- Freeradius-Users - lists.freeradius.org

mysql configuration
by Ahmet DÜLGAR 25 Aug '08

25 Aug '08

hi everyone i use fedora 9 and freeraidus 2.0.5 i want to use mysql database for user lists and i want to limit time users login for example 3 hour or 3 days i looked documents for howto wpa i create the radius db by db_mysql.sql configure the sql.conf by writein login mysql password and include sql.conf in radiusd.conf but i only cant correct the statement, i think they are for 1.1.7 authorise { preprocess chap mschap suffix eap # We leave "files" enabled to allow creation of test users in /etc/raddb/users files sql pap}accounting { # We leave "detail" enabled to _additionally_ log accounting to /var/log/radius/radacct detail sql} i add this statment end of the radiusd.conf but it doesnt work i am new at freeradius and linux, thanks for replay _________________________________________________________________ Gelen kutunuzda hiç yer kalmamasından bıktınız mı? Windows Live Hotmail şimdi size 5GB ÜCRETSİZ depolama alanı sunuyor! Ücretsiz Windows Live Hotmail hesabınızı buradan alın! http://get.live.com/mail/overview

3 2

Question about Logging
by Aaron Spanik 25 Aug '08

25 Aug '08

I apologize in advance if this question is answered in the documentation, but if it is, I haven't been able to find it. I have the following setup: - Client daemon running on host A - FreeRADIUS 2.0.4 server running on host A proxying auth requests - Two Remote RADIUS servers serving authentication from a load-balanced pool - The client daemon sends authentication requests to the FreeRADIUS server with a username and password over loopback. - The FreeRADIUS server receives the Access-Request and proxies it to the remote RADIUS servers. - Responses from the RADIUS server are proxied back to the client daemon for action. - Accounting records are sent by the client daemon, however they are "swallowed" by the FreeRADIUS server (always ok) as accounting is not being used at this point. The first thing I will mention is that this I do not have any issue with this configuration; i.e. it works exactly the way it's supposed to. Recently, however, there has been reason to suspect that the two remote RADIUS servers are behaving inconsistently with each other (i.e. auth fails on one and then immediately succeeds on the other). Unfortunately, I have zero access to the remote RADIUS servers and limited access to the folks who could tell me whether something is, in fact, wrong with the remote configuration. In order to provide statistics on my end or at least look for trends, I would like to keep track of what remote server a given request is proxied to, but I can't seem to find an easy way of doing it: - I have auth_logging turned on so that my radius.log file contains basic Yay/Nay information about a particular auth request, but the IP of the server the request was proxied to is not included. - I have detail configured for auth-detail, pre-proxy-detail, post-proxy-detail, and reply-detail. All are pretty much stock except I put the User-Name into the header in a couple of them. None of these show the IP of the particular home server that a given request was sent to. I do understand that I can get this information if I run a full debug trace, however this is a production system and I don't need all that information, just one little piece, nor do I want to run a production server outputting to stdout. I have also peeled through all the dictionary files looking for an appropriate RADIUS Attribute which I could use. I found Packet-Src-Ip-Address and Packet-Dst-Ip-Address, which didn't work in any of the detail sections, as they all returned 127.0.0.1, which makes some sense to me given the initial source and destination of the request packets; I'm also pretty sure I shouldn't be using parameters from dictionary.freeradius.internal this way. I also found FreeRADIUS-Proxied-To, however it appears that's only for accounting packets. So my question is this: short of editing the source to make the auth_log pop the home server being contacted into the loglines in radius.log, is there any way to get that information on a per-request basis? Is there some unlang magic I could work in the pre- or post-processing phases? It doesn't really matter to me where the information goes, as long as I can associate it with a particular request. Thanks, /a -- Aaron Spanik a.spanik(a)ns.sympatico.ca

2 3

Re: Quota Control based on freeradius and SSG
by ahmed adel 25 Aug '08

25 Aug '08

Can anyone send me a sample for the configuration for Quota control service profile in users file. ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, August 25, 2008 6:22:09 PM Subject: Re: Quota Control based on freeradius and SSG It is a separate entry (in users file). Documentation does explain what needs to be in the service profile in order to generate an additional request. Use += operator to put multiple service info attributes in a reply packet. http://www.cisco.com/en/US/docs/ios/12_2/12_2b/12_2b4/feature/guide/12bssgp… pap will live with Password as attibute, but for current freeradius version it should be Cleartext-Password. Ivan Kalik Kalik Informatika ISP Dana 25/8/2008, "ahmed adel" <ahmedadel4eg(a)yahoo.com> piše: >I don't get a request for Quota, where does the Quota belong, I don't know where else to define it > > > > >----- Original Message ---- >From: Ivan Kalik <tnt(a)kalik.net> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Monday, August 25, 2008 1:11:41 PM >Subject: Re: Quota Control based on freeradius and SSG > >Post the debug. If you have set things up properly you should get three >requests: one for the user, one for the service and one for the quota. >Quota doesn't belong in service profile. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 25/8/2008, "ahmed adel" <ahmedadel4eg(a)yahoo.com> piše: > >>Hi >> I have a setup where there is cisco 7200 router having SSG enabled on it, I want to enable quota control using SSG and radius. I made a service profile: >> >>quota Password := "cisco" >> Service-Type = Outbound-User, >> Cisco-Service-Info = "R0.0.0.0;0.0.0.0", >> Cisco-Control-Info = "QV100" >> >>and the router logs the user in and gets the profile from the radius but doesn't assign a quota to the user. I followed Cisco documentation but without any success. If anyone has faced a situation like this or succeeded in such a configuration please help. >> >>Best Regards >> >> >> >> >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

TLS_accept:error in SSLv3 read client certificate A
by Martin Silvero 25 Aug '08

25 Aug '08

the method is eap+tls, ticket that need to know and what post. thanks!!! -- -- Silvero Martin

1 0

Re: Quota Control based on freeradius and SSG
by ahmed adel 25 Aug '08

25 Aug '08

I don't get a request for Quota, where does the Quota belong, I don't know where else to define it ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Monday, August 25, 2008 1:11:41 PM Subject: Re: Quota Control based on freeradius and SSG Post the debug. If you have set things up properly you should get three requests: one for the user, one for the service and one for the quota. Quota doesn't belong in service profile. Ivan Kalik Kalik Informatika ISP Dana 25/8/2008, "ahmed adel" <ahmedadel4eg(a)yahoo.com> piše: >Hi > I have a setup where there is cisco 7200 router having SSG enabled on it, I want to enable quota control using SSG and radius. I made a service profile: > >quota Password := "cisco" > Service-Type = Outbound-User, > Cisco-Service-Info = "R0.0.0.0;0.0.0.0", > Cisco-Control-Info = "QV100" > >and the router logs the user in and gets the profile from the radius but doesn't assign a quota to the user. I followed Cisco documentation but without any success. If anyone has faced a situation like this or succeeded in such a configuration please help. > >Best Regards > > > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Quota Control based on freeradius and SSG
by ahmed adel 25 Aug '08

25 Aug '08

Hi I have a setup where there is cisco 7200 router having SSG enabled on it, I want to enable quota control using SSG and radius. I made a service profile: quota Password := "cisco" Service-Type = Outbound-User, Cisco-Service-Info = "R0.0.0.0;0.0.0.0", Cisco-Control-Info = "QV100" and the router logs the user in and gets the profile from the radius but doesn't assign a quota to the user. I followed Cisco documentation but without any success. If anyone has faced a situation like this or succeeded in such a configuration please help. Best Regards

2 1

Re: Re: Re: expiration or session-timeot
by Bozhan Boiadzhiev 24 Aug '08

24 Aug '08

Thank you Ivan, it works as you said. As i read in documentation Expiration attribute have accept date values and as in mysql i decide that it is only date. May be it is good if this is fixed in documentation. And i don't know how this can be done Thanks Bozhan Boiadzhiev >-------- Оригинално писмо -------- >От: "Ivan Kalik" >Относно: Re: Re: expiration or session-timeot >До: "FreeRadius users mailing list" >Изпратено на: Четвъртък, 2008, Август 21 00:02:21 EEST >>As i understand Expiration attribute can get only date values. > >No, date and time: > >August 20 2008 13:45:00 > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

RE: radsniff
by Lemaster, Rob 24 Aug '08

24 Aug '08

Thank you for your quick reply. I tried radsniff -h before posting. What I'm hoping to do is to troubleshoot a particular user, but I don't think I'm using the -r option correctly. # ./radsniff -i lo -rFOO -ssecret -X radsniff: Invalid RADIUS filter "(null)": expecting operator No matter what I use for -r, I get the same reply. When I use it without -r, I get basically the same as radtest output. Could you reply with some examples of the correct usage of this command? Is it possible to do a regex on a username or on Access-Rejects with radsniff? thanks ------------------------------ Message: 5 Date: Fri, 22 Aug 2008 20:54:53 -0700 From: "Lemaster, Rob" <rlemaste(a)covad.com> Subject: radsniff To: <freeradius-users(a)lists.freeradius.org> Message-ID: <3BC5D44AB71A754FAE3CA68A7597EABE0F82C86C(a)ZANEVS03.cc-ntd1.covad.com> Content-Type: text/plain; charset="iso-8859-1" I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples? ------------------------------ Message: 6 Date: Sat, 23 Aug 2008 06:51:31 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: radsniff To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48AF9753.8040602(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Lemaster, Rob wrote: > I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably doing it wrong). Anyone got any examples? $ radsniff -h It's a simple wrapper around libpcap. It can also print out the contents of RADIUS packets using the FreeRADIUS dictionaries. Wireshark does more, but it's dictionaries aren't as up to date, and it's a *lot* bigger. Alan DeKok.

2 1

Re: Fwd: Certificate problem on Windows XP clinet ...
by Venkata LK Mula 23 Aug '08

23 Aug '08

Hi Ivan, "network Roaming test2" in which "Roaming test2" is the SSID. regards, Venkat ----- Original Message ----- From: "Ivan Kalik" <tnt(a)kalik.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: Fwd: Certificate problem on Windows XP clinet .. Date: Sat, 23 Aug 2008 01:51:24 +0100 > How? What do you think we know about "network Roaming > test2" setup? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 22/8/2008, "Venkata LK Mula" > <vlkmula(a)saitechnology.com> piše: > > > Hi, > > Can any body respond to my earlier requst please. > > > > regards, > > Venkat > > > > > >----- Forwarded Message ----- > >From: "Venkata LK Mula" > >To: > >Subject: Certificate problem on Windows XP clinet ... > >Date: Thu, 21 Aug 2008 00:33:26 +0530 > > > > > > > > Hi, > > > > Regarding the above mentioned subject, we are facing the > > problem of "Windows was unable to find the certificate > > to log on to the network Roaming test2". > > > > Though the certificates are installed properly, and when > > we are using the same certificates for 'PEAP-MSCHAPv2' > > with 'validate server certificate' working fine. > > > > Can any one look into the same and respond me back > please. > > > regards, > > Venkat > > > > > > > > [Attachment: cacert.der] > > [Attachment: clinet.p12] > > > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: Fwd: Certificate problem on Windows XP clinet ...
by Venkata LK Mula 23 Aug '08

23 Aug '08

Hi Ivan, "network Roaming test2" in which "Roaming test2" is the SSID. regards, Venkat ----- Original Message ----- From: "Venkata LK Mula" To: FreeRadius users mailing list Subject: Re: Fwd: Certificate problem on Windows XP clinet .. Date: Sat, 23 Aug 2008 08:31:01 +0530 > Hi Ivan, > > "network Roaming test2" in which "Roaming test2" is the > SSID. > > regards, > Venkat > > ----- Original Message ----- > From: "Ivan Kalik" > To: "FreeRadius users mailing list" > > Subject: Re: Fwd: Certificate problem on Windows XP clinet > .. > Date: Sat, 23 Aug 2008 01:51:24 +0100 > > > How? What do you think we know about "network Roaming > > test2" setup? > > > > Ivan Kalik > > Kalik Informatika ISP > > > > > > Dana 22/8/2008, "Venkata LK Mula" > > piše: > > > > > Hi, > > > Can any body respond to my earlier requst please. > > > > > > regards, > > > Venkat > > > > > > > > >----- Forwarded Message ----- > > >From: "Venkata LK Mula" > > >To: > > >Subject: Certificate problem on Windows XP clinet ... > > >Date: Thu, 21 Aug 2008 00:33:26 +0530 > > > > > > > > > > > > Hi, > > > > > > Regarding the above mentioned subject, we are facing > > > the problem of "Windows was unable to find the > > > certificate to log on to the network Roaming test2". > > > > > > Though the certificates are installed properly, and > > > when we are using the same certificates for > > > 'PEAP-MSCHAPv2' with 'validate server certificate' > > working fine. > > > > Can any one look into the same and respond me back > > please. > > > > regards, > > > Venkat > > > > > > > > > > > > [Attachment: cacert.der] > > > [Attachment: clinet.p12] > > > > > > > > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

2 1