- Freeradius-Users - lists.freeradius.org

Cisco 10008 issue
by Alex Moen 12 Jan '08

12 Jan '08

Hello list, We have a Cisco 10008 that we are trying to set up for broadband aggregation. The 10008 utilizes a radius server to authenticate each internet subscriber, either based on mac address or circuit id. Cisco says that we cannot use freeradius (they recommend Cistron, which is now 4 years old) because "freeradius is buggy and does not work well" (their words, not mine, no flaming please!!!). I suspect that the particular CCIE has had some bad experience with freeradius in his sysadmin past, but he is normally a very good engineer and hasn't steered us wrong in the past on other projects... We use freeradius for other uses in our network and have never had problems with it. In fact, we are using it (v. 0.9.3) with a Cisco 10008SSG to authenticate PPPOE clients on an MMDS system, with no problems. Has anyone ever run into this type of problem or roadblock before? Any advice would be welcome, and let me know if I need to send more detail... Thanks! Alex

4 3

probs with accounting Attribute Client-IP-Address was not
by orion 12 Jan '08

12 Jan '08

hi to all. im using FR 2.0.0 with default config. in debug mode i get *rlm_acct_unique*: *WARNING*: *Attribute* *Client*-*IP*-*Address* was not found in request, unique ID MAY be inconsistent in 1.1.7 was ok. My nas is the same ( mikrotik routerboard ) with the same config that was with 1.1.7

3 9

help
by adnan deura 12 Jan '08

12 Jan '08

hello i am given a project of installing freeRADIUS 1.1.7 on fedora core 7. i am unable to go next to the step "radiusd -x" kindly tell me some method to install it please help i have installed fedora core 7 on VmWare 5.5 and that on windows xp. do i need more than one computer to install this. i am a student at university 3rd year BSc computer science help me please _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

5 4

interfacing with ISC DHCP
by bjlockie＠lockie.ca 12 Jan '08

12 Jan '08

Is it possible to authenticate with radius and the have ISC DHCP hand out out an IP (etc)?

4 6

Problems with Prefix
by Andreas Thienemann 12 Jan '08

12 Jan '08

Hi, I'm trying to migrate our old livingston radius (from around '96) user-file to a newly installed freeradius 1.1.7 server. Our general setup is, that dialing in with user should rlogin the user to a shell-server. If the username is prefixed by a P, a PPP-Session should be started. Reading the docs, this setup should be pretty straight-forward, using the hints file. Unfortunately, it does not really work as expected. The hints file contains the following lines, which seem to at least somewhat work as the P is stripped and authentication succeeds. DEFAULT Prefix == "P", Strip-User-Name = Yes Hint = "PPP", Service-Type = Framed-User, Framed-Protocol = PPP The users file has users configured with the following structure: user Password == "whatever" Service-Type = Login-User, Login-IP-Host = 192.168.1.1, Login-Service = Rlogin, Port-Limit = 2, Filter-Id = "dialin", Framed-IP-Address = 192.168.2.123 My understanding of the documentation (http://freeradius.org/radiusd/man/users.html) is, that the Service-Type should _not_ be set to Login-User when authenticating as Puser as it has been previously set as configured in the hints file. Unfortunately, this seems to be incorrect. [root@phoenix raddb]# radtest Puser whatever localhost 0 testing123 Sending Access-Request of id 214 to 127.0.0.1 port 1812 User-Name = "Puser" User-Password = "whatever" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=214, length=59 Service-Type = Login-User Login-IP-Host = 192.168.1.1 Login-Service = Rlogin Port-Limit = 2 Filter-Id = "dialin" Framed-IP-Address = 192.168.2.123 Any suggestions how to correctly get the Service-Type set to Framed-User when authenticating as Puser? thx, andreas

2 3

SQL Counter Problem
by Keith Dovale 12 Jan '08

12 Jan '08

Is there a limitation with the SQLCounter routine using a value above 2,148,000,000 in the checkfield ? As if I set this value to anything below this figure the routine works as planned however if I go above this value it rejects the user as no available time. I am trying to use the sqlcounter to check to see if the user has available bandwidth and if so give them access, but this now limits me to this value. I am using the freeradius port for cygwin, can anyone help me out with this as I need to set this figure to above 30Mb value

2 2

LDAP Groups and EAP
by Brian Wilson 12 Jan '08

12 Jan '08

Hi all: I am running Freeradius 1.1.0 and am trying to get Ldap-Groups to work with EAP/PEAP/MSCHAPv2, but have been running into issues. I'm trying to permit authentication to a wireless SSID based on an LDAP group. Here is my configuration: Radiusd.conf: authorize{ preprocess auth_log files { notfound = return } eap redundant-load-balance { ldap1 ldap2 } authenticate { Auth-Type LDAP { redundant-load-balance { ldap1 ldap2 } Auth-Type EAP { eap } hints: DEFAULT Called-Station-Id =~ ".*:ssid" Called-Station-Id := "ssid" huntgroups: restrict Called-Station-Id == ssid all NAS-IP-Address == xxx users: DEFAULT Huntgroup-Name == restrict, Ldap-group == "cn=something,ou=something" DEFAULT Huntgroup-Name == all When I try to authenticate, the radius server receives about 7 Access-requests. Each time it receives one, the Radius server checks the LDAP store to verify that the user exists in the ldap group (is this normal? can this be reduced? 7 LDAP binds per authentication attempt seems high), and each module returns OK. On the 6th attempt though, it attempts to decode the EAP tunnel, and this happens: rlm_dap::ldap_groupcmp: User found in group cn=something,ou=something blah blah blah Processing the authenticate section blah blah blah rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - XXX rlm_eap_peap: Tunneled data is valid PEAP: Got tunneled identity of XXX PEAP: Setting default EAP type for tunneled EAP session PEAP: Setting User-Name to XXX Processing the authorize section modcall[authorize]: module "preprocess" returns ok for request 6 blah blah blah modcall[authorize]: module "auth_log" returns ok for request 6 modcall[authorize]: module "files" returns notfound for request 6 Notice that there is no additional call to ldap_group between the authorize and the resulting failure in the files module. Since I have set "files { notfound = return}," the user fails to authenticate despite being accepted 5 times previously with ldap_group. If I remove "notfound = return", the user can authenticate REGARDLESS of the ldap-group I set, even when ldap_group returns notfound. Is there something i'm missing in the configuration file? ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

3 2

Message-Authenticator
by Norbert Wegener 12 Jan '08

12 Jan '08

In cvs from January 9th I noticed for the first time, that freeradius complains about packets without Message-Authenticator and ignores them: WARNING: Insecure packet from host 145.25.153.222: Packet does not contain required Message-Authenticator attribute How can freeradius be convinced to handle those packets? In clients.conf I have require_message_authenticator = no but the clients come from an sql database. Norbert Wegener

2 2

How to enable only EAP-TTLS type and not EAP-TLS?
by nikitha george 11 Jan '08

11 Jan '08

Hi, I want to enable only TTLS authentication and if the client is requesting any other types EAP-TLS or PEAP the authentication should be denied. I am running freeradius-1.1.6, and if try to disable EAP-TLS module the server itself is not starting up. Please let me know if there are any ways to achieve this. Thanks a lot.. Nikitha.

7 23

Problem in Accounting
by Jayaraman Balasubramanian 11 Jan '08

11 Jan '08

Hi I have configured the Free Radius Server to work as proxy radius server with the following in the proxy.conf realm NULL { type = radius authhost = 100.100.0.2:1812 accthost = 100.100.0.2:1813 secret = testing123 } All the other conf files are configured properly. AM getting the following problem. For authentication of user, the Access Request packet is transferred to the ip address 100.100.0.2. But for Accounting Request the packet is transfered locally Am getting log as sending Accounting Request to 127.0.0.1:4445 What can be the solution ? -- Regards Balu

2 3