- Freeradius-Users - lists.freeradius.org

Novice user. Authenticate against Radius Server
by German Anguiano Bayardo 24 Jan '08

24 Jan '08

Hi guys. I'm a beginner with the Radius protocol. I've been using Linux for a while now, so I hope it doesn't take me too long to catch the idea. Sorry in advance if a make some stupid questions. Ok, here I go. I'm in a new job. My boss told me that they attempted to setup a Hotspot for free public access. But they want the users to register with us (this is a government office) for usage statistics, accounting, etc. They say the only missing part is a Radius Server where to authenticate the users. The steps are as follows: 1.- The user uses his laptop to access Internet, open the web browser and get a Welcome Page, where they have to login 2-. When they give user an password, the access point verifies it against a Radius Server, just for access statistics purposes. 3.- If it's a valid user, he/she can have access to Internet. Some sort of that is the idea. Nothing sophisticated, only that users must be registered. Can anyone point me to the right path ?? Thanks in advance... German Anguiano B. _________________________________________________________________ ¡Actúa tu película favorita y gana fabulosos premios! http://cine.prodigymsn.com/nanometraje

3 2

Blank spaces after username - problem with accounting - MySql database.
by Marinko Tarlac 24 Jan '08

24 Jan '08

Hi there... It is me again... Few days ago, I wrote about my problem with accounting. Problem is that accounting doesn't work for some users. In this case it is "test.user"... After some investigation with log files (holly radiusd -X), I can see that problem is in username. As you can see (line marked with *-*-*-*-*-*-*), some blank spaces were added to username. I'm not sure how is this possible and who adds this blank spaces (Mikrotik as nas or radius server?). Log file is truncated but I believe you can see where is the problem. ------------------------------------------------------------------------------------------------- LOG STARTS Finished request 13 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.15.2:48263, id=86, length=145 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 23427 NAS-Port-Type = Ethernet User-Name = "test.user " *-*-*-*-*-*-* (notice blank spaces before closing ") .... rlm_realm: No '@' in User-Name = "test.user ", looking up realm NULL *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") .... ... radius_xlat: 'test.user ' *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") rlm_sql (sql): sql_set_user escaped user --> 'test.user ' *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test.user ' ORDER BY id' *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") ..... rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 14 rlm_chap: login attempt by "test.user " with CHAP password *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") rlm_chap: Using clear text password "testpassword" for user test.user authentication. rlm_chap: chap user test.user authenticated succesfully *-*-*-*-*-*-* (user with blank spaces doesn't exist anywhere and especially not in radcheck table and authentication was successful ????) modcall[authenticate]: module "chap" returns ok for request 14 modcall: leaving group CHAP (returns ok) for request 14 .............. radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('814054d0', '8ff2e3a7022d4a99', 'test.user ', '', '192.168.15.2', '23427', 'Ethernet', '2008-01-21 23:41:06', '0', '0', 'RADIUS', '', '', '0', '0', 'ht1', '00:19:66:11:59:F7', '', 'Framed-User', 'PPP', '192.168.15.212', '0', '0')' ------------------------------------------------------------------------------------------------- LOG ENDS p.s. As I can see in debug lines, raddacct table has been filled with wrong username so I searched for username "test.user " and I can see his traffic. I can solve this problem with small scheduler script who will replace "test.user " with "test.user" but who knows... Maybe tomorrow I will have more spaces and other signs in username ??? One is sure. MySql seems fine and only solution I can do now is to make querry "UPDATE radacct SET UserName='test.user' WHERE UserName='test.user '"; FR is 1.1.4 and I will update it and see what's going on...

5 14

how to enable ldap during authentication
by Tomasz Zieleniewski 24 Jan '08

24 Jan '08

Hi, I am using version 2.0.2-pre I would like to use ldap for freeradius authentication. I couldn't find anything on web about this topic. I have ldap module in the authorize section in my default virtual server. I see in the debug that ldap module returns ok during authorization please point me what do I have to do to use ldap olso for authentication is it enough to put ldap invocation in authentication section? below debug from authorization thanks a lot for any help! regards -tomasz rlm_ldap: waiting for bind result ... request 1 done rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Touki,ou=People,dc=touk,dc=pl, with filter (mail=tzl(a)touk.pl) request 2 done rlm_ldap: Added User-Password = {MD5}SNNMxdM+Zfvr//0yEp0DuA== in check items rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute userPassword as RADIUS attribute Cleartext-Password == "{MD5}SNNMxdM+Zfvr//0yEp0DuA==" rlm_ldap: looking for reply items in directory... rlm_ldap: user tzl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok

4 6

Project site down
by Frank Büttner 24 Jan '08

24 Jan '08

Hello, can it be, that the site is down?

5 4

Re: Re: Problem with Vista EAP-PEAP Authentication
by debug afone 24 Jan '08

24 Jan '08

Hi All, I solved this problem using cert gen tools from 2.0.1 version of FreeRadius, as advised by Alan. Sending Access-Accept of id 108 to 10.40.0.114 port 1073 User-Name = "LDAPAFONE\\nsouleman" MS-MPPE-Recv-Key = 0x98a6ba5cb9a9a972244128a592224d932a0350aaf8d4dda665a7472e4479c0b7 MS-MPPE-Send-Key = 0x07405f0d8af6adda158c16a0dbb2581c9be219dcf251fc9c8d74bb8c2498edb4 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 Thanks, problem Solved. Nicolas SOULEMAN.

1 0

EXAMPLE: unlang removing attribute inside a test
by Mike O'Connor 24 Jan '08

24 Jan '08

Hi Guys I thought I would send an example of unlang being used to remove an attribute after proxying. My attrs file add a Cisco-AVPair which needs removing if the customer is given a static ip address by the retail ISP. authorize { ..... if("%{reply:Framed-IP-Address}") { update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_1" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_2" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_3" } } } I also added the update option to the post-auth to remove the Cisco-AVPair in the case of a reject. post-auth { ...... Post-Auth-Type REJECT { update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_1" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_2" } update reply { Cisco-AVPair -= "ip:addr-pool=ip_pool_3" } sql_log } } One issue I could not seem to find a way of removing an attribute unless both the attribute and value match, this means that I have to list each of the pool individually. Cheers Mike

2 3

Re: extract different field from ldap on nas's ip address base
by arjuna＠ts.infn.it 24 Jan '08

24 Jan '08

> Is it possible to extract (to filter) different field in a ldap entry on > the base of the "nas" ip address? ok i've found out this old thread http://lists.cistron.nl/pipermail/freeradius-users/2004-December/039132.html and it was realy usefull, but i still have problem to make the rule in users file match the packet.... can someone tell me where to find out a guide, tutorial, README about the fields i can use in the rules inside users file? thanks, arjuna

2 1

Don't work freeradius with MySQL.
by mohsen rahmanian 24 Jan '08

24 Jan '08

Hi dears, I install freeradius, MySQL on Ubuntu 7 and work correctly with file authentication, but where follow "http://wiki.freeradius.org/SQL_HOWTO" instruction don't get any response. my output when run 'freeradius -x' are: **** Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Module: Loaded sql_log Module: Instantiated sql_log (sql_log) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. **** debug msg are: ##### rad_recv: Access-Request packet from host 192.168.1.7:1500, id=2, length=45 User-Name = "fred" CHAP-Password = 0xdd72a5e140beedbac0d9088eb9a4fb1bce rlm_chap: Setting 'Auth-Type := CHAP' rad_recv: Access-Request packet from host 192.168.1.7:1500, id=2, length=45 rad_recv: Access-Request packet from host 192.168.1.7:1500, id=2, length=45 ##### I add my client IP (192.168.1.7) on clients.conf and naslist and insert a record in nas table . I use NTRadPing for test FreeRadius. Why? -- Best Regards Rahmanian

3 4

Unsubscribe
by Rakesh Jha 24 Jan '08

24 Jan '08

Unsubscribe. Thanks, Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0

extract different field from ldap on nas's ip address base
by arjuna＠ts.infn.it 24 Jan '08

24 Jan '08

Is it possible to extract (to filter) different field in a ldap entry on the base of the "nas" ip address? arjuna

1 0