- Freeradius-Users - lists.freeradius.org

Re: NAS-Post in Netgear Accounting-Packet
by Stefan Puch 19 Aug '08

19 Aug '08

> In the "Start"-Packets and "Interim-Update"-Packets it seems to be right. > > But ALL the "Stop"-Packets have 0 as NAS-Port. > > So, you agree that this is a bug of the Access-Point? > > Thank you for your reply. > > Wolfgang Burger Hello, I've got three WG102 Access Points from Netgear. I'm using the latest firmware Version 4.0.27 because it should "Fixed the issue that 802.1x Authentication does not work with machine authentication" But I can confirm that the accounting it still NOT working everytime. Looking into my logfiles I can see that the cases which worked fine everytime the same port is used. Here are two examples, the first one worked fine, the Session-Id is always the same: Wed Aug 13 20:05:14 2008 Service-Type = Framed-User Acct-Status-Type = Start User-Name = "test1" Framed-MTU = 1488 Acct-Session-Id = " 1" Acct-Authentic = RADIUS Acct-Delay-Time = 0 Called-Station-Id = "00184DC8XXXX:Network" Calling-Station-Id = "001A73XXXXXX" NAS-Identifier = "APBuero" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 NAS-Port-Id = "STA port # 1" Acct-Unique-Session-Id = "866e0c5655a05a0b" Timestamp = 1218650714 Request-Authenticator = Verified Wed Aug 13 20:10:13 2008 Service-Type = Framed-User Acct-Status-Type = Interim-Update User-Name = "test1" Framed-MTU = 1488 Acct-Session-Id = " 1" Acct-Authentic = RADIUS Acct-Session-Time = 299 Acct-Delay-Time = 0 Called-Station-Id = "00184DC8XXXX:Network" Calling-Station-Id = "001A73XXXXXX" NAS-Identifier = "APBuero" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 NAS-Port-Id = "STA port # 1" Acct-Unique-Session-Id = "866e0c5655a05a0b" Timestamp = 1218651013 Request-Authenticator = Verified Wed Aug 13 20:34:33 2008 Service-Type = Framed-User Acct-Status-Type = Stop User-Name = "test1" Framed-MTU = 1488 Acct-Session-Id = " 1" Acct-Authentic = RADIUS Acct-Session-Time = 1758 Acct-Terminate-Cause = User-Request Acct-Delay-Time = 0 Called-Station-Id = "00184DC8XXXX:Network" Calling-Station-Id = "001A73XXXXXX" NAS-Identifier = "APBuero" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 NAS-Port-Id = "STA port # 1" Acct-Unique-Session-Id = "866e0c5655a05a0b" Timestamp = 1218652473 Request-Authenticator = Verified ------------------------------------------------------------------------------------ But this second one from today fails with the error: Tue Aug 19 18:11:30 2008 : Auth: Login OK: [test2 /<via Auth-Type = EAP>] (from client AP-Halle1 port 1 cli 001302BEXXXX) Tue Aug 19 18:12:30 2008 : Error: rlm_radutmp: Logout for NAS AP-Halle1 port 0, but no Login record When looking into detail log I can also see, that the Session-Id and the port changed and I don't know why Tue Aug 19 18:11:30 2008 Service-Type = Framed-User Acct-Status-Type = Start User-Name = "test2" Framed-MTU = 1488 Acct-Session-Id = " 6" Acct-Authentic = RADIUS Acct-Delay-Time = 0 Called-Station-Id = "000000000000:Network" Calling-Station-Id = "001302BEXXXX" NAS-Identifier = "AP-Halle1" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.xx.xx NAS-Port = 1 NAS-Port-Id = "STA port # 1" Acct-Unique-Session-Id = "11f6ee9422434136" Timestamp = 1219162290 Request-Authenticator = Verified Tue Aug 19 18:12:30 2008 Service-Type = Framed-User Acct-Status-Type = Stop User-Name = "test2" Framed-MTU = 1488 Acct-Session-Id = " 6" Acct-Authentic = RADIUS Acct-Session-Time = 60 Acct-Terminate-Cause = User-Request Acct-Delay-Time = 0 Called-Station-Id = "000000000000:Network" Calling-Station-Id = "001302BEXXXX" NAS-Identifier = "AP-Halle1" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.xx.xx NAS-Port = 0 NAS-Port-Id = "STA port # 0" Acct-Unique-Session-Id = "9c44efbf7672967b" Timestamp = 1219162350 Request-Authenticator = Verified --------------------------------------------------------------------------- Obviously the netgear access point uses port 1 on start but port 0 on stop. Also the user is definitely NOT connected anymore but radwho shows the following: # radwho -R User-Name = "test2" Acct-Session-Id = " 6" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 Service-type = Login-User Framed-IP-Address = Acct-Session-Time = 10255 Calling-Station-Id = "001302BEXXXX" User-Name = "test2" Acct-Session-Id = " 16" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 Service-type = Login-User Framed-IP-Address = Acct-Session-Time = 8170 Calling-Station-Id = "001302BEXXXX" # It's shows that the user is still connected... Does anyone know how this is possible? Best regards Stefan Puch

2 1

Question regarding rlm_perl and Access-Challenge
by Harry J Walsh 19 Aug '08

19 Aug '08

Hi, I want to develop some test cases for a radius client I am developing and I would like to be able to use rlm_perl to simulate various scenarios. The one I am having major problems with is Access-Challenge. I really like rlm_perl and the flexibility it provides and I would like to be able to specify the reply type. I've looked through documentation and the rlm_perl code for any hints on how to do this and at this stage I'm thinking I'll have to create a new interface to allow my perl script to specify the correct reply type to rlm_perl. Do any of you know of an existing way to do this? -- Harry J Walsh

2 4

convert steel-belt radius .dct to freeradius dictionary
by S Adrian 19 Aug '08

19 Aug '08

Hi everybody, I got a file that looks like this (utstarcom.dct) which would need to be translated to freeradius .. anyone can help? >>start of file<< # utstarcom.dct - Radius dictionary for UTStarcom BBS1000 @radius.dct # # UTStarcom specific parameters # MACRO UTStarcom-VSA(t,s) 26 [vid=7064 type1=%t% len1=+2 data=%s%] ATTRIBUTE Utstarcom-VLAN-ID Utstarcom-VSA(140, integer) r ATTRIBUTE Utstarcom-CommittedBandwidth Utstarcom-VSA(142, integer) r ATTRIBUTE Utstarcom-MaxBandwidth Utstarcom-VSA(143, integer) r ATTRIBUTE Utstarcom-Priority Utstarcom-VSA(145, integer) r ATTRIBUTE Utstarcom-Error-Reason Utstarcom-VSA(147, integer) r ATTRIBUTE Utstarcom-PrimaryDNS Utstarcom-VSA(152, integer) r ATTRIBUTE Utstarcom-SecondaryDNS Utstarcom-VSA(153, integer) r ATTRIBUTE Utstarcom-MaxBurstSize Utstarcom-VSA(161, integer) r ATTRIBUTE Utstarcom-MaxDelay Utstarcom-VSA(162, integer) r ATTRIBUTE Utstarcom-MaxJitter Utstarcom-VSA(163, integer) r ATTRIBUTE Utstarcom-DeviceId Utstarcom-VSA(165, string) cr ATTRIBUTE Utstarcom-Module-Id Utstarcom-VSA(166, integer) cr ATTRIBUTE Utstarcom-Port-No Utstarcom-VSA(167, integer) cr ATTRIBUTE Utstarcom-Logical-Port-No Utstarcom-VSA(168, integer) r ATTRIBUTE Utstarcom-UNI-MAX-MAC Utstarcom-VSA(169, integer) r ATTRIBUTE Utstarcom-Default-Gateway Utstarcom-VSA(170, integer) r ATTRIBUTE Utstarcom-CLI-Access-Level Utstarcom-VSA(171, integer) r ATTRIBUTE Utstarcom-Act-Input-Octets Utstarcom-VSA(180, string) r ATTRIBUTE Utstarcom-Act-Output-Octets Utstarcom-VSA(181, string) r ATTRIBUTE Utstarcom-Act-Input-Frames Utstarcom-VSA(182, string) r ATTRIBUTE Utstarcom-Act-Output-Frames Utstarcom-VSA(183, string) r ATTRIBUTE Utstarcom-Onu-MC-Filter-Enable Utstarcom-VSA(184, integer) r ATTRIBUTE Utstarcom-UNI-Auto-Negotiation Utstarcom-VSA(185, integer) r ATTRIBUTE Utstarcom-UNI-Speed Utstarcom-VSA(186, integer) r ATTRIBUTE Utstarcom-UNI-Duplex Utstarcom-VSA(187, integer) r ATTRIBUTE Utstarcom-ONU-Admin_status Utstarcom-VSA(188, integer) r ATTRIBUTE Utstarcom-ONU-FW-SC-Upgrade Utstarcom-VSA(189, integer) r >>EOF<<

3 3

web based certificate management
by Tomoki Taniguchi 19 Aug '08

19 Aug '08

is there a good web based certificate management system that users of freeradius recommend? i need something that will apply the needed xpextensions and generate the necessary .p12 and .der certificates for a windows xp client. i am looking into editing the ebox-ca to generate the additional certificates, but would perfer not to have to go through the trouble if possible. TIA, Tomoki

2 1

final question about client certs using eap-tls (was: cert bootstrap bug?)
by Sergio 19 Aug '08

19 Aug '08

Hi, also was so many others. At this time i have got one eap module which authenticates users under a PKI. My client certs are issued by root ca (ca.pem) and everything works. I can manage the crl, because it is public, and authenticate any user against any server. So my question is, what's the final goal of signing certificates with server's? The only difference (i think) is about the crl managing, because in my case, the authority should provide the crl to the server administrators. I don't see any more difference. Thanks

1 1

Crash on x64?
by Alex Balashov 19 Aug '08

19 Aug '08

Greetings, I am running a very high-volume FreeRADIUS installation on RHEL 5 (not my choice), and noticed that FreeRADIUS was periodically dying after instantiating a great many worker servers. I looked at the output in GDB and got: Continuing. [New LWP 11400] [tcsetpgrp failed in terminal_inferior: Operation not permitted] (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread 47272748113904 (LWP 11350)] [New Thread 1328978240 (LWP 11441)] [New Thread 1318488384 (LWP 11439)] [New Thread 1370937664 (LWP 11438)] [New Thread 1307998528 (LWP 11437)] [New Thread 1360447808 (LWP 11436)] [New Thread 1140160832 (LWP 11435)] [New Thread 1297508672 (LWP 11434)] [New Thread 1287018816 (LWP 11433)] [New Thread 1276528960 (LWP 11432)] [New Thread 1266039104 (LWP 11431)] [New Thread 1119181120 (LWP 11430)] [New Thread 1255549248 (LWP 11429)] [New Thread 1245059392 (LWP 11428)] [New Thread 1234569536 (LWP 11427)] [New Thread 1129670976 (LWP 11423)] [New Thread 1203099968 (LWP 11422)] [New Thread 1339468096 (LWP 11421)] [New Thread 1108691264 (LWP 11420)] [New Thread 1349957952 (LWP 11419)] [New Thread 1213589824 (LWP 11412)] [New Thread 1224079680 (LWP 11411)] [New Thread 1094392128 (LWP 11410)] [New Thread 1538775360 (LWP 11406)] [New Thread 1528285504 (LWP 11405)] [New Thread 1517795648 (LWP 11404)] [New Thread 1192610112 (LWP 11403)] [New Thread 1507305792 (LWP 11402)] [New Thread 1496815936 (LWP 11401)] [New Thread 1486326080 (LWP 11400)] [New Thread 1475836224 (LWP 11399)] [New Thread 1465346368 (LWP 11398)] [New Thread 1454856512 (LWP 11397)] [New Thread 1444366656 (LWP 11396)] [New Thread 1433876800 (LWP 11395)] [New Thread 1423386944 (LWP 11394)] [New Thread 1412897088 (LWP 11393)] [New Thread 1161140544 (LWP 11392)] Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to Thread 1486326080 (LWP 11400)] 0x00002afe89997d19 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2 (gdb) Continuing. Program received signal SIGABRT, Aborted. 0x00002afe8ad3d155 in raise () from /lib64/libc.so.6 Is this a bug in the x64 libdl? -- Alex -- Alex Balashov Evariste Systems Web : http://www.evaristesys.com/ Tel : (+1) (678) 954-0670 Direct : (+1) (678) 954-0671 Mobile : (+1) (706) 338-8599

4 10

Realms and proxying
by Dean, Barry 19 Aug '08

19 Aug '08

I currently have a realm defined: realm liv.ac.uk { type = radius authhost = LOCAL accthost = LOCAL } I now have one of my departments, which for various complex reasons, has been allowed to have its own user accounts. They have the subdomain name "csc.liv.ac.uk". I want to proxy RADIUS to their server. If I add: realm csc.liv.ac.uk { type = radius authhost = server.csc.liv.ac.uk:1812 accthost = server.csc.liv.ac.uk:1813 } Is this position dependant? Does it have to appear before the liv.ac.uk realm to prevent "user(a)csc.liv.ac.uk" being caught by the first realm? I have: realm suffix { format = suffix delimiter = "@" } in radius.conf. --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

2 1

Locking accounts after failed attempts. pam_tally ?
by Mark Tunnell 19 Aug '08

19 Aug '08

Is there a way to disable radius access for a user after a specified number of incorrect passwords using the standard Unix passwd system? I have pam_tally running and it correctly increments on failed SSH login attempts. However, failed Radius attempts do not increment the counter. Is there a way to make pam_tally work with Radius or do I need to find another way to do this? Thanks, Mark

2 1

FreeRadius, MySQL, MAC Authentication w/ Dynamic VLAN
by James Taylor 19 Aug '08

19 Aug '08

Hello everyone! I am currently tasked with a new project where I have been asked to move our currently working 'users' file into a manageable MySQL DB (we have over 500 user entries so it's understandable). Below you will find a currently working entry from the 'users' file. Mac-addresss Auth-Type := local, User-Password == "password" Calling-Station-ID == "mac-address", Airespace-Wlan-Id = 5, Airespace-Interface-Name = Wireless WLAN Name, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE:802, Tunnel-Private-Group-ID = VLAN-ID As you can tell this is a wireless user and of course I have the dictionary attributes added (like I said it is currently a working users file) but my question is how to take this information and add it to the MySQL radius.radcheck database? From what I am seeing the ID is a primary key and must be unique and there is only one attribute field. I may be asking this incorrectly but, does the DB read the rows starting with the ID 1 being the first user and continue down until the next user entry and return all the rows into Radius for authentication? If you have any possible pointers it would be greatly appreciated! Thank you everyone! James Taylor FCIP Networks

3 6

Limiting a user to a specific realm
by Lisa Casey 18 Aug '08

18 Aug '08

Hi Folks, I know there's an easy way to do this, but I've googled a bit this morning and can't quite figure it out. We are running Freeradius with a users file (no database). I have several realms defined, each with a fallthrough like so: DEFAULT Realm == realm1.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 DEFAULT Realm == realm2.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 DEFAULT Realm == realm3.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 I also have these 3 realms defined in the realms file. The way things are setup now, username bob could log in as bob(a)realm1.com or bob(a)realm2.com or bob(a)realm3.com and as long as bob supplied the correct password he would be granted access and that's been fine up until now. What I'ld like to do is to fix it so that only certain usernames could log on as username(a)realm3.com (leave realm1.com and realm2.com as they are). So anyone with a correct username/password could log in using realm1.com or realm2.com but only bob, jane and alex could log in with realm3.com. I suppose I could add an entry in my users file as so: bob Realm=realm3.com, Auth-Type = Local, Password == xxxxx Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500 Would that work? How would I define realm3.com earlier in my users file? Would this work or is there a better way? Thanks, Lisa Casey

2 1