- Freeradius-Users - lists.freeradius.org

Group Expiration Date
by CoMeC 05 Jun '08

05 Jun '08

Hi, I was try to find an answer for my question, but without success.. I wanted to ask if it is possible to set expiration date for a group, so all users in this group won't get access after expiration date? "Expiration" works for single user (as a radcheck table attribute), but when I enter it in radgroupcheck, it doesn't work. Do I make a mistake anywhere, or it is just impossible? There are any other solutions? Please let me know, or send me any link, where I could get those info's. Best regards, CoMeC

4 3

Proxy Not working
by Bryan Evege 05 Jun '08

05 Jun '08

We are setting up 2 factor authentication with Wikid via our current freeradius server. Using Centos 4.6 and freeradisu 1.1.7. Raidus is currently using LDAP for user authentication. For some reason the radius server will not forward the Proxy requests to the wikid server even though it finds the realm in the proxy.conf file. If I run a tcpdump on the wiikid server there is nothing sent by the radius server. The radius server just continues down it's local ldap lookup and returns a user not found. I really need to get this working. I can post my entire radisud.conf if necessary. Any help would be greatly appreciated. Here's what I get in debug mode //rlm_realm: Looking up realm "vpn.net" for User-Name = "testuser(a)vpn.net" rlm_realm: Found realm "vpn.net" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm vpn.net rlm_realm: Adding Realm = "vpn.net" rlm_realm: Authentication realm is LOCAL. <-----This is what is strange to me. Why is it local? Shouldn't it be the server I have defined in proxy.conf (vpn.net)? Relevant radiusd.conf proxy_requests = yes $INCLUDE ${confdir}/proxy.conf ----------------- realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = yes (I've tried this with yes and with no. Makes no difference) ignore_null = yes (I've tried this with yes and with no. Makes no difference) } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } Startup Info [******]$ sudo /opt/freeradius/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/sql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: snmp = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 3 ldap: timelimit = 5 ldap: identity = *************************** ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "********" ldap: basedn = "dc=csctus,dc=net" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/opt/freeradius/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 10 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute atlanta-Ldap-Group rlm_ldap: Registering ldap_groupcmp for atlanta-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name atlanta rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /opt/freeradius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x86ff188 Module: Instantiated ldap (atlanta) ldap: server = "************" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 3 ldap: timelimit = 5 ldap: identity = "******************" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "********" ldap: basedn = "dc=csctus,dc=net" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/opt/freeradius/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 10 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute denver-Ldap-Group rlm_ldap: Registering ldap_groupcmp for denver-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name denver rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /opt/freeradius/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x87002f0 Module: Instantiated ldap (denver) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/opt/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/opt/freeradius/etc/raddb/huntgroups" preprocess: hints = "/opt/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/opt/freeradius/etc/raddb/users" files: acctusersfile = "/opt/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/opt/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/opt/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) main: smux_password = "**********" main: snmp_write_access = no SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: **************** SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. SMUX read start SMUX read len: 6 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 6 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Proxy.conf settings proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } { realm NULL { Type = radius Authhost = currentradius_server_IP:1812 # accthost = 127.0.0.1:1813 Secret = ************* } realm vpn.net { Type = radius Authhost = wikidserver_ip:1812 # accthost = 127.0.0.1:1813 Secret = ************** } Bryan Evege

2 1

(Fwd) Error on Accounting SQL
by Breuer Nicolas 05 Jun '08

05 Jun '08

Hello , Seems to have a bug on 2.0.4 WARNING: Deprecated conditional expansion ":-". See "man unlang" for details WARNING: Deprecated conditional expansion ":-". See "man unlang" for details The accounting is stored into the SQL. Paste the debug here : ++[files] returns noop +- entering group accounting expand: %{User-Name} -> BCXXX rlm_sql (sql): sql_set_user escaped user --> 'BCXXX' TRIED THE UPDATE RADACCT . expand: UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets- 64}', AcctOutputOctets = '%{Acct-Output-Octets-64}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' -> UPDATE radacct SET FramedIPAddress = '', AcctSessionTime = '', AcctInputOctets = '', AcctOutputOctets = '' WHERE AcctSessionId = '0D00003F280001EB-483E2C69' AND UserName = 'BCXXX' AND NASIPAddress= '217.112.179.x' rlm_sql (sql): Reserving sql socket id: 3 NOT POSSIBLE because the line doesn't exists so Alternate SQL query should be used. >>>>>> WARNING: Deprecated conditional expansion ":-". See "man unlang" for details WARNING: Deprecated conditional expansion ":-". See "man unlang" for details >>>>> What's this error below ? ALTERNATE QUERY expand: INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId,NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic,ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId,CallingStationId, ServiceType, FramedProtocol, FramedIPAddress,AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session- Id}','%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}','%{NAS-Port- Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} +%{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}','', '%{Acct-Input-Octets-64}', '%{Acct- Output-Octets-64}', '%{Called-Station-Id}','%{Calling-Station-Id}', '%{Service- Type}','%{Framed-Protocol}-1','%{Framed-IP-Address}', '0') -> INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId,NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic,ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId,CallingStationId, ServiceType, FramedProtocol, FramedIPAddress,AcctStartDelay) values('0D00003F280001EB-483E2C69', '5c28bc24233262ac','BCXXX', '', '217.112.179.X', '3777167632','Virtual', DATE_SUB('2008- 06-04 17:36:58',INTERVAL (0 +0) SECOND), '', '','', '', '', '','', 'Framed-User','PPP-1','', '0') rlm_sql (sql): Released sql socket id: 3 OK ++[sql] returns ok ++? if (!ok) ? ------- End of forwarded message -------

2 1

FreeRADIUS and SQLite: any experiences?
by Jos Vos 05 Jun '08

05 Jun '08

Hi, Since 2.0.3 (according to the changelog) there is a SQLite driver added (rlm_sql_sqlite). It is said to be preliminary and untested. Is anybody actually using it and able to provide some feedback? Thanks, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

2 1

Maximum Vendor Specific AV Pairs
by Danny Paul 05 Jun '08

05 Jun '08

Greetings All, I'm running FreeRADIUS version 1.1.7. I notice that sometimes not all vendor specific AV pairs are included in access-accept packets. I suspect that this is because I am hitting the maximum packet size of 4096 bytes. However, some of the information I've read tells me that there is no limit on the VSAs that can be included in an access-accept packet. Which is it? I've run the server in full debugging mode and there is no output relating to dropping attributes from the access-accept packet. All the best!

2 1

Reconfiguration of "rlm_fastusers.c" to compare User-Name in a case-insensitive
by Khaiti, Issam (ext) 05 Jun '08

05 Jun '08

Hi,All! Is there anybody knows, how can I extend or reconfigure " rlm_fastusers.c " , so that this one do match User-Names in a case-insensitive. Thank you in advance.

2 1

different cost for different services
by sub 04 Jun '08

04 Jun '08

Hello everybody, I'm going to set-up different services that are going to use the same freeradius server and accounts. So actually I have user X that with the same username/password can use service A and service B connecting from different NAS; services have a different cost to the end user. Is it possibile to configure freeradius in such a way where, for me, cost means a different amount of seconds? Thanks, sub

2 1

Freeradius with SAMBA
by vijayakumar 04 Jun '08

04 Jun '08

Dear All, I want to use my /etc/smbpasswd file for authenticating MSCHAP V2 .Is it possible??????? .If so what configuration changes to be made in raius.conf,eap.conf etc.......... Thanks in advance.. Regards. VIJAY

2 1

FreeRadius + OpenLDAP + Router Cisco VPN
by youness hsina 04 Jun '08

04 Jun '08

Hi all, sorry for my english ! i want to thank every all the member of this list for help that was given to me already . i'm going o introduce my subject. i configured a Radius server with LDAP and a router CISCO VPN . every thing is works with no problem! i can authentificate from my router cisco to the radius server i can authentificate from radius server to ldap server Every thing is OK !! i can also make a connection with my vpn router using the softwar ( UGent Vpn ) on a client machine i have some user on the ldap data base and i want to make test on my client machine . Do you know the software that can make a connection to the ldap using vpn connection ? any ideas will be appreciated thank you very much -- uness

1 0

TLS/wired fail
by 娟严 04 Jun '08

04 Jun '08

Hi,All! I 'd like to add some infos about this issue. TLS/wired is failed,but MD5/wired is successful. It's Ok when I use AP instead of switch authenticating eap/tls and eap/ttls with the same freeradius. Is it the problem of switch or the problem of radius? I think it's the problem of radius server,because md5 can authenticate successful, that means 802.1X works properly on switch. So how to configure freeradius as wired authentication? I don't use sql, I just add some items at the end of the users file,just like this: switch_client Cleartext-Password :="whatever" #################################### Hi,All! My freeradius version is v2.0.2,and I use cisco 2950 switch as Authenticator; the packet sent by server miss the EAP-TLS Fragments(server sent a packet which miss the server hello and ciper suilt messages after received a client hello packet),I don't kown what the prolbem.Can anybody help me? Here are the packets,the ip of radius server is:192.168.0.197,the ip of switch is:192.168.0.123. No. Time Source Destination Protocol Info 63 89.556162 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=3, l=116) Frame 63 (158 bytes on wire, 158 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.456040000 [Time delta from previous captured frame: 1.228814000 seconds] [Time delta from previous displayed frame: 89.556162000 seconds] [Time since reference or first frame: 89.556162000 seconds] Frame Number: 63 Frame Length: 158 bytes Capture Length: 158 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 144 Identification: 0x0003 (3) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x38c9 [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 124 Checksum: 0x12c3 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x3 (3) Length: 116 Authenticator: FE6787CBF64C4301CBAD5355610B9634 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=20 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 18 Type: Identity [RFC3748] (1) Identity (13 bytes): switch_client AVP: l=18 t=Message-Authenticator(80): 1C066799CF105346E40019AA2E291D22 Message-Authenticator: 1C066799CF105346E40019AA2E291D22 No. Time Source Destination Protocol Info 66 89.572574 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=3, l=64) Frame 66 (106 bytes on wire, 106 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.472452000 [Time delta from previous captured frame: 0.000009000 seconds] [Time delta from previous displayed frame: 0.016412000 seconds] [Time since reference or first frame: 89.572574000 seconds] Frame Number: 66 Frame Length: 106 bytes Capture Length: 106 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 92 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb800 [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 72 Checksum: 0x82ea [incorrect, should be 0xa1e2 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x3 (3) Length: 64 Authenticator: D2EF3D5B79C3B1A4742E4A8C5FB00BD0 Attribute Value Pairs AVP: l=8 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 6 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x20): Start AVP: l=18 t=Message-Authenticator(80): A58A6FE1C598F8E9A979BABECD78BF65 Message-Authenticator: A58A6FE1C598F8E9A979BABECD78BF65 AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE No. Time Source Destination Protocol Info 67 89.681078 192.168.0.123 192.168.0.197 RADIUS Access-Request(1) (id=4, l=224) Frame 67 (266 bytes on wire, 266 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.580956000 [Time delta from previous captured frame: 0.108504000 seconds] [Time delta from previous displayed frame: 0.108504000 seconds] [Time since reference or first frame: 89.681078000 seconds] Frame Number: 67 Frame Length: 266 bytes Capture Length: 266 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap:ssl] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_44:1b:40 (00:0a:8a:44:1b:40), Dst: Micro-St_89:79:21 (00:19:db:89:79:21) Destination: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.123 (192.168.0.123), Dst: 192.168.0.197 (192.168.0.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 252 Identification: 0x0004 (4) Flags: 0x00 0... = Reserved bit: Not set .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (0x11) Header checksum: 0x385c [correct] [Good: True] [Bad : False] Source: 192.168.0.123 (192.168.0.123) Destination: 192.168.0.197 (192.168.0.197) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 232 Checksum: 0x6329 [correct] [Good Checksum: True] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x4 (4) Length: 224 Authenticator: E1D8149F5F84CF6AB2EF07BC7AB683F2 Attribute Value Pairs AVP: l=6 t=NAS-IP-Address(4): 192.168.0.123 NAS-IP-Address: 192.168.0.123 (192.168.0.123) AVP: l=6 t=NAS-Port(5): 50003 NAS-Port: 50003 AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=15 t=User-Name(1): switch_client User-Name: switch_client AVP: l=19 t=Calling-Station-Id(31): 00-C0-02-2B-D6-04 Calling-Station-Id: 00-C0-02-2B-D6-04 AVP: l=6 t=Service-Type(6): Framed-User(2) Service-Type: Framed-User (2) AVP: l=18 t=State(24): 6B1410EF6B171D4FB7BBF03DE9D33AFE State: 6B1410EF6B171D4FB7BBF03DE9D33AFE AVP: l=110 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 108 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0x0): Secure Socket Layer SSL Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 97 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 93 Version: TLS 1.0 (0x0301) Random gmt_unix_time: Jun 3, 2008 00:35:22.000000000 random_bytes: 38DD0828D867BEEFB4B298B72518C35459979BC7ED92A0D7... Session ID Length: 0 Cipher Suites Length: 54 Cipher Suites (27 suites) Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039) Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038) Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016) Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013) Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a) Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033) Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032) Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f) Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007) Cipher Suite: TLS_DHE_DSS_WITH_RC4_128_SHA (0x0066) Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005) Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA (0x0063) Cipher Suite: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA (0x0062) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 (0x0061) Cipher Suite: TLS_DHE_RSA_WITH_DES_CBC_SHA (0x0015) Cipher Suite: TLS_DHE_DSS_WITH_DES_CBC_SHA (0x0012) Cipher Suite: TLS_RSA_WITH_DES_CBC_SHA (0x0009) Cipher Suite: TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA (0x0065) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA (0x0064) Cipher Suite: TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 (0x0060) Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0014) Cipher Suite: TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA (0x0011) Cipher Suite: TLS_RSA_EXPORT_WITH_DES40_CBC_SHA (0x0008) Cipher Suite: TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 (0x0006) Cipher Suite: TLS_RSA_EXPORT_WITH_RC4_40_MD5 (0x0003) Compression Methods Length: 1 Compression Methods (1 method) Compression Method: null (0) AVP: l=18 t=Message-Authenticator(80): 4A1E0B1F9718533C8A225B0FC8EBB617 Message-Authenticator: 4A1E0B1F9718533C8A225B0FC8EBB617 No. Time Source Destination Protocol Info 68 89.725405 192.168.0.197 192.168.0.123 RADIUS Access-challenge(11) (id=4, l=1090) Frame 68 (1132 bytes on wire, 1132 bytes captured) Arrival Time: Jun 3, 2008 08:32:22.625283000 [Time delta from previous captured frame: 0.044327000 seconds] [Time delta from previous displayed frame: 0.044327000 seconds] [Time since reference or first frame: 89.725405000 seconds] Frame Number: 68 Frame Length: 1132 bytes Capture Length: 1132 bytes [Frame is marked: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: Checksum Errors] [Coloring Rule String: cdp.checksum_bad==1 || edp.checksum_bad==1 || ip.checksum_bad==1 || tcp.checksum_bad==1 || udp.checksum_bad==1] Ethernet II, Src: Micro-St_89:79:21 (00:19:db:89:79:21), Dst: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Destination: Cisco_44:1b:40 (00:0a:8a:44:1b:40) Address: Cisco_44:1b:40 (00:0a:8a:44:1b:40) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Source: Micro-St_89:79:21 (00:19:db:89:79:21) Address: Micro-St_89:79:21 (00:19:db:89:79:21) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) Type: IP (0x0800) Internet Protocol, Src: 192.168.0.197 (192.168.0.197), Dst: 192.168.0.123 (192.168.0.123) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 1118 Identification: 0x0000 (0) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xb3fe [correct] [Good: True] [Bad : False] Source: 192.168.0.197 (192.168.0.197) Destination: 192.168.0.123 (192.168.0.123) User Datagram Protocol, Src Port: radius (1812), Dst Port: radius (1812) Source port: radius (1812) Destination port: radius (1812) Length: 1098 Checksum: 0x86ec [incorrect, should be 0x7116 (maybe caused by "UDP checksum offload"?)] [Good Checksum: False] [Bad Checksum: True] Radius Protocol Code: Access-challenge (11) Packet identifier: 0x4 (4) Length: 1090 Authenticator: BFFB901870A6B7784BF8FC427088FD1F Attribute Value Pairs AVP: l=255 t=EAP-Message(79) Segment[1] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[2] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[3] EAP fragment AVP: l=255 t=EAP-Message(79) Segment[4] EAP fragment AVP: l=14 t=EAP-Message(79) Last Segment[5] EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1024 Type: EAP-TLS [RFC2716] [Aboba] (13) Flags(0xC0): Length More Length: 2669 AVP: l=18 t=Message-Authenticator(80): F7F26F81A3C0666CA9725E9E0C46907C Message-Authenticator: F7F26F81A3C0666CA9725E9E0C46907C AVP: l=18 t=State(24): 6B1410EF6A101D4FB7BBF03DE9D33AFE State: 6B1410EF6A101D4FB7BBF03DE9D33AFE back at one.... ________________________________ 雅虎邮箱，您的终生邮箱！ ________________________________ 雅虎邮箱，您的终生邮箱！ ___________________________________________________________ 雅虎邮箱，您的终生邮箱！ http://cn.mail.yahoo.com/

1 0