- Freeradius-Users - lists.freeradius.org

Re: sqlippool reject authentication if no IP?
by Hugh Messenger 28 Jun '07

28 Jun '07

Peter Nixon <listuser(a)peternixon.net> said: > On Thu 28 Jun 2007, Alan DeKok wrote: > > Hugh Messenger wrote: > > > With my current configuration, if sqlippool cannot assign an IP, the > > > authentication still succeeds. > > > > The module returns NOOP. It could arguable return "fail". Just a nitpick, but for pool depletion it returns 'notfound'. > > > How can I set things up so if no IP is available, the authentication > > > will fail with some informative Reply-Message, like the simultaneous > use > > > session control does? > > > > Use configurable failover (see doc/configurable_failover). It's not > > yet integrated into the unlang nicely. I'd like to do that before > > releasing -pre2. > > Yeah. Its currently designed to allow you to run two copies of the module > side by side and have the second one assign the IP if the first one > doesn't > (Simply by listing one module after the other). This is to allow > replicated > pools on 2 different physical database servers. Additionally I use it with > one table for dynamic ips, and a separate table for "static" ips. OK, that makes sense. I see why it returns 'NOOP' rather than 'fail'. Wow, that was easy! Freeradius rocks. I just skimmed the configurable_failover doc, and tried this: post-auth { # Get an address from the IP Pool. sqlippool { # not much point auth'ing them if we can't give them an IP notfound = reject noop = reject } ... } ... which seems to do exactly what I need. When I add a second sql server, I'll work out how to handle the noop so it fails over, whilst still rejecting on a notfound. OK, that's the functionality. How about setting the "informative Reply-Message"? Even if the customer doesn't see them, at least it'll be in my Mtik logs. Speaking of which. What would be the simplest way of having an email alert if a 'notfound' happens? This is all for PPPOE wireless clients, which are carefully provisioned. So we should never end up running out of dynamic pool space, and I need to know about it if we do. > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 2

Windows sesion Login and Password
by alfonso celestino 28 Jun '07

28 Jun '07

Hi everybody! We need your help. We are using freeradius for wireless users authentication using WPA - PEAP - with login and password different of Windows sesion; but there are many many users who treating to authenticate with windows sesion login; Can We limit the number of attempts or send them a message that they have wrong configuration?? log(user attempting to authenticate with Windows sesio credencials) ... ... Thu Jun 28 09:40:56 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:40:56 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:40:58 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:40:59 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:40:59 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:01 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:01 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:02 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:04 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:04 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:04 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:07 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:07 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:07 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:11 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:11 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:11 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:14 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:14 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:14 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:17 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:17 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:17 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:19 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:20 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:20 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:22 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:22 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:23 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:25 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:25 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:25 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:27 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:28 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:28 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:31 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:32 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:32 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:34 2007 : Info: rlm_eap_mschapv2: Issuing Challenge ... ... Thanks in advance Alfonso Celestino --------------------------------- Do You Yahoo!? La mejor conexión a Internet y 2GB extra a tu correo por $100 al mes. http://net.yahoo.com.mx

2 1

freeradius and AD
by Donny Jekels 28 Jun '07

28 Jun '07

Did anyone ever got FreeRadius to work with AD on Windows 2003 R2? I tried the config recommended in the FAQ to get FR to work with AD and I never get nay use to authorize. Any advise or working configs would be greatly appreciated.

2 1

802.1x+EAP+LDAP
by Arjuna Scagnetto 28 Jun '07

28 Jun '07

i have a configuration that works. Using 802.1x Eap-ttls (pap) and a OpenLdap for user authentication. It works. But this lines inside radius.conf make me confused. # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. in my radius.conf the following lines ,in section authorize, are uncommented Auth-Type LDAP { ldap } and in section authentication ldap option is uncommented. if i comment the ldap options in authorize section doesn't work, and the same if i comment the ldap option in authenticate section. No radius schema installed on openldap. Using ldap.attr in radius. Can someone help me understand why it works even if it shouldn't? Thanks for answering Arjuna Scagnetto

2 1

Hints File and Users file and I am lost
by Jeff 28 Jun '07

28 Jun '07

First let me say I have worked on this for a day, read pretty much all i can find, docs etc, and am getting more confused as I go, so its time to step back and ask for some help om what I am doing wrong. I am trying to get a default profile to work I can't put on in the users file cause the billling program auto creates a file, and its the culprit that won't input the ascend-data-filter in the correct format. So I can't create a default profile in the users file I use a users txt file for users to auth thats imported by our billing program This works great, etc and users auth, etc aok all works and is in production The issue came up when the ascend data filter would not work well it turns out the billing program sends the info wrong it just not chageable at the billing software Ascend-Data-Filter = "ip in forward tcp est", ---> note no + as += And of course without the += when its sent out to the nas its only seeing the 1st line and doesn't read the rest of the filters The issue is its importing the ascend data filter attribute incorrectly and theirs no way to change it at the rodopi billing end I won't get into details of that for its just not possible to get that to happen So I need to come up with a way add that info at the radius level I have played with the hints file but i am not sure thats my answer, and for some reason its not even appearing to see it ie the preprocess is uncommented in radiusd.conf authorize section and in accounting section Heres the example Heres whats happening on a user with what i have been trying First I have two realms example realm sakeoftest.net { type = radius authhost = LOCAL accthost = LOCAL nostrip realm sakeoftest2.net { type = radius authhost = LOCAL accthost = LOCAL nostrip --- Heres the hints file entry DEFAULT Suffix == "", Strip-User-Name = No Hint = "test", Framed-Protocol = PPP, Service-Type = Framed-User, Session-Timeout = 14400, Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in drop tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Port-Limit = 1 --- Heres the entry for the users.txt file joe "test" Hint = "test", Fall-Through = no Any ideas anyone ???? Please!!!!!!!!!

3 6

FreeRadius.Net
by Summer Dance 28 Jun '07

28 Jun '07

Hi all, I have problem with FreeRadius.net - Windows version of FreeRadius and not sure if I am on right place to post question. Now, I will supose that I am on right question and post it, otherwise I suggest someone of administrators to point it out and hoppely point out where to post the question. I cann't start FreeRadius.net in debug mode and I have this reply: Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\FreeRADIUS.net\bin>radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Errors reading /usr/local/FreeRADIUS.net-1.1.5/etc/raddb: No such file or direct ory Errors reading radiusd.conf C:\FreeRADIUS.net\bin> As far as I can see, something wrong with paths. Trying to find where to correct the paths in configuration files on Radius server and I have changed all lines looking like this: /usr/local/FreeRADIUS.net-1.1.5/ to path I have installed in my FreeRadius.net but still have the same output with an Error... as you can see above. Can someone help me with this ? Al.

1 0

Segfault when accessing request attributes
by baki＠enternet.hu 28 Jun '07

28 Jun '07

Hello! I use Debian 4.0 with FreeRadius 1.1.3 and I am developing a custom module for the post-auth section. When I want to access the request attributes (user name and password) I get a segmentation fault with this code: VALUE-PAIR *request_pairs = request->packet->vp; When I used gdb to debug the segfault I noticed that the request attributes are in request->proxy (and the reply attributes are in request->proxy_reply). I don't understand this because the preprocess module runs before my module and it uses request->packet->vps without any errors. Please help me, because if I write my module using request->proxy and request->proxy_reply I get a segfault in an accounting module (running after my module) when it tries to access the request attributes in request->packet. Thanks. Best regards, Baki

2 1

Re: Pam_radius_Auth - Problem
by Geoff Mitchell 28 Jun '07

28 Jun '07

Markus, Did you get any replies to your post from the 18th about pam_radius_auth not working, as I am having exactly the same issue. What I have found out is that the pam_radius_auth module is fine, except when the user is not in the password file. At this point it would seem that something is not getting initialised correctly which results in the call to conv->conv, which should prompt you for the password and then return it in resp->resp, constantly comes back with ^H ^\177INCORRECT. As this translates to the value you saw in your password field, I have to suspect that something is broken within PAM and requires the modules to work around this if the user is not in the password file. The problem I am having is working out how to work around the problem, so I am interested as to if you got a reply to your post. Thanks Geoff

1 0

duplicate requests...
by suganthi velusamy 28 Jun '07

28 Jun '07

--------------------------------- Bollywood, fun, friendship, sports and more... you name it, we have it.

3 3

sqlippool reject authentication if no IP?
by Hugh Messenger 28 Jun '07

28 Jun '07

With my current configuration, if sqlippool cannot assign an IP, the authentication still succeeds. How can I set things up so if no IP is available, the authentication will fail with some informative Reply-Message, like the simultaneous use session control does? -- hugh

3 2