- Freeradius-Users - lists.freeradius.org

Cleartext-password problem
by hadi golestani 22 Oct '07

22 Oct '07

Hi, I've installed freeradius and it was working fine with users file authentication but when I add sql module ( freeradius's wiki->SQL_HOWTO ) when I try radtest with a username that is in db, authentication failed, and it's the out put of debug mode: rad_recv: Access-Request packet from host 127.0.0.1:1026, id=168, length=147 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "n2test" MS-CHAP-Challenge = 0x409da00bcdf49bf9ac057995c300f40b MS-CHAP2-Response = 0x24003e5162483aabe749b5dd4550f8e68be60000000000000000980209d9d70a472836d24769c794daa603e726bc8f27c73e Calling-Station-Id = "192.168.1.4" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 12 rlm_realm: No '@' in User-Name = "n2test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 12 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry DEFAULT at line 184 modcall[authorize]: module "files" returns ok for request 12 radius_xlat: 'n2test' rlm_sql (sql): sql_set_user escaped user --> 'n2test' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'n2test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql: Failed to create the pair: Unknown attribute "Cleartext-Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns fail for request 12 modcall: leaving group authorize (returns fail) for request 12 Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 168 with timestamp 471cb73a Nothing to do. Sleeping until we see a request. Why this happens? can this was for some missing information in my db?

2 1

Load Balancing user requests to multiple LNS's
by Adrian 22 Oct '07

22 Oct '07

Hello Everyone, I am trying to configure our free-radius server to send multiple LNS L2TP parameters to a customer's radius server for establishing an L2TP tunnel prior to the user authenticating. Apparently these responses will have to exist in every request however the Customer will only establish an L2TP session if one doesn't exist already. As per their documentation, I would have to do something like below, where the :1: would be L2TP tunnel 1 and :2: would be Tunnel 2: Service-Type=framed Tunnel-Medium-Type=:1:IP Tunnel-Medium-Type=:2:IP Tunnel-Password=:1:password Tunnel-Password=:2:password Tunnel-Type=:1:L2TP Tunnel-Type=:2:L2TP Tunnel-Server-Endpoint=:1:X.X.X.X Tunnel-Server-Endpoint=:2:Y.Y.Y.Y Tunnel-Preference=:1:1 Tunnel-Preference=:2:1 The tunnel-preference would tell them to load balance between Tunnel Server Endpoint 1 and 2. I have loaded all this in a group in the radgroupreply and assigned the group to the user table however when I query the radius I only get the first tunnel info back to me. Can anyone point me in the right direction? In the radius logs there are no errors logged and it just shows the replies it sent to the customer which excludes the :2: tunnel information. I'm using Freeradius 1.0.4 with a mysql config. Thanks Adrian Boros

4 3

allowing multiple values through the attribute filter
by A.L.M.Buxey＠lboro.ac.uk 22 Oct '07

22 Oct '07

hi, i've got a remote site that we want to trust a few return attributes from.... no problem. configured. however, there are 2 different attribute values for one of the attributes and i'm not quite sure of the syntax available for use....eg realm.com Session-Timeout <= 28800, Idle-Timeout <= 600, Tunnel-Medium-Type == IEEE-802, Tunnel-Type == VLAN, Tunnel-Private-Group-Id == testvlan this works...and allows ONLY 'testvlan' attribute to be returned but I also need to accept 'othervlan' and a structure of Tunnel-Private-Group-Id =~ ( /^testvlan$/ || /^othervlan$/ ) doesnt do what i need. is this do-able in attribute filter or can I construct something in unlang (this is a 2.0.0pre2 server) thanks alan PS I've tried setting 2 values...as per the Framed-Protocol == PPP, Framed-Protocol == SLIP, part.....eg Tunnel-Private-Group-Id == testvlan, Tunnel-Private-Group-Id == othervlan, but that just stops EITHER of the return attributes from working. bug?

3 2

concurrency query
by Punith Raj 22 Oct '07

22 Oct '07

Hi all I have a doubt regarding concurrency in freeradius. If freeradius recives an eap-sim packets while it is authenticating one currently, will the new packet ll' wait for the prior to complete or both ll be authenticated simultaniously. I could see thread implementation in eapsim directory but just wanted to make sure once. Thanks in advance -- Regards Punith

2 2

Setting a conditional variable
by mozart＠pisem.net 21 Oct '07

21 Oct '07

Hi everyone! I'm trying to set a conditional variable in my sql.conf. According to value of %{NAS-Port-Type} my variable (i.e. MYVAR) should be assigned to value returned by different programs through 'exec' module. I couldn't find any examples how to do it. So I will appreciate if someone helped me. ps. I'm using version 1.1.2 from FreeBSD ports collection.

2 1

rlm_ippool: Could not find Pool-Name attribute
by hyunok 19 Oct '07

19 Oct '07

Hello, I have a freeradius 1.1.7 server setup with ppp and pptp using a mysql DB for user authentication. radiusd -xx ............. rlm_ippool: Could not find Pool-Name attribute ........... ........... modcall[accounting]: module "radutmp" returns ok for request 1 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "dialup" returns noop for request 1 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "sp_pool" returns noop for request 1 ----------------------------------------------------------------- radiusd.conf ippool dialup { range-start = 172.16.0.1 range-stop = 172.16.0.125 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } ippool sp_pool { range-start = 172.16.1.1 range-stop = 172.16.1.125 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippoolsp ip-index = ${raddbdir}/db.ipindexsp override = no maximum-timeout = 0 } ------------------------------------------------ post-auth { # main_pool dialup sp_pool # sqlippool # sql # ldap } --------------------------------------------------- accounting { detail # daily radutmp # sradutmp # main_pool dialup sp_pool # sqlippool sql } users file ----------------------------------- DEFAULT Pool-Name := dialup Fall-Through = Yes DEFAULT Pool-Name := sp_pool Fall-Through = Yes DEFAULT Group == dialup, Pool-Name := "dialup" DEFAULT Group == sp_pool, Pool-Name := "sp_pool"

2 1

clients linux to freeradius
by lvizcardof＠unsa.edu.pe 18 Oct '07

18 Oct '07

Hello. How do I do for that my clients linux (fedora core 4) soliciten autenticarse ante el servidor freeradius antes de conectarse a la red. Should I install an additional program for my client lunix asking for authentication?. Or is only necessary in some file modoficacion sde linux, as I did in Windows. Liset Vizcardo ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

issue with mysql accounting
by Jan Satko 18 Oct '07

18 Oct '07

Hi. I have WIFI network based on Cisco Aironet 1130 with WPA/TKIP - EAP-PEAP. Radius server is freeradius (just upgraded to 1.1.7) with mysql backend (users,accounting). Everything worked fine for maybe 2 years. Just atm i have a new problem. Some APs got new IOS and i noticed that now is not sending User-Name like name@real but is sending MAC address as Username. This "MAC address" username i got also as system enviroment variables. On other APs with old IOS i got also problem. Some users got some new software for connecting to the network(suplicant) where they can set some "fake" outer username. Ofc users can authenticate against radius without problems. I think its because inner authentication variables (MS-CHAPv2 login name?) which freeradus use for authentication. So it looks like (for me) that AP is sending "outer" information for accounting. Maybe there is some option howto force AP to show inner username ? Back to MYSQL. Mysql atm is logging "fake usernames" or MAC addresses as UserName into radacc table. BUT mysql is logging correct username (inner) into radpostauth. Any chance howto solve this problem ? I want to log username like for radpostauth. Also want this username as system enviroment variable so i can make some start/stop scripts where i can use it. I noticed that TTLS has some options in eap.conf about tunneled-reply or variables. But i have dozen of users(usually students) which have only XP/Vista with PEAP plugin. Cannot force them to install TTLS (if TTLS will works). Tyvm for help. S pozdravom -- Bc. Jan 'EIS' Satko Slovak University of Agriculture network & system manager Tr. A. Hlinku 2 Tel: +421 37 7412 616 949 76 Nitra Slovakia

2 2

Freeradius logging w/syslog
by ballgyer＠mac.com 18 Oct '07

18 Oct '07

Hi Alan, Ok, seems the default install is dated that comes with CentOS 4.4... I've upgraded to FreeRADIUS Version 1.1.7 now and logging seems to be working but I'd like to be able to get more usable data. I nthe /etc/syslog.conf file I have this entry: # .* will log all messages in the same log file local1.* /var/log/radius/radius.log From the syslog server I see this data: Oct 17 19:11:16 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:12:06 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:12:26 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:13:52 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= But I'd like to see the User_Name and Client_Name similar to what you in localhost:/var/log/radius/radius.log file. Thanks again,

2 1

accounting update
by Daann 18 Oct '07

18 Oct '07

I'm trying to do something like http://www.netexpertise.eu/en/FreeRadius/DailyAcct.html this tutorial so that traffic is collected at a regular intervals. The only thing is that they use a cisco router, which has some shell command configuration (I suppose?), anyway, I don't think my router supports the aaa accounting update commands, neither it has many configuration options. Is there any way to work around this. Freeradius server and client run on a linux computer, with apache, and chillispot(for web based login). Greetz Daan EDIT: Could someone post me some more info about the Acct-Interim-Interval command, how this works and if this could be a workaround for traffic collection on a regular base. I saw on this site how someone did this. >I use freeradius & MySQL. I am able to set frequency of acct update by setting attribute Acct-Interim-Interval in rad[group]reply table to number of seconds between updates. > but I'd like to have some more detailed instructions on what to do. Thanks in advance -- View this message in context: http://www.nabble.com/accounting-update-tf4635760.html#a13238963 Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1