- Freeradius-Users - lists.freeradius.org

Re: Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy(forward) request as PAP
by Ryan 21 Mar '08

21 Mar '08

Hi All, I'm having a problem trying to configure proxy from one radius to another. Users are connecting using 802.1x with EAP/PEAP. There are two groups of users, one group are authenticated on the main radius using local LDAP. However for the second group of users, they have to be authenticated via the radius proxy. The problem is the radius proxy does not have EAP configured and its not an option to reconfigure it with EAP. >From the threads, I found something similar in http://lists.freeradius.org/pipermail/freeradius-users/2008-February/069230… applies as well, will this applies to my situation as well? Thanks/Regards, Ryan

2 2

Freeradius with Nortel WSS 2300
by Mike Wing 21 Mar '08

21 Mar '08

Has anyone tried to use free radius to authenticate users via username/password to a Nortel wireless security switch 2300. I can get 802.1x working with a self-signed cert but want to be able to plain username/password authentication. Mike Wing IT Manager Anaheim Ducks Honda Center (714) 704-2549 phone (714) 704-2406 fax mwing(a)hondacenter.com

3 2

Hint. Need help
by Mikhail Novikov 21 Mar '08

21 Mar '08

Hello Please, what the hint should I add to hints file to remove Nas-Port-ID attribute Nas-Port-ID = GigabitEthernet 0/0/3.23203101:2321-121 and add PortID like this PortID = 2321-121 ? Thanks

2 1

rlm_sqlcounter + reset=never
by Tuc at T-B-O-H.NET 20 Mar '08

20 Mar '08

Hi, I'm using the "sqlcounter noresetcounter" which sets the reset to "never". When it sends back the reply, it ends up looking like : Your maximum never usage time has been reached Is there a way to change it short of just changing the line : snprintf(msg, sizeof(msg), "Your maximum %s usage time has been reached", data->reset); not to insert data->reset ? Thanks, Tuc

1 0

php resource application
by Charnjit Sidhu 20 Mar '08

20 Mar '08

Hi, I have a working client which authenticates with the radius server, I wanted to know if anyone has had experience of using a php/sql application called mrbs. I want the application to use radius authentication to authenticate users logging into this resource booking application, there are scripts provided for other forms of authentication (ie pam, ldap, smb) however wanted to know if anyone has created a php or any other kind of script to do this. It looks like I will need to add php script to authenticate but not sure what needs to go in it. Charnjit

4 4

freeradius 2GB problem
by Rahul Nakra 20 Mar '08

20 Mar '08

I am using freeradius 2.0. With the default schema which comes with that. Following is the database entry. It shows a new user never logged in before. If i give value of Max-All-Data 2147483646 it works fine. Anything above it doesnt work. Attached is the radius log where it displays negative value for sqlcounter. mysql> select * from radcheck; +----+----------+--------------+----+------------+ | id | username | attribute | op | value | +----+----------+--------------+----+------------+ | 1 | rahul | password | == | rahul | | 2 | rahul | Max-All-Data | := | 2147483648 | +----+----------+--------------+----+------------+ 2 rows in set (0.00 sec) sqlcounter -------------------------- sqlcounter usagelimitDOWN { counter-name = Max-All-Session-Data check-name = Max-All-Data reply-name = Mikrotik-Xmit-Limit sqlmod-inst = sql key = User-Name reset = never query="select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='%{%k}'" } User-Name = "rahul" User-Password = "rahul" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "rahul", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound expand: %{User-Name} -> rahul rlm_sql (sql): sql_set_user escaped user --> 'rahul' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rahul' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rahul' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rahul' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='%{User-Name}'' expand: select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='%{User-Name}' -> select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul' sqlcounter_expand: '%{sql:select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul'}' rlm_sql (sql): - sql_xlat expand: %{User-Name} -> rahul rlm_sql (sql): sql_set_user escaped user --> 'rahul' expand: select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul' -> select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select SUM(acctinputoctets+acctoutputoctets) from radacct where UserName='rahul'} -> rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user rahul, check_item=-2147483648, counter=0 ++[usagelimitDOWN] returns reject Invalid user (rlm_sqlcounter: Maximum never usage time reached): [rahul/rahul] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> rahul attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Reply-Message = "Your maximum never usage time has been reached" Waking up in 4.9 seconds. Cleaning up request 0 ID 106 with timestamp +55 Ready to process requests. Regards Rahul Nakra

2 1

MACAddress silent authentication in LDAP using freeradius2.0.2
by Eric Martell 20 Mar '08

20 Mar '08

Please let me know if this topic is already discussed or has doc/wiki. If yes please guide me to the right thread. Thanks. We are going to use MACaddress as silent authentication. When the users tries to connect to the WIFI Access point, Aptilo Networks is going to send MacAddress as User-Name attribute of freeradius. User-Password attribute will be empty. We are storing MAC Addresses in the LDAP under the device tree thru user interface tools. The LDAP tree is as, deviceid = 111 macaddress = 001122334455 devicename = Personal PC. deviceid = 222 macaddress = 001199887766 devicename = SIP Phone. How do I configure ldap module in the freeradius so that it checks if the MACaddress exists in LDAP and returns Access-Accept or Access-Reject along with reply of devicename. Not sure how do I handle this in authorization or authentication or post-auth? There are NO passwords. I am using freeradius-2.0.2. Is there a way I can use "unlang" ? Thanks and Regards. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 6

Freeradius Execute Script
by fvt3 20 Mar '08

20 Mar '08

I understand that it is possible to have Freeradius execute a script when a user authenticate. What I want to do is to be able to pass that user name and the client's ip address to the script. This is my setup, I have freeradius with mysql setup. radgroupreply table: testprogramExec-Program-Wait==/usr/local/etc/raddb/test.pl When user Joe authenticates with his credential, radius would look in mysql and execute the test.pl script. How can I pass the user name "joe" and client's ip address to the test.pl script? Thanks in advance .. ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

Re: listen { type = detail } - Forked accounting
by Arran Cudbard-Bell 20 Mar '08

20 Mar '08

Hi, With eduroam, its good practice to proxy accounting packets back to the home server. But it's also very useful to record those accounting packets. Before I just set up the proxy in pre-acct, then listed the SQL module in accounting, and let the accounting server sent the accounting-reply... I never really liked this way because if the remote accounting server was down, it would mean lots of repeat accounting packets. What I was to do now is write out the accounting packet to two detail files, something like acct-buffer-sql and acct-buffer-proxy. Use one file to populate our local SQL db, and the other to deal with proxying the accounting information back to the home server. This would mean duplicate accounting-response packets being sent, which isn't ideal. Is there any way to stop the server sending an accounting response packet when it receives the reply from the home server ? Thanks, Arran

2 1

incorrect shared secret entry authenticates successfully for freerradius
by sanjeev.kumarroy＠wipro.com 20 Mar '08

20 Mar '08

Hi, I am using the following configuration: O/S: rhel4_u5_i386 Freeradius 1.1.7 Client to test: NTRadPing 1.5 Steps undertaken: -------------------- - Installed a fresh system with rhel4_u5_i386 - Build and compile freeradius 1.1.7 on it. - Update the clients.conf file to add the client entries for the machine that uses NTRadPing 1.5 (IP of the client machine and the shared secret) - Start the radiusd daemon in debug mode (radiusd -X) - Now generate a simple PAP authentication request using NTRadPing. (Port is 1812, also provide the shared secret correctly). The authentication passes successfully as it should. Now give a junk secret key in the NTRadPing utility. The access is rejected. - However when the same cases are tried for CHAP we can see the difference. In the first case the authentication is successful; however when we give a junk shared secret the authentication should ideally have been rejected. However the authentication passes successfully. NOTE: I tried the same for MSCHAPv1 and MSCHAPv2 authentication using VPN client. There I can see clearly that the access is not granted to the VPN client. However when we look at the radius logs it can be seen that the Authentication requests responds with a Successful message. Any help or info in this regards would be highly appreciated. Thanks. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

4 8