- Freeradius-Users - lists.freeradius.org

concurrency query
by Punith Raj 22 Oct '07

22 Oct '07

Hi all I have a doubt regarding concurrency in freeradius. If freeradius recives an eap-sim packets while it is authenticating one currently, will the new packet ll' wait for the prior to complete or both ll be authenticated simultaniously. I could see thread implementation in eapsim directory but just wanted to make sure once. Thanks in advance -- Regards Punith

2 2

Setting a conditional variable
by mozart＠pisem.net 21 Oct '07

21 Oct '07

Hi everyone! I'm trying to set a conditional variable in my sql.conf. According to value of %{NAS-Port-Type} my variable (i.e. MYVAR) should be assigned to value returned by different programs through 'exec' module. I couldn't find any examples how to do it. So I will appreciate if someone helped me. ps. I'm using version 1.1.2 from FreeBSD ports collection.

2 1

rlm_ippool: Could not find Pool-Name attribute
by hyunok 19 Oct '07

19 Oct '07

Hello, I have a freeradius 1.1.7 server setup with ppp and pptp using a mysql DB for user authentication. radiusd -xx ............. rlm_ippool: Could not find Pool-Name attribute ........... ........... modcall[accounting]: module "radutmp" returns ok for request 1 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "dialup" returns noop for request 1 rlm_ippool: This is not an Accounting-Stop. Return NOOP. modcall[accounting]: module "sp_pool" returns noop for request 1 ----------------------------------------------------------------- radiusd.conf ippool dialup { range-start = 172.16.0.1 range-stop = 172.16.0.125 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } ippool sp_pool { range-start = 172.16.1.1 range-stop = 172.16.1.125 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippoolsp ip-index = ${raddbdir}/db.ipindexsp override = no maximum-timeout = 0 } ------------------------------------------------ post-auth { # main_pool dialup sp_pool # sqlippool # sql # ldap } --------------------------------------------------- accounting { detail # daily radutmp # sradutmp # main_pool dialup sp_pool # sqlippool sql } users file ----------------------------------- DEFAULT Pool-Name := dialup Fall-Through = Yes DEFAULT Pool-Name := sp_pool Fall-Through = Yes DEFAULT Group == dialup, Pool-Name := "dialup" DEFAULT Group == sp_pool, Pool-Name := "sp_pool"

2 1

clients linux to freeradius
by lvizcardof＠unsa.edu.pe 18 Oct '07

18 Oct '07

Hello. How do I do for that my clients linux (fedora core 4) soliciten autenticarse ante el servidor freeradius antes de conectarse a la red. Should I install an additional program for my client lunix asking for authentication?. Or is only necessary in some file modoficacion sde linux, as I did in Windows. Liset Vizcardo ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

issue with mysql accounting
by Jan Satko 18 Oct '07

18 Oct '07

Hi. I have WIFI network based on Cisco Aironet 1130 with WPA/TKIP - EAP-PEAP. Radius server is freeradius (just upgraded to 1.1.7) with mysql backend (users,accounting). Everything worked fine for maybe 2 years. Just atm i have a new problem. Some APs got new IOS and i noticed that now is not sending User-Name like name@real but is sending MAC address as Username. This "MAC address" username i got also as system enviroment variables. On other APs with old IOS i got also problem. Some users got some new software for connecting to the network(suplicant) where they can set some "fake" outer username. Ofc users can authenticate against radius without problems. I think its because inner authentication variables (MS-CHAPv2 login name?) which freeradus use for authentication. So it looks like (for me) that AP is sending "outer" information for accounting. Maybe there is some option howto force AP to show inner username ? Back to MYSQL. Mysql atm is logging "fake usernames" or MAC addresses as UserName into radacc table. BUT mysql is logging correct username (inner) into radpostauth. Any chance howto solve this problem ? I want to log username like for radpostauth. Also want this username as system enviroment variable so i can make some start/stop scripts where i can use it. I noticed that TTLS has some options in eap.conf about tunneled-reply or variables. But i have dozen of users(usually students) which have only XP/Vista with PEAP plugin. Cannot force them to install TTLS (if TTLS will works). Tyvm for help. S pozdravom -- Bc. Jan 'EIS' Satko Slovak University of Agriculture network & system manager Tr. A. Hlinku 2 Tel: +421 37 7412 616 949 76 Nitra Slovakia

2 2

Freeradius logging w/syslog
by ballgyer＠mac.com 18 Oct '07

18 Oct '07

Hi Alan, Ok, seems the default install is dated that comes with CentOS 4.4... I've upgraded to FreeRADIUS Version 1.1.7 now and logging seems to be working but I'd like to be able to get more usable data. I nthe /etc/syslog.conf file I have this entry: # .* will log all messages in the same log file local1.* /var/log/radius/radius.log From the syslog server I see this data: Oct 17 19:11:16 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:12:06 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:12:26 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= Oct 17 19:13:52 radius radiusd(pam_unix)[15776]: authentication failure; logname= uid=95 euid=95 tty= ruser= rhost= But I'd like to see the User_Name and Client_Name similar to what you in localhost:/var/log/radius/radius.log file. Thanks again,

2 1

accounting update
by Daann 18 Oct '07

18 Oct '07

I'm trying to do something like http://www.netexpertise.eu/en/FreeRadius/DailyAcct.html this tutorial so that traffic is collected at a regular intervals. The only thing is that they use a cisco router, which has some shell command configuration (I suppose?), anyway, I don't think my router supports the aaa accounting update commands, neither it has many configuration options. Is there any way to work around this. Freeradius server and client run on a linux computer, with apache, and chillispot(for web based login). Greetz Daan EDIT: Could someone post me some more info about the Acct-Interim-Interval command, how this works and if this could be a workaround for traffic collection on a regular base. I saw on this site how someone did this. >I use freeradius & MySQL. I am able to set frequency of acct update by setting attribute Acct-Interim-Interval in rad[group]reply table to number of seconds between updates. > but I'd like to have some more detailed instructions on what to do. Thanks in advance -- View this message in context: http://www.nabble.com/accounting-update-tf4635760.html#a13238963 Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

radcheck & NAS-identifier
by YvesDM 18 Oct '07

18 Oct '07

Hi, FR + mysql auth&acct. Sometimes I need to restrict users or groups to acces a certain NAS. I use the nas-identifier attribute to recognize the nas To accomplish this I just add an entry to radcheck or radgroupcheck like this NAS-identifier != nas-name This works fine but, sometimes I use radtest directly on the server to test accounts if someone claims he/she is unable to login. Now for every user/group I've set the above entry in the database, radcheck on the server always returns an acces-reject for some reason. Though, users can login the nas's they are allowed to and get rejected on the certain nas I've specified, so the setup itself is working. But I've kind of lost my "account testing utitlity" :-) I don't understand why radcheck fails on these accounts. I understand radcheck doesn't send any nas-identifier, but I used operator ' ! = ' and not ' ==' so shouldn't the radius accept radtest requests on localhost? I 'm sure there is a good explanation why radtest returns an Acces-reject, but I'd like to know why and, if possible, if there is a solution/work-around for this. Many tnx, Y.

1 0

ssh, pam, radius not playing nicely
by meo＠intrinsity.com 17 Oct '07

17 Oct '07

We are trying to set up and ssh server and a VPN server to both use the same radius server. We are currently using freeradius-1.0.1-3 with EL4.4 . It works fine with our Cisco 3015 VOPN concentrator. It's not working so well with our EL4.4-based ssh server. I doanloaded the pam_radius_auth source and built and installed per http://www.hoei.com/2007/09/linux-sshd-authentication-to-external-radius/ and the INSTALL file that came with the software. I can get radtest to work just fine from the ssh system, but when I try to authenticate via ssh onto that system, it fails. Running debug on the server, I was seeing this: User-Password = "\010\n\rINCORRECT" I found something on the list saying this could happen if the user wasn't in the passwd file on the ssh box. I added the user there: meo:x:9999:100::/home/meo:/bin/tcsh and now the radius server is happy. It claims to be authenticating OK (we use shadow passwd on the radius server, but I did not make shadow entries on the ssh box), but the ssh login fails. Any ideas? Thanks, Miles

1 1

Segment Fault after reload
by Joe Mom 17 Oct '07

17 Oct '07

Hey, I'm using freeradius 1.1.6 on gentoo and I've noticed that if I attempt to do a /etc/init.d/radiusd reload that freeradius stops responding. When i run the server with Radiusd -X and do a reload I get: <snip> reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib64" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Wed Oct 17 18:26:20 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Oct 17 18:26:20 2007 : Error: radiusd.conf[1910] Auth-Type PAP already configured - skipping Wed Oct 17 18:26:20 2007 : Error: radiusd.conf[1919] Auth-Type CHAP already configured - skipping Wed Oct 17 18:26:20 2007 : Error: radiusd.conf[1925] Auth-Type MS-CHAP already configured - skipping Wed Oct 17 18:26:20 2007 : Info: radiusd.conf Auth-Type eap already configured - skipping Wed Oct 17 18:26:20 2007 : Info: rlm_passwd: nfields: 2 keyfield 0(User-Name) listable: no Wed Oct 17 18:26:20 2007 : Info: Ready to process requests. </snip> Then once I attempt to do a radtest i get a "Segmentation fault" and the server quits. Any thoughts? -- Regards Joe

2 1