- Freeradius-Users - lists.freeradius.org

rlm_perl authentication override
by Henry 17 Dec '08

17 Dec '08

Greets, Using freeradius 2.0.5 and rlm_perl. Let's say we have a username which is locked in /etc/shadow. Normal authentication will prevent this user from logging in. I would like to override this behaviour in either authorize() or post_auth() and allow the user to login (but with modified $RAD_REPLY) despite the locked system user. In authorize(), changing $RAD_REPLY (to allow a modified service) is no problem, but I'm not sure what to return so radiusd will authenticate the user even though their password is incorrect (return RLM_MODULE_OK of course doesn't change this behaviour) - eg, rejecting a user is easy, just return RLM_MODULE_REJECT. Is there a way to change the reply from Access-Reject, to Access-Accept? Thanks Henry

2 2

vlan in ldap - full version
by alois blasbichler 17 Dec '08

17 Dec '08

Hello list I was send the last mail wrongly - here the correct version : I am trying to assign different vlans for my different Radius-users. The good news is that with a user defined in the users file it works fine. The users file : tester cleartext-Password := "alois" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 155 The message: ++[eap] returns ok Login OK: [tester] (from client ciscosw port 29 cli 00-1F-E1-23-71-85) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 255 to 10.53.240.10 port 32769 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "155" User-Name = "tester" MS-MPPE-Recv-Key = 0x283b539628ec3ece70444bce496d078fc67323356a6cd12f435f878743447f7a MS-MPPE-Send-Key = 0xa978c29338aa1547d14524b0f43bfcde45841e3bce0f9c30a0b6c3d57187d810 EAP-Message = 0x03130004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 12. But with my users in Ldap - it does not work - seems that radius dont replay the vlan-attributes Some hints? luis my user in ldap : dn: uid=test,ou=users,dc=sb-brixen,dc=it objectClass: radiusprofile radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 154 The message i get: [ldap] looking for check items in directory... rlm_ldap: radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 == "154" rlm_ldap: radiusTunnelMediumType -> Tunnel-Medium-Type:0 == IEEE-802 rlm_ldap: radiusTunnelType -> Tunnel-Type:0 == VLAN ... Login OK: [test] (from client ciscosw port 29 cli 00-1F-E1-23-71-85) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 97 to 10.53.240.10 port 32769 User-Name = "test" MS-MPPE-Recv-Key = 0x460785611f313ad630d4947a9f319303a05238d5b340b0a32d38a58b81a416aa MS-MPPE-Send-Key = 0xceeebab47129af3baa96c6fa859b26434b3894a32fddeeffc4f86bb9dfc080b1 EAP-Message = 0x031a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 53.

4 5

RE: Duplicate IPs for Radius Clients with different secrets
by Eric Geier 17 Dec '08

17 Dec '08

Opps I didn't see this message at first. Does this go along with what Alan was thinking? If I understand what you said, I would only need one IP entry (the Internet IP) in the config file for each location, right? Most of these locations will be using dynamic Internet IPs; I'm not sure how'd I keep the config updated. Plus this would make each location/network use the same shared secret among all their APs, which I want to prevent. The best solution I can think of that I want to mimic is SecureMyWiFi from WiTopia, a hosted radius service (www.witopia.net) Their service works just like I want. Thanks, Eric > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of Paul Bartell > Sent: Tuesday, December 16, 2008 2:13 AM > To: FreeRadius users mailing list > Subject: Re: Duplicate IPs for Radius Clients with different secrets > > Okay. What you need to do is set ips in the client configuraiton file > for each of the APs that is going to be authenticating by using their > external ip address, which is where the connection will appear to come > from to freeradius. do a freeradius -X and it should be quite > explanatory, when you try to connect through an AP to it. > > On Mon, Dec 15, 2008 at 6:56 PM, Eric Geier <me(a)egeier.com> wrote: > >> >Hi, I'm wondering if someone can point me in the right direction. I > >> want to > >> >list radius clients with the same IPs (and different shared > secrets). > >> This > >> >would let me use freeradius among multiple offices, where each > could > >> use the > >> >same IP addresses for the radius clients. > >> > >> And how is routing going to work there? How is radius server suposed > to > >> send the response back to the correct client? This can work only if > >> carry radius server from office to office so it works a little bit > >> here, > >> little bit there. If you connect those clients onto a network they > will > >> all stop working (or, at best, first one you put on the network will > >> work but others won't). > >> > >> Ivan Kalik > >> Kalik Informatika ISP > > > > I'm not exactly sure. How does a RADIUS server work over the > Internet? I'm > > not connecting the radius clients onto the same LAN. If a radius > request > > comes in from the internet, would the server send responses to the > Internet > > IP that it received it from (which I think would work for my case) or > would > > it send to the radius client IP? > > > > Here's what I'm trying to do: > > Host a radius server on the Internet...for PEAP 802.1X (WPA- > enterprise). > > Each AP at the different offices would be set with the Internet IP > address > > of where the radius server is running, along with a shared secret. > There > > would likely be APs set to the same IP address, that's why I'm asking > about > > all this. > > > >> > Hi, I'm wondering if someone can point me in the right direction. > I > >> want to > >> > list radius clients with the same IPs (and different shared > secrets). > >> This > >> > would let me use freeradius among multiple offices, where each > could > >> use the > >> > same IP addresses for the radius clients. I need something very > >> dynamic; > >> > manually creating virtual servers in the config file won't work > well. > >> > >> RADIUS doesn't work that way. > >> > >> Shared secrets are per client IP. Each client IP is used to look > up > >> the shared secret. You can't have multiple shared secrets for one > IP. > >> > >> > Right now I'm using v1.188.2.4.2.14 > >> > >> That's not the server version number. > >> > >> Use "radiusd -v" to get the version information. > >> > >> Alan DeKOk. > > > > I know it traditionally doesn't, just checking to see what people > think and > > if I might find a way to do what I want to do. > > > > What got me thinking something like this could work is when using a > > different server, I thought I could modify the SQL select statement > that's > > used to find the shared secret. For example, the default is "select > > SharedSecret from NASES where ClientIPAddress='$c'" I thought I could > just > > add the following to the end "and where Domain=(function that takes > the > > domain from the username...after the @) I found that server can't > register > > the username attribute during the select statement...so it all didn't > work. > > > > Opps. I'm using v1.1.7 because at the moment I'm using FreeRadius.net > on > > Windows > > > > Thanks for your help guys - Eric > > > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > -- > Random quote of the week/month/whenever i get to updating it: > "Opportunity knocked. My doorman threw him out." - Adrienne Gusoff > > "At school you don't get parole, good behavior only brings a longer > sentence." - The History Boys > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - http://www.avg.com > Version: 8.0.176 / Virus Database: 270.9.18/1850 - Release Date: > 12/15/2008 5:04 PM

4 3

EAP/MD5 with mysql authentication failed
by henry1412 17 Dec '08

17 Dec '08

EAP/MD5 with mysql authentication failed My running environment is freeraius-2.1.3 and mysql-5.0.37. The authentication type is EAP/MD5. It's running well with individual 'user' file, however, If I enable the sql optioal, it rejects with '[eap] Handler failed in EAP/md5'. The mysql module was loaded success and could connected with my database. It could authorized in freeradius-1.0.5 and freeradius-1.1.7 with mysql, but failed in freeradius-2.1.3. I paste my mainly configuration file and debug information below. Thanks for your help! IN radius.conf ---------------------- $INCLUDE sql.conf IN sql.conf ---------------------- server = "localhost" port = 3306 login = "radius" password = "radius" IN sites-enabled/inner-tunnel ---------------------- authorize { eap { ok = return } files sql expiration logintime } authenticate { eap } IN eap.conf ---------------------- eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no max_sessions = 2048 md5 { } } IN user ---------------------- DEFAULT Auth-Type := EAP Fall-Through = 1 IN radcheck table ---------------------- mysql> select * from radcheck; +----+----------+--------------------+----+-------+ | id | username | attribute | op | value | +----+----------+--------------------+----+-------+ | 1 | test | Cleartext-Password | := | test | IN radreply table ---------------------- mysql> select * from radreply; +----+----------+-------------------+----+---------------+ | id | username | attribute | op | value | +----+----------+-------------------+----+---------------+ | 1 | test | Framed-IP-Address | := | 192.168.1.55 | DEBUG information ---------------------- -----------Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.7 port 1024, id=0, length=142 User-Name = "test" NAS-IP-Address = 192.168.1.7 NAS-Port = 0 Called-Station-Id = "00-0F-1E-51-00-04:" Calling-Station-Id = "00-13-D7-20-00-90" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000090174657374 Message-Authenticator = 0xbfed0ae2dd3f0b2a36fe1a88cbd3569d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 144 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.7 port 1024 EAP-Message = 0x01010016041095e48ee00d7d5ecc1639d149c9aa7283 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40ca4f4d40cb4b4734e42cbd94a7636b Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.7 port 1024, id=1, length=173 User-Name = "test" NAS-IP-Address = 192.168.1.7 NAS-Port = 0 Called-Station-Id = "00-0F-1E-51-00-04:" Calling-Station-Id = "00-13-D7-20-00-90" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100160410f34f8c1c140e4f4b3846e691a7aa2175 State = 0x40ca4f4d40cb4b4734e42cbd94a7636b Message-Authenticator = 0xa9e8279e3d299800129cc25ad426acce +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 144 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 1 to 192.168.1.7 port 1024 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds.-----------

3 2

vlan in ldap
by alois blasbichler 17 Dec '08

17 Dec '08

Hello list I am trying to assign different vlans for my different Radius-users. The good news is that with a user defined in the users file it works fine. The users file : tester cleartext-Password := "alois" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 155 The message: ++[eap] returns ok Login OK: [tester] (from client ciscosw port 29 cli 00-1F-E1-23-71-85) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 255 to 10.53.240.10 port 32769 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "155" User-Name = "tester" MS-MPPE-Recv-Key = 0x283b539628ec3ece70444bce496d078fc67323356a6cd12f435f878743447f7a MS-MPPE-Send-Key = 0xa978c29338aa1547d14524b0f43bfcde45841e3bce0f9c30a0b6c3d57187d810 EAP-Message = 0x03130004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 12. But with my users in Ldap - it does not work my user in ldap : dn: uid=test,ou=users,dc=sb-brixen,dc=it objectClass: radiusprofile radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 154 The message: [ldap] looking for check items in directory... rlm_ldap: radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 == "154" rlm_ldap: radiusTunnelMediumType -> Tunnel-Medium-Type:0 == IEEE-802 rlm_ldap: radiusTunnelType -> Tunnel-Type:0 == VLAN ...

2 1

Sending Accounting Response
by Padam J Singh 17 Dec '08

17 Dec '08

3 9

FreeRADIUS + WiMAX + Authentication
by Kristoffer Milligan 17 Dec '08

17 Dec '08

Hello I'm trying to set up FreeRADIUS as a AAA for an Alvaristar ASN gateway. My current setup is this: CPE (Client) <-> WiMAX radiolink <-> Basestation <-> ASN GW <-> AAA Traffic is successfully traveling from one end to the other, and authentication is seemingly correct, but the CPE still doesn't connect for some reason. At this url is the logfile of the AAA server start, and the connection process: http://multigan.com/log.txt To me, it seems that the login is successful. What does raise a question though, is this line: Info: [wimax] No EAP-MSK or EAP-EMSK. Cannot create WiMAX keys. Is this correct behavior, or ? Also, any ideas to why the CPE doesn't associate after (apparently) receiving a valid login? Sincerely, Kristoffer Milligan

2 2

Radrelay
by lreeves 17 Dec '08

17 Dec '08

I found FreeRadius 2.1.1 very easy to setup for authentication however, I am experiencing problems in setting up the accounting with 2 servers. Radrelay was very simple and although I have found lots of information on the radrelay function built in to FreeRadius, I have not been able to get it working. Is there a shortcut, Howto or instructions on what files need to be changed to get the detail files to match on 2 servers? Thanks Larry Reeves lreeves(a)heartoftn.net

5 6

Working config file for data counter.
by Marcel Grandemange 16 Dec '08

16 Dec '08

Good Day. I am still struggling to get a working solution with freeradius and mysql as backend. What im trying to do simply is have the radius server use data counters instead of time counters. I want to limit a users collective data to amounts of 1gb,2gb,3gb, all the way up. And it must be resset on the first of the month. I have tried many versions of freeradius with many different queries and methods and there is ALWAYS something that doesn't seem to work properly. With Freeradius 2.1.3 I cannot use anything above 4gb, although I followed instructions on wiki to the tee for overcoming the wrapping problem. (wiki was outdated, but still tried) With 1.1.7 I think it was I would simply get arratic responses. Sometimes worked fine with up to 8gb tested, the next month it wouldn't. 2gb limits would also only sometimes work. The only one that was consistant was the 1gb option. Now ive tried so many methods, versions , tricks and wiki's and docs.. It's been years and still I cannot get it working correctly. There is a bit of a lack of docs on what I would like to do and ive come to the conclusion that if I could see someone elses working config for this sort of setup I could deduce where im going wrong. Thank You!

2 1

Re: FreeRADIUS vs Aradial RADIUS
by Aldo Zavala 16 Dec '08

16 Dec '08

Thanks for the input Alan, definitely I am sure FreeRADIUS is much better...what can be better than thousand of users, open source, free, and feature rich as itself... I apologize to all for the Subject of my inquiry, I wanted somebody to have tested Aradial and FreeRADIUS and tell me how professional can be this "Aradial". I am like scared because I am about to deploy a RADIUS AAA server in my network, and I was looking into commercial options... such as: Huawei: $500,000 DLLS (yes... DAMN!) Juniper: $100,000 DLLS ( !!! )... and here is FreeRADIUS... but I have no idea how to configure it... it like scares me because there are no manual to tell me step by step how to configure it to fit my needs and to feet my equipment.... I am in a cellular network (CDMA2000), I need to create two domains in AAA, one for EVDO and other internet services, the other for MMSC services, In order to have the capability of adding different subscribers in AAA under different domains, that way we can bill MMS and EVDO as separate services. I downloaded the FreeRADIUS mysql port in one FreeBSD box, I have no idea how to start configuring it there are many .conf files, and each config file is huge..., you told me in another reply that I have to configure FreeRADIUS to respond with the correct attributes that are needed by the PDSN, how can I know that? The Huawei PDSN documentation I have only tells how to configure the NAS with the "Huawei AAA" and dont say much about attributes.... can please tell what you mean with "attributes that are needed by PDSN?" what are those attributes and what they does? This is the relevant part of the PDSN config that I think is related to RADIUS: [conf] # interface Piif3/0/0 ip address 192.168.1.2 255.255.255.255 # interface Rpif3/0/0 ip address 192.168.1.1 255.255.255.255 # a11 enable pcf 192.168.0.200 192.168.1.1 256 skey 1234567891234567 # construct domain huawei domain enable domain AAAclientsig 1 domain address-group huawei 0 0 10.0.0.51 50 domain dns huawei 0 209.145.204.26 bip 209.145.204.20 # charge enable weekday 6 1 weekday 5 0 weekday 4 0 weekday 3 0 weekday 2 0 weekday 1 0 weekday 0 1 # [/conf] Thanks, Aldo Zavala Mobile (760) 556-5050 GTalk: aldo.zavala(a)gmail.com ----- Original Message ----- From: freeradius-users-request(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Mon, 15 Dec 2008 13:08:36 -0700 Subject: Freeradius-Users Digest, Vol 44, Issue 82 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Attributes Bandwidth in radgrouprepy table (tnt(a)kalik.net) > 2. Re: MAC Auth (new problem) (tnt(a)kalik.net) > 3. Re: calling-station-id filtering with checkval (tnt(a)kalik.net) > 4. Re: calling-station-id filtering with checkval (tnt(a)kalik.net) > 5. Re: MAC Auth (new problem) (Nataniel Klug) > 6. Re: FreeRADIUS vs Aradial RADIUS (Alan DeKok) > 7. Re: Somewhat OT: Captive portal on acess points instead > complex?supplicant at level end user? (Alexander Clouter) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 15 Dec 2008 19:36:48 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Attributes Bandwidth in radgrouprepy table > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <Y0HT6pSa.1229366208.9737470.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >[sql] expand: SELECT id, username, attribute, value, op FROM radcheck > >WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, > >attribute, value, op FROM radcheck WHERE username = > >'pepe(a)dominio.com' ORDER BY id > >WARNING: Found User-Password == "...". > >WARNING: Are you sure you don't mean Cleartext-Password? > >WARNING: See "man rlm_pap" for more information. > > Fix that. > > >[sql] User found in radcheck table > >rlm_sql (sql): Released sql socket id: 4 > >++[sql] returns ok > > > > And what happened to authorize_reply_query? It would be helpful to see > part of the server startup debug where sql module is instatiated. > > Ivan Kalik > Kalik Informatika ISP > > >It's checking the query in radcheck but not in radgroupreply. And I've > >tested the query in dialup.conf and seems correct > > > > authorize_group_reply_query = "SELECT ${groupreply_table}.id, > >${groupreply_table}.GroupName,${groupreply_table}.Attribute, > >${groupreply_table}.Value,${groupreply_table}.op FROM > >${groupreply_table},${usergroup_table} WHERE ${usergroup_table}.Username > >= '%{SQL-User-Name}' AND ${usergroup_table}.GroupName = > >${groupreply_table}.GroupName ORDER BY ${groupreply_table}.id" > > > >Thanks in advance > > > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > > ------------------------------ > > Message: 2 > Date: Mon, 15 Dec 2008 19:45:40 +0100 > From: <tnt(a)kalik.net> > Subject: Re: MAC Auth (new problem) > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <hGU36snT.1229366740.7674820.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >Ready to process requests. > >rad_recv: Access-Request packet from host 172.30.0.165 port 6001, id=3, > >length=69 > > User-Name = "00:19:79:0F:98:3D" > > User-Password = "cnett1298" > > NAS-IP-Address = 172.30.0.165 > > NAS-Port = 0 > >server proxim { > >+- entering group authorize {...} > >++[preprocess] returns ok > >[suffix] No '@' in User-Name = "00:19:79:0F:98:3D", looking up realm NULL > >[suffix] No such realm "NULL" > >++[suffix] returns noop > >[sql_ap2000] expand: %{User-Name} -> 00:19:79:0F:98:3D > >[sql_ap2000] sql_set_user escaped user --> '00:19:79:0F:98:3D' > >rlm_sql (sql_ap2000): Reserving sql socket id: 4 > >[sql_ap2000] expand: SELECT id, username, attribute, value, > >op FROM radcheck WHERE value = > >'%{SQL-User-Name}' ORDER BY id -> SELECT id, username, > >attribute, value, op FROM radcheck WHERE value = > >'00:19:79:0F:98:3D' ORDER BY id > >[sql_ap2000] expand: SELECT groupname FROM > >usergroup WHERE username = '%{SQL-User-Name}' ORDER > >BY priority -> SELECT groupname FROM usergroup WHERE > >username = '00:19:79:0F:98:3D' ORDER BY priority > >rlm_sql (sql_ap2000): Released sql socket id: 4 > >[sql_ap2000] User 00:19:79:0F:98:3D not found > >++[sql_ap2000] returns notfound > >++[expiration] returns noop > >++[logintime] returns noop > >[pap] WARNING! No "known good" password found for the user. > >Authentication may fail because of this. > >++[pap] returns noop > >No authenticate method (Auth-Type) configuration found for the request: > >Rejecting the user > >Failed to authenticate the user. > >Login incorrect: [00:19:79:0F:98:3D/cnett1298] (from client ap2000 port 0) > >} # server proxim > >Delaying reject of request 0 for 1 seconds > >Going to the next request > >Waking up in 0.9 seconds. > >Sending delayed reject for request 0 > >Sending Access-Reject of id 3 to 172.30.0.165 port 6001 > >Waking up in 4.9 seconds. > >Cleaning up request 0 ID 3 with timestamp +29 > >Ready to process requests. > > > > This user (MAC) exists and its in radcheck like this: > > > >mysql> SELECT * FROM radcheck WHERE Username="marmatec"; > >+------+----------+--------------------+----+-------------------+--------+------+ > >| id | UserName | Attribute | op | Value | numero > >| obs | > >+------+----------+--------------------+----+-------------------+--------+------+ > >| 796 | marmatec | Cleartext-Password | := | 654321 | 00923 > >| | > >| 1886 | marmatec | Calling-Station-Id | == | 00:19:79:0F:98:3D | 00923 > >| NULL | > >+------+----------+--------------------+----+-------------------+--------+------+ > > > > On mysql/sql/ap2000.conf (copy of dialup.conf file) I just changed > >this on authorize section: > > > > WHERE value = '%{SQL-User-Name}' \ > > > > I really don't know how to make this work. Can someone help me? > > > Lets try again: put the mac address in to the radcheck table as UserName > field. Without that mac authentication is not going to work. If your > "adminstartion system" has something against it, throw it away and > write another one youself. Or use dialup admin (comes with the server) > or something like daloRadius. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 3 > Date: Mon, 15 Dec 2008 20:01:15 +0100 > From: <tnt(a)kalik.net> > Subject: Re: calling-station-id filtering with checkval > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <2XjDGByZ.1229367675.3010030.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > Look again. Hint: have a look at you radcheck entry and the one in the > document. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 15/12/2008, "Justin A. Williams " <justin(a)justinawilliams.com> > pi?e: > > >Alan, > > > >Honestly I have read this document but I do not see what i need to do. > > > > > > > > > > > > > >On Mon, Dec 15, 2008 at 1:37 AM, Alan DeKok > <aland(a)deployingradius.com>wrote: > > > >> Justin A. Williams wrote: > >> > I see that the mac address from the calling-station-id but then it will > >> > not login with the user. > >> > If i delete the row 26 with calling-station-id it will permit that user > >> > to login. > >> > >> Read doc/rlm_sql. This is explained. > >> > >> Alan DeKok. > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > > > > >-- > >Justin A Williams > > > > > > > > ------------------------------ > > Message: 4 > Date: Mon, 15 Dec 2008 20:07:43 +0100 > From: <tnt(a)kalik.net> > Subject: Re: calling-station-id filtering with checkval > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <LgWmJbfe.1229368063.8923830.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > PS. You don't need checkval in inner-tunnel or you should copy request > attributes into the tunnel as well (see eap.conf, peap section). > > Ivan Kalik > Kalik Informatika ISP > > Dana 15/12/2008, "Justin A. Williams " <justin(a)justinawilliams.com> > pi?e: > > >Alan, > > > >Honestly I have read this document but I do not see what i need to do. > > > > > > > > > > > > > >On Mon, Dec 15, 2008 at 1:37 AM, Alan DeKok > <aland(a)deployingradius.com>wrote: > > > >> Justin A. Williams wrote: > >> > I see that the mac address from the calling-station-id but then it will > >> > not login with the user. > >> > If i delete the row 26 with calling-station-id it will permit that user > >> > to login. > >> > >> Read doc/rlm_sql. This is explained. > >> > >> Alan DeKok. > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > > > > >-- > >Justin A Williams > > > > > > > > ------------------------------ > > Message: 5 > Date: Mon, 15 Dec 2008 17:30:06 -0200 > From: Nataniel Klug <nata(a)cnett.com.br> > Subject: Re: MAC Auth (new problem) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4946B03E.1000001(a)cnett.com.br> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > Ivan, > > I can just throw it away... and I still need this to work. There should > be someway to make this happens... > > tnt(a)kalik.net escreveu: > > > > Lets try again: put the mac address in to the radcheck table as UserName > > field. Without that mac authentication is not going to work. If your > > "adminstartion system" has something against it, throw it away and > > write another one youself. Or use dialup admin (comes with the server) > > or something like daloRadius. > > > > Ivan Kalik > > Kalik Informatika ISP > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > -- > Att, > > NATANIEL KLUG > nata(a)cnett.com.br > > LEIA O DIA-A-DIA DO NATA > http://nataklug.blogspot.com/ > > Cyber Nett - Internet Banda Larga > www.cnett.com.br > (42) 3635-2957 > Rua Diogo Pinto, 1046, Centro > Laranjeiras do Sul - PR > Brasil - 85301-290 > > "... tamb?m os s?bios possuem cora??o tang?vel e podem, por vezes, usar da > ci?ncia como meio de demonstrar impress?es sentimentais de que muitos n?o os > julgam suscet?veis." > Visconde de Taunay > >

3 2