- Freeradius-Users - lists.freeradius.org

mysql isn't match with online users status
by Zahra Bahar 20 May '08

20 May '08

we have freeradius for accounting of dialup and vpn users. sometimes users have been stoped but they are online in mysql table . what's wrong? is there any log of commmands exchange between freeardius and mysql?

4 6

Re: SNMP error
by Alan DeKok 20 May '08

20 May '08

Edvin Seferovic wrote: > I am also curious about the answer on this question ! Are there any plans to > implement AgentX protocol into freeradius project? No plans. At this point, the only plans for 2.0 are minor feature improvements and bug fixes. I plan on spending time working on the book, unless otherwise motivated. Alan DeKok.

3 5

proxy.conf problem: username send with suffix
by Hans Bornemann 20 May '08

20 May '08

Hi, what is wrong in this configuration: # A standard realm entry. A request from "user(a)company.com" will be # sent to radius.company.com as "user", unless the 'nostrip' # configuration item is specified. If the 'nostrip' configuration # item is specified, then the request will be proxied as # "user(a)company.com" # realm tu-dortmund.de { type = radius authhost = LOCAL accthost = LOCAL } but freeradius takes username(a)tu-dortmund.de to check against radcheck. debug output: rad_recv: Access-Request packet from host 129.217.169.191:32769, id=14, length=280 User-Name = "mhanborn(a)tu-dortmund.de" Calling-Station-Id = "00-19-D2-CF-E5-50" Called-Station-Id = "00-0B-85-60-39-10:ITMC-WPA2" NAS-Port = 29 NAS-IP-Address = 129.217.157.246 NAS-Identifier = "mh-wlc4" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3503" EAP-Message = 0x0210005019800000004616030100410100003d03014832b93a0818b6073bdbd9b486630753af0d0f2e0469e2b071963d5240815fae00001600040005000a000900640062000300060013001200630100 State = 0x622cbb3df28c136e779e7cacb89d1a8d Message-Authenticator = 0xc969e31716dd9b76025be36ae5e396e4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 81 modcall[authorize]: module "preprocess" returns ok for request 81 modcall[authorize]: module "chap" returns noop for request 81 modcall[authorize]: module "mschap" returns noop for request 81 rlm_realm: Looking up realm "tu-dortmund.de" for User-Name = "mhanborn(a)tu-dortmund.de" rlm_realm: Found realm "tu-dortmund.de" rlm_realm: Adding Stripped-User-Name = "mhanborn" rlm_realm: Proxying request from user mhanborn to realm tu-dortmund.de rlm_realm: Adding Realm = "tu-dortmund.de" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 81 rlm_eap: EAP packet type response id 16 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 81 radius_xlat: 'mhanborn(a)tu-dortmund.de' rlm_sql (sql): sql_set_user escaped user --> 'mhanborn(a)tu-dortmund.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'mhanborn(a)tu-dortmund.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): User mhanborn(a)tu-dortmund.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mhanborn(a)tu-dortmund.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'mhanborn(a)tu-dortmund.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User mhanborn(a)tu-dortmund.de not found in radgroupcheck Thanks Hans -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

2 1

Segmentation fault when use Odyssey Client
by Hangjun He 20 May '08

20 May '08

If I select EAP-TTLS + use only my certificate for auth will cause segmentation fault. Others seems OK. Debug info: rad_recv: Access-Request packet from host 192.168.200.57:32785, id=95, length=325 User-Name = "bbb" NAS-IP-Address = 192.168.200.57 NAS-Identifier = "auth_test" NAS-Port = 0 Called-Station-Id = "00-19-77-02-E6-90:auth-wpa2-tkip-8021x" Calling-Station-Id = "00-1D-7E-03-2B-CF" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0215009015800000008616030100461000004200400d423029041904e4b654b0384c78b56d7490853af607b909c2f54fc376bebac512ebfb7663e9ee2fc7320d175037da31f09e90ad986d539d519d6ef6c39f577914030100010116030100302027f914730434165f520dc31734211631a5c96402b0ddabaf4d815209d07bb6c0f2817ed3a2233822587288715beab6 State = 0x4f6739def5f0e9f45fd60479253cc3cd Message-Authenticator = 0xe06aac6aeeefc91f7920fd60b05ea9ab Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "bbb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 21 length 144 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 rlm_ldap: - authorize rlm_ldap: performing user authorization for bbb radius_xlat: '(uid=bbb)' radius_xlat: 'ou=radius,dc=bestgo,dc=aero' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,dc=bestgo,dc=aero, with filter (uid=bbb) rlm_ldap: checking if remote access for bbb is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "1234" rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id:0 = "1" rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type:0 = IPv4 rlm_ldap: Adding radiusTunnelType as Tunnel-Type:0 = GRE rlm_ldap: user bbb authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 9 modcall: leaving group authenticate (returns handled) for request 9 Sending Access-Challenge of id 95 to 192.168.200.57 port 32785 Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IPv4 Tunnel-Type:0 = GRE EAP-Message = 0x0116004515800000003b1403010001011603010030b081e94e6f9087f3c237216ab3fd9d65fc8311b18e37e66208369fb451d373695f16b167d85e80c870295da3d2f21cf4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x10aabdcc7ef9ba295475b0706b6e070c Finished request 9 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.200.57:32785, id=96, length=187 User-Name = "bbb" NAS-IP-Address = 192.168.200.57 NAS-Identifier = "auth_test" NAS-Port = 0 Called-Station-Id = "00-19-77-02-E6-90:auth-wpa2-tkip-8021x" Calling-Station-Id = "00-1D-7E-03-2B-CF" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x021600061500 State = 0x10aabdcc7ef9ba295475b0706b6e070c Message-Authenticator = 0xa07cb0441d0e9d898030c912f9ae54d3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 modcall[authorize]: module "chap" returns noop for request 10 modcall[authorize]: module "mschap" returns noop for request 10 rlm_realm: No '@' in User-Name = "bbb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 10 rlm_eap: EAP packet type response id 22 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 rlm_ldap: - authorize rlm_ldap: performing user authorization for bbb radius_xlat: '(uid=bbb)' radius_xlat: 'ou=radius,dc=bestgo,dc=aero' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,dc=bestgo,dc=aero, with filter (uid=bbb) rlm_ldap: checking if remote access for bbb is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "1234" rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id:0 = "1" rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type:0 = IPv4 rlm_ldap: Adding radiusTunnelType as Tunnel-Type:0 = GRE rlm_ldap: user bbb authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 10 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 10 modcall: leaving group authorize (returns updated) for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 Segmentation fault John --------------------------------- 雅虎邮箱，您的终生邮箱！

2 1

freeradius documentation: Auth-Type
by NPY 20 May '08

20 May '08

Hi, As someone very new to freeradius, I find that I am struggling with the available documentation. I have problem trying to find explanations on important attributes such as Auth-Type on what it means, what are the valid values etc. Can someone point me to the right place? I know http://www.freeradius.org/rfc/attributes.htm is around but it does not list all attributes, including Auth-Type.

6 8

users advanced configuration
by tribestom 20 May '08

20 May '08

Hi I have a little hard to configure freeradius. here is what i want to do : I want to run an hotspot with different accounts which give different connection time. I have an openldap server with this organisation : dc=com | dc=exempl | | ou=heure ou=jour | | uid=user1 uid=user2 What i have running now : I can authenticate a users with a time limit. Here is my users file : DEFAULT Auth-Type = ldap,Max-Daily-Session := 3600 I want add a second line with correspond to a day like this : DEFAULT Auth-Type = ldap,Max-Daily-Session := 86400 and i want that user from ou=heure use the first one and user from ou=jour use the policy with a day time which attribute should i add to this line or how should i do to realize this. I haven t found any clue on the net how to do this. Here is my ldap conf in radiusd.conf : server = "192.168.20.240" # ip de la machine avec le serveur ldap identity = "cn=admin,dc=exempl,dc=lcom" # login sur le serveur ldap password = "******" # mots de passe sur le serveur ldap basedn = "dc=exempl,dc=com" # base de recherche sur le serveur ldap filter ="uid=%u" # filtre de recherche ( ici tout utilisateur ) ldap_connections_number = 5 # nombre de tentative de connection timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap edir_account_policy_check = no Sorry for my bad english and thanks for your help If you need more informations just tell me Tribolet Thomas

4 6

Question of Monthly-Session-Time
by Roberto Salazar M. 20 May '08

20 May '08

Hi: Sorry my english!! I need modify begin of period of Monthly-Session-Time parameter, this reset on 00:00:00 of the first day of each month, but I need set begin period in: day 24 of each month to 00:00:00. Is that possible? Regards, Roberto _________________________________________________________________ Do more with your photos with Windows Live Photo Gallery. http://www.windowslive.com/share.html?ocid=TXT_TAGLM_Wave2_photos_022008

1 0

RE: Cisco Mac-Auth-Bypass with Freeradius 2.0.4
by MONTFORD, AUSTIN 19 May '08

19 May '08

Frank & Ivan, Just wanted to thank yall for the advice and let you know this worked like a charm. Just had to change Fall-Through = True to Fall-Through = Yes which was simple enough using the debug output. Version thing with the syntax I guess... Thanks again! Austin -----Original Message----- Message: 5 Date: Fri, 16 May 2008 10:27:06 +1000 From: "Ranner, Frank MR" <Frank.Ranner(a)defence.gov.au> Subject: RE: Cisco Mac-Auth-Bypass with Freeradius 2.0.4 [SEC=UNCLASSIFIED] To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> ______________________________ From: freeradius-users-bounces+frank.ranner=defence.gov.au(a)lists.freeradius.or g [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@lists.freer adius.org] On Behalf Of MONTFORD, AUSTIN Sent: Friday, 16 May 2008 07:31 To: freeradius-users(a)lists.freeradius.org Subject: Cisco Mac-Auth-Bypass with Freeradius 2.0.4 Hey, I just got this working on a test server finally using the users file and have a quick question. I was wondering is there a way where I don't have to type the last 3 lines of this everytime in my users file? I was thinking of using some kind of setup with a seperate file for each vlan containing only the first statement (with the mac address as the user/pass). Then $include each vlanfile in the users file with freeradius appending the correct tunnel statements depending on what vlanfile the mac address was in. Anyways I haven't quite wrapped my head around the syntax to do this or am sure this is the best way. If someone has any advice that would be great. 123400000000 Cleartext-Password := "123400000000" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "Students" By the way Freeradius rocks! Thanks, Austin There is a couple of ways to do this. 1. Use groups. 2. Use Fall-Through and group you users file. Example: # Set boilerplate text DEFAULT Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Fall-Through = True # Staff systems DEFAULT Tunnel-Private-Group-Id := "Staff", Fall-Through = True $INCLUDE staff.users # Student systems DEFAULT Tunnel-Private-Group-Id := "Students", Fall-Through = True $INCLUDE student.users ... DEFAULT Auth-Type:=reject Student.users would have lines like: 123400000000 Cleartext-Password := "123400000000" 123500000000 Cleartext-Password := "123500000000" and could be generated by a script. Regards, Frank Ranner

1 0

2 server radius (same configuration), different log messages
by Enrico Fanti 19 May '08

19 May '08

Hi all. I have 2 server radius and 1 "AP Cisco" configured to use EAP Authentication. I have 2 server radius with freeradius 1.1.7 (fedora 8), configured in the same way (PEAP) (I haad configured my first server radius and then I copied my configuration files , and the certificates in second server radius) Then by my linux laptop, with wpa_supplicant I try to connect to my wireless ntwork. 1) If my AP is configured to require the authentication on first server radius 1, I obtain this log messages: *Mon May 19 08:51:20 2008 : Error: TLS_accept:error in SSLv3 read client certificate A Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon May 19 08:51:20 2008 : Info: (other): SSL negotiation finished successfully Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message* Mon May 19 08:51:20 2008 : Info: rlm_eap_mschapv2: Issuing Challenge *Mon May 19 08:51:20 2008 : Auth: Login OK: [fanti/<no User-Password attribute>] (from client localhost port 3686 cli 001e.4c00.dade) Mon May 19 08:51:20 2008 : Auth: Login OK: [fanti/<no User-Password attribute>] (from client ap-alternet port 3686 cli 001e.4c00.dade)* ############################################################## If I start with radius -X: rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: group authenticate returns ok for request 9 *Login OK: [fanti/<no User-Password attribute>] (from client ap-alternet port 3687 cli 001e.4c00.dade)* ################################################################## 2) In my second server radius I obtain: Mon May 19 08:50:38 2008 : Info: rlm_eap_mschapv2: Issuing Challenge *Mon May 19 08:50:38 2008 : Auth: Login OK: [fanti] (from client localhost port 3689 cli 001e.4c00.dade) Mon May 19 08:50:38 2008 : Auth: Login OK: [fanti] (from client ap-alternet port 3689 cli 001e.4c00.dade)* ##################### If I start with radius -X: rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group authenticate (returns ok) for request 9 *Login OK: [fanti] (from client ap-alternet port 3690 cli 001e.4c00.dade *I don't understand why I have differences in this 2 logs (In rows where I have Login OK). Can you help me please ? Thank you enrico

2 2

Problem in testing Radius server
by youness hsina 19 May '08

19 May '08

Hi all sorry for my english. i'm running a freeradius server.and i wanted to test it but it doesn't work and i don't know why. i have tried this command : *radtest yhsina yhsina @IPserver 1 testing123.* ** *yhsina *is a user who is located in a LDAP server. it give me this thing : *radclient: no reponse from server for ID 107* thank for your help in advance. Uness -- HSINA Youness Etudiant R&T - IUT--Velizy 78140 Tél : 06.28.73.76.75 -- HSINA Youness Etudiant R&T - IUT--Velizy 78140 Tél : 06.28.73.76.75

1 0