- Freeradius-Users - lists.freeradius.org

Re: Consuming card code
by Juraj Bilic 28 Feb '08

28 Feb '08

> >> Can i implement user login, consuming of card codes, etc. with only packets (acct) >> or im missing some crucial points? > > No idea. What "card codes" are you talking about? > The problem: There is a host that controls internet access for 25 different machines. For having internet access machine user must type prepaid code. (there are 1000 generated prepaid valid codes) With one prepaid code user can use the internet for 1h. If user used only 20min of his current prepaid code he can use it again. on another machine (this code now gives 40min of internet access) My naive solution: Use freeradius on host and special .net app on every user machine to control everything. >> I hope that i (user, client) can make an behaviour of communicating with freeradius every 10sec >> and consuming 10sec of currently selected card code. > > You don't want to send accounting packets to the server every 10s. > It's a very bad idea. > > If you need 10s granularity on accounting, use a local database. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

3 2

can't get radtest/radclient to work
by Dan Gahlinger 28 Feb '08

28 Feb '08

I'm having a really stupid problem. I created a "dummy" user for testing: useradd -m testing passwd testing (set password to "testing"). not secure, but who cares - it's just for testing. left share secret as default, tried to login locally with this: echo "User-Name = testing,password=testing" | /usr/bin/radclient localhost:1812 auth testing123 I enabled bad password logging, and get this error in the log: Wed Feb 27 15:13:18 2008 : Auth: rlm_unix: [testing]: invalid password Wed Feb 27 15:13:18 2008 : Auth: Login incorrect: [testing/testing] (from client localhost port 0) I also tried this way: radtest testing testing 127.0.0.1:1812 0 testing123 and this was the result: Sending Access-Request of id 92 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 92 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=92, length=20 All the radius.conf defaults are left the same except the extra bad password logging. I have no idea why that's failing. I know it's something really stupid like the "system" login fall-through bypass not being high up enough in the config or something. Can anyone jog my memory again? thanks! Dan. _________________________________________________________________

5 8

Help With Cisco Configuration
by Joseph.Corrado＠nc4.us 27 Feb '08

27 Feb '08

I am trying to get a freeradius implementation rolled out for the first time and am running into a few issues that I cannot seem to resolve. I have a Cisco 2960 in a test lab with a Linux server running freeradius 2.0.0 for authentication. There are 2 problems I am running into. 1. I cannot seem to get the radius server to authenticate a user and place them at the privilege exec prompt, even thought I have configured the 'users' file to place all users at the privilege exec prompt when logging in by default (I did this just to test, ultimately I would like to create groups with different privilege levels). 2. I cannot seem to get the Cisco 2960 to accept the radius servers authentication response when logging in the device via a VTY session using SSH. When running the server in debug mode, you can see the request coming in and the server sending the authentication response back to the switch, but the authentication will still fail at the switch. The only authentication I get is at the console level. Any help would be greatly appreciated. Thank you. Joe Disclaimer: This message is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential, proprietary, or exempt from disclosure under applicable law. If you are not the intended recipient or the person responsible for delivering the message to the intended recipient, you are strictly prohibited from disclosing, distributing, copying, or in any way using this message. If you have received this communication in error, please notify the sender and destroy and delete any copies you may have received.

2 2

Re: header enrichment
by mauro 27 Feb '08

27 Feb '08

Normally in a mobile services there's no specification into the header about connection type. many sniffing were done but only specific equipment allows to enrich the header with this inofrmation, for example some particular charging proxy. We need to have this information cause from server side could be interesting to give to the user different services according to the user connections. now i asked, if freeradius can help us in this. regards Mauro ----- Messaggio originale ----- Da: Guy Davies <aguydavies(a)gmail.com> A: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Inviato: Mercoledì 27 febbraio 2008, 12:01:21 Oggetto: Re: header enrichment On 27/02/2008, Alan DeKok <aland(a)deployingradius.com> wrote: > mauro wrote: > > Hi all > > i would like to know if freeradius can help to enrich the user header > > for that mobile services that needs some particular params as for > > connection type ( 3g, gprs...). > > > What does that mean? > > I'm not a 3g expert. Maybe the 3g equipment you're using can use > RADIUS attributes. If so, see it's documentation for what RADIUS > attributes it uses. Alan is right. I would imagine that you'd need to use the 3GPP or 3GPP2 RADIUS dictionary to respond with attributes that could be used by the client to perform the header enrichment. As long as the information can be presented as a regular RADIUS attribute or VSA, then you can use FreeRADIUS to provide that information to the client (the device performing the header enrichment function). Rgds, Guy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

2 1

VMPS support
by Phil Mayers 27 Feb '08

27 Feb '08

All, I'm moving our legacy switches over to the VMPS support in FreeRadius 2 and I'm aware there are others on the list who have done this. I'm seeing several different formats of VMPS request. The "easy" ones are from older switches e.g. cisco 1900s: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 2207055872 VMPS-Client-IP-Address = 172.28.72.65 VMPS-Port-Name = "22" VMPS-VLAN-Name = "PROD" VMPS-Domain-Name = "HOR-PG" VMPS-Unknown = 0x00 VMPS-MAC = 00:01:4a:f8:93:e5 However, newer switches e.g. Cisco 3500XL are sending Reconfirm-Request packets with no MAC (but with a cookie): VMPS-Packet-Type = VMPS-Reconfirm-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13320 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "PROD" VMPS-Unknown = 0x01 VMPS-Cookie = 00:1b:78:a5:96:e0 How do I need to respond to these? It seems that if I return a Join-Response it will simply be obeyed, but I'm worried it will explode later. Do I need to return a Reconfirm-Reponse with a Deny if the requested vlan is different to the desired on, or a permit otherwise? We're also seeing from the newer switches join packets with no MAC or cookie, but an ethernet header: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13329 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/3" VMPS-VLAN-Name = "--NONE--" VMPS-Unknown = 0x00 VMPS-Ethernet-Frame = 0xffffffffffff001636e46d1b08004500015... What's the easiest way to get the MAC address out of these?

2 4

RE: Radius MAC filtering with EAP-PEAP
by Ivan Kalik 27 Feb '08

27 Feb '08

1. Debug is a bit longer than that. You should post the whole thing. 2. This is not a mac authentication request. 3. That Calling-Station-Id is not going to get checked. Read instruction in users file where do check items go. Ivan Kalik Kalik Informatika ISP Dana 27/2/2008, "Era" <alexey.eronko(a)gmail.com> piše: >Hi! > >Could you please assist me to find my fault. I have test user with laptop. I >want to restrict access for this laptop. In users file I added wrong mac >address (00-18-de-4e-8f-11) but laptop still can connect with testuser/12345 >credentials. > >:( > >Here is my AP request : > >rad_recv: Access-Request packet from host 10.10.10.139:6001, id=65, >length=195 > User-Name = "testuser" > NAS-IP-Address = 89.10.10.139 > Called-Station-Id = "00-20-a6-64-66-a3:A" > Calling-Station-Id = "00-18-de-4e-8f-1d" > NAS-Identifier = "ORiNOCO-AP-700-64-66-a3" > State = 0x47e0330ad155ef064a62de62873e8690 > Framed-MTU = 1400 > NAS-Port = 2 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020900261900170301001b139845f4c8e9bcb46 > >Debug log: > >rlm_checkval: Item Name: Calling-Station-Id, Value: 00-18-de-4e-8f-1d >rlm_checkval: Could not find attribute named Calling-Station-Id in check >pairs > modcall[authorize]: module "checkval" returns notfound for request 8 > > > >Here is my users file: > >testuser User-Password == "12345" > Calling-Station-Id = "00-18-de-4e-8f-11" > >Here is my checkval config: > >checkval { > # The attribute to look for in the request > item-name = Calling-Station-Id > # The attribute to look for in check items. Can be multi >valued > check-name = Calling-Station-Id > # The data type. Can be > # string,integer,ipaddr,date,abinary,octets > data-type = string > # If set to yes and we dont find the item-name attribute in >the > # request then we send back a reject > # DEFAULT is no > notfound-reject = yes > } > >Era > >-----Original Message----- >From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org >[mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or >g] On Behalf Of Ivan Kalik >Sent: Wednesday, February 27, 2008 12:33 PM >To: FreeRadius users mailing list >Subject: Re: Radius MAC filtering with EAP-PEAP > >>Could you please suggest me how can I check MAC filter(via Radius) and >after >>that do EAP-PEAP authorization? >> > >Read your NAS documentation. > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

Re: Radius MAC filtering with EAP-PEAP
by Liran Tal 27 Feb '08

27 Feb '08

On Wed, Feb 27, 2008 at 1:19 PM, Era <alexey.eronko(a)gmail.com> wrote: > Era wrote: > > > Could you please assist me to find my fault. I have test user with > laptop. > I > > want to restrict access for this laptop. In users file I added wrong mac > > address (00-18-de-4e-8f-11) but laptop still can connect with > testuser/12345 > > credentials. > > Did you read the documentation for the "users" file? > > [Era]: Yes I did. But no result. > > > Here is my users file: > > > > testuser User-Password == "12345" > > Calling-Station-Id = "00-18-de-4e-8f-11" > > What do you think this entry does? > > [Era:] I thought that this entry maps user with mac hardware address. > > No that lines means that the user tester/12345 will be granted access and freeradius will send a Calling-Station-Id attribute reply to the NAS in return, which is not what you wanted... I hope this makes more sense. Regards, Liran Tal.

1 0

Re: Radius MAC filtering with EAP-PEAP
by Alan DeKok 27 Feb '08

27 Feb '08

Era wrote: > Could you please assist me to find my fault. I have test user with laptop. I > want to restrict access for this laptop. In users file I added wrong mac > address (00-18-de-4e-8f-11) but laptop still can connect with testuser/12345 > credentials. Did you read the documentation for the "users" file? > Here is my users file: > > testuser User-Password == "12345" > Calling-Station-Id = "00-18-de-4e-8f-11" What do you think this entry does? > Here is my checkval config: I don't think you need to use the "checkval" module. In 2.0, you can just write the logic you want in "unlang". Alan DeKok.

2 1

header enrichment
by mauro 27 Feb '08

27 Feb '08

Hi all i would like to know if freeradius can help to enrich the user header for that mobile services that needs some particular params as for connection type ( 3g, gprs...). Somebody has experience in this ? thanks ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

3 2

Complex redundant ldap setup
by Capelle, Mark (PCMC-GB) 27 Feb '08

27 Feb '08

I have an LDAP setup with multiple module statements pointing to the same LDAP server, but at different OU's (referred to as sites) to get around issues due to the large tree size present. This is currently working with the following setup radiusd.conf: modules { ldap srv1-sitea { .. set_auth_type = yes } ldap srv1-siteb { .. set_auth_type = yes } } sites-available/default: authorize { srv1-sitea srv1-siteb } authenticate { Auth-Type srv1-sitea { srv1-sitea } Auth-Type srv1-siteb { srv1-siteb } } Now my goal is to make this a redundant configuration. I have duplicated my modules config, changing "srv1" to "srv2" and changing the IP address of the LDAP server. The rest of the configuration is what is fuzzy for me. I assume that my authorize section would be: authorize { redundant { srv1-sitea srv2-sitea } redundant { srv1-siteb srv2-siteb } Now the authentication part is where is becomes complicated. I don't even know where to begin with this. I tried this based on some old configs I had used in the past, but this failed miserably: authenticate { Auth-Type ldap { group { srv1-sitea { reject = 1 ok = return } srv2-siteb { reject = return ok = return } } } I read the "configurable failover" docs, but it is still not clear to me what I would need to do in this situation. I am sure there is probably an easy way to accomplish this so that for each OU ("site") it uses both LDAP servers ("srv1","srv2") in a redundant fashion, but how to do it is something I am having a heck of a time figuring out.

4 3