- Freeradius-Users - lists.freeradius.org

Adding a counter to raddb/sql/mysql/counter.conf
by Liran Tal 30 Jul '08

30 Jul '08

Hey, How about adding more widely used counters to the counter.conf collection? One suggestion is the Access-Period counter which is provided with the attachment. Regards, Liran Tal.

1 0

%{2} not expanding for accounting packets?
by Phil Mayers 30 Jul '08

30 Jul '08

We've got some switches that don't include the MAC address in the Calling-Station-Id of accounting packets. To simplify the config, I use an unlang expression to add it: if ((!Calling-Station-Id) && (NAS-Port-Type == Ethernet) && (User-Name =~ /(..)(..)(..)(..)(..)(..)/)) { update request { Calling-Station-Id = "%{1}:%{2}:%{3}:%{4}:%{5}:%{6}" } } However, the output of that is: 00::22:33:44:55 ...which is odd: rad_recv: Accounting-Request packet from host 172.16.54.36 port 32770, id=92, length=113 Acct-Status-Type = Start User-Name = "001E0BA09F67" NAS-IP-Address = 172.16.54.36 Acct-Session-Id = "Tue Jul 29, 2008 18:54:00" Service-Type = Login-User NAS-Port = 1035 NAS-Port-Type = Ethernet Tunnel-Private-Group-Id:0 = "14" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Acct-Delay-Time = 0 server macauth { +- entering group preacct calling-mac-1: Could not find value pair for attribute Calling-Station-Id ++[calling-mac-1] returns noop calling-mac-2: Could not find value pair for attribute Calling-Station-Id ++[calling-mac-2] returns noop called-mac-1: Could not find value pair for attribute Called-Station-Id ++[called-mac-1] returns noop called-mac-2: Could not find value pair for attribute Called-Station-Id ++[called-mac-2] returns noop ++? if ((!Calling-Station-Id) && (NAS-Port-Type == Ethernet) && (User-Name =~ /(..)(..)(..)(..)(..)(..)/)) ?? Evaluating !(Calling-Station-Id) -> FALSE ?? Evaluating (NAS-Port-Type == Ethernet) -> TRUE ?? Evaluating (User-Name =~ /(..)(..)(..)(..)(..)(..)/) -> TRUE ++? if ((!Calling-Station-Id) && (NAS-Port-Type == Ethernet) && (User-Name =~ /(..)(..)(..)(..)(..)(..)/)) -> TRUE ++- entering if ((!Calling-Station-Id) && (NAS-Port-Type == Ethernet) && (User-Name =~ /(..)(..)(..)(..)(..)(..)/)) expand: %{1}:%{2}:%{3}:%{4}:%{5}:%{6} -> 00::0B:A0:9F:67 Similar expressions in the "authorize" section appear to work. Anyone have any ideas?

2 3

peap/mschapv2 + mysql + filter-id
by Adam W. Sewell 30 Jul '08

30 Jul '08

I've been working trying to setup freeradius to work with peap/mschapv2 backended by a mysql database on Enterasys switches. I've got almost everything working except for when a user authenticates with a 802.1x supplicant with peap/mschapv2, freeradius sends an access-accept packet but does not append the Filter-Id that is required for Enterasys switches to switch the default port policy. However, when I authenticate to the management portion of the switch, which uses pap, it authenticates and sends the Filter-Id as it should. I'm not sure what I'm missing here and I honestly don't know what configs you guys would need to see to help with this. So if I can provide any logs or config files, please let me know. Thanks for any help.

2 2

SIGHUP
by Raffael Himmelreich 30 Jul '08

30 Jul '08

Hi there again, I'm trying to change the detailfile location on the fly. But when I edit the value in the config file and send the process a HUP signal this is what I get: Wed Jul 30 09:45:11 2008 : Debug: Received HUP signal. Wed Jul 30 09:45:11 2008 : Debug: Module: Trying to reload module "detail" Wed Jul 30 09:45:11 2008 : Debug: detail { Wed Jul 30 09:45:11 2008 : Debug: detailfile = "/dev/null" Wed Jul 30 09:45:11 2008 : Debug: header = "%t" Wed Jul 30 09:45:11 2008 : Debug: detailperm = 384 Wed Jul 30 09:45:11 2008 : Debug: dirperm = 493 Wed Jul 30 09:45:11 2008 : Debug: locking = no Wed Jul 30 09:45:11 2008 : Debug: log_packet_header = no Wed Jul 30 09:45:11 2008 : Debug: } Unfortunately "/dev/null" is the old value. What I try to archive is dynamic relaying. I want to enable and disable relaying while the server is running. I'm open to other solutions too. :) best regards

2 1

peap-tls support in freeradius
by Gopinath Reddy N 30 Jul '08

30 Jul '08

Hi, I would like to know whether peap-tls(peap as outer authentication, tls as inner authentication method) is supported in freeradius. Some of my clients use peap-tls so want to know whether its supported by freeradius. I tried using a setup that works for tls for peap-tls but it fails saying "rlm_eap_peap: Tunneled data is invalid. " Thanks in advance for ur help. Regards Gopi

2 4

Openser+radiusclient-ng+Freeradius+IAS
by António Rio Costa 30 Jul '08

30 Jul '08

Hi all, I'm trying to put toghether one way to register softphones into openser doing the users authentication in IAS. I would like to put some questions into the list in way to clear out my doubts. 1 Can radiusclient-ng authenticate in IAS ???? If so how? I've tried it and IAS says that there is an malformed radius message. 2 Putting freeradius in the midlle of the radiusclient-ng and IAS shoud he act as a proxy between the radiusclient-ng and the IAS? this configuration works? has anyone done it? Thanks in advance for all the help that anyone can give

2 1

Ldap-Group unlang FR 2.0.5
by Rohaizam Abu Bakar 30 Jul '08

30 Jul '08

OS: FB 7.0 FR: 2.0.5 Let we analyze below if statement using unlang with Ldap-Group:- ++? if (("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) && ((ldap1-Ldap-Group == "UNLIMITED") || (ldap2-Ldap-Group == "UNLIMITED"))) expand: %{NAS-Port-Type} -> ?? Evaluating ("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) -> FALSE ??? Skipping (ldap1-Ldap-Group == "UNLIMITED") ??? Skipping (ldap2-Ldap-Group == "UNLIMITED") ++? if (("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) && ((ldap1-Ldap-Group == "UNLIMITED") || (ldap2-Ldap-Group == "UNLIMITED"))) -> TRUE ++- entering if (("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) && ((ldap1-Ldap-Group == "UNLIMITED") || (ldap2-Ldap-Group == "UNLIMITED"))) suppose if ("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) -> FALSE, the whole line should FALSE. but why it show TRUE? It is AND (&&) comparison. Or possible problem in my if statement?? --haizam

1 0

Digest Authentications Cisco Access Registrar 4.1.X
by Hoa But 30 Jul '08

30 Jul '08

Hello, Thanks for all the RADIUS messages. They are very helpful. I am able to successfully implemented digest authentications in FreeRADIUS and have been using it ever since. This is after getting help from the great people on this mailing. I wonder if anyone here has any experience Cisco Access Registrar 4.1.X as it relates to digest authentications? I know it is probably not related to FreeRADIUS but I tried everything and Cisco Access Registrar 4.1.X keeps dropping the Access-Request packets with response-type: -1. cisco support is of no help. I went through 5 support representatives so far. Below is the output of the trace file (i.e. name_radius_1_trace). This is running on Solaris 10 on a T1000 Ultrasparc T1 8 cores, 4 threads per core, 32 virtual cpus total. I am not sure if any of the cores make any difference. As always, your assistances are greatly appreciated. Best regards, Hoa ------------------ Output of trace file -------------------------- 07/29/2008 18:55:04: P11864: Packet received from 10.8.140.21 07/29/2008 18:55:04: P11864: Packet successfully added 07/29/2008 18:55:04: P11864: Trace of Access-Request packet 07/29/2008 18:55:04: P11864: identifier = 209 07/29/2008 18:55:04: P11864: length = 218 07/29/2008 18:55:04: P11864: reqauth = cf:04:c9:51:ae:f5:ed:34:aa:47:61:ed:9f:96:63:eb 07/29/2008 18:55:04: P11864: User-Name = fakeuser 07/29/2008 18:55:04: P11864: Service-Type = 200 07/29/2008 18:55:04: P11864: NAS-Identifier = qcs-qchat-ops-2-3.qln.test.com.(none) 07/29/2008 18:55:04: P11864: NAS-Port-Type = Virtual 07/29/2008 18:55:04: P11864: Digest-Response = fakeqcdigest 07/29/2008 18:55:04: P11864: Digest-Attributes = { Realm = fakedomain } 07/29/2008 18:55:04: P11864: Digest-Attributes = { Nonce = fakeqcnonce } 07/29/2008 18:55:04: P11864: Digest-Attributes = { Method = QCHAT-REGISTER } 07/29/2008 18:55:04: P11864: Digest-Attributes = { URI = fakedomain } 07/29/2008 18:55:04: P11864: Digest-Attributes = { QOP = auth } 07/29/2008 18:55:04: P11864: Digest-Attributes = { Algorithm = MD5-sess } 07/29/2008 18:55:04: P11864: Digest-Attributes = { CNonce = fakeqccnonce } 07/29/2008 18:55:04: P11864: Digest-Attributes = { Nonce-Count = 1 } 07/29/2008 18:55:04: P11864: Digest-Attributes = { User-Name = fakeuseraddr } 07/29/2008 18:55:04: P11864: Running Server's IncomingScript: show-contents 07/29/2008 18:55:04: Log: Request from 10.8.140.21: Server IncomingScript failed fakeuser 07/29/2008 18:55:04: P11864: Dropping request (response-type: -1) 07/29/2008 18:55:04: P11864: Packet successfully removed ---------------------------------------------------------------------

1 0

Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow
by Ryan Pugatch 29 Jul '08

29 Jul '08

Hello everyone, I am having an issue where when a user attempts to authenticate the following error is logged: Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow FreeRADIUS receives appropriate information as to whether or not the credentials used were correct, but it also throws that error which I suspect is an easy fix. Unforunately, I'm not sure why it can't set that option correctly. Thanks, Ryan

1 0

radrelay freeradius 2.x
by Raffael Himmelreich 29 Jul '08

29 Jul '08

Hi there, I wonder if there's an easy way/guide to reproduce the freeradius 1.x radrelay behavior? I'm afraid that the copy-to-home-server solution does not execute the accounting requests, but only relays them. Am I right? I want to execute accounting requests and relay these packets to another RADIUS server for testing purposes. best regards

3 2