- Freeradius-Users - lists.freeradius.org

frammed ip adress
by David Hláčik 14 Apr '08

14 Apr '08

Hi, in my working solution, i have pptp (vpn) configured with radius using LDAP. Each user has a value Framed IP Adress which will assign him exact IP adress. Currently i am rebuilding ldap structure to groups. And i want the users which will be members of group foo , to have dynamically assignet ip adresses from pool 10.123.40.0/255.255.255.0 . How can i achieve ? Which radius attributes should i use? Thanks a lot!

2 14

exec-program-wait problem with freeradius 2.0.3
by Emmanuel Willems 14 Apr '08

14 Apr '08

Hi, I'm carrying out tests with 2 versions for freeradius 1.1.3 and 2.0.3 . I'm trying to use Exec-Program-Wait to run a script to do some extra checking. Both setups use the same MySQL database All works well in version 1.1.3 but the script does not get called in version 2.0.3 The SQL statements generated with both the 1.1.3 and 2.0.3 are identical and return the same result. But version 1.1.3 of freeradius runs the script while version 2.0.3 does not. Any ideas? Thanks in advance, Emmanuel

2 1

newexperimental on radius
by Si St 14 Apr '08

14 Apr '08

-ASUS-laptop(SuSE 10 and WinXP),HP-laptop(Win-Vista only),ACER-laptop(WinXP only),HPC-workstation(SLED Novell-SuSE and WinXP). -Dlink DIR-635 router -Zyxel Prestige 600 ADSL modem -FreeRADIUS Version 1.0.4 Q: Could anybody tell me what kind of password is to be set on the router configuration to enable RADIUS setup? The router states that the password has to correspond with the password in the radius, but which one and how? It is boxed as "RADIUS-Server Shared Secret" What file does it correspond with? The secret in clients.conf? And what password is the YaST asking for when configuring the networkcard with WPA-EAP? The same password or another? In YaST it is asked for 1)Identity, 2)Password, 3)Client-Zertifikat and 4)Server-Zertifikat It is number 1 and 2 I am wondering about I have tried to read carefully about RADIUS in the documentation in SuSE and on the web. I have also tried out to run the CA.pl and CA.all as to certificates for web and radius EAP-TLS. It is so far just practice and tryouts for me now. I have several machines PCs at home with SuSE_10.0,SuSE_Linux_Enterprise_Desktop_SP1,WinXP and WinVista. I would like to try out Radius for Internet connections. Q: Is it difficult to make EAP-TLS work with windows, and should I use EAP-TTLS instead or PEAP? I am eager to have these things work in the end, but I try carefully to approach it step by step. I have so far changed as little as possible in the config-files as I am told to. All together I am understanding more and more to be able to finally make the setup. Router config management Authentifizierung Zeitüberschreitung : (Minuten) RADIUS-Server IP-Adresse : RADIUS-Server Port : RADIUS-Server Shared Secret : MAC-Adresse Authentifizierung : Radius-Server Shared Secret: Eine Pass-Phrase, welche mit dem Authentifizierungsserver zusammenpassen muß. radiusd -v radiusd: FreeRADIUS Version 1.0.4, for host , built on Sep 13 2005 at 02:15:36 radiusd -X: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. I have also tried out: /usr/sbin/radexample /usr/sbin/radlogin /usr/bin/radclient /usr/bin/radtest and find that all together I must be on the right track. RADEXAMPLE login: sigbj Password: "sigbj" RADIUS Authentication OK RADLOGIN ($Id: radlogin.c,v 1.3 1997/12/29 23:07:25 lf Exp $) ----------------------------------------------------- Linux 2.6.13-15.18-default (linux) (port 1) ----------------------------------------------------- login: sigbj Password: RADIUS: Authentication OK Starting. RADIUS_FRAMED_COMPRESSION = Van-Jacobson-TCP-IP RADIUS_FRAMED_PROTOCOL = PPP RADIUS_FRAMED_MTU = 1500 RADIUS_FILTER_ID = std.ppp RADIUS_USER_NAME = sigbj RADIUS_FRAMED_IP_ADDRESS = 192.168.0.198 RADIUS_SERVICE_TYPE = Framed-User RADIUS_FRAMED_ROUTING = Broadcast-Listen RADIUS_FRAMED_IP_NETMASK = 255.255.255.0 Unhandled Service-Type RADCLIENT radclient -f radius.test 127.0.0.1:1812 auth testing123 Received response ID 95, code 3, length = 20 Received response ID 96, code 3, length = 20 Received response ID 97, code 3, length = 20 RADTEST radtest sigbj testing 127.0.0.1:1812 1 testing123 Sending Access-Request of id 151 to 127.0.0.1:1812 User-Name = "sigbj" User-Password = "testing" NAS-IP-Address = linux NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=151, length=71 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.0.198 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

2 1

groupcheck is not working
by Dmitry A. Sysoev 14 Apr '08

14 Apr '08

Hi! Why the author is not commented the: http://lists.freeradius.org/pipermail/freeradius-users/2008-April/070897.htm l and http://lists.freeradius.org/pipermail/freeradius-users/2008-April/070924.htm l ? This bug is very big...

1 0

Re: Dead Proxy Detection?
by Lemaster, Rob 14 Apr '08

14 Apr '08

I revewed raddb/sites-available/default and found Post-Proxy "fail"; Post-Proxy-Type Fail {detail} This appears to be to write Accounting logs locally if the remote proxy is down. I'm not clear if this will be enabled if only ONE of the remote proxies are down, or if ALL proxies are down. It would go through normal round-robin and then only turn on if ALL proxies are down, correct? I would like to configure a Post-Proxy type action to take if ALL of a Realm's remote proxies are down. To be specific, I'd like to configure a realm to send access-accepts to all requests for that realm if ALL the remote proxies for that realm are unavailable, until they become available again. Can this be done here? If so, can you give me a syntax example? I could not find that in default, example, or README. Thanks! Lemaster, Rob wrote: > Can FreeRADIUS automatically set all subcribers to "authenticate all" if all proxies are unavailable, and then authenticate normally automatically after the proxies come back online? Yes. See raddb/sites-available/default. Look for Post-Proxy "fail". You can have actions triggered when no home server is available. Alan DeKok.

2 1

Re: Dynamic IP Allocation With Freeradius
by Joel ＠ Gmail 13 Apr '08

13 Apr '08

Hi Ivan, As per your mail, I have modified the subnet mask to 255.255.255.255 and below is other config. /usr/local/etc/raddb/radiusd.conf ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.255 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } # ANSI X9.9 token support. Not included by default. # $INCLUDE ${confdir}/x99.conf } main_pool is enabled in accounting & post-auth modules. I have kept nothing in USERS file right now. Just wanted to see if radius starts or not. I did run radiusd -XXX but give me below error. Sun Apr 13 06:04:17 2008 : Info: Starting - reading configuration files ... Sun Apr 13 06:04:17 2008 : Debug: reread_config: reading radiusd.conf Sun Apr 13 06:04:17 2008 : Debug: Config: including file: /usr/local/etc/raddb/clients.conf Sun Apr 13 06:04:17 2008 : Debug: Config: including file: /usr/local/etc/raddb/snmp.conf Sun Apr 13 06:04:17 2008 : Debug: Config: including file: /usr/local/etc/raddb/eap.conf Sun Apr 13 06:04:17 2008 : Debug: Config: including file: /usr/local/etc/raddb/sql.conf Sun Apr 13 06:04:17 2008 : Debug: main: prefix = "/usr/local" Sun Apr 13 06:04:17 2008 : Debug: main: localstatedir = "/usr/local/var" Sun Apr 13 06:04:17 2008 : Debug: main: logdir = "/usr/local/var/log/radius" Sun Apr 13 06:04:17 2008 : Debug: main: libdir = "/usr/local/lib" Sun Apr 13 06:04:17 2008 : Debug: main: radacctdir = "/usr/local/var/log/radius/radacct" Sun Apr 13 06:04:17 2008 : Debug: main: hostname_lookups = no Sun Apr 13 06:04:17 2008 : Debug: main: max_request_time = 30 Sun Apr 13 06:04:17 2008 : Debug: main: cleanup_delay = 5 Sun Apr 13 06:04:17 2008 : Debug: main: max_requests = 1024 Sun Apr 13 06:04:17 2008 : Debug: main: delete_blocked_requests = 0 Sun Apr 13 06:04:17 2008 : Debug: main: port = 1645 Sun Apr 13 06:04:17 2008 : Debug: main: allow_core_dumps = no Sun Apr 13 06:04:17 2008 : Debug: main: log_stripped_names = no Sun Apr 13 06:04:17 2008 : Debug: main: log_file = "/usr/local/var/log/radius/radius.log" Sun Apr 13 06:04:17 2008 : Debug: main: log_auth = no Sun Apr 13 06:04:17 2008 : Debug: main: log_auth_badpass = no Sun Apr 13 06:04:17 2008 : Debug: main: log_auth_goodpass = no Sun Apr 13 06:04:17 2008 : Debug: main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Sun Apr 13 06:04:17 2008 : Debug: main: user = "(null)" Sun Apr 13 06:04:17 2008 : Debug: main: group = "(null)" Sun Apr 13 06:04:17 2008 : Debug: main: usercollide = no Sun Apr 13 06:04:17 2008 : Debug: main: lower_user = "no" Sun Apr 13 06:04:17 2008 : Debug: main: lower_pass = "no" Sun Apr 13 06:04:17 2008 : Debug: main: nospace_user = "no" Sun Apr 13 06:04:17 2008 : Debug: main: nospace_pass = "no" Sun Apr 13 06:04:17 2008 : Debug: main: checkrad = "/usr/local/sbin/checkrad" Sun Apr 13 06:04:17 2008 : Debug: main: proxy_requests = no Sun Apr 13 06:04:17 2008 : Debug: security: max_attributes = 200 Sun Apr 13 06:04:17 2008 : Debug: security: reject_delay = 1 Sun Apr 13 06:04:17 2008 : Debug: security: status_server = no Sun Apr 13 06:04:17 2008 : Debug: main: debug_level = 0 Sun Apr 13 06:04:17 2008 : Debug: read_config_files: reading dictionary Sun Apr 13 06:04:17 2008 : Debug: read_config_files: reading naslist Sun Apr 13 06:04:17 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Sun Apr 13 06:04:17 2008 : Debug: read_config_files: reading clients Sun Apr 13 06:04:17 2008 : Debug: read_config_files: reading realms Sun Apr 13 06:04:17 2008 : Debug: radiusd: entering modules setup Sun Apr 13 06:04:17 2008 : Debug: Module: Library search path is /usr/local/lib Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded exec Sun Apr 13 06:04:17 2008 : Debug: exec: wait = yes Sun Apr 13 06:04:17 2008 : Debug: exec: program = "(null)" Sun Apr 13 06:04:17 2008 : Debug: exec: input_pairs = "request" Sun Apr 13 06:04:17 2008 : Debug: exec: output_pairs = "(null)" Sun Apr 13 06:04:17 2008 : Debug: exec: packet_type = "(null)" Sun Apr 13 06:04:17 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated exec (exec) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded expr Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated expr (expr) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded PAP Sun Apr 13 06:04:17 2008 : Debug: pap: encryption_scheme = "crypt" Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated pap (pap) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded CHAP Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated chap (chap) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded MS-CHAP Sun Apr 13 06:04:17 2008 : Debug: mschap: use_mppe = yes Sun Apr 13 06:04:17 2008 : Debug: mschap: require_encryption = no Sun Apr 13 06:04:17 2008 : Debug: mschap: require_strong = no Sun Apr 13 06:04:17 2008 : Debug: mschap: with_ntdomain_hack = no Sun Apr 13 06:04:17 2008 : Debug: mschap: passwd = "(null)" Sun Apr 13 06:04:17 2008 : Debug: mschap: authtype = "MS-CHAP" Sun Apr 13 06:04:17 2008 : Debug: mschap: ntlm_auth = "(null)" Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated mschap (mschap) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded System Sun Apr 13 06:04:17 2008 : Debug: unix: cache = no Sun Apr 13 06:04:17 2008 : Debug: unix: passwd = "(null)" Sun Apr 13 06:04:17 2008 : Debug: unix: shadow = "(null)" Sun Apr 13 06:04:17 2008 : Debug: unix: group = "(null)" Sun Apr 13 06:04:17 2008 : Debug: unix: radwtmp = "/usr/local/var/log/radius/radwtmp" Sun Apr 13 06:04:17 2008 : Debug: unix: usegroup = no Sun Apr 13 06:04:17 2008 : Debug: unix: cache_reload = 600 Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated unix (unix) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded eap Sun Apr 13 06:04:17 2008 : Debug: eap: default_eap_type = "md5" Sun Apr 13 06:04:17 2008 : Debug: eap: timer_expire = 60 Sun Apr 13 06:04:17 2008 : Debug: eap: ignore_unknown_eap_types = no Sun Apr 13 06:04:17 2008 : Debug: eap: cisco_accounting_username_bug = no Sun Apr 13 06:04:17 2008 : Debug: rlm_eap: Loaded and initialized type md5 Sun Apr 13 06:04:17 2008 : Debug: rlm_eap: Loaded and initialized type leap Sun Apr 13 06:04:17 2008 : Debug: gtc: challenge = "Password: " Sun Apr 13 06:04:17 2008 : Debug: gtc: auth_type = "PAP" Sun Apr 13 06:04:17 2008 : Debug: rlm_eap: Loaded and initialized type gtc Sun Apr 13 06:04:17 2008 : Debug: mschapv2: with_ntdomain_hack = no Sun Apr 13 06:04:17 2008 : Debug: rlm_eap: Loaded and initialized type mschapv2 Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated eap (eap) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded preprocess Sun Apr 13 06:04:17 2008 : Debug: preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" Sun Apr 13 06:04:17 2008 : Debug: preprocess: hints = "/usr/local/etc/raddb/hints" Sun Apr 13 06:04:17 2008 : Debug: preprocess: with_ascend_hack = no Sun Apr 13 06:04:17 2008 : Debug: preprocess: ascend_channels_per_line = 23 Sun Apr 13 06:04:17 2008 : Debug: preprocess: with_ntdomain_hack = no Sun Apr 13 06:04:17 2008 : Debug: preprocess: with_specialix_jetstream_hack = no Sun Apr 13 06:04:17 2008 : Debug: preprocess: with_cisco_vsa_hack = no Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated preprocess (preprocess) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded realm Sun Apr 13 06:04:17 2008 : Debug: realm: format = "suffix" Sun Apr 13 06:04:17 2008 : Debug: realm: delimiter = "@" Sun Apr 13 06:04:17 2008 : Debug: realm: ignore_default = no Sun Apr 13 06:04:17 2008 : Debug: realm: ignore_null = no Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated realm (suffix) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded files Sun Apr 13 06:04:17 2008 : Debug: files: usersfile = "/usr/local/etc/raddb/users" Sun Apr 13 06:04:17 2008 : Debug: files: acctusersfile = "/usr/local/etc/raddb/acct_users" Sun Apr 13 06:04:17 2008 : Debug: files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" Sun Apr 13 06:04:17 2008 : Debug: files: compat = "no" Sun Apr 13 06:04:17 2008 : Debug: Module: Instantiated files (files) Sun Apr 13 06:04:17 2008 : Debug: Module: Loaded SQL Sun Apr 13 06:04:17 2008 : Debug: sql: driver = "rlm_sql_mysql" Sun Apr 13 06:04:17 2008 : Debug: sql: server = "localhost" Sun Apr 13 06:04:17 2008 : Debug: sql: port = "" Sun Apr 13 06:04:17 2008 : Debug: sql: login = "root" Sun Apr 13 06:04:17 2008 : Debug: sql: password = "rootpass" Sun Apr 13 06:04:17 2008 : Debug: sql: radius_db = "radius" Sun Apr 13 06:04:17 2008 : Debug: sql: acct_table = "radacct" Sun Apr 13 06:04:17 2008 : Debug: sql: acct_table2 = "radacct" Sun Apr 13 06:04:17 2008 : Debug: sql: authcheck_table = "radcheck" Sun Apr 13 06:04:17 2008 : Debug: sql: authreply_table = "radreply" Sun Apr 13 06:04:17 2008 : Debug: sql: groupcheck_table = "radgroupcheck" Sun Apr 13 06:04:17 2008 : Debug: sql: groupreply_table = "radgroupreply" Sun Apr 13 06:04:17 2008 : Debug: sql: usergroup_table = "usergroup" Sun Apr 13 06:04:17 2008 : Debug: sql: nas_table = "nas" Sun Apr 13 06:04:17 2008 : Debug: sql: dict_table = "dictionary" Sun Apr 13 06:04:17 2008 : Debug: sql: sqltrace = no Sun Apr 13 06:04:17 2008 : Debug: sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" Sun Apr 13 06:04:17 2008 : Debug: sql: readclients = no Sun Apr 13 06:04:17 2008 : Debug: sql: deletestalesessions = yes Sun Apr 13 06:04:17 2008 : Debug: sql: num_sql_socks = 5 Sun Apr 13 06:04:17 2008 : Debug: sql: sql_user_name = "%{User-Name}" Sun Apr 13 06:04:17 2008 : Debug: sql: default_user_profile = "" Sun Apr 13 06:04:17 2008 : Debug: sql: query_on_not_found = no Sun Apr 13 06:04:17 2008 : Debug: sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" Sun Apr 13 06:04:17 2008 : Debug: sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" Sun Apr 13 06:04:17 2008 : Debug: sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" Sun Apr 13 06:04:17 2008 : Debug: sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" Sun Apr 13 06:04:17 2008 : Debug: sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" Sun Apr 13 06:04:17 2008 : Debug: sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" Sun Apr 13 06:04:17 2008 : Debug: sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" Sun Apr 13 06:04:17 2008 : Debug: sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" Sun Apr 13 06:04:19 2008 : Debug: sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" Sun Apr 13 06:04:19 2008 : Debug: sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" Sun Apr 13 06:04:19 2008 : Debug: sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" Sun Apr 13 06:04:19 2008 : Debug: sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" Sun Apr 13 06:04:19 2008 : Debug: sql: connect_failure_retry_delay = 60 Sun Apr 13 06:04:19 2008 : Debug: sql: simul_count_query = "" Sun Apr 13 06:04:19 2008 : Debug: sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" Sun Apr 13 06:04:19 2008 : Debug: sql: postauth_table = "radpostauth" Sun Apr 13 06:04:19 2008 : Debug: sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" Sun Apr 13 06:04:19 2008 : Debug: sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Sun Apr 13 06:04:19 2008 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sun Apr 13 06:04:19 2008 : Info: rlm_sql (sql): Attempting to connect to root@localhost:/radius Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): starting 0 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Sun Apr 13 06:04:19 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Connected new DB handle, #0 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): starting 1 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Sun Apr 13 06:04:19 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Connected new DB handle, #1 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): starting 2 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Sun Apr 13 06:04:19 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Connected new DB handle, #2 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): starting 3 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Sun Apr 13 06:04:19 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Connected new DB handle, #3 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): starting 4 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Sun Apr 13 06:04:19 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Apr 13 06:04:19 2008 : Debug: rlm_sql (sql): Connected new DB handle, #4 Sun Apr 13 06:04:19 2008 : Debug: Module: Instantiated sql (sql) Sun Apr 13 06:04:19 2008 : Debug: Module: Loaded Acct-Unique-Session-Id Sun Apr 13 06:04:19 2008 : Debug: acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Sun Apr 13 06:04:19 2008 : Debug: Module: Instantiated acct_unique (acct_unique) Sun Apr 13 06:04:19 2008 : Debug: Module: Loaded detail Sun Apr 13 06:04:19 2008 : Debug: detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Sun Apr 13 06:04:19 2008 : Debug: detail: detailperm = 384 Sun Apr 13 06:04:19 2008 : Debug: detail: dirperm = 493 Sun Apr 13 06:04:19 2008 : Debug: detail: locking = no Sun Apr 13 06:04:19 2008 : Debug: Module: Instantiated detail (detail) Sun Apr 13 06:04:19 2008 : Debug: Module: Loaded radutmp Sun Apr 13 06:04:19 2008 : Debug: radutmp: filename = "/usr/local/var/log/radius/radutmp" Sun Apr 13 06:04:19 2008 : Debug: radutmp: username = "%{User-Name}" Sun Apr 13 06:04:19 2008 : Debug: radutmp: case_sensitive = yes Sun Apr 13 06:04:19 2008 : Debug: radutmp: check_with_nas = yes Sun Apr 13 06:04:19 2008 : Debug: radutmp: perm = 384 Sun Apr 13 06:04:19 2008 : Debug: radutmp: callerid = yes Sun Apr 13 06:04:19 2008 : Debug: Module: Instantiated radutmp (radutmp) Segmentation fault Any suggestions please. Regards, Joel ----- Original Message ----- From: Joel @ Gmail To: freeradius-users(a)lists.freeradius.org Sent: Saturday, April 12, 2008 7:11 PM Subject: Dynamic IP Allocation With Freeradius Dear Friends, Right now I have setup working of freeradius with mysql authentication. I have static & dynamic group created in mysql and all seems working. Currently static IPs are provided by radius with mysql backend. But dynamic IP is provided by Cisco Router. Cisco router is configured as PPPOE/PPPOA. Cisco does all authentication with freeradius. Now what I want is to provided Dynamic IPs with freeradius instead of Cisco. I have searched alot and tried few setting but that didnt worked. Is it possible to configure USERS file and have all dynamic users get dynamically using USERS file ? I checked but wasnt sucessful. Or a solution in mysql itself. For testing i had activated below config in radiusd.conf ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } main_pool in accounting & post-auth modules. doing this and starting the radius gives me segmentation error. Any suggestion please ? Regards, Joel

4 4

Router,Passwords;Radius
by Si St 13 Apr '08

13 Apr '08

-ASUS-laptop(SuSE 10 and WinXP),HP-laptop(Win-Vista only),ACER-laptop(WinXP only),HPC-workstation(SLED Novell-SuSE and WinXP). -Dlink DIR-635 router -Zyxel Prestige 600 ADSL modem -FreeRADIUS Version 1.0.4 Q: Could anybody tell me what kind of password is to be set on the router configuration to enable RADIUS setup? The router states that the password has to correspond with the password in the radius, but which one and how? It is boxed as "RADIUS-Server Shared Secret" What file does it correspond with? The secret in clients.conf? And what password is the YaST asking for when configuring the networkcard with WPA-EAP? The same password or another? In YaST it is asked for 1)Identity, 2)Password, 3)Client-Zertifikat and 4)Server-Zertifikat It is number 1 and 2 I am wondering about I have tried to read carefully about RADIUS in the documentation in SuSE and on the web. I have also tried out to run the CA.pl and CA.all as to certificates for web and radius EAP-TLS. It is so far just practice and tryouts for me now. I have several machines PCs at home with SuSE_10.0,SuSE_Linux_Enterprise_Desktop_SP1,WinXP and WinVista. I would like to try out Radius for Internet connections. Q: Is it difficult to make EAP-TLS work with windows, and should I use EAP-TTLS instead or PEAP? I am eager to have these things work in the end, but I try carefully to approach it step by step. I have so far changed as little as possible in the config-files as I am told to. All together I am understanding more and more to be able to finally make the setup. Router config management Authentifizierung Zeitüberschreitung : (Minuten) RADIUS-Server IP-Adresse : RADIUS-Server Port : RADIUS-Server Shared Secret : MAC-Adresse Authentifizierung : Radius-Server Shared Secret: Eine Pass-Phrase, welche mit dem Authentifizierungsserver zusammenpassen muß. radiusd -v radiusd: FreeRADIUS Version 1.0.4, for host , built on Sep 13 2005 at 02:15:36 radiusd -X: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. I have also tried out: /usr/sbin/radexample /usr/sbin/radlogin /usr/bin/radclient /usr/bin/radtest and find that all together I must be on the right track. RADEXAMPLE login: sigbj Password: "sigbj" RADIUS Authentication OK RADLOGIN ($Id: radlogin.c,v 1.3 1997/12/29 23:07:25 lf Exp $) ----------------------------------------------------- Linux 2.6.13-15.18-default (linux) (port 1) ----------------------------------------------------- login: sigbj Password: RADIUS: Authentication OK Starting. RADIUS_FRAMED_COMPRESSION = Van-Jacobson-TCP-IP RADIUS_FRAMED_PROTOCOL = PPP RADIUS_FRAMED_MTU = 1500 RADIUS_FILTER_ID = std.ppp RADIUS_USER_NAME = sigbj RADIUS_FRAMED_IP_ADDRESS = 192.168.0.198 RADIUS_SERVICE_TYPE = Framed-User RADIUS_FRAMED_ROUTING = Broadcast-Listen RADIUS_FRAMED_IP_NETMASK = 255.255.255.0 Unhandled Service-Type RADCLIENT radclient -f radius.test 127.0.0.1:1812 auth testing123 Received response ID 95, code 3, length = 20 Received response ID 96, code 3, length = 20 Received response ID 97, code 3, length = 20 RADTEST radtest sigbj testing 127.0.0.1:1812 1 testing123 Sending Access-Request of id 151 to 127.0.0.1:1812 User-Name = "sigbj" User-Password = "testing" NAS-IP-Address = linux NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=151, length=71 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.0.198 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Maybe lot of unnecessary outputs here not concerning my questions, but................ Sincerely, S.Storset, Norway -- _______________________________________________ Surf the Web in a faster, safer and easier way: Download Opera 9 at http://www.opera.com Powered by Outblaze

1 0

No EAP Start, assuming it's an on-going EAP conversation
by Johan Nyman 13 Apr '08

13 Apr '08

Hello, - I will look into that book you recommended Alan - "OReilly book on OpenSSLL" thanks! - But for right now do you have any clues on what I could/do test, look at to fix this: - I have a Linux client trying to connect to the Free Radius, and on the client side I am getting this error message: "CTRL-EVENT-EAP-FAILURE EAP authentication failed" - And on the Free radius console I have this information is shown: Called-Station-Id = "00-20-a6-64-c3-b1:MVG-Personal" Calling-Station-Id = "00-0f-cb-f9-3b-f9;MVG-Personal" NAS-Identifier = "MVG-1" State = 0x73e4f46973e6f0393091c54faaf880fd Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060315 Message-Authenticator = 0x330b306447495e1a49cd5c7cfe5c1c6d +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "easy", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry easy at line 90 expand: Hello, %{User-Name} -> Hello, easy ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Reply-Message = "Hello, easy" EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73e4f46972e7e1393091c54faaf880fd Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 153 with timestamp +279 Cleaning up request 1 ID 154 with timestamp +279 Ready to process requests. - And the client don't get/receive an IP address, guessing it has something to do with EAP authentication "No EAP Start". Thanks for help, Best regards, Johan Nyman

2 1

RFC 3576 support
by vmx vmx 13 Apr '08

13 Apr '08

Hello everyone, Is Freeradius able to send Change of Authorization Messages and Disconnect messages (RFC 3576) According to http://www.freeradius.org/features/ Freeradius supports RFC 3576. According to this http://wiki.freeradius.org/RFC: Freeradius does not support RFC 3576. I can't find any information on the site on how ro configure this. >From this it appears only a test client RadClient is supporting this: http://www.usenet-forums.com/freeradius-users/280002-re-change-authorizatio… Is there any development? Has RFC 3576 support has been introduced for Server and not for client. I want to send CoA and DM form the server. Thank you

3 8

Problem with proxy-radius function
by banga 13 Apr '08

13 Apr '08

Hello All. I Use freeradius 2.0.3 only for accounting purpose. More than that, I have dozen realms that should be counted locally, and only one that should be proxed to redundant AAA servers. My current configuration is the next: >cat clients.conf client test1 { ipaddr = 192.168.100.1 secret = somesecret shortname = test1 nastype = other } client test2 { ipaddr = 192.168.100.2 secret = somesecret shortname = test2 nastype = other } >cat proxy.conf proxy server { default_fallback = no } home_server test1 { type = acct ipaddr = 192.168.100.1 port = 1646 secret = somesecret status_check = request } home_server test2 { type = acct ipaddr = 192.168.100.2 port = 1646 secret = somesecret status_check = request } home_server_pool test { type = fail-over home_server = test1 home_server = test2 } realm dialup.domain.com { acct_pool = test nostrip } >cat default preacct { suffix } accounting { acct_unique sql } In case if radius work like daemon I can see next massages in the log (different time different): Error: Ignoring request from unknown home server 192.168.100.2 port 1646 Error: Rejecting request 2583 due to lack of any response from home server 192.168.100.2 Error: Ignoring request from unknown home server 192.168.100.1 port 1646 Error: Rejecting request 2545 due to lack of any response from home server 192.168.100.1 In case if radiusd –X than I get Segmentation fault: Like example: Rejecting request 602 due to lack of any response from home server 192.168.100.2 port 1646 Finished request 602. Cleaning up request 602 ID 152 with timestamp +102 Cleaning up request 602 ID 0 with timestamp +102 Segmentation fault 1) Why “unknown home server” ? clients.conf has this IPs? 2) Why Segmentation faul on –X ? After hours of test I decide that it’s because of my configuration. (proxy.conf incorrect?) 3) Then I debug on realm that should accounting locally i can see the next: ++[acct_unique] returns ok rlm_realm: Looking up realm "domain.com" for User-Name = "usera(a)domain.com" rlm_realm: No such realm "domain.com" ++[suffix] returns noop +- entering group accounting ++[acct_unique] returns noop Is it good idea to add next to proxy.conf or I do not need to do that ? realm LOCAL { accthost = LOCAL } realm NULL { accthost = LOCAL } realm DEFAULT { accthost = LOCAL } I case if it's good then should I define “=LOCAL” somewhere ? I mean why ”accthost = LOCAL” is correct and ”accthost = LOCALXXX” not ? Thanx. -- View this message in context: http://www.nabble.com/Problem-with-proxy-radius-function-tp16610498p1661049… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4