- Freeradius-Users - lists.freeradius.org

Help for radius configuration
by Basant Agarwal 13 Apr '09

13 Apr '09

Hello , I want to install freeradius server for the authentic wifi users , whose database is stored in ldap server ..Users who will use the wifi are mostly windows xp /vista users. what i have tried: (1) Install openssl by apt-get install command ... (Also By the source code by the commands ./configure make make make install) (2) installed freeradius-1.1.7 ./configure make make install (3) used default configuration and added one entry in the users file .. (Also tried for installing with apt-get install freeradius freeradius-ldap freeradius-eappeap .. ) It worked well with radtest from localhost .. But when i try from laptop ..it does not work .. After That i tried to configure eap type peap since i came to know that windows xp /vista support EAP/PEAP for wifi authentication . with this configuration also radtest works well ...but from laptop it does not work (4) I receive the following request from AP Message-Authenticator = 0x3f459af06e42a2a0b7cf9c1d80092e31 Service-Type = Framed-User User-Name = "testap" Framed-MTU = 1488 Called-Station-Id = "00-15-E9-C9-F3-80:MNIT-DC-AP" Calling-Station-Id = "00-16-6F-7C-DB-2D" NAS-Identifier = "D-link Corp. Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b01746573746170 NAS-IP-Address = 172.16.1.80 NAS-Port = 1 NAS-Port-Id = "STA port # 1" I want to ask you that how radius server with get authentic the user since it is not getting user password or hashed password ..?? (4) I have tried all the above process for the freearadius-2.1.4 also , (When i try to install freeradius-2.1.4 it does not include eap/peap even i have installed openssl previously ... No problem with freeradius-1.1.7) I have tried all installation on debian/ubuntu/deepofix. I want to ask .. Is this compulsory to configure EAP/PEAP since our end users would have windows xp/ vista ..?? what will be basic configuration ..?? I am sorry .. i am not posting any debug output here .. reason is -- i have been posted those already , got solutions for that but still i am not getting things working.. probably i got things wrong hence i am posting all things which i need .. Please give your views on what i have understood wrong ..!! and what should i do ..?? Please provide me the steps for this scenario ...!!!

2 1

no entries in radacct
by John Millican 13 Apr '09

13 Apr '09

Complete Newb to FreeRadius here. I have: radiusd -v radiusd: FreeRADIUS Version 2.1.5, for host x86_64-unknown-linux-gnu, built on Apr 1 2009 at 15:51:57 built from freeradius-server-2.1.4.tar.gz on an OpenSuSE 10.X server using postgresql 8.3.3 Authorize works well, all my NAS info is in the NAS table, and I have dial up clients using now on a very limited basis. My problem is that I can not get the accounting to work in postgres, my radacct table is empty. Everything I have read has said to put sql in the accounting section and I have done this. I also uncommented the section: $INCLUDE sql/${database}/dialup.conf At the end of the log file I have this: radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr /usr/local/etc/raddb/modules/counter[71]: Failed to link to module 'rlm_counter': rlm_counter.so: cannot open shared object file: No such file or directory Errors initializing modules I "assume" this is my problem? I did a find for rlm_counter.so and, guess what, it was not found. I then looked for just rlm_counter and it was found in freeradius-server-2.1.4/src/modules/rlm_counter from the tarball. I did read a list post from back in October of 2002 that talked about libtool not working well on SuSE, not sure if this is still the case. Any pointers? Am I going down the wrong road? Is there anything else that is glaringly missing? Any other relevant info I need to add here to aid in getting help? Thanks for any help. -- JohnM

3 4

Looking to pay someone for a customization
by Eric Geier 13 Apr '09

13 Apr '09

Hi, if anyone is interested in customizing the source code for me, please check out either site: http://www.getacoder.com/projects/c_developer_radius_expe_102912.html http://www.odesk.com/jobs/Developer-with-RADIUS-Experience_~~f48a82c177d7e1b 3?tot=129&pos=7 I would like FreeRADIUS to check incoming requests based upon the domain (derived from the username), instead of the NAS IP addresses. Thanks! Eric

1 0

Offloading password verification
by Phil Meech 13 Apr '09

13 Apr '09

Hi All, I'm running version 1.18 currently on Ubuntu 2.6.24-19-server; configured to use MYSQL for all auth and accounting requests. I have been asked to move the password verification away from MySQL and use an external username/password DB (managed by another company), for which my only method of access is an http API (given a username and password the API returns either 1 or 0). All attributes will still be held in the current MySQL freeradius DB; and all the users that exist in the API DB will also exist in the same current MySQL DB. The password is passed as PAP through to freeradius currently from the NAS devices, and the API also expects a plaintext password. I was thinking I could use the perl module to achieve this; but am a little lost with where to start (writing the perl script is fine). I guess the point of my post is how to keep all the attributes in MySQL and only offload the password to the API; and where this change would fit in to the radiusd.conf file? Any advice would be gratefully received. Many Thanks, Phil

3 2

dynamic ip address allocation problem for wifi system
by kalesameer 13 Apr '09

13 Apr '09

I have implemented a wifi authentication system wherein users authenticate themselves using their username and password. I am using EAP-PEAP for this purpose.Further, I want to assign ip addresses to the users dynamically.From whatever documentation i have read, I gather that using rlm_ippool module does not work for EAP authentication.Also,FreeRADIUS does not support DHCP fully. I am using OpenLDAP as a database which stores entries of all the users authorised to use the wireless system.FreeRADIUS version is 2.1.1. So,first of all,am I correct in saying that rlm_ippool cannot be used with EAP authentication for assigning ip addresses to clients(not access points but end users of wifi system)?Also,is there any patch or sample code available for allocating ip addresses dynamically using DHCP?And if both the above methods are not possible, then is there any other way to assign ip addresses to clients dynamically? -- View this message in context: http://www.nabble.com/dynamic-ip-address-allocation-problem-for-wifi-system… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

rlm_perl don't support tagged attributes
by Igor Belikov 13 Apr '09

13 Apr '09

Hello Freeradius-users, FreeRADIUS Version 2.1.5 (it was downloaded as 2.1.4, but it writes about itself as 2.1.5) Portion from "radiusd -X" output Module: Linked to module rlm_perl Module: Instantiating erxlogontime perl erxlogontime { module = "/usr/local/freeradius-2.1.4/etc/raddb/servicelogintime.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth_erx" } File servicelogintime.pl use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle post_auth sub post_auth_erx { &radiusd::radlog(1, "***** custom post_auth procedure *****"); # For debugging purposes only #&log_request_attributes; #for (keys %RAD_REPLY) #{ # &radiusd::radlog(1, "RAD_REPLY: $_ = $RAD_REPLY{$_}"); #} return RLM_MODULE_NOOP; } procedure post_auth_erx executed as expected portion from debug output: +- entering group post-auth {...} GOT CLONE -1212740928 0x82bbaf0 rlm_perl: ***** custom post_auth procedure ***** but after returning from post_auth_erx all tags from attributes are resetted to zero: Sending Access-Accept of id 186 to 192.168.100.73 port 60654 ERX-Service-Login-Time:0 = "Al1800-2359,Al0000-0859" ERX-Qos-Profile-Name = "SP_WCL" ERX-Qos-Parameters += "world_value 1000000" ERX-Qos-Parameters += "assure_world_value 100000" ERX-Qos-Parameters += "city_value 10000000" ERX-Service-Statistics:0 += time-volume ERX-Service-Statistics:0 += time-volume ERX-Service-Activate:0 += "world(1000000)" ERX-Service-Activate:0 += "city(10000000)" ERX-Service-Activate:0 += "deny" ERX-Service-Interim-Acct-Interval:0 += 600 ERX-Service-Interim-Acct-Interval:0 += 600 If we comment out module servicelogintime.pl, we receive correct tagged attributes: Sending Access-Accept of id 154 to 192.168.100.73 port 65168 ERX-Service-Login-Time:1 = "Al1800-2359,Al0000-0859" ERX-Service-Activate:1 += "world(1000000)" ERX-Service-Statistics:1 += time-volume ERX-Service-Interim-Acct-Interval:1 += 600 ERX-Qos-Parameters += "world_value 1000000" ERX-Qos-Parameters += "assure_world_value 100000" ERX-Service-Activate:2 += "city(10000000)" ERX-Service-Statistics:2 += time-volume ERX-Service-Interim-Acct-Interval:2 += 600 ERX-Qos-Parameters += "city_value 10000000" ERX-Service-Activate:3 += "deny" ERX-Qos-Profile-Name = "SP_WCL" -- Best regards, Igor mailto:ivb@is.ua

1 0

Log and datatime
by peppeska 13 Apr '09

13 Apr '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 is possible to log the date and time of connection and disconnection of each user? - -- <<<<---------------------------------------------------------->>>> |Giuseppe Moscato aka peppeska - Linux User - no html messages---| |ggippone(a)yahoo.it --------- http://peppeska.altervista.org------| |Fingerprint = 90DC 05A8 2D65 BC04 BD1B 4C07 C389 434B 3201 319D| <<<<---------------------------------------------------------->>>> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkni/rQACgkQkA6hcnFZI/a1XACg1Y3VkjixKecvn9SYtOxWVNdE YtYAoJZKm27pygq7LcmkSF1dWgg4ERYZ =Tdgk -----END PGP SIGNATURE-----

2 1

Handling of duplicates in clients.conf
by Garber, Neal 13 Apr '09

13 Apr '09

I'm running FR 2.0.3 and I just found that if there is more than one client with the same IP address in clients.conf, then it will stop processing the remainder of the file and continue startup. The only indication it has done this are 2 error messages that are easily missed when running with debug on. I checked git.freeradius.org and noticed that the client.c committed on 09-March now ignores duplicates if they are exactly the same. In my case, everything was the same except the name. My question is, wouldn't it be better to continue processing the remainder of the file even when there are duplicates that aren't identical or alternatively to preclude the server from starting (I'd vote for the former). Ignoring what could be hundreds of clients that follow the error doesn't seem useful. I propose ignoring all duplicates and having client_add return ok (1). This would log the error for any duplicates (even duplicates that aren't completely identical), but allow processing to continue for the remainder of the file.

5 12

Re: billing using radius
by Eric 13 Apr '09

13 Apr '09

> > Thanks parham, I'm new in freeradius. could you please send me configs needed in freeradius files? I want to disconnect some users after receiving 8G and for others I want to calculate base on KB that they have used rather than 8G. In which file I should do changes? > > > Message: 1 > Date: Sun, 12 Apr 2009 14:45:21 +0430 > From: "Parham Beheshti" <p_beheshti(a)rasana.net> > Subject: RE: billing using radius > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org>, > <freeradius-users(a)lists.freeradius.org> > Message-ID: <ED57DEBBACDAFF43A9ABD14FF9CBD1E82BB823(a)mail.rasana.ir> > Content-Type: text/plain; charset="iso-8859-1" > > Hello, > Well, this can be very simple ... or very complicated ... > I'm doing traffic based accounting with freeradius and have been more then > happy. > Our scenario is pretty complicated, it involves different pricing KB for > day of week/time of day, users are able to purchase additional credit,etc. > to get you started: > > 1. you can get user's traffic (acctinputoctets+acctoutputoctets) for a > given time period and don't let the user login next time he/she wants to > access the service. This will take care of not letting users over the quota > to login... > > 2. you can check your online users periodically send COA (Disconnect > packet) if user's traffic is above your limit... > > 3. you may have very long sessions(days, weeks or months) that cross > bounderies for example: 10GB/week and have sessions longer then week. to > solve this issue you need to have interim-update packets from your NAS, the > nas will send you packets regularly... use this against your old data to > calculate how much traffic was used. create a daily traffic table and update > it with calculated amount. use counters based on the dailytraffic. > > depending on number of users you have you may need to partition your daily > traffic table. > > this solution scales pretty good: > we have about 50,000 broadband users, 5 minute interim-update and we have > hourly and daily traffic information tables. we are no where near our limits > and freeradius/mysql is scaling very well. (10% load) > > You will be better off to do all this calculation in stored procedures > instead of queries ... > Let me know if you need more info > > Cheers, > Parham > > > ------------------------------------------------------------------------------------------ > > > Hi, > I use freeradius server for accounting of vpn users.I use monthly counter > to limit users but now I want if user's traffic is rather than specific > amount, I will be able to have billing for them and to disconnect some of > them. Is it possible to have billing with config in freeradius or a new > software is needed? > could radius disconnect users based on amount of traffic not counters? > > > > End of Freeradius-Users Digest, Vol 48, Issue 48 > ************************************************ >

1 0

Help userpassword attribute requird
by Basant Agarwal 12 Apr '09

12 Apr '09

Hello, I am using freeradius-1.1.7 . i am using the default configuration with a local user whose entry is in users file . now when i try from localhost it works.. But when i try from laptop it shows error that user password attribute requird ..!!! what should i do...? rad_recv: Access-Request packet from host 172.16.1.205:3072, id=0, length=125 User-Name = "basant" NAS-IP-Address = 172.16.1.205 Called-Station-Id = "001a70aa5bee" Calling-Station-Id = "001b777bdffa" NAS-Identifier = "001a70aa5bee" NAS-Port = 30 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000b01626173616e74 Message-Authenticator = 0xda9d5f6bde06b199a7cbb321e26604cc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "basant", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry basant at line 100 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 172.16.1.205 port 3072 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 49dffaf3 Nothing to do. Sleeping until we see a request.

2 1