- Freeradius-Users - lists.freeradius.org

mrtg module for FreeRADIUS
by Tseveendorj 07 Apr '09

07 Apr '09

Hello, Does FreeRADIUS have mrtg module for monitoring bandwidth usage? Sincerely, Tseveen.

4 3

Problem with rlm_perl
by Волошин Вячеслав 07 Apr '09

07 Apr '09

Hello. Config: perl auth_perl_pppoe { module = /var/www/radius/radius_auth.pl func_accounting = accounting } perl acc_perl_pppoe { module = /var/www/radius/radius_accounting.pl func_authenticate = authenticate } ----------------------------------------------------------------- authenticate { Auth-Type PPPOE_AUTH { auth_perl_pppoe } } # # Accounting. Log the accounting data. # accounting { Acct-Type PPPOE_ACC { acc_perl_pppoe } detail unix radutmp } this error in radiusd -X: rad_recv: Access-Request packet from host 93.95.41.141 port 53773, id=8, length=146 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" CHAP-Challenge = 0x3b30fc1959ca610275bdc66582b579cf CHAP-Password = 0x013e0573332525cd3ebc797dbe68f0969d NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "pppoe_test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[mschap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 1 [files] users: Matched entry DEFAULT at line 7 [files] users: Matched entry DEFAULT at line 19 ++[files] returns ok ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = PPPOE_AUTH +- entering group PPPOE_AUTH {...} GOT CLONE -1209066800 0x91011d8 rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair CHAP-Password = 0x013e0573332525cd3ebc797dbe68f0969d rlm_perl: Added pair Huntgroup-Name = ntk_pppoe rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Called-Station-Id = internet rlm_perl: Added pair Calling-Station-Id = 00:13:77:60:60:CB rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = pppoe_test rlm_perl: Added pair CHAP-Challenge = 0x3b30fc1959ca610275bdc66582b579cf rlm_perl: Added pair NAS-Identifier = ntk-hsgw rlm_perl: Added pair NAS-IP-Address = 93.95.41.141 rlm_perl: Added pair NAS-Port = 100 rlm_perl: Added pair NAS-Port-Id = e2_v15 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Class = dialup rlm_perl: Added pair Mikrotik-Rate-Limit = 256k rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Auth-Type = PPPOE_AUTH ++[auth_perl_pppoe] returns ok Login OK: [pppoe_test] (from client ntk-hsgw port 100 cli 00:13:77:60:60:CB) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 8 to 93.95.41.141 port 53773 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6469616c7570 Mikrotik-Rate-Limit = "256k" Framed-Compression = Van-Jacobson-TCP-IP Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 93.95.41.141 port 57551, id=9, length=157 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" Class = 0x6469616c7570 Acct-Session-Id = "8170005c" Framed-IP-Address = 93.95.42.63 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2009 17:07:22 MSD" Acct-Status-Type = Start NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 100,Client-IP-Address = 93.95.41.141,NAS-IP-Address = 93.95.41.141,Acct-Session-Id = "8170005c",User-Name = "pppoe_test"' [acct_unique] Acct-Unique-Session-ID = "de65ab6044a69020". ++[acct_unique] returns ok [files] acct_users: Matched entry DEFAULT at line 29 ++[files] returns ok Found Acct-Type PPPOE_ACC +- entering group PPPOE_ACC {...} rlm_perl: perl_embed:: module = /var/www/radius/radius_accounting.pl , func = accounting exit status= Undefined subroutine &main::accounting called. Use of uninitialized value. rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Acct-Session-Id = 8170005c rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Acct-Unique-Session-Id = de65ab6044a69020 rlm_perl: Added pair Called-Station-Id = internet rlm_perl: Added pair Acct-Authentic = RADIUS rlm_perl: Added pair Acct-Status-Type = Start rlm_perl: Added pair NAS-IP-Address = 93.95.41.141 rlm_perl: Added pair NAS-Port-Id = e2_v15 rlm_perl: Added pair Huntgroup-Name = ntk_pppoe rlm_perl: Added pair Calling-Station-Id = 00:13:77:60:60:CB rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = pppoe_test rlm_perl: Added pair Event-Timestamp = Apr 7 2009 17:07:22 MSD rlm_perl: Added pair NAS-Identifier = ntk-hsgw rlm_perl: Added pair Framed-IP-Address = 93.95.42.63 rlm_perl: Added pair Class = 0x6469616c7570 rlm_perl: Added pair NAS-Port = 100 rlm_perl: Added pair Acct-Delay-Time = 0 rlm_perl: Added pair Acct-Type = PPPOE_ACC ++[acc_perl_pppoe] returns reject Finished request 1. Cleaning up request 1 ID 9 with timestamp +8 Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 93.95.41.141 port 57551, id=9, length=157 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 100 NAS-Port-Type = Ethernet User-Name = "pppoe_test" Calling-Station-Id = "00:13:77:60:60:CB" Called-Station-Id = "internet" NAS-Port-Id = "e2_v15" Class = 0x6469616c7570 Acct-Session-Id = "8170005c" Framed-IP-Address = 93.95.42.63 Acct-Authentic = RADIUS Event-Timestamp = "Apr 7 2009 17:07:22 MSD" Acct-Status-Type = Start NAS-Identifier = "ntk-hsgw" NAS-IP-Address = 93.95.41.141 Acct-Delay-Time = 4 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 100,Client-IP-Address = 93.95.41.141,NAS-IP-Address = 93.95.41.141,Acct-Session-Id = "8170005c",User-Name = "pppoe_test"' [acct_unique] Acct-Unique-Session-ID = "de65ab6044a69020". ++[acct_unique] returns ok [files] acct_users: Matched entry DEFAULT at line 29 ++[files] returns ok Found Acct-Type PPPOE_ACC +- entering group PPPOE_ACC {...} rlm_perl: perl_embed:: module = /var/www/radius/radius_accounting.pl , func = accounting exit status= Undefined subroutine &main::accounting called. Segmentation fault But accounting exist in /var/www/radius/radius_accounting.pl. Why it? Formula+ LTD, т.(8617) 61-02-01 ф.(8617) 61-34-16 м.(918) 634-7550 voloshin(a)maks.net www.formulaplus.ru

1 0

Unable to find module....
by Bryan Graham 07 Apr '09

07 Apr '09

I'm using freeradius 2.1.4, hand compiled, and running on Solaris 10, in a zone. I have attr_rewrite in my authorize { } section of the sites-enabled/default. A raidusd -X shows the following (relevant) lines: including configuration file /opt/csg/etc/raddb/modules/attr_rewrite . . conns: 87848 /opt/csg/etc/raddb/sites-enabled/default[198]: Failed to find module "attr_rewrite". /opt/csg/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. } Errors initializing modules Now, the attr_rewrite libraries ARE in /opt/csg/lib with the other modules, and I should mention that I have been using ldap and kerberos just fine before this, so I doubt that this is a generic library location issue. Any ideas why it can't find this specific module? thanks, Bryan Graham

2 1

need help & advice getting started with freeradius
by daniel knox 06 Apr '09

06 Apr '09

Hello everyone, this is my first time getting started with freeradius. I implement ICT at a local school and I would like to improve our wireless from a WPA pre-share key to a radius based system. We have an openldap server already with all our users and groups and use them to authticate them into our clients. I would like to extend this username and password requirement to our wireless systems rather than having to give out our wireless key. Our wireless users have a variety of Windows, OSX and Linux machines. Free-radius therefore seems to be the idea solution to this. First up i have read this guide: http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch31_:_Cent… get me started on the idea of ldap and radius. Next up ive read this guide: http://ubuntuforums.org/archive/index.php/t-478804.html which works on the idea of PEAP. In my scenario I would like to use PEAP if possible but not require the user client to have a certificate, just the radius-server (which is why i believe the TTLS solution will be in-efficient here as i would have to deal with handy out client certificates to hundreds of users). And to be asked thern their username and password to authticate onto our wireless. Would combining these two guides work to get these two intial sets up and running? Second up how can i then extend this system so that i can ban specific users and groups from the wireless system. Obviously i could remove them from ldap but I would like to be able to have the flexibility to prevent a user using the wireless but to still be able to log onto one of our terminals. I believe in your FAQ article the section How do I deny access to a specific user, or group of users? would do this definatly for the user. If i make sure I add the user specifically before it goes onto the ldap auth. However how can i get it to deny access to ldap groups from this? Any help / guides online which you think will help me get pointed in the right direction would be super. Many Thanks.

5 10

RE: Problems in redudant ldap and authorization.
by Ville Leinonen 06 Apr '09

06 Apr '09

Hi, I try to stop authorization proccess if user is not found in ldap. If it's found then eap-tls is allowed. Br, Ville -----Original Message----- From: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 06/04/2009 14:45 To: FreeRadius users mailing list Subject: Re: Problems in redudant ldap and authorization. Ville Leinonen wrote: > I have a little problem in my radius configuration in my > redudant ldap section rad ver is 2.1.5. > > redundant { > ldap-srv1 > ldap-srv2 > notfound = reject > } That is not the correct format. It does not follow any of the examples or documentation. > Any suggestion what is wrong in my configuration? What are you trying to do? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

[Wimax TTLS with Alcatel - Lucent ASN GW]
by Thomas Fagart 06 Apr '09

06 Apr '09

Hello, First thanks again for this new release that adds very interesting features for debug, specially raddebug and radmin. Using basic setup, Freeradius successfully authenticate request coming from CPE Wimax through ASN Alcatel GW (called WAC) using EAP/TTLS Fri Apr 3 01:05:10 2009 : Auth: Login OK: [00210400E0D7(a)test.fr/<via Auth-Type = EAP>] (from client wimax port 0 cli 00-21-04-00-E0-D7) Fri Apr 3 01:05:19 2009 : Auth: Login OK: [cpe2-lab(a)test.fr/<via Auth-Type = mschap>] (from client wimax port 0 via TLS tunnel) I now have 2 issues to fill properly the access accept with correct attribute. (This needs might be weird, but it is the way this ASN GW works) 1. I would like that the outer access accept contains attributes coming from the inner access accept So I tried to use the update outer.reply on post-auth section of the inner-tunnel virtual server update outer.reply { #User-Name = "%{request:User-Name}" WiMAX-Packet-Data-Flow-Id = "%{request:WiMAX-Packet-Data-Flow-Id}" } But as I understand, you can only use "request" from the inner tunnel, but not the attribute contained in the reply of the inner tunnel. Is that true ? Is there a way to do that. To be more precise this is the reply in the inner tunnel Fri Apr 3 01:13:33 2009 Packet-Type = Access-Accept WiMAX-Packet-Data-Flow-Id = 1 WiMAX-Service-Data-Flow-Id = 1 WiMAX-Service-Profile-Id = 1 WiMAX-Direction = Bi-Directional WiMAX-QoS-Id = 1 WiMAX-Media-Flow-Type = Robust-Browser WiMAX-Schedule-Type = Best-Effort WiMAX-Traffic-Priority = 0 WiMAX-Maximum-Sustained-Traffic-Rate = 512000 MS-CHAP2-Success = 0xdf533d37443041423038393133393032414333353841304630414336383132453546434243364130323046 MS-MPPE-Recv-Key = 0x1d7c9b57392b589e2849640bad969199 MS-MPPE-Send-Key = 0x4aa107e5fa9573846af44d21c5080749 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 and the one in the outer tunnel Fri Apr 3 01:13:34 2009 Packet-Type = Access-Accept MS-MPPE-Recv-Key = 0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395 MS-MPPE-Send-Key = 0x009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b EAP-MSK = 0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b EAP-EMSK = 0xc5f48626093f9313c5090254ffc375d4594bf6570025a260801e4b8d0ff852167d0748bd50b27d214b0ee67c1bbe1a4395faf094a8cb56663177fa8f32586f40 EAP-Message = 0x03f00004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00210400E0D7(a)test.fr" I would like the reply of the outer tunnel to contain all the Wimax Attribute I got in the inner. 2. For some weird reason again, Alcatel ASN needs to receive two times the same attribute with differente value (Actually this WiMAX-QoS-Descriptor (TLV Attribute)) I guess this is not very compliant with RFC, but is there a way to send 2 times the same attribute in the same reply. I've tried that but without surprise this send only the first part of the attribute cpe2-lab(a)test.fr Cleartext-Password := "xxx" WiMAX-Packet-Data-Flow-Id=1, WiMAX-Service-Data-Flow-Id=1, WiMAX-Service-Profile-Id=1, WiMAX-Direction=Bi-Directional, WiMAX-QoS-Id=01, WiMAX-Media-Flow-Type=Robust-Browser, WiMAX-Schedule-Type=BEST-EFFORT, WiMAX-Traffic-Priority=0, WiMAX-Maximum-Sustained-Traffic-Rate=512000, WiMAX-QoS-Id=02, WiMAX-Media-Flow-Type=Robust-Browser, WiMAX-Schedule-Type=BEST-EFFORT, WiMAX-Traffic-Priority=0, WiMAX-Maximum-Sustained-Traffic-Rate=512000 Maybe using perl module in the post-auth ? Thanks Thomas Fagart

3 4

1.1.7 with CHAP and Mysql
by Benjamin Marvin 06 Apr '09

06 Apr '09

Good day,I inherited a system running two Freeradius 1.1.7 servers with CHAP and Mysql. They run seemingly fine, but I am trying to add a third (and a fourth eventually, planning to use the fourth as a testbed for a newer Freeradius version). So I installed Mysql and Freeradius 1.1.7. The Mysql database is replicated from the existing servers. I tried to configure FreeRadius from scratch and finally tried copying the config files from a working machine. In both cases I've received the error: rlm_chap: Could not find clear text password for user testuser(a)mydomain.com It's clear in the preceding Debug lines that SQL is being called and that the proper select statements are being run. In fact, up until this point in the debug the debug looks exactly the same as a debug on my working servers. When I run the select statements manually, the output is identical to the results of the working servers. As I mentioned, the Debug for the working servers deviate only at this point, and on the working server the line reads: rlm_chap: Using clear text password "mypassword" for user testuser(a)mydomain.com authentication. I'm fairly confident that Freeradius is interacting with the Mysql server because when I forward accounting to the server, the accounting is stored to the Mysql tables. I was interested in seeing what the Freeradius server thinks the select queries are returning that it can't find a clear text password. I had thought maybe sqltrace = yes would enable me to see this, but this option appears to do nothing (in -X and -x and with no arguments. Also no sql appears in the radius.log file either). Next I got the idea to use radtest with a non chap password to test. radtest works just fine, calls the SQL and everything: rlm_pap: login attempt with password mypassword rlm_pap: Using clear text password. rlm_pap: User authenticated succesfully Haven't gotten much sleep thanks to this, and I'm not sure where to go next. So thank you all in advance for any advice/recommendations. -Benjamin Marvin _________________________________________________________________ Curiosità, trucchi e consigli per il tuo Messenger! http://www.messenger.it

2 1

Limit user by Time and Bandwidth
by Sunday Olutayo 06 Apr '09

06 Apr '09

Please, I just install it with Freeradius and SQL. How can I limit user by time of the day? And how do I limit user to maximum bandwidth?

2 1

VS: Chap auhtentication against LDAP
by Ville Leinonen 06 Apr '09

06 Apr '09

Hi, So i cannot do this about using freeradius, but i can make it using IAS (see link)? http://h40060.www4.hp.com/procurve/includes/application-notes/index.php?cc=… Br, Ville -----Alkuperäinen viesti----- Lähettäjä: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org puolesta: Alan DeKok Lähetetty: pe 3.4.2009 16:10 Vastaanottaja: FreeRadius users mailing list Aihe: Re: Chap auhtentication against LDAP Ville Leinonen wrote: > Does Freeradius 2.1.5 support chap authentication against ldap? No RADIUS server supports this. It's impossible. Instead, have FreeRADIUS pull the clear-text password from LDAP. FreeRADIUS can then do CHAP. If you don't have a clear-text password in LDAP, it's impossible. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Problems in redudant ldap and authorization.
by Ville Leinonen 06 Apr '09

06 Apr '09

Hi, I have a little problem in my radius configuration in my redudant ldap section rad ver is 2.1.5. redundant { ldap-srv1 ldap-srv2 notfound = reject } Gives this error message: /usr/local/etc/raddb/sites-enabled/default[167]: Entry with no value is invalid /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. Any suggestion what is wrong in my configuration? If i use individual configuration eg. ldap-srv1{ notfound = reject } Then it works. Br, Ville

2 1