- Freeradius-Users - lists.freeradius.org

1.1.7 MySQL postauth_query
by Hugh Messenger 17 Jul '07

17 Jul '07

I seem to recall having this problem when I first ran 1.1.6. The postauth_query is: postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" . but MySQL barfs about an invalid 'id' value. Maybe this is down to my schema . but surely, being an auto increment, we just don't need to specify the 'id' in the INSERT? I've modified it at my end to just be . postauth_query = "INSERT into ${postauth_table} (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" . which works fine. -- hugh

2 1

dictionary files 'encrypt' option
by Gaonkar, Kedar 17 Jul '07

17 Jul '07

Hi, There are a few dictionary files in /freeradius-1.1.6/share/ directory. Some of the Attributes have 'encrypt' option with values 1 or 2. I tried putting 'encrypt=2' for an attribute in a packet that was meant to be proxied on port 1814. But after giving this value, the packet is being sent on 1812. I wanted to know what these values mean, and what are the other values that can be given. Can someone please help me with this? Thanks! Regards, - Kedar

2 1

FreeRadius MySQL -> Logs (where they are?)
by Nataniel Klug 16 Jul '07

16 Jul '07

Hello all, I have configured my FreeRadius server to auth my clients over a MySQL table. The problem is that I do not have any more logs (like wrong login attempts). The detailed log is been done into a MySQL table named radacct (and works fine to bloqs simultaneous use) but the problem is that I cant see anymore why a login attempt gets rejected. Can someone tell me where to look? -- Att, NATANIEL KLUG nata(a)cnett.com.br Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay -- Esta mensagem foi verificada pelo antivirus e antispam e acredita-se nao se tratar de nenhum dos dois. Sistema de email Cyber Nett - v2.0

6 15

1.1.7 %{foo:-0} syntax?
by Hugh Messenger 16 Jul '07

16 Jul '07

Does 1.1.7 use the newer %{%{foo}:-0} or the older %{foo:-0} format? Or is it biformatual? -- hugh

3 3

Re : How to configure EAP Identity in 1.1.3
by Eshun Benjamin 16 Jul '07

16 Jul '07

Check on your AP, client.conf and naslist ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Govardhana K N <govardhan.nagarajaiah(a)gmail.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 16 Juillet 2007, 13h28mn 28s Objet : How to configure EAP Identity in 1.1.3 I changed it but the same error is still coming. On 7/16/07, Eshun Benjamin <bkeshun(a)yahoo.fr> wrote: You have misconfigured the Nas-Identifier > govardhana Nas-Identifier == nas, Nas-Port-Type == 15 You have NAS-Identifier = "jrcnas" ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Govardhana K N < govardhan.nagarajaiah(a)gmail.com> À : FreeRadius <freeradius-users(a)lists.freeradius.org > Envoyé le : Lundi, 16 Juillet 2007, 12h24mn 09s Objet : How to configure EAP Identity in 1.1.3 Hi, I was trying to configure FreeRadius server with EAP authentication. AS mentioned in "eap.conf", I didn't change the Auth-Type, but I was sending a EAP message, and Message-Authenticator attributes in Access-Request. When i tried sending an Access-Request with EAP-Message, I got the following error "rlm_eap: Identity Unknown, authentication failed". How to configure the Identity for EAP? debug log from server: --------------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = no exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32813, id=179, length=95 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x64c5851b699cd2c027877bbb94fe7f8b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jrc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type request id 16 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry jrc at line 178 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity Unknown, authentication failed rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 179 to 127.0.0.1 port 32813 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 179 with timestamp 469b9233 Nothing to do. Sleeping until we see a request. debug log from Client: ------------------------------------- cheux301:/home/govardhana# radeapclient -x localhost auth jrcsecret <access-request +++> About to send encoded packet: User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x00 Sending Access-Request of id 179 to 127.0.0.1 port 1812 User-Name = "jrc" NAS-Identifier = "jrcnas" NAS-Port-Type = Ethernet CUI = "0" Service-Type = Framed-User Framed-MTU = 1400 Calling-Station-Id = "1:1:1:1:1:1" EAP-Message = 0x01100008016a7263 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=179, length=20 rlm_eap: EAP-Message not found <+++ EAP decoded packet: Thanks & Regards, Govardhana K N -- With Regards, Govardhana K N - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- With Regards, Govardhana K N - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

1 0

FreeRadius and User-Password from Cisco Device
by nicolaskarp＠free.fr 16 Jul '07

16 Jul '07

Hello, Here a access-request packet from a Cisco Router (2621) : NAS-IP-Address = "IP_NAS" NAS-Port = 66 NAS-Port-Type = Virtual User-Name = "MyUserLogin" Calling-Station-Id = "IP NAS" User-Password = "ry\My\Pass/Wo\rd\Hash\Not\Plain\Text`" Why is my password not in plain text ? With other cisco devices (Switch 2960 for example), the User-Password is in plain text.. If I receive a hashed password, the authentication doesn't work.. My AAA configuration : aaa new-model aaa authentication login default group radius line aaa authentication login console line aaa authorization exec default group radius none aaa authorization network default group radius aaa accounting exec default start-stop group radius aaa accounting connection default start-stop group radius What can I do ? Thanks for your help ! Nicos.

4 8

Configuration doubt
by Osvaldohp 16 Jul '07

16 Jul '07

I have a hotSpot that give access to the internet for my users. I use IPCOP with advproxy addon like a point controller. So when a user try to aceess the internet IPCOP (advproxy) ask for a username and password and then try to authenticate the user in the radius server. Everything is great so far my only problem is i can't limit the user to access the internet using Session-timeout attribute. I really don't know what i have to do now. Can someone help me? ________________________________________________ Message sent using Prodepa Webmail 2.7.9

2 1

figuration doubt
by Osvaldohp 16 Jul '07

16 Jul '07

I found a nice paper about freeradius+mysql, so far everything is installed and working fine. My guestion is which field of my radius database (db_mysql.sql) i have to put Session-Timeout attribute to limit the use of the Internet from my HotSpot users? ________________________________________________ Message sent using Prodepa Webmail 2.7.9

3 2

Configuration doubt
by Osvaldohp 16 Jul '07

16 Jul '07

Hi all. I'd like some help to configure my Radius server. My Radius authenticates users from my HotSpot to access the internet. I want to limit the uses to access the Internet, i did try Session-Timeout attribute but don't work so far. This is my users file: mike Auth-Type = System, User-Password == mike" Session-Timeout := 3600, What i am doing wrong? Can anyone help me with this task? Thanks ________________________________________________ Message sent using Prodepa Webmail 2.7.9

3 2

cisco redirect from freeradius
by guildivernos guildivernos 16 Jul '07

16 Jul '07

hi freeradius people, I want to redirect http traffic for some users in a cisco NAS. Is there any way to do this ? maybe with some VSA thanks in advance

1 0