- Freeradius-Users - lists.freeradius.org

Re: authentication failed because sqlcounter...
by Nizar Zulmi 13 May '09

13 May '09

the problem solved it just because 30 second less than one minute, i've tried using Max-All-Sesion:=3600 and it works.. --- On Sat, 5/9/09, Nizar Zulmi <siapa_bilang_emailku_panjang(a)yahoo.com> wrote: From: Nizar Zulmi <siapa_bilang_emailku_panjang(a)yahoo.com> Subject: Re: authentication failed because sqlcounter... To: tnt(a)kalik.net, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Saturday, May 9, 2009, 2:03 PM i am using freeradius 1.1.7, not that old rite??? i've tried using := operator and cleartext-password but still doesn't work..this bellow is my radcheck table.. +----+----------+--------------------+----+--------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+--------+ | 1 | nizar | Password | == | nizar | | 2 | nizar1 | Password | == | nizar1 | | 6 | tes | Max-All-Session | == | 90 | | 4 | tes | Password | == | tes | | 7 | denizaro | Cleartext-Password | := | 123456 | | 8 | denizaro | Max-All-Session | := | 30 | +----+----------+--------------------+----+--------+ 6 rows in set (0.00 sec) i try to log in with user denizaro first time before i add attribute max-all-session its succesfully logged in, but after i adding max-all-session attribut its failed.. whats happen?? --- On Sat, 5/9/09, Ivan Kalik <tnt(a)kalik.net> wrote: From: Ivan Kalik <tnt(a)kalik.net> Subject: Re: authentication failed because sqlcounter... To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Saturday, May 9, 2009, 2:51 AM > mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it > as default no change i made in noresetcounter module. then i adding > noresetcounter in authorize and instantiate section. > i have defined 1user named tes and password tes has loged in normally > before i add attribut max-all-session in the table radcheck just like > this. > +----+----------+-----------------+----+--------+ > | id | UserName | Attribute | op | Value | > +----+----------+-----------------+----+--------+ > | 1 | nizar | Password | == | nizar | > | 2 | nizar1 | Password | == | nizar1 | > | 6 | tes | Max-All-Session | == | 90 | > | 4 | tes | Password | == | tes | > +----+----------+-----------------+----+--------+ > after i adding the attribut max-all-session the user tes cannot login > anymore. i do running freeradius in debug mode and the following si the > result.. := not ==. And that password attribute Password is deprecated for many years. How old is your freeradius version? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PAP password
by Doug Hardie 13 May '09

13 May '09

V 2.1.5. I am having a problem with PAP not using the proper user id. IF the user id is just a plain <user_id> then it works properly. However, I have some realms setup that have prefixes and suffixes e.g., DUB+<user_id>@lafn. PAP is trying to find the user_id DUB+<user_id>@lafn rather than the stripped user id <user_id> and hence it doesn't find a password for the user. Everything works just fine if I add Auth-Type := Accept to the users file, but thats not a great way to run a railroad. Obviously I missed something. hints has: DEFAULT Prefix == "DUB+", Suffix == "@lafn", Strip-User-Name = Yes Hint = "SlipStream" What have I missed?

3 6

MySQL radacct backup
by sub 13 May '09

13 May '09

Hello everybody, I've a full working freeradius server on an Ubuntu server. My accounting table grows and grows so I'd like to backup my data in any way; before I write my own procedure, does the server (freeradius) provide any utility? I've looked in the config but I've not found anything useful. Basically, this would be something different from a simple MySQL Database backup as I'll have to keep info about the total AcctSessionTime of every user. Thanks! -- sub

5 5

radius client on fedora 10 ?
by François Mehault 13 May '09

13 May '09

Hi, I would like to know is there any radius client on fedora 10 ? pam_radius ? other ? Regards, François

2 1

IPSEC-tunnell from FreeRadius to WLC Cisco
by Saleh Abuzid 13 May '09

13 May '09

Our university college (HiST) is trying to establish an IPSec tunnel between a FreeRadius server using Openswan OpenSwan 2.4.12 and a Cisco WLC running 4.2.173.00. To start the IPSec negotiation we need RSA-keys at both ends of the tunnel ( freeradius, WLC Cisco), or Pre-shared keys (PSK). Case 1: On the Freeradius Server we two pairs of keys on the command line as follows: - Keypair for the FreeRadius-server: Freradiushost# ipsec newhostkey --hostname "FreeRadius" -output /etc/ipsec.secrets -bits 1024. - Keypair for the wlc: Freradiushost# ipsec newhostkey -hostname "wlcname" -output "RSAKeyFileName" -bits 1024 However, the WLC doesn't accept the RSA keys generated. The file produced looks like this: : RSA { # RSA 1024 bits "wlcname" etc. # for signatures only etc. #pubkey=xxxxxxx Modulus: xxxx PublicExponent: xxx #everything after this point is secret PrivateExponent: xxx Prime1: xxxx Prime2: xxxx Exponent1: xxxx Exponent2: xxxx Coefficient: xxxx } We try to paste the wlc's keys into the web interface under the menu Security, Advanced, CA Certificate, IPSec Certs. But, to no avail, the page at "ip-number of wlc" says: Error in setting Certificate". How should we generate the RSA keys in OpenSwan in order to get them into the Cisco WLC? Case 2: We have also tried to use Pre-shared keys. But alas, the Cisco WLC doesn't respond to the request from Freeradius Server. How should these PSK's be formed and what settings should be used? Any configuration examples of IPSEC on the OpenSwan, or generic explanations would be welcome as well. Shared Secret Format: ASCII Shared Secret: <same as on OpenSwan> Key Wrap: <not used> Port Number: 1812 Server Status: Enabled Support for RFC 3576 : Enabled Server Timeout: 2 seconds Network User: Enable Management: Enable IPSec Enable IPsec Parameters IPSec: HMAC SHA1 IPSEC Encryption: AES CBS (Shared Secret will be used as the Preshared Key) IKE Phase 1 Aggressive (tried main as well, with corresponding settings in OpenSwan) Lifetime (seconds) 28800 IKE Diffie Hellman Group Group 2 (1024 bits) Remarks: I would like to mention two tings: The path is open between FreeRadius server and WLC Cisco. The FreeRadius server was tested with other Linux IPSec tunnels, and this worked flawlessly. The setup of the FreeRadius is changed in each case to correspond with settings on the WLC. Looking forward to getting help from you! P.S.: It seems that IPSEC tunnels vs. WLCs is not what's easy to get help with; we've contacted several major Norwegian consulting firms with little or no response. Regards Saleh Abuzid Dept. engineer, Dept. of servers- and networks, HiST - Sor-Trondelag University College (www.hist.no <http://www.hist.no/> ) Phone: ++47 73559672 E-mail: Saleh.Abuzid(a)hist.no Saleh Abuzid Gunnerus gate 1 Høgskolen i Sør-Trøndlag (HiST) SPO-IKT Avdelingsingeniør tlf: 73559672 E-mail: Saleh.Abuzid(a)hist.no

2 1

Re: Upgrading freeradius from source
by Ming-Ching Tiew 13 May '09

13 May '09

--- On Tue, 5/12/09, John Dennis <jdennis(a)redhat.com> wrote: > > I think you'll save yourself a lot of headaches if you > stick with RPM > based packages. If the version of FreeRADIUS is not > available as an RPM > for the version of the distro you're using then you can > find > instructions for how to download, build and install the > *RPM* for a > current version here: > > http://wiki.freeradius.org/Red_Hat_FAQ > > I can't find a SOURCE RPM for 2.1.4 yet for fedora. I tried one of those 2.1.3 rpm, it works perfectly on my older fedora distro, even though it seem to indicate that they are for newer fedora. So I guess I have to wait a little longer. Regards.

4 3

FreeRadius and logwatch
by Matthieu Lazaro 13 May '09

13 May '09

Hello forum, Just wondering if someone found or had written perl scripts for logwatch so that we can send the logs all tidy?? Asking this in case I missed something or if someone had this in it's drawer! I'm going to post this as well to the logwatch mailing. Best regards, Matt

1 1

Re: Upgrading freeradius from source
by Ming-Ching Tiew 13 May '09

13 May '09

--- On Wed, 5/13/09, Ivan Kalik <tnt(a)kalik.net> wrote: > From: Ivan Kalik <tnt(a)kalik.net> > Subject: Re: Upgrading freeradius from source > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Date: Wednesday, May 13, 2009, 9:06 AM > 2.1.4/2.1.5 release had identity > crises. 2.1.8. will be available in > matter of days. It's on pre-release testing. > > Catching up with releases is always a never ending game, and each version can take up a lot of resources to prove to be stable for production use. Are there major defects with 2.1.4 which resulting in quick subsequent new releases ? Regards.

1 0

Date/Time inside the log file in each request
by Selcuk COSAN 13 May '09

13 May '09

> Hi > > We are running FreeRADIUS Version 2.1.5 using "radiusd -xx" command. > Is it possible to make date/time written into radius.log file without using -X parameter in each request line? > Because " -X " points " -sfxx " and we do not want to use -s parameter. > > Thanks > > > Selcuk COSAN >

2 1

Re: Add users without restarting radiusd
by ournixnation＠gmail.com 13 May '09

13 May '09

I am fairly new to radius and would like to know if you could explain how I would go about this: "In 2.1.x, you can HUP the server, and it will reload the users file."

2 2