- Freeradius-Users - lists.freeradius.org

Problem with only some users. Monowall - Freeradius
by Daniel Bojczuk 04 Feb '09

04 Feb '09

Hi!! I have a Monowall athorizing and accounting on a Freeradius 2.1.1 When I execute: radtest nbatista(a)dialup.usp.br ******* 123.123.123.123 0 's3mf!o/' I get the folowing answer: Sending Access-Request of id 177 to 123.123.123.123 port 1812 User-Name = "nbatista(a)dialup.usp.br" User-Password = "nat6672" NAS-IP-Address = 123.123.123.123 NAS-Port = 0 rad_recv: Access-Accept packet from host 123.123.123.123 port 1812, id=177, length=68 Framed-IP-Address = 255.255.255.254 Framed-MTU = 1500 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Session-Timeout = 86400 Framed-IP-Netmask = 255.255.255.0 Idle-Timeout = 3600 Everything works fine. But when I try to login using Monowall login page on debug mode I have this: ___________________________________________________________________________________________________________________________ rad_recv: Access-Request packet from host 124.124.124.124 port 63026, id=166, length=150 NAS-IP-Address = 124.124.124.124 NAS-Identifier = "gwrp.semfio.usp.br" User-Name = "nbatista(a)dialup.usp.br" User-Password = "*******" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 83 Framed-IP-Address = 125.125.125.125 Called-Station-Id = "00:11:2f:75:81:7c" Calling-Station-Id = "00:1b:77:b5:34:9d" +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/143.107.192.54/auth-detail-20090203 [auth_log] /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/ 143.107.192.54/auth-detail-20090203 [auth_log] expand: %t -> Tue Feb 3 17:30:54 2009 ++[auth_log] returns ok [suffix] Looking up realm "dialup.usp.br" for User-Name = " nbatista(a)dialup.usp.br" [suffix] Found realm "dialup.usp.br" [suffix] Adding Realm = "dialup.usp.br" [suffix] Proxying request from user nbatista to realm dialup.usp.br [suffix] Preparing to proxy authentication request to realm "dialup.usp.br" ++[suffix] returns updated [sql] expand: %{User-Name} -> nbatista(a)dialup.usp.br [sql] sql_set_user escaped user --> 'nbatista(a)dialup.usp.br' rlm_sql (sql): Reserving sql socket id: 6 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = ' nbatista(a)dialup.usp.br' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='nbatista(a)dialup.usp.br' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 6 [sql] User nbatista(a)dialup.usp.br not found ++[sql] returns notfound ++[pap] returns noop Sending Access-Request of id 239 to 126.126.126.126 port 1812 NAS-IP-Address = 124.124.124.124 NAS-Identifier = "gwrp.semfio.usp.br" User-Name = "nbatista(a)dialup.usp.br" User-Password = "*******" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 83 Framed-IP-Address = 125.125.125.125 Called-Station-Id = "00:11:2f:75:81:7c" Calling-Station-Id = "00:1b:77:b5:34:Sending Access-Request of id 239 to 143.107.253.10 port 1812 NAS-IP-Address = 124.124.124.124 NAS-Identifier = "gwrp.semfio.usp.br" User-Name = "nbatista(a)dialup.usp.br" User-Password = "*******" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 83 Framed-IP-Address = 125.125.125.125 Called-Station-Id = "00:11:2f:75:81:7c" Calling-Station-Id = "00:1b:77:b5:34:9d" Proxy-State = 0x313636 Going to the next request Waking up in 0.8 seconds. Cleaning up request 5 ID 194 with timestamp +9 Waking up in 0.1 seconds. Waking up in 13.0 seconds. rad_recv: Access-Reject packet from host 126.126.126.126 port 1812, id=239, length=82 Reply-Message = "\r\nYou are already logged in 2 times - access denied\r\n\n" Proxy-State = 0x313636 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Login incorrect (Home Server says so): [nbatista(a)dialup.usp.br] (from client gwrp port 83 cli 00:1b:77:b5:34:9d) Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 166 to 123.123.123.123 port 63026 Reply-Message = "\r\nYou are already logged in 2 times - access denied\r\n\n" Finished request 6. Going to the next request Waking up in 4.9 seconds. ____________________________________________________________________________________________________________________ I understood that there are 2 sessions opened. am I correct? If I am how can I close these sessions? And why does radtest work? Thanks! Sorry about my English. Daniel Bojczuk

3 2

User account lockout
by SDamron 04 Feb '09

04 Feb '09

Is there a way using what ever method to lock out accounts after several bad login attempts? TIA, Damron

2 2

radius web managment
by Mr Little Crazzy 03 Feb '09

03 Feb '09

Someone has installed dialup admin or daloradius ?? I have installed diaul up admin , but my problem is that not list the user conecct. Which is the best ?? and someone has an install guide for install each of one _________________________________________________________________ Adelántate a tu futuro. Ingresa ahora a MSN Astrología http://astrologia.latam.msn.com/msnlatam/

8 11

Variable for Secret in Request?
by Eric Geier 03 Feb '09

03 Feb '09

Is there a Variable for the shared secret used in the request packets? Thanks, Eric.

2 1

None
by А Гауэрт 03 Feb '09

03 Feb '09

I'm new at this and I was wondering if anyone can help me out configuring free radius for mac address authentication I need to install a server for mac address authentication, without certificates. I have switch clients and I need authenticate users on these switches for mac (only). It's about 10 000 users on 200 switches in network. The problem is that same switches returns for user: User-Name = "002179a516be" and another switches the same user in reverse!!! format: User-Name = "eb-61-5a-79-12-00" Should I configure different Users for that? Thanks

3 2

CERTIFICATE problem
by Cristian Novac 03 Feb '09

03 Feb '09

Hello, I'm trying to do a TLS auth, and I get an error after user sending his cert; Could someone please take a look at the log error, maybe it tels you more than I understand from it. Thank you! ps: the cert that is doing problems is a wimax device certificate.

2 1

OTP autentication to a mobile phone (sometimes called mobile TAN/mTAN)
by Verlag Neue Stadt 03 Feb '09

03 Feb '09

Hello, we would like to have captive users(authentication portal) authenticated with a one time password (OTP). After entering the user-account at the captive login page, preferably a/the RADIUS server should send the unique autentication number (sometimes called mobile TAN/mTAN or OTP) to the users mobile phone in order to gant access. Is something like that possible with freeradius? Thank's for any feedback. John

2 1

Certificate Provisioning for EAP-TLS Networks
by Matt Causey 03 Feb '09

03 Feb '09

I am running FreeRadius at my company on a WLAN - using SSL key material issued by our internal certificate authority. All is well. However a pretty big limitation of this security architecture is of course getting the SSL key material onto the devices. In our case - the devices are SIP phones with no wired ethernet connection. I know there are other sites with similar issues. I would like to hear some ideas on what folks are doing to manage SSL key material on devices. This would include initial key provisioning and re-keying when certs expire. Presently ours expire every 90 days. Thoughts? -- Matt

4 6

chap authentication and freeradius
by gf fg 02 Feb '09

02 Feb '09

Hi Freeradius users! I have installed Freeradius and diualup admin and mysql I configurated the both ! I have an an aplication called vyatta. I am trying that this vyatta validate the users with the freeradius I configurated in the admin.conf with chap and clear-password and i set that the password are store in clear in the database too. But when i try to login with a user that uses chap authentiation! the freeradius told me that need claer password! what is worng ??? Someone can help me to configurate Freeradius , dialup admin and mysql with chap authentication ?? _________________________________________________________________ Permanece actualizado con MSN Noticias. Clic aquí http://noticias.cl.msn.com/

4 17

invalid Message-Authenticator! (Shared secret is incorrect.)
by Hegedus Gabor 02 Feb '09

02 Feb '09

Hi I have a problem: I get this message *invalid Message-Authenticator! (Shared secret is incorrect.) * But I checked the key and it equals. What is the problem? clients.conf: client 192.168.1.10 { secret = test shortname=blablabla } thx

4 7