- Freeradius-Users - lists.freeradius.org

need help on accounting respond
by Do Nguyen Ha 10 Jun '08

10 Jun '08

> hi all > > i need help on account of freeradius > > Accounting Respond Message: > > AttributeID Vendor ID Sub Attribute ID Status Attribute Name > Type Value > 26 9 101 O > h323-credit-amount String Customer balance at the time of > authentication > 26 9 103 M+ > h323-return-code Integer 5 > 26 9 109 O > h323-billing-model Integer Type of billing service for a specific > call: > > 0 = credit customer (post-paid) > > 1= debit card (prepaid) > > 2= limited service (prepaid) > > 3= limited service (postpaid) > 26 9 110 O > h323-currency String Customer currency in the form of > 3-character value from ISO 4217 (e.g. USD) > > > now i want freeradius reply to the client with Accounting Respond with the > structure of message above > > the M+ : is required > > where do i edit to make it works > > > > Thanks > > Ha` > Message: 4 > Date: Mon, 09 Jun 2008 13:16:34 +0100 > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: Fw: need help on accounting respond > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <ahvE3AEn.1213013794.6975800.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Wherever you keep user details - users file, sql, ldap, ... > > Ivan Kalik > Kalik Informatika ISP > > Hi IvanKalik can you give me an example of it i use MySQL, at this time only testing with some subscribers the radacct table is now empty, what information should i put could you give me an example of radacct table i send attached file which is the sample of Accounting request Thanks Ha`

2 1

RE: rlm_ippool fail
by Ivan Kalik 10 Jun '08

10 Jun '08

>You are suposed to delete those files when you are changing ip pool >range. Module should be able to start without them. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 5/6/2008, "Alan DeKok" <aland at deployingradius.com> piše: > >>tg_melo at bol.com.br wrote: >>> I had a freeradius server 1.1.7 running up with some errors when doing updates in radacct (mysql) some hours after it just started. Since then, I decided to upgrade to >>2.0.4. But now, it refuses to start with the error "rlm_ippool: Failed to open file $(raddbdir)/db.ippool: No such file or directory". >> >> Does the file exist? FreeRADIUS is at the mercy of the OS here. If >>the OS says "no such file or directory", it means "no such file or >>directory". No amount of playing with the FreeRADIUS configuration will >>make the file suddenly exist. >> >>> Finally, /usr/local/etc/raddb/ is with the right permissions to the user freeradius. >>> So, what's wrong? >> >> Does the db.ippool file exist? >> >> Alan DeKok. >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> OK. I was able to recreate this when I installed 2.0.5. All modules using db.* files (counters, ippool, ...) were affected. Turned out that there is an error in radiusd.conf: prefix = @prefix@ exec_prefix = @exec_prefix@ sysconfdir = @sysconfdir@ localstatedir = @localstatedir@ sbindir = @sbindir@ logdir = @logdir@ raddbdir = @raddbdir@ radacctdir = @radacctdir@ # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # Should likely be ${localstatedir}/lib/radiusd db_dir = $(raddbdir) <<== It should be: db_dir = ${raddbdir} (brackets are wrong) Ivan Kalik Kalik Informatika ISP

2 1

proxy problems with 2.0.5
by Pshem Kowalczyk 10 Jun '08

10 Jun '08

Hi, I upgraded our test server from 2.0.4 to 2.0.5 today and proxy setup we use stopped working. Currently (2.0.4) we have following entries in the users.conf: DEFAULT User-Name =~ '@bitstream.dsl.xxxx$', Proxy-To-Realm := quik-dsl Cisco-AVpair += "ip:dns-servers=x.y.129.67 x.y.129.68", Framed-Pool += "ubs-1", Huawei-Primary-DNS += "x.y.129.67", Huawei-Secondary-DNS += "x.y.129.68" And as expected after the home server said 'accept' I could see the following reply: Framed-Protocol = PPP Service-Type = Framed-User Framed-Pool = "ubs-1" Huawei-Primary-DNS = x.y.129.67 Huawei-Secondary-DNS = x.y.129.68 (a combination of reply from the home server and proxy, plus some filtering). On the 2.0.5 - i only get the attributes from the home servers, stuff doesn't get appended by proxies. Should that continue to work? kind regards Pshem

2 5

PAM, ms-chap and shadow passwords
by up＠3.am 09 Jun '08

09 Jun '08

I understand that radius authenticating ppp (PPTP in this case) connections against shadow passwords requires cleartext authentication (PAP). Does PAM allow you to work around this? From reading what I can find on PAM, it would seem that FreeRADIUS would pass off the authentication request to PAM and PAM could then take care of the crypt/decrypt, thus allowing CHAP or MSCHAP client authentication against shadow passwords. Is this correct? TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

2 1

Authorization queries based on realm
by sub 09 Jun '08

09 Jun '08

Hi guys, I looked around a bit but I've not found an answer to my question. I have a freeradius server, it works fine and so on but now I need to differentiate class of users that is that I have users of class A that have a Max-All-Session attribute which I manipulate with standard accounting informations and queries (and with the noresetcounter). Class B users, instead, should have access guaranteed only if they have valid access credentials (i.e. username and password) and they should not have a check of Max-All-Session attribute so they have to use resources without any time limit. I thought to use realms but I don't know if it's the right manner to configure this need as I am only able to configure a different radius server according to realm value. Any suggestion please? Thanks, sub

2 1

Fw: need help on accounting respond
by Do Nguyen Ha 09 Jun '08

09 Jun '08

hi all i need help on account of freeradius Accounting Respond Message: AttributeID Vendor ID Sub Attribute ID Status Attribute Name Type Value 26 9 101 O h323-credit-amount String Customer balance at the time of authentication 26 9 103 M+ h323-return-code Integer 5 26 9 109 O h323-billing-model Integer Type of billing service for a specific call: 0 = credit customer (post-paid) 1= debit card (prepaid) 2= limited service (prepaid) 3= limited service (postpaid) 26 9 110 O h323-currency String Customer currency in the form of 3-character value from ISO 4217 (e.g. USD) now i want freeradius reply to the client with Accounting Respond with the structure of message above the M+ : is required where do i edit to make it works Thanks Ha`

2 1

PEAP version 1
by Riccardo Veraldi 09 Jun '08

09 Jun '08

Hello, new network manager version prompt for PEAP version 0 or version 1. Is there support for PEAP version 1 on freeradius ? thanks Riccardo

2 1

Version 2.0.5 has been released
by Alan DeKok 09 Jun '08

09 Jun '08

We are pleased to announce the release of version 2.0.5 of the FreeRADIUS server. Download: http://freeradius.org/download.html FreeRADIUS 2.0.5 ; Date: 2008/05/30 09:31:23 , urgency=medium Feature improvements * Permit SQL authorize_reply_query to be empty. * Allow setting response packet type in Post-Proxy-Type Fail handler. * Added install-chown target to set correct permission and ownership, via make RADMIN=radmin RGROUP=radius install-chown * Support for LDAP-Group and other dynamic comparison attributes in unlang. Developed from a patch by Jason Alderfer. * Added chroot support. See radiusd.conf for comments. * Allow clients of 0/0. We do not recommend using this, though. * Moved many module configurations into raddb/modules/* Bug fixes * Allow proxying to virtual servers for accounting packets, too. * Added "num fields" function to PostgreSQL client. * Updated proxy fallback mechanism to validate fallback servers, and to process fallback requests in a child thread. * rlm_realm returns "ok" for LOCAL realms, not "noop". * Fixed some DHCP code handling. The examples should now work.

3 3

Re: Freeradius-Users Digest, Vol 38, Issue 32
by Piero Giobbi 09 Jun '08

09 Jun '08

Hi Alan. Hers's my version: OpenSSL> version OpenSSL 0.9.8g 19 Oct 2007 OpenSSL> p 7 jun 2008 kl. 12.00 skrev freeradius-users- request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > Today's Topics: > > 1. Re: Problems compiling Freeradius 2.0.4 on Fedora 8. > (A.L.M.Buxey(a)lboro.ac.uk) > 2. Re: logging of tls logons (Vladimir Vassiliev) > > Från: A.L.M.Buxey(a)lboro.ac.uk > Datum: lö 7 jun 2008 09.40.22 GMT+02:00 > Till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > Ämne: Re: Problems compiling Freeradius 2.0.4 on Fedora 8. > Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > > hi, > > what version of OpenSSL do you have? > > alan > > > > > Från: Vladimir Vassiliev <vova(a)edu.yar.ru> > Datum: lö 7 jun 2008 09.54.16 GMT+02:00 > Till: freeradius-users(a)lists.freeradius.org > Ämne: Re: logging of tls logons > Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > >> So, how can I get in logs exactly common names? > > As I understand, only way to do it is > > check_cert_cn = %{User-Name} > > in eap.conf? > > -- > Vladimir Vassiliev <vova(a)edu.yar.ru> > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PEAP problem when using domain suffix
by Graham Marsh 08 Jun '08

08 Jun '08

Hi Have set up freeradius on a SLES10SP1 box in order to do 802.1X authentication. All is fine if the client submits a request using just the user name e.g. test05 in the case below: Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: Told to do MS-CHAPv2 for test05 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 6 modcall: leaving group MS-CHAP (returns ok) for request 6 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 However, if the user submits a request with the domain name appended such as @xyz.edu.hk, then the request fails at the same point in the process as shown: Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: Told to do MS-CHAPv2 for test08(a)xyz.edu.hk with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 6 I defined the domain suffix in the proxy conf file and set it to LOCAL because the local server should process the requests no matter whether the suffix is there or not. I also tried rewriting the User-Name attribute to remove the suffix (which is already done by Stripped-User-Name) but that caused another problem. So I'm at the point where just scratching my head...any hints most appreciated. Graham Marsh Hong Kong

4 9