- Freeradius-Users - lists.freeradius.org

freeradius mysql apache2 for Wi Fi hotspotsetup
by Mini Jerome 19 May '09

19 May '09

Hi, I have installed free radius to work with mysql on Ubuntu 6.0.6 with radiusclient Nomadicx AG 2000 and it works fine. At present on Nomadix , internal web server is on and it gives the login and logout pages whenever a mysql databse username and passwords are submitted ,session starts on radius server I would like to make the login/logout pages from an external web server instead of internal webserver of nomadix which is configured on Nomadix and restrict users to go to loginpage forcefully , whenever the wifi customer has been assigned dynamic IP from Nomadix. Can any one help????//???????? Mini Jerome

3 2

Removing tunnel attributes only for specific NAS
by Ignacio Siles 19 May '09

19 May '09

Hello, I am trying to implement a Nomadix AG-5000 public NAS in a in a network with an existing FreeRADIUS server. The environment is as follows: - The customer wants nomadix to make public authentication (with captive portal and PAP) for guest users, and employees who cant use the protected wireless network working with WPA-Enterprise authentication. - The employees´ user names and passwords are stored in a LDAP structure. - There is a freeRADIUS v 1.0.5 server which asks that LDAP structure for authentication. So the Nomadix is configured as RADIUS client, connected to the FreeRADIUS server. I have tested the connection with test users stored in freeRADIUS´ users file, and everything worked fine. The problem starts with the Access-Accept RADIUS message. This message includes some tunnel attributes stored in the LDAP, which are necessary for the other networks to work properly. But the Nomadix does not understand those attributes and drops the Access-Accept messages, resulting in a failed authentication. The solution Im thinking about is to remove this tunnel atributes of the Access-Accept message should they be sent to the Nomadix. Ive read about rlm_attr_filter, but I dont know how to configure it to remove tunnel attribures should the Nomadix be acting as the NAS. File /etc/raddb/attrs: DEFAULT Packet-type =* ANY, EAP-Message =* ANY, User-Name =* ANY, Message-Authenticator =* ANY, State =* ANY, Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := 55 Thank you in advance, Ignacio Siles Ingeniero de Telecomunicaciones Libera Networks Avda. Juan López Peñalver, 21. PTA 29590 Campanillas (MÁLAGA) T: +34 951010529 - F: +34 951010542 <mailto:ignacio.siles@libera.net> ignacio.siles(a)libera.net www.libera.net <blocked::http://www.libera.net/>

2 1

duplicate Identity received, freeradius behaviour?
by Jean F. Mousinho 18 May '09

18 May '09

Hi, I've noticed that on our radius server logs lots of "EAP state variable not found", after some packet dump analysis (also -Xf) I've noticed that one of the cases that this happened was when some EAP Identity packets are duplicated during parallel authentications (I mean, when at least one session already began from the same client, and we're receiving duplicate ). I've noticed that these duplicate packets come with just a little difference which is the Proxy-State, the duplicate packets then, in my opinion could be caused by some bad proxying implementation (client EAP Identity passing through 2 or more proxies?), or even bad load balancing. Also, we did an upgrade of one of the two proxies connected to our home radius server and somehow noticed that the amount of EAP state errors was lower in the old version (1.1.7) than in the newer (2.1.3) (although its hard to confirm that). I've tried to compare the code from 1.1.7 and 2.1.3 and didn't come to a clear conclusion if its there any special treatment to duplicate proxied packets between 1.1.7 and 2.1.3 (while proxying). Thanks for your time. Jean F. Mousinho

2 1

Free radius configure as pre-paid billing system
by Sachidananda Sahoo 18 May '09

18 May '09

Hi , Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: question about windows users (Alan DeKok) 2. Re: Wimax + Freeradius (Alan DeKok) 3. Re: Module-Success-Message / Module-Failure-Message (Alan DeKok) 4. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) (Alan DeKok) 5. Re[2]: Wimax + Freeradius (Maxim Vinnichenko) 6. Re: Wimax + Freeradius (Alan DeKok) 7. FreeRADIUS Server Version 2.1.6 has been released (Alan DeKok) 8. RE: Module-Success-Message / Module-Failure-Message (Laar van de, Johan, TNF) 9. duplicate Identity received, freeradius behaviour? (Jean F. Mousinho) ---------------------------------------------------------------------- Message: 1 Date: Mon, 18 May 2009 12:57:38 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: question about windows users To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A113F22.8060006(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Bartosz Chodzinski wrote: > /etc/freeradius/certs/README I've never understood why people think it's useful to post documentation from the server on this list. Do you think we haven't seen it? > and something happend: > ( I think key information is > TLS_accept:error in SSLv3 read client certificate A > rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) > but uncle google find as many diferent answers as peple having this problem) It means that you're running a server that is YEARS out of date. Why not use a more recent version? > log freeradius -X: > Sending Access-Challenge of id 115 to 192.168.5.206 port 1812 > EAP-Message = > 0x010b00350d800000002b1403010001011603010020735b6dedb59fdb27811198c86a86bb2fdf2e96ce8f59031cc76f36b80bf1d04c > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x9f4e794b784914b1f67ff19696408712 > Finished request 9 > Going to the next request > Waking up in 5 seconds... > --- Walking the entire request list --- > Cleaning up request 5 ID 111 with timestamp 416c8b35 This is in the FAQ. Go read it. Alan DeKok. ------------------------------ Message: 2 Date: Mon, 18 May 2009 13:03:42 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Wimax + Freeradius To: maxim(a)babilon-t.tj, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A11408E.6060000(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Maxim Vinnichenko wrote: > Thank you for you answer. I've changed test user and now the server > sends access-accept but CPE still doesn't connect. Some NAS equipment will ignore Access-Accept if it doesn't contain the right magic. The exact definition of this magic is usually found buried in a footnote on page 400 out of 800 of the vendor documentation. Go look at the NAS logs, and see if there is any useful messages. If not, call the NAS vendor, and tell them that their product is defective. FreeRADIUS works with WiMAX equipment from Nokia, Cisco and Motorola. (That I've seen.) Other vendors known to have problems include Alvarion. They don't seem to care that their equipment doesn't work, and they haven't answered any of my messages about it. The only solution is to point out publicly that Alvarion is *not* following the WiMAX specs, and therefore people should buy *real* WiMAX equipment. Alan DeKok. ------------------------------ Message: 3 Date: Mon, 18 May 2009 13:04:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Module-Success-Message / Module-Failure-Message To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1140C3.5070202(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Laar van de, Johan, TNF wrote: > My Question is, if this is relatively easy, how can I achieve this? The log messages can be changed via source code edits. This *could* be made configurable, but that also requires source code edits. Alan DeKok. ------------------------------ Message: 4 Date: Mon, 18 May 2009 13:06:22 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A11412E.1030000(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 John Dennis wrote: > It is critical to note for RHEL customers the updated RPMS are > considered "tech preview" and do not come with any official RHEL > support. If they want support for *any* version of the server, it's available. See http://networkradius.com But that's specific to FreeRADIUS, and not to the entire RHEL package. Alan DeKok. ------------------------------ Message: 5 Date: Mon, 18 May 2009 16:25:23 +0500 From: Maxim Vinnichenko <maxim(a)babilon-t.tj> Subject: Re[2]: Wimax + Freeradius To: Alan DeKok <aland(a)deployingradius.com> Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <471893738.20090518162523(a)babilon-t.tj> Content-Type: text/plain; charset=utf-8 Hello Alan, Monday, May 18, 2009, 4:03:42 PM, you wrote: > Maxim Vinnichenko wrote: >> Thank you for you answer. I've changed test user and now the server >> sends access-accept but CPE still doesn't connect. > Some NAS equipment will ignore Access-Accept if it doesn't contain the > right magic. The exact definition of this magic is usually found buried > in a footnote on page 400 out of 800 of the vendor documentation. > Go look at the NAS logs, and see if there is any useful messages. If > not, call the NAS vendor, and tell them that their product is defective. > FreeRADIUS works with WiMAX equipment from Nokia, Cisco and Motorola. > (That I've seen.) Other vendors known to have problems include > Alvarion. They don't seem to care that their equipment doesn't work, > and they haven't answered any of my messages about it. > The only solution is to point out publicly that Alvarion is *not* > following the WiMAX specs, and therefore people should buy *real* WiMAX > equipment. > Alan DeKok. Thank You very much. Vendor forces us to buy theirs "unique" TRIAS server aka radius. :) That costs several hundred thousands. Anyway thanks to all of you for help. -- ?????????? ?????? ????? IP ????????? __________________ ??? "Babilon - T", ???????????, ?. ???????, ?-?? ?????? 8. ????: (992 44) 600 00 83 ?????????: (992 918) 62 37 22 ??. ?????: maxim(a)babilon-t.tj ------------------------------ Message: 6 Date: Mon, 18 May 2009 13:42:46 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Wimax + Freeradius To: maxim(a)babilon-t.tj, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1149B6.2090402(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Maxim Vinnichenko wrote: > Thank You very much. Vendor forces us to buy theirs "unique" TRIAS > server aka radius. :) That costs several hundred thousands. Dollars? Odds are that their product is less functional than FreeRADIUS. It would likely be cheaper to figure out what the problem is, and to make FreeRADIUS inter-operate with the vendor. And what the vendor *really* meant is that they do *not* implement the standards, and they don't care. Why not buy equipment from a vendor that is interested in making *useful* products? Alan DeKok. ------------------------------ Message: 7 Date: Mon, 18 May 2009 13:59:07 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: FreeRADIUS Server Version 2.1.6 has been released To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A114D8B.3090203(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 The following is the change log. Thanks to everyone for testing the pre releases. FreeRADIUS 2.1.6 Mon May 18 10:00:00 CEST 2009; , urgency=medium Feature improvements * radclient exits with 0 on successful (accept / ack), and 1 otherwise (no response / reject) * Added support for %{sql:UPDATE ..}, and insert/delete Patch from Arran Cudbard-Bell * Added sample "do not respond" policy. See raddb/policy.conf and raddb/sites-available/do_not_respond * Cleanups to Suse spec file from Norbert Wegener * New VSAs for Juniper from Bjorn Mork * Include more RFC dictionaries in the default install * More documentation for the WiMAX module * Added "chase_referrals" and "rebind" configuration to rlm_ldap. This helps with Active Directory. See raddb/modules/ldap * Don't load pre/post-proxy if proxying is disabled. * Added %{md5:...}, which returns MD5 hash in hex. * Added configurable "retry_interval" and "poll_interval" for "detail" listeners. * Added "delete_mppe_keys" configuration option to rlm_wimax. Apparently some WiMAX clients misbehave when they see those keys. * Added experimental rlm_ruby from http://github.com/Antti/freeradius-server/tree/master * Add Tunnel attributes to ldap.attrmap * Enable virtual servers to be reloaded on HUP. For now, only the "authorize", "authenticate", etc. processing sections are reloaded. Clients and "listen" sections are NOT reloaded. * Updated "radwatch" script to be more robust. See scripts/radwatch * Added certificate compatibility notes in raddb/certs/README, for compatibility with different operating systems. (i.e. Windows) Bug fixes * Minor changes to allow building without VQP. * Minor fixes from John Center * Fixed raddebug example * Don't crash when deleting attributes via unlang * Be friendlier to very fast clients * Updated the "detail" listener so that it only polls once, and not many times in a row, leaking memory each time... * Update comparison for Packet-Src-IP-Address (etc.) so that the operators other than '==' work. * Did autoconf magic to work around weird libtool bug * Make rlm_perl keep tags for tagged attributes in more situations * Update UID checking for radmin * Added "include_length" field for TTLS. It's needed for RFC compliance, but not (apparently) for interoperability. ------------------------------ Message: 8 Date: Mon, 18 May 2009 14:38:06 +0200 From: "Laar van de, Johan, TNF" <Johan.van.de.Laar(a)tnf.nl> Subject: RE: Module-Success-Message / Module-Failure-Message To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1389360D6F590C44A15A626176B599A21069F31B(a)SR-EXC-006-SON.internal.tnf.nl> Content-Type: text/plain; charset="us-ascii" Ok, but there is no other variable available which can be used within a sql query in the Post-Auth section? Thanks. Johan van de Laar -----Oorspronkelijk bericht----- Van: freeradius-users-bounces+johan.van.de.laar=tnf.nl(a)lists.freeradius.org [mailto:freeradius-users-bounces+johan.van.de.laar=tnf.nl@lists.freeradius.org] Namens Alan DeKok Verzonden: maandag 18 mei 2009 13:05 Aan: FreeRadius users mailing list Onderwerp: Re: Module-Success-Message / Module-Failure-Message Laar van de, Johan, TNF wrote: > My Question is, if this is relatively easy, how can I achieve this? The log messages can be changed via source code edits. This *could* be made configurable, but that also requires source code edits. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 9 Date: Mon, 18 May 2009 14:21:03 +0100 From: "Jean F. Mousinho" <jean.mousinho(a)ist.utl.pt> Subject: duplicate Identity received, freeradius behaviour? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1242652863.1410.26.camel(a)jemos-workd.ist.utl.pt> Content-Type: text/plain Hi, I've noticed that on our radius server logs lots of "EAP state variable not found", after some packet dump analysis (also -Xf) I've noticed that one of the cases that this happened was when some EAP Identity packets are duplicated during parallel authentications (I mean, when at least one session already began from the same client, and we're receiving duplicate ). I've noticed that these duplicate packets come with just a little difference which is the Proxy-State, the duplicate packets then, in my opinion could be caused by some bad proxying implementation (client EAP Identity passing through 2 or more proxies?), or even bad load balancing. Also, we did an upgrade of one of the two proxies connected to our home radius server and somehow noticed that the amount of EAP state errors was lower in the old version (1.1.7) than in the newer (2.1.3) (although its hard to confirm that). I've tried to compare the code from 1.1.7 and 2.1.3 and didn't come to a clear conclusion if its there any special treatment to duplicate proxied packets between 1.1.7 and 2.1.3 (while proxying). Thanks for your time. Jean F. Mousinho ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 49, Issue 74 ************************************************ I want to configure for pre-paid billing system in free radius , please let me what are necessary module need to configure. Regards, Sachidananda Sahoo ________________________________ From: "freeradius-users-request(a)lists.freeradius.org" <freeradius-users-request(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org Sent: Monday, May 18, 2009 6:55:29 PM Subject: Freeradius-Users Digest, Vol 49, Issue 74

2 1

Re: Freeradius-Users Digest, Vol 49, Issue 75(Free radius configure as pre-paid billing system)
by Sachidananda Sahoo 18 May '09

18 May '09

Hi , I want to configure for pre-paid billing system in free radius , please let me what are necessary module need to configure. Regards, Sachidananda Sahoo ________________________________ From: "freeradius-users-request(a)lists.freeradius.org" <freeradius-users-request(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org Sent: Monday, May 18, 2009 7:16:30 PM Subject: Freeradius-Users Digest, Vol 49, Issue 75 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Free radius configure as pre-paid billing system (Sachidananda Sahoo) ---------------------------------------------------------------------- Message: 1 Date: Mon, 18 May 2009 06:46:21 -0700 (PDT) From: Sachidananda Sahoo <sahoo_sachi(a)yahoo.com> Subject: Free radius configure as pre-paid billing system To: freeradius-users(a)lists.freeradius.org Message-ID: <858597.78562.qm(a)web31915.mail.mud.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" Hi , Send Freeradius-Users mailing list submissions to ??? freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit ??? http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to ??? freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at ??? freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: ? 1. Re: question about windows users (Alan DeKok) ? 2. Re: Wimax + Freeradius (Alan DeKok) ? 3. Re: Module-Success-Message / Module-Failure-Message (Alan DeKok) ? 4. Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) ? ? ? (Alan DeKok) ? 5. Re[2]: Wimax + Freeradius (Maxim Vinnichenko) ? 6. Re: Wimax + Freeradius (Alan DeKok) ? 7. FreeRADIUS Server Version 2.1.6 has been released (Alan DeKok) ? 8. RE: Module-Success-Message / Module-Failure-Message ? ? ? (Laar van de, Johan, TNF) ? 9. duplicate Identity received, freeradius behaviour? ? ? ? (Jean F. Mousinho) ---------------------------------------------------------------------- Message: 1 Date: Mon, 18 May 2009 12:57:38 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: question about windows users To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A113F22.8060006(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Bartosz Chodzinski wrote: > /etc/freeradius/certs/README ? I've never understood why people think it's useful to post documentation from the server on this list.? Do you think we haven't seen it? > and something happend: > ( I think key information is? ? > TLS_accept:error in SSLv3 read client certificate A > rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) > but uncle google find as many diferent answers as peple having this problem) ? It means that you're running a server that is YEARS out of date.? Why not use a more recent version? > log freeradius -X: > Sending Access-Challenge of id 115 to 192.168.5.206 port 1812 >? ? ? ? EAP-Message = > 0x010b00350d800000002b1403010001011603010020735b6dedb59fdb27811198c86a86bb2fdf2e96ce8f59031cc76f36b80bf1d04c >? ? ? ? Message-Authenticator = 0x00000000000000000000000000000000 >? ? ? ? State = 0x9f4e794b784914b1f67ff19696408712 > Finished request 9 > Going to the next request > Waking up in 5 seconds... > --- Walking the entire request list --- > Cleaning up request 5 ID 111 with timestamp 416c8b35 ? This is in the FAQ.? Go read it. ? Alan DeKok. ------------------------------ Message: 2 Date: Mon, 18 May 2009 13:03:42 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Wimax + Freeradius To: maxim(a)babilon-t.tj,??? FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A11408E.6060000(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Maxim Vinnichenko wrote: > Thank you for you answer. I've changed test user and now the server > sends access-accept but CPE still doesn't connect. ? Some NAS equipment will ignore Access-Accept if it doesn't contain the right magic.? The exact definition of this magic is usually found buried in a footnote on page 400 out of 800 of the vendor documentation. ? Go look at the NAS logs, and see if there is any useful messages.? If not, call the NAS vendor, and tell them that their product is defective. ? FreeRADIUS works with WiMAX equipment from Nokia, Cisco and Motorola. (That I've seen.)? Other vendors known to have problems include Alvarion.? They don't seem to care that their equipment doesn't work, and they haven't answered any of my messages about it. ? The only solution is to point out publicly that Alvarion is *not* following the WiMAX specs, and therefore people should buy *real* WiMAX equipment. ? Alan DeKok. ------------------------------ Message: 3 Date: Mon, 18 May 2009 13:04:35 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Module-Success-Message / Module-Failure-Message To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1140C3.5070202(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Laar van de, Johan, TNF wrote: > My Question is, if this is relatively easy, how can I achieve this? ? The log messages can be changed via source code edits. ? This *could* be made configurable, but that also requires source code edits. ? Alan DeKok. ------------------------------ Message: 4 Date: Mon, 18 May 2009 13:06:22 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: current RHEL/CentOS pre-built packages (Was: freeRADIUS) To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A11412E.1030000(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 John Dennis wrote: > It is critical to note for RHEL customers the updated RPMS are > considered "tech preview" and do not come with any official RHEL > support. ? If they want support for *any* version of the server, it's available. See http://networkradius.com ? But that's specific to FreeRADIUS, and not to the entire RHEL package. ? Alan DeKok. ------------------------------ Message: 5 Date: Mon, 18 May 2009 16:25:23 +0500 From: Maxim Vinnichenko <maxim(a)babilon-t.tj> Subject: Re[2]: Wimax + Freeradius To: Alan DeKok <aland(a)deployingradius.com> Cc: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <471893738.20090518162523(a)babilon-t.tj> Content-Type: text/plain; charset=utf-8 Hello Alan, Monday, May 18, 2009, 4:03:42 PM, you wrote: > Maxim Vinnichenko wrote: >> Thank you for you answer. I've changed test user and now the server >> sends access-accept but CPE still doesn't connect. >? Some NAS equipment will ignore Access-Accept if it doesn't contain the > right magic.? The exact definition of this magic is usually found buried > in a footnote on page 400 out of 800 of the vendor documentation. >? Go look at the NAS logs, and see if there is any useful messages. If > not, call the NAS vendor, and tell them that their product is defective. >? FreeRADIUS works with WiMAX equipment from Nokia, Cisco and Motorola. >? (That I've seen.)? Other vendors known to have problems include > Alvarion.? They don't seem to care that their equipment doesn't work, > and they haven't answered any of my messages about it. >? The only solution is to point out publicly that Alvarion is *not* > following the WiMAX specs, and therefore people should buy *real* WiMAX > equipment. >? Alan DeKok. Thank You very much. Vendor forces us to buy theirs "unique" TRIAS server aka radius. :) That costs several hundred thousands. Anyway thanks to all of you for help. -- ?????????? ?????? ????? IP ????????? __________________ ??? "Babilon - T", ???????????, ?. ???????, ?-?? ?????? 8. ????:? ? ? (992 44) 600 00 83 ?????????:? (992 918) 62 37 22 ??. ?????:? maxim(a)babilon-t.tj ------------------------------ Message: 6 Date: Mon, 18 May 2009 13:42:46 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Wimax + Freeradius To: maxim(a)babilon-t.tj,??? FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A1149B6.2090402(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Maxim Vinnichenko wrote: > Thank You very much. Vendor forces us to buy theirs "unique" TRIAS > server aka radius. :) That costs several hundred thousands. ? Dollars? ? Odds are that their product is less functional than FreeRADIUS.? It would likely be cheaper to figure out what the problem is, and to make FreeRADIUS inter-operate with the vendor. ? And what the vendor *really* meant is that they do *not* implement the standards, and they don't care.? Why not buy equipment from a vendor that is interested in making *useful* products? ? Alan DeKok. ------------------------------ Message: 7 Date: Mon, 18 May 2009 13:59:07 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: FreeRADIUS Server Version 2.1.6 has been released To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <4A114D8B.3090203(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 ? The following is the change log.? Thanks to everyone for testing the pre releases. FreeRADIUS 2.1.6 Mon May 18 10:00:00 CEST 2009;? , urgency=medium ??? Feature improvements ??? * radclient exits with 0 on successful (accept / ack), and 1 ??? ? otherwise (no response / reject) ??? * Added support for %{sql:UPDATE ..}, and insert/delete ??? ? Patch from Arran Cudbard-Bell ??? * Added sample "do not respond" policy.? See raddb/policy.conf ??? ? and raddb/sites-available/do_not_respond ??? * Cleanups to Suse spec file from Norbert Wegener ??? * New VSAs for Juniper from Bjorn Mork ??? * Include more RFC dictionaries in the default install ??? * More documentation for the WiMAX module ??? * Added "chase_referrals" and "rebind" configuration to ??? ??? ? rlm_ldap. ??? ? This helps with Active Directory.? See raddb/modules/ldap ??? * Don't load pre/post-proxy if proxying is disabled. ??? * Added %{md5:...}, which returns MD5 hash in hex. ??? * Added configurable "retry_interval" and "poll_interval" ??? ? for "detail" listeners. ??? * Added "delete_mppe_keys" configuration option to rlm_wimax. ??? ? Apparently some WiMAX clients misbehave when they see those ??? ? keys. ??? * Added experimental rlm_ruby from ??? ? http://github.com/Antti/freeradius-server/tree/master ??? * Add Tunnel attributes to ldap.attrmap ??? * Enable virtual servers to be reloaded on HUP.? For now, only ??? ? the "authorize", "authenticate", etc. processing sections are ??? ? reloaded.? Clients and "listen" sections are NOT reloaded. ??? * Updated "radwatch" script to be more robust.? See ??? ? scripts/radwatch ??? * Added certificate compatibility notes in raddb/certs/README, ??? ? for compatibility with different operating systems. (i.e. ??? ? Windows) ??? Bug fixes ??? * Minor changes to allow building without VQP. ??? * Minor fixes from John Center ??? * Fixed raddebug example ??? * Don't crash when deleting attributes via unlang ??? * Be friendlier to very fast clients ??? * Updated the "detail" listener so that it only polls once, ??? ? and not many times in a row, leaking memory each time... ??? * Update comparison for Packet-Src-IP-Address (etc.) so that ??? ? the operators other than '==' work. ??? * Did autoconf magic to work around weird libtool bug ??? * Make rlm_perl keep tags for tagged attributes in more ??? ? situations ??? * Update UID checking for radmin ??? * Added "include_length" field for TTLS.? It's needed for RFC ??? ? compliance, but not (apparently) for interoperability. ------------------------------ Message: 8 Date: Mon, 18 May 2009 14:38:06 +0200 From: "Laar van de, Johan, TNF" <Johan.van.de.Laar(a)tnf.nl> Subject: RE: Module-Success-Message / Module-Failure-Message To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: ??? <1389360D6F590C44A15A626176B599A21069F31B(a)SR-EXC-006-SON.internal.tnf.nl> ??? Content-Type: text/plain; charset="us-ascii" Ok, but there is no other variable available which can be used within a sql query in the Post-Auth section? Thanks. Johan van de Laar -----Oorspronkelijk bericht----- Van: freeradius-users-bounces+johan.van.de.laar=tnf.nl(a)lists.freeradius.org [mailto:freeradius-users-bounces+johan.van.de.laar=tnf.nl@lists.freeradius.org] Namens Alan DeKok Verzonden: maandag 18 mei 2009 13:05 Aan: FreeRadius users mailing list Onderwerp: Re: Module-Success-Message / Module-Failure-Message Laar van de, Johan, TNF wrote: > My Question is, if this is relatively easy, how can I achieve this? ? The log messages can be changed via source code edits. ? This *could* be made configurable, but that also requires source code edits. ? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 9 Date: Mon, 18 May 2009 14:21:03 +0100 From: "Jean F. Mousinho" <jean.mousinho(a)ist.utl.pt> Subject: duplicate Identity received, freeradius behaviour? To: FreeRadius users mailing list ??? <freeradius-users(a)lists.freeradius.org> Message-ID: <1242652863.1410.26.camel(a)jemos-workd.ist.utl.pt> Content-Type: text/plain Hi, I've noticed that on our radius server logs lots of "EAP state variable not found", after some packet dump analysis (also -Xf) I've noticed that one of the cases that this happened was when some EAP Identity packets are duplicated during parallel authentications (I mean, when at least one session already began from the same client, and we're receiving duplicate ). I've noticed that these duplicate packets come with just a little difference which is the Proxy-State, the duplicate packets then, in my opinion could be caused by some bad proxying implementation (client EAP Identity passing through 2 or more proxies?), or even bad load balancing. Also, we did an upgrade of one of the two proxies connected to our home radius server and somehow noticed that the amount of EAP state errors was lower in the old version (1.1.7) than in the newer (2.1.3) (although its hard to confirm that). I've tried to compare the code from 1.1.7 and 2.1.3 and didn't come to a clear conclusion if its there any special treatment to duplicate proxied packets between 1.1.7 and 2.1.3 (while proxying). Thanks for your time. Jean F. Mousinho ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 49, Issue 74 ************************************************ I want to configure for pre-paid billing system in free radius , please let me what are necessary module need to configure. ?Regards, Sachidananda Sahoo ________________________________ From: "freeradius-users-request(a)lists.freeradius.org" <freeradius-users-request(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org Sent: Monday, May 18, 2009 6:55:29 PM Subject: Freeradius-Users Digest, Vol 49, Issue 74

1 0

Re: Module-Success-Message / Module-Failure-Message
by Laar van de, Johan, TNF 18 May '09

18 May '09

Hi all, Excuse me, but I don't know how to reply to an older archived message on this list. On the 3th of April 2008 Alan DeKok replied to the message with the same subject as this mail with the following: > Are they legacy attributes ? They don't seem to be being populated. Be > really nice if they were populate with the nice new shiny Login OK / > Login Fail messages... > > Login OK: [ac221/***** (from client > hp-e-engg1-1-dev-8021x-sw1.net.susx.ac.uk port 1 cli 0080c8396796) That's relatively easy to do. Alan DeKok. My Question is, if this is relatively easy, how can I achieve this? I'm really interested in storing the 'Module-Failure-Message' (or an equivalent which explains why a request has been rejected) in my database for further use. Johan van de Laar The Network Factory

2 2

Wimax + Freeradius
by Maxim Vinnichenko 18 May '09

18 May '09

Hello Freeradius-users, We are trying to implement AAA service for WIMAX project and have some problems. Freeradius ver 2.1.3 is installed on Gentoo. The schema is this CPE >> WASN9770 GW >> RADIUS At the moment problem is the following [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for 123(a)wimax.tj with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect The test user is listed in users. But as far as I understood radius is not using users to authenticate anyone. Please help. Full debug is here http://217.11.185.178:8080/eap.log Maxim Vinnichenko.

3 5

Re:Re: checking authorization in the duration of connection
by Eric 17 May '09

17 May '09

Hi. I found how to kill online users if were above their limits in FAQ in freeradius. but the address of download is <ftp://ftp.nmo.net/pub/radkill/radkill-latest.tar.gz> I can't connect this link. could you please send me this package? does it do that I wanted?

2 1

Last chance to check the "pre" release of 2.1.6
by Alan DeKok 16 May '09

16 May '09

http://git.freeradius.org/pre/ Unless there are issues, it will become 2.1.6 on Monday. Alan DeKok.

3 7

iPlanet Schema install into Directory Server 6.3
by Urugn 16 May '09

16 May '09

Hi Guys I know this is pretty easy out there i just cant get it to work. Just a newbeee Am trying to install the doc/examples/iplanet.schema and doc/examples/iplanet.ldif into dsee6 and cant seem to get it done via ldapadd or ldapmodify. Please help

1 0