- Freeradius-Users - lists.freeradius.org

Re: freeradius 2.0.3 peap, mschapv2, sql
by SANDY KALUGDAN 07 Apr '08

07 Apr '08

try to send the radiusd -X output after you've done some authentication. ----- Original Message ---- From: "Martin.Gabauer(a)spselh.sk" <Martin.Gabauer(a)spselh.sk> To: freeradius-users(a)lists.freeradius.org Sent: Monday, April 7, 2008 13:12:19 Subject: freeradius 2.0.3 peap, mschapv2, sql Hi all, I have following problem, I compiling and installing freeradius 2.0.3 from tgz. I configuring him for authorizing from windows clients (Winxp), whith using mysql to save login and password. The problem is that if password in sql is saved as user-password authorization works fine, but if I save password in MD5 or DES authorization don't work. SQL entry: mysql> select * from radcheck; +----+----------+--------------------+----+------------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------------------------------+ | 5 | test | User-Password | == | test1 | | 7 | gabo2 | MD5-Password | == | $1$7MAOFK8L$5s0zdXoefcE10UfSAjf831 | +----+----------+--------------------+----+------------------------------------+ radius -X output: FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Mar 26 2008 at 12:53:26 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.168.6/32 { require_message_authenticator = no secret = "mysecret" shortname = "Test" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "MyKey" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radiususer" password = "SQlpassword" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawo! rds}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Fr! amed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gi! gawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiususer@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.168.1 port = 1812 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address 192.168.168.1 port 1812 Listening on accounting address * port 1813 Listening on proxy address 192.168.168.1 port 1814 Ready to process requests. ############# END of radiusd -X ####################################### Thanks for help, and sorry for my bad english. Martin Gabauer -- .--. |o_o | Ing. Martin Gabauer |:_/ | network & system administrator // \ \ Zdruzena stredna skola elektrotechnicka (| | ) v Lipt. Hradku /'\_ _/`\ Europe / Slovakia \___)=(___/ homepage : http://www.zsselh.sk/mgabauer icq : #289207549 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Windows AD Integration
by Lemaster, Rob 07 Apr '08

07 Apr '08

Can FreeRADIUS be integrated into Windows Active Directory for user credentials and privelige based on Active Directory group? What is the best way to integrate FreeRADIUS into Windows Active Directory? Thanks! FreeRADIUS: It's what's for dinner.

2 1

RADIUS Packet Debugging
by Lemaster, Rob 07 Apr '08

07 Apr '08

Does FreeRADIUS have a functionality that allows the administrator to debug RADIUS requests and responses? Something that will show the request and response with attributes, etc.. Thanks! FreeRADIUS: The other white meat.

2 1

Missing NAS-Port in Access request with respect to RFC 2865
by Ramm-Ericson, Johannes 07 Apr '08

07 Apr '08

Hello Freeradius-users, >From what I see in the mailing list archives several freeradius users have historically run into trouble with Access-Request information sent by NASes and particularly the lack of the NAS-Port attribute. I've run into it quite often recently and was wondering if I may have found a way to solve it. The workaround I currently employ is to configure acct_users to let the access request from the NAS in question through anyway but it's a workaround. If possible I'd like to find the *correct* solution.... :-) The RFC 2865 http://www.freeradius.org/rfc/rfc2865.html#NAS-Port states that: "Either NAS-Port or NAS-Port-Type (61) or both SHOULD be present in an Access-Request <http://www.freeradius.org/rfc/rfc2865.html#Access-Request> packet, if the NAS differentiates among its ports." >From what I understand the current Freeradius code interprets the RFC statement so that if the NAS-Port attribute is not sent then the access request is not processed and subsequently denied (in rlm_radutmp.c - line 404). if (!port_seen) { However; shouldn't the statement from the RFC be intertpreted such that if *neither* the NAS-Port or the NAS-Port-Type is set then the access request should not be processed and subsequently denied? I'm thinking something along the lines of changing line 404 of rlm_radutmp.c to: if (!port_seen && !nas_port_type) { I'll apologise in advance if my all too rusty programming skills are making me misunderstand the situation entirely... Best Regards, Johannes Ramm-Ericson ----------------------------------------------------------- The information in this e-mail, and attachment(s) thereto, is strictly confidential and may be legally privileged. It is intended solely for the named recipient(s), and access to this e-mail, or any attachment(s) thereto, by anyone else is unauthorized. Violations hereof may result in legal actions. Any attachment(s) to this e-mail has been checked for viruses, but please rely on your own virus-checker and procedures. If you contact us by e-mail, we will store your name and address to facilitate communications in the matter concerned. If you do not consent to us storing your name and address for above stated purpose, please notify the sender promptly. Also, if you are not the intended recipient please inform the sender by replying to this transmission, and delete the e-mail, its attachment(s), and any copies of it without, disclosing it.

3 3

compare check items in LDAP - pairs do not match
by mel 07 Apr '08

07 Apr '08

Hi, When I set compare_check_items in modules { ldap {} }, I'm getting the errors below: rad_recv: Access-Request packet from host 127.0.0.1 port 58575, id=39, length=96 User-Name = "user10" User-Password = "abc123" Calling-Station-Id = "00:18:DE:28:7C:7C" Message-Authenticator = 0xcfe57cf5ca3366338fd35142085e45b8 EAP-Message = 0x02d2000b01757365723130 +- entering group authorize ++[preprocess] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for user10 expand: (uid=%u) -> (uid=user10) expand: dc=iiu,dc=edu,dc=my -> dc=iiu,dc=edu,dc=my rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=iiu,dc=edu,dc=my, with filter (uid=user10) rlm_ldap: checking if remote access for user10 is allowed by radiusFilterId rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute macAddress as RADIUS attribute Calling-Station-Id == "00:18:DE:28:7C:7C" rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "{sha}Y2fEjdGT1W6nsLqtJbGUVeUp9e4=" rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusFilterId as RADIUS attribute Filter-Id = "1" rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns reject Invalid user (rlm_ldap: Pairs do not match): [user10/abc123] (from client localhost port 0 cli 00:18:DE:28:7C:7C) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> user10 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 39 to 127.0.0.1 port 58575 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 39 with timestamp +42 Ready to process requests. In ldap.attr, Calling-Station-Id is mapped to macAddress. In modules checkval, item-name is Calling-Station-Id, while check-name is macAddress. The macAddress is stored using ":" as delimiter in OpenLDAP What I was tasked to do is to authorize the user based on the password and macAddress pair. Prior to this, I've been able to do the following successfully - basic LDAP authentication with username/password stored in LDAP - EAP-TTLS with username/password stored in LDAP - EAP-GTC with username/password stored in LDAP - PAP with username/password stored in LDAP These have been tested locally (using radtest and radeapclient) and also via a NAS. Regards, --mel

1 0

mera vsa on freeradius
by Budi Wibowo 07 Apr '08

07 Apr '08

dear all anybody have mera vsa or dictionary for freeradius? i want to make call performance base on the that. br budi

1 0

EAP Authentication
by Devinder Singh 07 Apr '08

07 Apr '08

Hi I have set up Free Radius to allows users to set up certificates on their notebook and get access to the Internet. When i set EAP i cant sem to allow monowall captiv portal users to login to the RADIUS Server. Is there any settings to be done in users.conf file or radiusd .conf file to allow users to login via the monowall captive portal login page. FREE Radisu rejects login from the caprive portal login. Shoud i be using MSCHAP or can i still use EAP. Thank you Devinder

2 7

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

That looks familiar? :P How about for the other tables? any pointers? ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 21:11:58 Subject: Re: Freeradius + CHAP "I modified my rachek table to look like this. as you have mentioned. mysql> select * from radcheck -> ; +----+----------+--------------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+-------+ | 1 | s | Cleartext-Password | := | s | | 2 | steve | Cleartext-Password | := | s | +----+----------+--------------------+----+-------+ 2 rows in set (0.00 sec)" That should do it. Ivan Kalik Kalik Informatika ISP Dana 6/4/2008, "SANDY KALUGDAN" <sandykalugdan(a)yahoo.com> piše: >Ok, I shall definitely remove the old version. I already found where I should insert the sql. Ivan is right, it is in the sites-enabled folder. >Anyone kind enough to provide me some sample data that I could insert in my sql table? > >----- Original Message ---- >From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Sunday, April 6, 2008 19:25:48 >Subject: Re: Freeradius + CHAP > >Hi, > >> Configuration so much different. Where shall I include sql for the radius to look into mysql database? Before I just open and radiusd.conf and insert the sql into, authorize & accounting. Now, I am at a total loss. > >sql.conf > > >i'd advise removing the 1.0.1 that your distro dropped in. > >rpm -e freeradius > >then you know all action (eg dictionaries) is from 2.0.3 > >just read the config files - all the files they use then become >clear. red sql.conf and you'll see which engine/dialup.conf >etc is used > >alan >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > >Send instant messages to your online friends http://uk.messenger.yahoo.com > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Freeradius + CHAP
by SANDY KALUGDAN 06 Apr '08

06 Apr '08

Ok, I shall definitely remove the old version. I already found where I should insert the sql. Ivan is right, it is in the sites-enabled folder. Anyone kind enough to provide me some sample data that I could insert in my sql table? ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Sunday, April 6, 2008 19:25:48 Subject: Re: Freeradius + CHAP Hi, > Configuration so much different. Where shall I include sql for the radius to look into mysql database? Before I just open and radiusd.conf and insert the sql into, authorize & accounting. Now, I am at a total loss. sql.conf i'd advise removing the 1.0.1 that your distro dropped in. rpm -e freeradius then you know all action (eg dictionaries) is from 2.0.3 just read the config files - all the files they use then become clear. red sql.conf and you'll see which engine/dialup.conf etc is used alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: Why my schema is not working?
by snaut＠snaut.ru 06 Apr '08

06 Apr '08

And any ideas? I'm sure, that this bug is very important. >Yes, a'm fix it. -----Original Message----- From: freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org [mailto:freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org] On Behalf Of Ivan Kalik Sent: Friday, April 04, 2008 4:57 PM To: freeradius-users at lists.freeradius.org Subject: RE: Why my schema is not working? And the warning about using User-Password is now gone from the debug? Ivan Kalik Kalik Informatika ISP Dana 4/4/2008, "Dmitry A. Sysoev" <snaut at snaut.ru> piše: >SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = >'250092020001115 at evdo.uln.skylink.ru' ORDER BY id > >1 4732 250092020001115 at evdo.uln.skylink.ru Cleartext-Password >EBLAImXtaUidLnSa := > > SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = >'250092020001115 at evdo.uln.skylink.ru' ORDER BY id > >1 4147 250092020001115 at evdo.uln.skylink.ru Callback-Id >0250092020001115 == > >SELECT GroupName FROM usergroup WHERE >UserName='250092020001115 at evdo.uln.skylink.ru' OR CLID='' order by >priority > >1 blackholed > >SELECT >radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgro >upche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE >(usergroup.Username = '250092020001115 at evdo.uln.skylink.ru' or >usergroup.CLID = '') AND usergroup.GroupName = radgroupcheck.GroupName >ORDER BY usergroup.PRIORITY,radgroupcheck.id > >1 181 blackholed Auth-Type Reject := >2 182 blackholed Fall-Through No = > > > >-----Original Message----- >From: freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org >[mailto:freeradius-users-bounces+snaut=snaut.ru at lists.freeradius.org] >On Behalf Of Ivan Kalik >Sent: Friday, April 04, 2008 4:32 PM >To: freeradius-users at lists.freeradius.org >Subject: RE: Why my schema is not working? > >What happens when you copy and paste the query from the debug? Can you >post the result? > >I would doubt that the code is "alergic" to that particular group and >works for others. "blackholed" doesn't look like a reserved word. >Queries are executed by mysql not radius server. > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > >

1 0