- Freeradius-Users - lists.freeradius.org

Re:FreeRadius for wireless authentication
by cdemel 20 Nov '07

20 Nov '07

Hi I am new to radius and the list. I need to configure a free radius server to authenticate wireless users using the Organisations CA certificate which is on Netscape. wireless users will use individual certificates which are generated from the CA of the organisation. any help or documentation mostly appriciated. regs Cdem

1 0

DEFAULT entry in users file (1.0.5-->1.1.7)
by Martin Pauly 19 Nov '07

19 Nov '07

Hi everybody, sorry to ask, but I don' get it. I'm still trying to upgrade from 1.0.5 to 1.1.7. Previously, my users fiel looked like this: [some static entries for special users] [some entries with Auth-Type=Reject for special conditions] DEFAULT Auth-Type = LDAP, Called-Station-Id == "our-dialup-number" Service-Type = Framed-User, Framed-Protocol = PPP, [more reply-items for dialup users] # All other requests: simply match against LDAP # Replace 'outer' attribute User-Name with value from variable # ==> This yields the true username from inside the tunnel in case of # anonymous outer identification with 802.1x DEFAULT Auth-Type = LDAP User-Name = `%{User-Name}`, Reply-Message = "Matched DEFAULT user entry in staff-RADIUS" So all my normal users' passwords are checked against LDAP, using LDAP bind-as-user. There's a properly configured LDAP section in radiusd.conf, of course. With 1.1.7 (and perhaps with any version >=1.1.4), Auth-Type = LDAP seems to be gone, but what on earth do put there instead? The static entries (with cleartext-password for 1.1.7) work fine, With a users file like DEFAULT User-Name = `%{User-Name}` the server complains loudly about the missing Auth-Type when asking with radtest: rad_recv: Access-Request packet from host 127.0.0.1:41995, id=59, length=58 User-Name = "martin" User-Password = "testpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "pauly0", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pauly0" rlm_realm: Proxying request from user pauly0 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 69 radius_xlat: 'pauly0' modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. So how do I direct the server to use LDAP without setting Auth-Type? Or is radtest somehow the wrong test tool in the new scenario?? Thanks, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 2

Rlm_sqlcounter - how to configure weekly reset on every Sunday?
by Lee Sing Chyun 19 Nov '07

19 Nov '07

Hi, I'm trying to configure a sqlcounter that is reset every Sunday 0:00AM: sqlcounter weeklycounter { counter-name = Weekly-Session-Time check-name = Max-Weekly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = weekly # For mysql: query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } After that, I did a radtest. From the resulting SQL trace, I notice "%b" is expanded as 7 days earlier than today. For instance, when running radtest on 20 Nov 2007 1:16AM (a Tuesday), "%b" gets expanded to 13 Nov 2007 0:00AM (a Tuesday too), which is not my desired outcome. Hence, how do I configure a sqlcounter that is reset every Sunday 0:00AM? Thanks in advance, and sorry if there're any obvious mistakes that I have overlooked. -- sc

1 0

AAA Services with multiple SQL
by Paolo Serafino Via 19 Nov '07

19 Nov '07

I've configured my freeradius conf files to accept Authorization and Accounting Request using two different sql instances and driving them with Realms, looking at various posts about this argument. It works with accounting, but not with authorization. I've run freeradius in debug mode (freeradius -x) and i saw that it loads the right sql instance depending the right realm, but it EVER gives "wrong username and password" despite i copy the sql query that i see in the debug and i get my username!!!!!! ### radiusd.conf authorize { Autz-Type wic { wic } Autz-Type no { no } } ### users DEFAULT Mikrotik-Realm == "wic", Autz-Type := "wic" DEFAULT Mikrotik-Realm == "novara", Autz-Type := "no" and in my NAS i put that realms.... -- View this message in context: http://www.nabble.com/AAA-Services-with-multiple-SQL-tf4835226.html#a138332… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

force reject user without password
by Marc delavaud 19 Nov '07

19 Nov '07

I have users who try to authenticate without password, this cause load on my ldap server Mon Nov 19 15:05:59 2007 : Auth: Login incorrect: [mike/<no User- Password attribute>] (from client localhost port 0) Mon Nov 19 15:05:59 2007 : Auth: Login incorrect: [mike/<no User- Password attribute>] (from client How can force reject users without password provided ? ----------------------------------- Marc Boisis-Delavaud tel: 05 46 45 82 14 Centre de Ressources Informatiques Université de La Rochelle -----------------------------------

1 0

Re: in vs. out
by wlan＠mac.com 19 Nov '07

19 Nov '07

Hi Alan, > No. The standard is the RFC. The portmaster text is just > additional > text from the people building RADIUS systems. > > It is NOT vendor specific. Do NOT say it is vendor specific. > Ok... I deserve a good slap for that one ;) I will start thinking of it as vendor specific brokenness. But, my reality remains the same.. the meaning depends on the NAS being broken or not. >>> Follow the standards. Do not follow broken vendors. >> >> It actually isn't just that one vendor... in fact, if not >> mistaken, much >> of the commercial wlan gear I've worked with used the above >> meaning. It >> would be curious to see a list of vendors and how they implemented >> their >> accounting... if we all checked the manuals of the devices we >> use, we >> could all help build that list in the freeradius wiki! > > Feel free to start this effort. > I will ... maybe at: http://wiki.freeradius.org/NAS_Accounting_Differences > There are many other vendor products that are very broken with > respect > to RADIUS. Do NOT follow any individual vendor, or even groups of > vendors. Follow the standards. If the standards aren't clear, ask on > the IETF RADEXT mailing list. The people there should be able to give > conclusive answers. > Unfortunately, from a back-end perspective, if having to support a variety of 'broken' commercial vendors, one doesn't have much choice (apart from not supporting these vendors). I guess we have to live with it as it would probably be difficult for these vendors to change their ways now... David

9 15

Benchmark test score about the performance of this server
by Liangliang Guo 19 Nov '07

19 Nov '07

Hi everyone: -Does any one have some measurement counters or benchmark test score about the performance of this server when using mysql database backend? For example 3000 requests/s for 5 millions users with 98% latency within 0.0X second on Netra 240 ......? -In my understanding this kind of figures may vary on the authentication method and backend type? Am I right? Br /Liangliang Guo

2 1

Authorization and account methods that the free radius supports?
by Liangliang Guo 18 Nov '07

18 Nov '07

Hi everyone: Does anybody know what kinds of authorization and account methods that the free radius supports. At the official wiki, authentication methods are documented in details. However for authorization methods only some supported database backbends are described, and for accounting only some conceptual introduction to accounting are available? Can anyone throw some lights on them. Best Regards /Liangliang Guo

1 0

wpa_supplicant eap trouble
by Patrick Welche 18 Nov '07

18 Nov '07

I have set up radiusd-CVS of 15 Nov, and can't connect to it with wpa_supplicant 0.4.9/bsd/ath0. (I also tried vista but that's worse.) The authentication seems to succeed: Sun Nov 18 15:11:10 2007 : Debug: ++[sql] returns ok Sending Access-Accept of id 1 to 192.168.200.34 port 1027 Service-Type = Framed-User Framed-Protocol = PPP EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "test" Sun Nov 18 15:11:10 2007 : Debug: Finished request 1. Sun Nov 18 15:11:10 2007 : Debug: Going to the next request But, now on the client (whose clock is 2.180s slow): Nov 18 15:11:12.979857: EAPOL: SUPP_BE entering state RECEIVE Nov 18 15:11:13.025776: RX EAPOL from 00:19:5b:67:d2:1c Nov 18 15:11:13.026165: RX EAPOL - hexdump(len=8): 01 00 00 04 04 01 00 04 Nov 18 15:11:13.026210: EAPOL: Received EAP-Packet frame Nov 18 15:11:13.026235: EAPOL: SUPP_BE entering state REQUEST Nov 18 15:11:13.026259: EAPOL: getSuppRsp Nov 18 15:11:13.026282: EAP: EAP entering state RECEIVED Nov 18 15:11:13.026308: EAP: Received EAP-Failure Nov 18 15:11:13.026332: EAP: EAP entering state DISCARD Received EAP-Failure ?! Am I right in guessing that EAP-Message = 0x03010004 means 03 = EAP-Success, 01 = id, 0004 = 4 bytes long? Sending... gets printed before the packet is signed, so I assume that the correct Message-Authenticator gets computed. How can I break the configuration files such that all communication up to Access-Accept is OK, and yet the connection fails? Cheers, Patrick

2 1

Error: no DB handles to use
by sam 18 Nov '07

18 Nov '07

Hi, I met a strange problem seems related "rlm_sql". When freeradius running in debug mode(radiusd -X) everything works fine, but there's something wrong in normal mode. Below please find the error information in radius.log file. Need your help! Sun Nov 18 15:13:24 2007 : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. Sun Nov 18 15:13:24 2007 : Error: rlm_sql_unixodbc: SQL down 08S01 [unixODBC][FreeTDS][SQL Server]Server is unavailable or does not exist. Sun Nov 18 15:13:24 2007 : Error: rlm_sql_unixodbc: Connection failed Sun Nov 18 15:13:24 2007 : Error: rlm_sql (sql): Failed to connect DB handle #4 Sun Nov 18 15:13:24 2007 : Info: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 1 My configuration: OS: Fedora Core 7 FreeRadius: 1.1.7-3 FreeTDS: 0.64-6 unixODBC: 2.2.12-2 Regards, Sam

1 0