FreeRADIUS & OpenLDAP For the moment, I don't install/configure supplicant on the Windows XP, I don't know if it's require because I don't want to use FreeRADIUS to auhtenticate my Windows session. I have an active directory to do this. I configure slapd.conf, radius.conf, clients.conf, module ldap etc ... and it's works. And now I would like to add some check-item like NAS-IP-Address and Caliing-Station-ID. But I don't succeed :s, I use checkval to do this. I have 2 questions : - Why my calling-station-id in the request is a IP and not a MAC ? - When I authenticate on the cisco 2950, I have in my log « rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ » instead of 192.168.0.50, what is the problem ??? I think I have numerous problem, If you see one of them, could you inform me ? I am a novice with freeradius (and openldap also :s ). I could give you all information you need to help me to fix my problem. Thanks for your help, Regards Francçois MEHAULT On my cisco 2950 : aaa new-model aaa authentication login default local group radius aaa authorization exec default group radius local aaa authorization network default group radius My ldap.attrmap : checkItem Calling-Station-Id radiusCallingStationId checkItem NAS-IP-Address radiusNASIpAddress Extract of my openldap : dn: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr givenName:: RnJhbsOnb2lz sn: MEHAULT uid: fmehault cn: Francois MEHAULT homeDirectory: /home/admins/fmehault loginShell: /usr/local/bin/zsh gidNumber: 1203 uidNumber: 1203 objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: radiusprofile radiusGroupName: stagiaire radiusCallingStationId: 192.168.0.80 -> I put a IP address and not a Mac address because in the request it's a IP and not a mac, I don't know why... radiusNASIpAddress: 192.168.0.60 -> in fact, the NAS IP is 192.168.0.50, but I put .60 to have Access-Reject userPassword: {SSHA}tOoPUvtVW5O3+StoxScmQLiGFTO5l/+z <12:34>[labobe2:~]# radiusd -X FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.0, built on Apr 16 2009 at 12:03:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf [...] including configuration file /usr/local/etc/raddb/sites-enabled/control-socket group = freeradius user = freeradius including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib/freeradius-2.1.4" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.50 { require_message_authenticator = no secret = "cherche" shortname = "swlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "127.0.0.1" port = 389 password = "secret" identity = "cn=root,dc=netplus,dc=fr" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=netplus,dc=fr" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusVSA mapped to RADIUS Cisco-AVPair conns: 0x2852c240 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_checkval Module: Instantiating station-check checkval station-check { item-name = "Calling-Station-Id" check-name = "Calling-Station-Id" data-type = "string" notfound-reject = no } rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiating nas-check checkval nas-check { item-name = "NAS-IP-Address" check-name = "NAS-IP-Address" data-type = "ipaddr" notfound-reject = no } rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Then I launch my putty and log on the cisco : rad_recv: Access-Request packet from host 192.168.0.50 port 1812, id=117, length=80 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "fmehault" Calling-Station-Id = "192.168.0.80" --> it's not a MAC address, why ??? User-Password = "toto" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "fmehault", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=root,dc=netplus,dc=fr/secret to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (&(cn=administrateur)(|(&(objectClass=GroupOfNames)(member=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr)))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr, with filter (objectclass=*) rlm_ldap::groupcmp: Group administrateur not found or user not a member rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (&(cn=stagiaire)(|(&(objectClass=GroupOfNames)(member=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dFrancois MEHAULT\2cou\3dUtilisateurs\2cdc\3dnetplus\2cdc\3dfr)))) rlm_ldap: object not found rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group stagiaire rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 224 [files] expand: Utilisateur: %{User-name}, group: Stagiaire -> Utilisateur: fmehault, group: Stagiaire ++[files] returns ok [ldap] performing user authorization for fmehault [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=fmehault) [ldap] expand: dc=netplus,dc=fr -> dc=netplus,dc=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=netplus,dc=fr, with filter (uid=fmehault) rlm_ldap: performing search in cn=stagiaire,ou=Profiles,dc=netplus,dc=fr, with filter (objectclass=radiusprofile) rlm_ldap: radiusServiceType -> Service-Type = NAS-Prompt-User [ldap] looking for check items in directory... rlm_ldap: radiusNASIpAddress -> NAS-IP-Address == 192.168.0.60 rlm_ldap: radiusCallingStationId -> Calling-Station-Id == "192.168.0.80" [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user fmehault authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 192.168.0.80 rlm_checkval: Value Name: Calling-Station-Id, Value: 192.168.0.80 ++[station-check] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: À¨ --> what is the problem ??? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.60 (I put 192.168.0.60 instead of 192.168.0.50 to be reject ) ++[nas-check] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] login attempt by "fmehault" with password "toto" [ldap] user DN: cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr rlm_ldap: (re)connect to 127.0.0.1:389, authentication 1 rlm_ldap: bind as cn=Francois MEHAULT,ou=Utilisateurs,dc=netplus,dc=fr/toto to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap] user fmehault authenticated succesfully ++[ldap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 117 to 192.168.0.50 port 1812 Reply-Message = "Utilisateur: fmehault, group: Stagiaire" Service-Type = NAS-Prompt-User Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 117 with timestamp +237 Ready to process requests.

2 2

freeradius mysql apache2 for Wi Fi hotspotsetup
by Mini Jerome 19 May '09

19 May '09

Hi, I have installed free radius to work with mysql on Ubuntu 6.0.6 with radiusclient Nomadicx AG 2000 and it works fine. At present on Nomadix , internal web server is on and it gives the login and logout pages whenever a mysql databse username and passwords are submitted ,session starts on radius server I would like to make the login/logout pages from an external web server instead of internal webserver of nomadix which is configured on Nomadix and restrict users to go to loginpage forcefully , whenever the wifi customer has been assigned dynamic IP from Nomadix. Can any one help????//???????? Mini Jerome

3 2

Removing tunnel attributes only for specific NAS
by Ignacio Siles 19 May '09

19 May '09

Hello, I am trying to implement a Nomadix AG-5000 public NAS in a in a network with an existing FreeRADIUS server. The environment is as follows: - The customer wants nomadix to make public authentication (with captive portal and PAP) for guest users, and employees who cant use the protected wireless network working with WPA-Enterprise authentication. - The employees´ user names and passwords are stored in a LDAP structure. - There is a freeRADIUS v 1.0.5 server which asks that LDAP structure for authentication. So the Nomadix is configured as RADIUS client, connected to the FreeRADIUS server. I have tested the connection with test users stored in freeRADIUS´ users file, and everything worked fine. The problem starts with the Access-Accept RADIUS message. This message includes some tunnel attributes stored in the LDAP, which are necessary for the other networks to work properly. But the Nomadix does not understand those attributes and drops the Access-Accept messages, resulting in a failed authentication. The solution Im thinking about is to remove this tunnel atributes of the Access-Accept message should they be sent to the Nomadix. Ive read about rlm_attr_filter, but I dont know how to configure it to remove tunnel attribures should the Nomadix be acting as the NAS. File /etc/raddb/attrs: DEFAULT Packet-type =* ANY, EAP-Message =* ANY, User-Name =* ANY, Message-Authenticator =* ANY, State =* ANY, Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 55 Thank you in advance, Ignacio Siles Ingeniero de Telecomunicaciones Libera Networks Avda. Juan López Peñalver, 21. PTA 29590 Campanillas (MÁLAGA) T: +34 951010529 - F: +34 951010542 <mailto:ignacio.siles@libera.net> ignacio.siles(a)libera.net www.libera.net <blocked::http://www.libera.net/>

2 1

duplicate Identity received, freeradius behaviour?
by Jean F. Mousinho 18 May '09

18 May '09

Hi, I've noticed that on our radius server logs lots of "EAP state variable not found", after some packet dump analysis (also -Xf) I've noticed that one of the cases that this happened was when some EAP Identity packets are duplicated during parallel authentications (I mean, when at least one session already began from the same client, and we're receiving duplicate ). I've noticed that these duplicate packets come with just a little difference which is the Proxy-State, the duplicate packets then, in my opinion could be caused by some bad proxying implementation (client EAP Identity passing through 2 or more proxies?), or even bad load balancing. Also, we did an upgrade of one of the two proxies connected to our home radius server and somehow noticed that the amount of EAP state errors was lower in the old version (1.1.7) than in the newer (2.1.3) (although its hard to confirm that). I've tried to compare the code from 1.1.7 and 2.1.3 and didn't come to a clear conclusion if its there any special treatment to duplicate proxied packets between 1.1.7 and 2.1.3 (while proxying). Thanks for your time. Jean F. Mousinho

2 1

Free radius configure as pre-paid billing system
by Sachidananda Sahoo 18 May '09

18 May '09

Hi , Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: question about windows users (Alan DeKok) 2. Re: Wimax + Freeradius (Alan DeKok) 3. Re: Module-Success-Message / Module-Failure-Message (Alan DeKok) 4. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) (Alan DeKok) 5. Re[2]: Wimax + Freeradius (Maxim Vinnichenko) 6. Re: Wimax + Freeradius (Alan DeKok) 7. FreeRADIUS Server Version 2.1.6 has been released (Alan DeKok) 8. RE: Module-Success-Message / Module-Failure-Message (Laar van de, Johan, TNF) 9. duplicate Identity received, freeradius behaviour? (Jean F. Mousinho) ---------------------------------------------------------------------- Message: 1 Date: Mon, 18 May 2009 12:57:38 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: question about windows users To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A113F22.8060006(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Bartosz Chodzinski wrote: > /etc/freeradius/certs/README I've never understood why people think it's useful to post documentation from the server on this list. Do you think we haven't seen it? > and something happend: > ( I think key information is > TLS_accept:error in SSLv3 read client certificate A > rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) > but uncle google find as many diferent answers as peple having this problem) It means that you're running a server that is YEARS out of date. Why not use a more recent version? > log freeradius -X: > Sending Access-Challenge of id 115 to 192.168.5.206 port 1812 > EAP-Message = > 0x010b00350d800000002b1403010001011603010020735b6dedb59fdb27811198c86a86bb2fdf2e96ce8f59031cc76f36b80bf1d04c > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x9f4e794b784914b1f67ff19696408712 > Finished request 9 > Going to the next request > Waking up in 5 seconds... > --- Walking the entire request list --- > Cleaning up request 5 ID 111 with timestamp 416c8b35 This is in the FAQ. Go read it. Alan DeKok. ------------------------------ Message: 2 Date: Mon, 18 May 2009 13:03:42 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Wimax + Freeradius To: maxim(a)babilon-t.tj, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A11408E.6060000(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Maxim Vinnichenko wrote: > Thank you for you answer. I've changed test user and now the server > sends access-accept but CPE still doesn't connect. Some NAS equipment will ignore Access-Accept if it doesn't contain the right magic. The exact definition of this magic is usually found buried in a footnote on page 400 out of 800 of the vendor documentation. Go look at the NAS logs, and see if there is any useful messages. If not, call the NAS vendor, and tell them that their product is defective. FreeRADIUS works with WiMAX equipment from Nokia, Cisco and Motorola. (That I've seen.) Other vendors known to have problems include Alvarion. They don't seem to care that their equipment doesn't work, and they haven't answered any of my messages about it. The only solution is to point out publicly that Alvarion is *not* following the WiMAX specs, and therefore people should buy *real* WiMAX equipment. Alan DeKok. ------------------------------ Message: 3 Date: Mon, 18 May 2009 13:04:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Module-Success-Message / Module-Failure-Message To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1140C3.5070202(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Laar van de, Johan, TNF wrote: > My Question is, if this is relatively easy, how can I achieve this? The log messages can be changed via source code edits. This *could* be made configurable, but that also requires source code edits. Alan DeKok. ------------------------------ Message: 4 Date: Mon, 18 May 2009 13:06:22 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A11412E.1030000(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 John Dennis wrote: > It is critical to note for RHEL customers the updated RPMS are > considered "tech preview" and do not come with any official RHEL > support. If they want support for *any* version of the server, it's available. See http://networkradius.com But that's specific to FreeRADIUS, and not to the entire RHEL package. Alan DeKok. ------------------------------ Message: 5 Date: Mon, 18 May 2009 16:25:23 +0500 From: Maxim Vinnichenko <maxim(a)babilon-t.tj> Subject: Re[2]: Wimax + Freeradius To: Alan DeKok <aland(a)deployingradius.com> Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <471893738.20090518162523(a)babilon-t.tj> Content-Type: text/plain; charset=utf-8 Hello Alan, Monday, May 18, 2009, 4:03:42 PM, you wrote: > Maxim Vinnichenko wrote: >> Thank you for you answer. I've changed test user and now the server >> sends access-accept but CPE still doesn't connect. > Some NAS equipment will ignore Access-Accept if it doesn't contain the > right magic. The exact definition of this magic is usually found buried > in a footnote on page 400 out of 800 of the vendor documentation. > Go look at the NAS logs, and see if there is any useful messages. If > not, call the NAS vendor, and tell them that their product is defective. > FreeRADIUS works with WiMAX equipment from Nokia, Cisco and Motorola. > (That I've seen.) Other vendors known to have problems include > Alvarion. They don't seem to care that their equipment doesn't work, > and they haven't answered any of my messages about it. > The only solution is to point out publicly that Alvarion is *not* > following the WiMAX specs, and therefore people should buy *real* WiMAX > equipment. > Alan DeKok. Thank You very much. Vendor forces us to buy theirs "unique" TRIAS server aka radius. :) That costs several hundred thousands. Anyway thanks to all of you for help. -- ?????????? ?????? ????? IP ????????? __________________ ??? "Babilon - T", ???????????, ?. ???????, ?-?? ?????? 8. ????: (992 44) 600 00 83 ?????????: (992 918) 62 37 22 ??. ?????: maxim(a)babilon-t.tj ------------------------------ Message: 6 Date: Mon, 18 May 2009 13:42:46 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Wimax + Freeradius To: maxim(a)babilon-t.tj, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1149B6.2090402(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Maxim Vinnichenko wrote: > Thank You very much. Vendor forces us to buy theirs "unique" TRIAS > server aka radius. :) That costs several hundred thousands. Dollars? Odds are that their product is less functional than FreeRADIUS. It would likely be cheaper to figure out what the problem is, and to make FreeRADIUS inter-operate with the vendor. And what the vendor *really* meant is that they do *not* implement the standards, and they don't care. Why not buy equipment from a vendor that is interested in making *useful* products? Alan DeKok. ------------------------------ Message: 7 Date: Mon, 18 May 2009 13:59:07 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: FreeRADIUS Server Version 2.1.6 has been released To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A114D8B.3090203(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 The following is the change log. Thanks to everyone for testing the pre releases. FreeRADIUS 2.1.6 Mon May 18 10:00:00 CEST 2009; , urgency=medium Feature improvements * radclient exits with 0 on successful (accept / ack), and 1 otherwise (no response / reject) * Added support for %{sql:UPDATE ..}, and insert/delete Patch from Arran Cudbard-Bell * Added sample "do not respond" policy. See raddb/policy.conf and raddb/sites-available/do_not_respond * Cleanups to Suse spec file from Norbert Wegener * New VSAs for Juniper from Bjorn Mork * Include more RFC dictionaries in the default install * More documentation for the WiMAX module * Added "chase_referrals" and "rebind" configuration to rlm_ldap. This helps with Active Directory. See raddb/modules/ldap * Don't load pre/post-proxy if proxying is disabled. * Added %{md5:...}, which returns MD5 hash in hex. * Added configurable "retry_interval" and "poll_interval" for "detail" listeners. * Added "delete_mppe_keys" configuration option to rlm_wimax. Apparently some WiMAX clients misbehave when they see those keys. * Added experimental rlm_ruby from http://github.com/Antti/freeradius-server/tree/master * Add Tunnel attributes to ldap.attrmap * Enable virtual servers to be reloaded on HUP. For now, only the "authorize", "authenticate", etc. processing sections are reloaded. Clients and "listen" sections are NOT reloaded. * Updated "radwatch" script to be more robust. See scripts/radwatch * Added certificate compatibility notes in raddb/certs/README, for compatibility with different operating systems. (i.e. Windows) Bug fixes * Minor changes to allow building without VQP. * Minor fixes from John Center * Fixed raddebug example * Don't crash when deleting attributes via unlang * Be friendlier to very fast clients * Updated the "detail" listener so that it only polls once, and not many times in a row, leaking memory each time... * Update comparison for Packet-Src-IP-Address (etc.) so that the operators other than '==' work. * Did autoconf magic to work around weird libtool bug * Make rlm_perl keep tags for tagged attributes in more situations * Update UID checking for radmin * Added "include_length" field for TTLS. It's needed for RFC compliance, but not (apparently) for interoperability. ------------------------------ Message: 8 Date: Mon, 18 May 2009 14:38:06 +0200 From: "Laar van de, Johan, TNF" <Johan.van.de.Laar(a)tnf.nl> Subject: RE: Module-Success-Message / Module-Failure-Message To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1389360D6F590C44A15A626176B599A21069F31B(a)SR-EXC-006-SON.internal.tnf.nl> Content-Type: text/plain; charset="us-ascii" Ok, but there is no other variable available which can be used within a sql query in the Post-Auth section? Thanks. Johan van de Laar -----Oorspronkelijk bericht----- Van: freeradius-users-bounces+johan.van.de.laar=tnf.nl(a)lists.freeradius.org [mailto:freeradius-users-bounces+johan.van.de.laar=tnf.nl@lists.freeradius.org] Namens Alan DeKok Verzonden: maandag 18 mei 2009 13:05 Aan: FreeRadius users mailing list Onderwerp: Re: Module-Success-Message / Module-Failure-Message Laar van de, Johan, TNF wrote: > My Question is, if this is relatively easy, how can I achieve this? The log messages can be changed via source code edits. This *could* be made configurable, but that also requires source code edits. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 9 Date: Mon, 18 May 2009 14:21:03 +0100 From: "Jean F. Mousinho" <jean.mousinho(a)ist.utl.pt> Subject: duplicate Identity received, freeradius behaviour? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1242652863.1410.26.camel(a)jemos-workd.ist.utl.pt> Content-Type: text/plain Hi, I've noticed that on our radius server logs lots of "EAP state variable not found", after some packet dump analysis (also -Xf) I've noticed that one of the cases that this happened was when some EAP Identity packets are duplicated during parallel authentications (I mean, when at least one session already began from the same client, and we're receiving duplicate ). I've noticed that these duplicate packets come with just a little difference which is the Proxy-State, the duplicate packets then, in my opinion could be caused by some bad proxying implementation (client EAP Identity passing through 2 or more proxies?), or even bad load balancing. Also, we did an upgrade of one of the two proxies connected to our home radius server and somehow noticed that the amount of EAP state errors was lower in the old version (1.1.7) than in the newer (2.1.3) (although its hard to confirm that). I've tried to compare the code from 1.1.7 and 2.1.3 and didn't come to a clear conclusion if its there any special treatment to duplicate proxied packets between 1.1.7 and 2.1.3 (while proxying). Thanks for your time. Jean F. Mousinho ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 49, Issue 74 ************************************************ I want to configure for pre-paid billing system in free radius , please let me what are necessary module need to configure. Regards, Sachidananda Sahoo ________________________________ From: "freeradius-users-request(a)lists.freeradius.org" <freeradius-users-request(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org Sent: Monday, May 18, 2009 6:55:29 PM Subject: Freeradius-Users Digest, Vol 49, Issue 74

2 1

Re: Freeradius-Users Digest, Vol 49, Issue 75(Free radius configure as pre-paid billing system)
by Sachidananda Sahoo 18 May '09

18 May '09

Hi , I want to configure for pre-paid billing system in free radius , please let me what are necessary module need to configure. Regards, Sachidananda Sahoo ________________________________ From: "freeradius-users-request(a)lists.freeradius.org" <freeradius-users-request(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org Sent: Monday, May 18, 2009 7:16:30 PM Subject: Freeradius-Users Digest, Vol 49, Issue 75 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Free radius configure as pre-paid billing system (Sachidananda Sahoo) ---------------------------------------------------------------------- Message: 1 Date: Mon, 18 May 2009 06:46:21 -0700 (PDT) From: Sachidananda Sahoo <sahoo_sachi(a)yahoo.com> Subject: Free radius configure as pre-paid billing system To: freeradius-users(a)lists.freeradius.org Message-ID: <858597.78562.qm(a)web31915.mail.mud.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" Hi , Send Freeradius-Users mailing list submissions to ??? freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit ??? http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to ??? freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at ??? freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: ? 1. Re: question about windows users (Alan DeKok) ? 2. Re: Wimax + Freeradius (Alan DeKok) ? 3. Re: Module-Success-Message / Module-Failure-Message (Alan DeKok) ? 4. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) ? ? ? (Alan DeKok) ? 5. Re[2]: Wimax + Freeradius (Maxim Vinnichenko) ? 6. Re: Wimax + Freeradius (Alan DeKok) ? 7. FreeRADIUS Server Version 2.1.6 has been released (Alan DeKok) ? 8. RE: Module-Success-Message / Module-Failure-Message ? ? ? (Laar van de, Johan, TNF) ? 9. duplicate Identity received, freeradius behaviour? ? ? ? (Jean F. Mousinho) ---------------------------------------------------------------------- Message: 1 Date: Mon, 18 May 2009 12:57:38 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: question about windows users To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A113F22.8060006(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Bartosz Chodzinski wrote: > /etc/freeradius/certs/README ? I've never understood why people think it's useful to post documentation from the server on this list.? Do you think we haven't seen it? > and something happend: > ( I think key information is? ? > TLS_accept:error in SSLv3 read client certificate A > rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) > but uncle google find as many diferent answers as peple having this problem) ? It means that you're running a server that is YEARS out of date.? Why not use a more recent version? > log freeradius -X: > Sending Access-Challenge of id 115 to 192.168.5.206 port 1812 >? ? ? ? EAP-Message = > 0x010b00350d800000002b1403010001011603010020735b6dedb59fdb27811198c86a86bb2fdf2e96ce8f59031cc76f36b80bf1d04c >? ? ? ? Message-Authenticator = 0x00000000000000000000000000000000 >? ? ? ? State = 0x9f4e794b784914b1f67ff19696408712 > Finished request 9 > Going to the next request > Waking up in 5 seconds... > --- Walking the entire request list --- > Cleaning up request 5 ID 111 with timestamp 416c8b35 ? This is in the FAQ.? Go read it. ? Alan DeKok. ------------------------------ Message: 2 Date: Mon, 18 May 2009 13:03:42 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Wimax + Freeradius To: maxim(a)babilon-t.tj,??? FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A11408E.6060000(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Maxim Vinnichenko wrote: > Thank you for you answer. I've changed test user and now the server > sends access-accept but CPE still doesn't connect. ? Some NAS equipment will ignore Access-Accept if it doesn't contain the right magic.? The exact definition of this magic is usually found buried in a footnote on page 400 out of 800 of the vendor documentation. ? Go look at the NAS logs, and see if there is any useful messages.? If not, call the NAS vendor, and tell them that their product is defective. ? FreeRADIUS works with WiMAX equipment from Nokia, Cisco and Motorola. (That I've seen.)? Other vendors known to have problems include Alvarion.? They don't seem to care that their equipment doesn't work, and they haven't answered any of my messages about it. ? The only solution is to point out publicly that Alvarion is *not* following the WiMAX specs, and therefore people should buy *real* WiMAX equipment. ? Alan DeKok. ------------------------------ Message: 3 Date: Mon, 18 May 2009 13:04:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Module-Success-Message / Module-Failure-Message To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1140C3.5070202(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Laar van de, Johan, TNF wrote: > My Question is, if this is relatively easy, how can I achieve this? ? The log messages can be changed via source code edits. ? This *could* be made configurable, but that also requires source code edits. ? Alan DeKok. ------------------------------ Message: 4 Date: Mon, 18 May 2009 13:06:22 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A11412E.1030000(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 John Dennis wrote: > It is critical to note for RHEL customers the updated RPMS are > considered "tech preview" and do not come with any official RHEL > support. ? If they want support for *any* version of the server, it's available. See http://networkradius.com ? But that's specific to FreeRADIUS, and not to the entire RHEL package. ? Alan DeKok. ------------------------------ Message: 5 Date: Mon, 18 May 2009 16:25:23 +0500 From: Maxim Vinnichenko <maxim(a)babilon-t.tj> Subject: Re[2]: Wimax + Freeradius To: Alan DeKok <aland(a)deployingradius.com> Cc: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <471893738.20090518162523(a)babilon-t.tj> Content-Type: text/plain; charset=utf-8 Hello Alan, Monday, May 18, 2009, 4:03:42 PM, you wrote: > Maxim Vinnichenko wrote: >> Thank you for you answer. I've changed test user and now the server >> sends access-accept but CPE still doesn't connect. >? Some NAS equipment will ignore Access-Accept if it doesn't contain the > right magic.? The exact definition of this magic is usually found buried > in a footnote on page 400 out of 800 of the vendor documentation. >? Go look at the NAS logs, and see if there is any useful messages. If > not, call the NAS vendor, and tell them that their product is defective. >? FreeRADIUS works with WiMAX equipment from Nokia, Cisco and Motorola. >? (That I've seen.)? Other vendors known to have problems include > Alvarion.? They don't seem to care that their equipment doesn't work, > and they haven't answered any of my messages about it. >? The only solution is to point out publicly that Alvarion is *not* > following the WiMAX specs, and therefore people should buy *real* WiMAX > equipment. >? Alan DeKok. Thank You very much. Vendor forces us to buy theirs "unique" TRIAS server aka radius. :) That costs several hundred thousands. Anyway thanks to all of you for help. -- ?????????? ?????? ????? IP ????????? __________________ ??? "Babilon - T", ???????????, ?. ???????, ?-?? ?????? 8. ????:? ? ? (992 44) 600 00 83 ?????????:? (992 918) 62 37 22 ??. ?????:? maxim(a)babilon-t.tj ------------------------------ Message: 6 Date: Mon, 18 May 2009 13:42:46 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Wimax + Freeradius To: maxim(a)babilon-t.tj,??? FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1149B6.2090402(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Maxim Vinnichenko wrote: > Thank You very much. Vendor forces us to buy theirs "unique" TRIAS > server aka radius. :) That costs several hundred thousands. ? Dollars? ? Odds are that their product is less functional than FreeRADIUS.? It would likely be cheaper to figure out what the problem is, and to make FreeRADIUS inter-operate with the vendor. ? And what the vendor *really* meant is that they do *not* implement the standards, and they don't care.? Why not buy equipment from a vendor that is interested in making *useful* products? ? Alan DeKok. ------------------------------ Message: 7 Date: Mon, 18 May 2009 13:59:07 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: FreeRADIUS Server Version 2.1.6 has been released To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A114D8B.3090203(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 ? The following is the change log.? Thanks to everyone for testing the pre releases. FreeRADIUS 2.1.6 Mon May 18 10:00:00 CEST 2009;? , urgency=medium ??? Feature improvements ??? * radclient exits with 0 on successful (accept / ack), and 1 ??? ? otherwise (no response / reject) ??? * Added support for %{sql:UPDATE ..}, and insert/delete ??? ? Patch from Arran Cudbard-Bell ??? * Added sample "do not respond" policy.? See raddb/policy.conf ??? ? and raddb/sites-available/do_not_respond ??? * Cleanups to Suse spec file from Norbert Wegener ??? * New VSAs for Juniper from Bjorn Mork ??? * Include more RFC dictionaries in the default install ??? * More documentation for the WiMAX module ??? * Added "chase_referrals" and "rebind" configuration to ??? ??? ? rlm_ldap. ??? ? This helps with Active Directory.? See raddb/modules/ldap ??? * Don't load pre/post-proxy if proxying is disabled. ??? * Added %{md5:...}, which returns MD5 hash in hex. ??? * Added configurable "retry_interval" and "poll_interval" ??? ? for "detail" listeners. ??? * Added "delete_mppe_keys" configuration option to rlm_wimax. ??? ? Apparently some WiMAX clients misbehave when they see those ??? ? keys. ??? * Added experimental rlm_ruby from ??? ? http://github.com/Antti/freeradius-server/tree/master ??? * Add Tunnel attributes to ldap.attrmap ??? * Enable virtual servers to be reloaded on HUP.? For now, only ??? ? the "authorize", "authenticate", etc. processing sections are ??? ? reloaded.? Clients and "listen" sections are NOT reloaded. ??? * Updated "radwatch" script to be more robust.? See ??? ? scripts/radwatch ??? * Added certificate compatibility notes in raddb/certs/README, ??? ? for compatibility with different operating systems. (i.e. ??? ? Windows) ??? Bug fixes ??? * Minor changes to allow building without VQP. ??? * Minor fixes from John Center ??? * Fixed raddebug example ??? * Don't crash when deleting attributes via unlang ??? * Be friendlier to very fast clients ??? * Updated the "detail" listener so that it only polls once, ??? ? and not many times in a row, leaking memory each time... ??? * Update comparison for Packet-Src-IP-Address (etc.) so that ??? ? the operators other than '==' work. ??? * Did autoconf magic to work around weird libtool bug ??? * Make rlm_perl keep tags for tagged attributes in more ??? ? situations ??? * Update UID checking for radmin ??? * Added "include_length" field for TTLS.? It's needed for RFC ??? ? compliance, but not (apparently) for interoperability. ------------------------------ Message: 8 Date: Mon, 18 May 2009 14:38:06 +0200 From: "Laar van de, Johan, TNF" <Johan.van.de.Laar(a)tnf.nl> Subject: RE: Module-Success-Message / Module-Failure-Message To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: ??? <1389360D6F590C44A15A626176B599A21069F31B(a)SR-EXC-006-SON.internal.tnf.nl> ??? Content-Type: text/plain; charset="us-ascii" Ok, but there is no other variable available which can be used within a sql query in the Post-Auth section? Thanks. Johan van de Laar -----Oorspronkelijk bericht----- Van: freeradius-users-bounces+johan.van.de.laar=tnf.nl(a)lists.freeradius.org [mailto:freeradius-users-bounces+johan.van.de.laar=tnf.nl@lists.freeradius.org] Namens Alan DeKok Verzonden: maandag 18 mei 2009 13:05 Aan: FreeRadius users mailing list Onderwerp: Re: Module-Success-Message / Module-Failure-Message Laar van de, Johan, TNF wrote: > My Question is, if this is relatively easy, how can I achieve this? ? The log messages can be changed via source code edits. ? This *could* be made configurable, but that also requires source code edits. ? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 9 Date: Mon, 18 May 2009 14:21:03 +0100 From: "Jean F. Mousinho" <jean.mousinho(a)ist.utl.pt> Subject: duplicate Identity received, freeradius behaviour? To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <1242652863.1410.26.camel(a)jemos-workd.ist.utl.pt> Content-Type: text/plain Hi, I've noticed that on our radius server logs lots of "EAP state variable not found", after some packet dump analysis (also -Xf) I've noticed that one of the cases that this happened was when some EAP Identity packets are duplicated during parallel authentications (I mean, when at least one session already began from the same client, and we're receiving duplicate ). I've noticed that these duplicate packets come with just a little difference which is the Proxy-State, the duplicate packets then, in my opinion could be caused by some bad proxying implementation (client EAP Identity passing through 2 or more proxies?), or even bad load balancing. Also, we did an upgrade of one of the two proxies connected to our home radius server and somehow noticed that the amount of EAP state errors was lower in the old version (1.1.7) than in the newer (2.1.3) (although its hard to confirm that). I've tried to compare the code from 1.1.7 and 2.1.3 and didn't come to a clear conclusion if its there any special treatment to duplicate proxied packets between 1.1.7 and 2.1.3 (while proxying). Thanks for your time. Jean F. Mousinho ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 49, Issue 74 ************************************************ I want to configure for pre-paid billing system in free radius , please let me what are necessary module need to configure. ?Regards, Sachidananda Sahoo ________________________________ From: "freeradius-users-request(a)lists.freeradius.org" <freeradius-users-request(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org Sent: Monday, May 18, 2009 6:55:29 PM Subject: Freeradius-Users Digest, Vol 49, Issue 74

1 0

Re: Module-Success-Message / Module-Failure-Message
by Laar van de, Johan, TNF 18 May '09

18 May '09

Hi all, Excuse me, but I don't know how to reply to an older archived message on this list. On the 3th of April 2008 Alan DeKok replied to the message with the same subject as this mail with the following: > Are they legacy attributes ? They don't seem to be being populated. Be > really nice if they were populate with the nice new shiny Login OK / > Login Fail messages... > > Login OK: [ac221/***** (from client > hp-e-engg1-1-dev-8021x-sw1.net.susx.ac.uk port 1 cli 0080c8396796) That's relatively easy to do. Alan DeKok. My Question is, if this is relatively easy, how can I achieve this? I'm really interested in storing the 'Module-Failure-Message' (or an equivalent which explains why a request has been rejected) in my database for further use. Johan van de Laar The Network Factory

2 2

Wimax + Freeradius
by Maxim Vinnichenko 18 May '09

18 May '09

Hello Freeradius-users, We are trying to implement AAA service for WIMAX project and have some problems. Freeradius ver 2.1.3 is installed on Gentoo. The schema is this CPE >> WASN9770 GW >> RADIUS At the moment problem is the following [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for 123(a)wimax.tj with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect The test user is listed in users. But as far as I understood radius is not using users to authenticate anyone. Please help. Full debug is here http://217.11.185.178:8080/eap.log Maxim Vinnichenko.

3 5

Re:Re: checking authorization in the duration of connection
by Eric 17 May '09

17 May '09

Hi. I found how to kill online users if were above their limits in FAQ in freeradius. but the address of download is <ftp://ftp.nmo.net/pub/radkill/radkill-latest.tar.gz> I can't connect this link. could you please send me this package? does it do that I wanted?

2 1