- Freeradius-Users - lists.freeradius.org

radclient and radtest.
by Diana Robert 29 Jun '07

29 Jun '07

hi, when i m using the radtest command to test the server, eg: radtest Mahalakshmi test localhost 0 testing123 i got Access- Accept Packet from server. but when i m using raclient, echo "User-Name = Mahalakshmi" | radclient localhost auth testing123 i got Access-Reject packet . can anyone say wat am i missing for radclient, thank u. --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 1

Problems with multiple groups in rlm_sql
by Pshem Kowalczyk 29 Jun '07

29 Jun '07

Hi, I'm trying to set up rlm_sql for users that belong to multiple groups. (1.1.6, postgresql 8.1). If user belongs to only one group - everything works fine - i.e. user can auth, gets correct attributes back. If I add the user to another group - it stops working all together - ie the user gets rejected. Database scheme and sql queries are default from the 1.1.6 version. Content of the database for the relevant user: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'przem' ORDER BY id; id | username | attribute | value | op ---------+----------+-----------+----------+---- 1944943 | przem | Password | xxxyyyzz | == (1 row) SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'przem' ORDER BY id; id | username | attribute | value | op ----+----------+-----------+-------+---- (0 rows) SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = 'przem' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; id | groupname | attribute | value | op ----+-----------+----------------+--------+---- 27 | DIALUP | Huntgroup-Name | DIALUP | == 28 | ADSL | Huntgroup-Name | ADSL | == (2 rows) SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = 'przem' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; id | groupname | attribute | value | op ----+-----------+-----------------+-------------+---- 37 | DIALUP | Framed-Protocol | PPP | := 38 | DIALUP | Service-Type | Framed-User | := 39 | ADSL | Framed-Protocol | PPP | := 40 | ADSL | Service-Type | Framed-User | := (4 rows) huntgroups file: DIALUP Huawei-Domain-Name == "ihug-dialup" WIREDCOUNTRY Huawei-Domain-Name == "ihug-pppoe-wc" ADSL Huawei-Domain-Name == "ihug-ubs" ADSL Huawei-Domain-Name == "ihug-dsl-pppoe" Debug is in the attached file. What am I missing here? kind regards Pshem

1 0

radclient
by Diana Robert 29 Jun '07

29 Jun '07

hi, i m using radclient with "auth" option to send a request packet to the server, now i want to know wat wil the other options namely auto, status, discover,coa do. and wat information has to be sent to the server if the corresponding option is used. thank you. --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Re: sqlippool reject authentication if no IP?
by Hugh Messenger 28 Jun '07

28 Jun '07

Peter Nixon <listuser(a)peternixon.net> said: > On Thu 28 Jun 2007, Alan DeKok wrote: > > Hugh Messenger wrote: > > > With my current configuration, if sqlippool cannot assign an IP, the > > > authentication still succeeds. > > > > The module returns NOOP. It could arguable return "fail". Just a nitpick, but for pool depletion it returns 'notfound'. > > > How can I set things up so if no IP is available, the authentication > > > will fail with some informative Reply-Message, like the simultaneous > use > > > session control does? > > > > Use configurable failover (see doc/configurable_failover). It's not > > yet integrated into the unlang nicely. I'd like to do that before > > releasing -pre2. > > Yeah. Its currently designed to allow you to run two copies of the module > side by side and have the second one assign the IP if the first one > doesn't > (Simply by listing one module after the other). This is to allow > replicated > pools on 2 different physical database servers. Additionally I use it with > one table for dynamic ips, and a separate table for "static" ips. OK, that makes sense. I see why it returns 'NOOP' rather than 'fail'. Wow, that was easy! Freeradius rocks. I just skimmed the configurable_failover doc, and tried this: post-auth { # Get an address from the IP Pool. sqlippool { # not much point auth'ing them if we can't give them an IP notfound = reject noop = reject } ... } ... which seems to do exactly what I need. When I add a second sql server, I'll work out how to handle the noop so it fails over, whilst still rejecting on a notfound. OK, that's the functionality. How about setting the "informative Reply-Message"? Even if the customer doesn't see them, at least it'll be in my Mtik logs. Speaking of which. What would be the simplest way of having an email alert if a 'notfound' happens? This is all for PPPOE wireless clients, which are carefully provisioned. So we should never end up running out of dynamic pool space, and I need to know about it if we do. > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 2

Windows sesion Login and Password
by alfonso celestino 28 Jun '07

28 Jun '07

Hi everybody! We need your help. We are using freeradius for wireless users authentication using WPA - PEAP - with login and password different of Windows sesion; but there are many many users who treating to authenticate with windows sesion login; Can We limit the number of attempts or send them a message that they have wrong configuration?? log(user attempting to authenticate with Windows sesio credencials) ... ... Thu Jun 28 09:40:56 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:40:56 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:40:58 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:40:59 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:40:59 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:01 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:01 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:02 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:04 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:04 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:04 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:07 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:07 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:07 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:11 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:11 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:11 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:14 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:14 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:14 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:17 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:17 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:17 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:19 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:20 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:20 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:22 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:22 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:23 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:25 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:25 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:25 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:27 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:28 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:28 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:31 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:32 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:32 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:34 2007 : Info: rlm_eap_mschapv2: Issuing Challenge ... ... Thanks in advance Alfonso Celestino --------------------------------- Do You Yahoo!? La mejor conexión a Internet y 2GB extra a tu correo por $100 al mes. http://net.yahoo.com.mx

2 1

freeradius and AD
by Donny Jekels 28 Jun '07

28 Jun '07

Did anyone ever got FreeRadius to work with AD on Windows 2003 R2? I tried the config recommended in the FAQ to get FR to work with AD and I never get nay use to authorize. Any advise or working configs would be greatly appreciated.

2 1

802.1x+EAP+LDAP
by Arjuna Scagnetto 28 Jun '07

28 Jun '07

i have a configuration that works. Using 802.1x Eap-ttls (pap) and a OpenLdap for user authentication. It works. But this lines inside radius.conf make me confused. # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. in my radius.conf the following lines ,in section authorize, are uncommented Auth-Type LDAP { ldap } and in section authentication ldap option is uncommented. if i comment the ldap options in authorize section doesn't work, and the same if i comment the ldap option in authenticate section. No radius schema installed on openldap. Using ldap.attr in radius. Can someone help me understand why it works even if it shouldn't? Thanks for answering Arjuna Scagnetto

2 1

Hints File and Users file and I am lost
by Jeff 28 Jun '07

28 Jun '07

First let me say I have worked on this for a day, read pretty much all i can find, docs etc, and am getting more confused as I go, so its time to step back and ask for some help om what I am doing wrong. I am trying to get a default profile to work I can't put on in the users file cause the billling program auto creates a file, and its the culprit that won't input the ascend-data-filter in the correct format. So I can't create a default profile in the users file I use a users txt file for users to auth thats imported by our billing program This works great, etc and users auth, etc aok all works and is in production The issue came up when the ascend data filter would not work well it turns out the billing program sends the info wrong it just not chageable at the billing software Ascend-Data-Filter = "ip in forward tcp est", ---> note no + as += And of course without the += when its sent out to the nas its only seeing the 1st line and doesn't read the rest of the filters The issue is its importing the ascend data filter attribute incorrectly and theirs no way to change it at the rodopi billing end I won't get into details of that for its just not possible to get that to happen So I need to come up with a way add that info at the radius level I have played with the hints file but i am not sure thats my answer, and for some reason its not even appearing to see it ie the preprocess is uncommented in radiusd.conf authorize section and in accounting section Heres the example Heres whats happening on a user with what i have been trying First I have two realms example realm sakeoftest.net { type = radius authhost = LOCAL accthost = LOCAL nostrip realm sakeoftest2.net { type = radius authhost = LOCAL accthost = LOCAL nostrip --- Heres the hints file entry DEFAULT Suffix == "", Strip-User-Name = No Hint = "test", Framed-Protocol = PPP, Service-Type = Framed-User, Session-Timeout = 14400, Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in drop tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Port-Limit = 1 --- Heres the entry for the users.txt file joe "test" Hint = "test", Fall-Through = no Any ideas anyone ???? Please!!!!!!!!!

3 6

FreeRadius.Net
by Summer Dance 28 Jun '07

28 Jun '07

Hi all, I have problem with FreeRadius.net - Windows version of FreeRadius and not sure if I am on right place to post question. Now, I will supose that I am on right question and post it, otherwise I suggest someone of administrators to point it out and hoppely point out where to post the question. I cann't start FreeRadius.net in debug mode and I have this reply: Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\FreeRADIUS.net\bin>radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Errors reading /usr/local/FreeRADIUS.net-1.1.5/etc/raddb: No such file or direct ory Errors reading radiusd.conf C:\FreeRADIUS.net\bin> As far as I can see, something wrong with paths. Trying to find where to correct the paths in configuration files on Radius server and I have changed all lines looking like this: /usr/local/FreeRADIUS.net-1.1.5/ to path I have installed in my FreeRadius.net but still have the same output with an Error... as you can see above. Can someone help me with this ? Al.

1 0

Segfault when accessing request attributes
by baki＠enternet.hu 28 Jun '07

28 Jun '07

Hello! I use Debian 4.0 with FreeRadius 1.1.3 and I am developing a custom module for the post-auth section. When I want to access the request attributes (user name and password) I get a segmentation fault with this code: VALUE-PAIR *request_pairs = request->packet->vp; When I used gdb to debug the segfault I noticed that the request attributes are in request->proxy (and the reply attributes are in request->proxy_reply). I don't understand this because the preprocess module runs before my module and it uses request->packet->vps without any errors. Please help me, because if I write my module using request->proxy and request->proxy_reply I get a segfault in an accounting module (running after my module) when it tries to access the request attributes in request->packet. Thanks. Best regards, Baki

2 1