- Freeradius-Users - lists.freeradius.org

rlm_sql_mysql encoding issue
by Eric Hoeve 29 Apr '09

29 Apr '09

I am trying to setup freeradius using EAP-PEAP using a mysql backend. I seem to have most of it working, but one small issue. I have freeradius 2.1.5. This is my radcheck table: mysql> select * from radcheck; +----+--------------+--------------------+----+---------+ | id | username | attribute | op | value | +----+--------------+--------------------+----+---------+ | 1 | MACH01\testuser | Cleartext-Password | := | mysecret | +----+--------------+--------------------+----+---------+ However in the (radiusd -X) I am seeing the following: rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radchec k WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'MACH01=5Ctestuser' ORDER BY id 'MACH01\testuser' is changed to 'MACH01=5Ctestuser' and thus FR does not find it. If I change username to 'MACH01=5Ctestuser' in the radcheck table it seems to work. Is there a way to change the way rlm_sql_mysql does its encoding? So I can leave it as 'MACH01\testuser'. To save bandwidth I posted the full (radiusd -X) log at www.ehoeve.com/radius-debug.log I can provide more info as needed. TIA -Eric -- -=-=-=-=-=-=-=-=-=-=-=- Eric Hoeve Email: eric-freerad(a)ehoeve.com

3 3

checking authorization in the duration of connection
by Eric 29 Apr '09

29 Apr '09

Hi, My radius server use ldap server for authorize and authentication.I set an attribute in ldap server that is the check-name in sqlcounter to limit users Input traffic. I want when user traffic reaches to this amount the user become stop but radius checks ldap attributes only at the first of connection not in the middle. How can I set radius server check users traffic with the amount of this attribute in ldap server in the duration of connection?

4 3

want to change one module in freeradius
by new conf 29 Apr '09

29 Apr '09

Dear all; If I have to change the module in FreeRadius that uses EAP-TLS to communicate with clients(to use it with other way then openSSL (ssl will generate keys and certficate seperately in another form) ).. the function I have to delete or change is-it *rlm_eap.c* ? thank you for help :)

1 0

radiusd only sending a NAK after a retransmission
by Jeremy M. Guthrie 29 Apr '09

29 Apr '09

We are having an issue with failed logins with FreeRADIUS. The problem is that FreeRADIUS doesn't appear to actually send a RADIUS Reject until the second authentication request comes in. I have an IOS Router authenticating ssh logins against freeradius. The example packets above I am using a static username/password in the users file. I see that if I enter the wrong password, radiusd doesn't send a NAK until the IOS router transmits the request. There are not any delay issues with ACKs coming out of freeradius. TCP Dump output: 10:38:22.703456 IP 172.16.1.8.1645 > 172.16.2.60.1645: RADIUS, Access Request (1), id: 0xf1 length: 103 10:38:38.008371 IP 172.16.1.8.1645 > 172.16.2.60.1645: RADIUS, Access Request (1), id: 0xf1 length: 103 10:38:38.008588 IP 172.16.2.60.1645 > 172.16.1.8.1645: RADIUS, Access Reject (3), id: 0xf1 length: 20 Does this sound familiar to anyone? Ideas? -- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie(a)cdw.com Hosting and Managed Services Managed Cisco Security Services Technical Architect Phone: 608-298-1061 CDW Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711 NOC Email: hmshelp(a)cdw.com

2 3

Looking for client configurations for dynamic client
by Fabián Omar Franzotti 29 Apr '09

29 Apr '09

Hi guys I'm running Debian lenny... in production server I have installed freeradius 1.x and in client.conf i have seted client 0.0.0.0/0 { secret = mySecret shortname = everyone } In Debian lenny is available freeradius 2.0.4 in this version that setting for client is not available. Some time ago Alan told me that use 2.0.5 version to this settings, I did try to build a .pkg to install in my server but never can done it, because i did have some errors and my knowledge are not enought. Well I want to know if some one can tell me how i can have clients that don't have static IP's if I don't allow access to every world, because nas database is loaded only at startup time. I think i can use dynDNS or something like that, so I can declare the host.name and not IP address, but I want to know if exists some way to handle this case. Ah the clientes can be added by it self with a register page. Any Idea? Thanks guys... ----- Fabián Omar Franzotti Resistencia - Chaco - Argentina Tel Arg.: 54-(372)-243-8710 / 54-(372)-257-0347 USA Phone: 1-(321)-284-3865

3 2

Vendor Specified Attribute
by Tseveendorj 29 Apr '09

29 Apr '09

Hello, Can I put one attribute in database like following 256Kbps Cisco-AVPair := ip:sub-policy-Out=256Kbps 256Kbps Cisco-AVPair := ip:sub-policy-In=256Kbps If not. How do I define bandwidth shape both in and out ? Sincerely, Tseveen

2 2

freeradius upgrade help
by ramesh p 29 Apr '09

29 Apr '09

I'm currently using freeradius version 1.1.6, planning to upgrdate to a stable version. Please suggest a version which is stable. My radius box running linux. Thanks in advance. Regards, Rams.

2 1

groupcmp fails during tunneled request
by Matthieu Lazaro 28 Apr '09

28 Apr '09

Hello list, I'm having an issue with the group check (ldap_groupcmp). Everything is fine until the request is tunnelled, and I can't find out why my user is rejected there.... It seems that he ends in this section during this phase: DEFAULT Ldap-Group == BANNED , Auth-Type := Reject Reply-Message = "Account disabled. Please call the helpdesk." Even if he has the correct group in the LDAP. This was working on my test bed. The configuration seems to be the same, the only change is the NAS type ( I have tested that on HP switches, and now it's using a Cisco Wireless controller). It was working perfectly before I introduced the group check using the huntgroups. I'm using version 2.1.1 of freeradius on an Debian etch box. Here is the part of the debug where it fails. Sending tunneled request EAP-Message = 0x020f000b01676269676f74 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "alicebob" Calling-Station-Id = "00-13-02-25-FF-40" Called-Station-Id = "00-1E-13-1D-85-70:WiFi-TEST" NAS-Port = 1 NAS-IP-Address = 192.168.226.8 NAS-Identifier = "accessPoint-Manager" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "502" server inner-tunnel { Tue Apr 28 11:42:35 2009 : Info: +- entering group authorize {...} Tue Apr 28 11:42:35 2009 : Info: ++[mschap] returns noop Tue Apr 28 11:42:35 2009 : Info: [suffix] No '@' in User-Name = "alicebob", looking up realm NULL Tue Apr 28 11:42:35 2009 : Info: [suffix] No such realm "NULL" Tue Apr 28 11:42:35 2009 : Info: ++[suffix] returns noop Tue Apr 28 11:42:35 2009 : Info: [eap] EAP packet type response id 15 length 11 Tue Apr 28 11:42:35 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Apr 28 11:42:35 2009 : Info: ++[eap] returns updated Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: Entering ldap_groupcmp() Tue Apr 28 11:42:35 2009 : Info: [files] expand: dc=companyname,dc=com -> dc=companyname,dc=com Tue Apr 28 11:42:35 2009 : Info: [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Tue Apr 28 11:42:35 2009 : Info: [files] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=alicebob) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: performing search in dc=companyname,dc=com, with filter (uid=alicebob) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Apr 28 11:42:35 2009 : Info: [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: performing search in dc=companyname,dc=com, with filter (&(radiusGroupName=BANNED)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: object not found or got ambiguous search result Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: performing search in uid=alicebob,ou=people,dc=companyname,dc=com, with filter (objectclass=*) Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap::groupcmp: Group BANNED not found or user not a member Tue Apr 28 11:42:35 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Apr 28 11:42:35 2009 : Info: [files] users: Matched entry DEFAULT at line 15 Tue Apr 28 11:42:35 2009 : Info: ++[files] returns ok Tell me if you need more debug output... Best regards, Matt

2 2

cange username in mysql auth
by Trujillo Carmona, Antonio 28 Apr '09

28 Apr '09

Hello and thank for all your work. Right now I'm try to use freeradius to validate access to our net throw a MAC auth. Our problem is that we have a inventory (in mysql) of printers with a field named MACADDR and we want check this field in order to grant access to the printers. How can we change the the sql query to check "MACADDR" instead of "username"? -- Por favor, NO utilice formatos de archivo propietarios para el intercambio de documentos, como DOC y XLS, sino HTML, RTF, TXT, CSV o cualquier otro que no obligue a utilizar un programa de un fabricante concreto para tratar la información contenida en él. SALUD.

2 1

problems with some libraires
by Ernesto Cadiz 28 Apr '09

28 Apr '09

hi there, my name is Ernesto from Chile and i'm doing my final project using a RADIUS server. I'm writing because i have some troubles to start the server. I use Debian Lenny and the output of the debug is this: *casa:/usr/local/etc/raddb# radiusd -X radiusd: error while loading shared libraries: libfreeradius-radius-2.1.5.so: cannot open shared object file: No such file or directory* i know that i have to point to the right directions of where are the libraries, but i don't have so much experience using linux, and if you could give me some info to fix the problem it would be nice. Best regards and thanks for the help. Ernesto Cádiz Lara.

5 6