- Freeradius-Users - lists.freeradius.org

Biometria
by Fábio Roberto da Silva 08 May '07

08 May '07

Good Morning I am verifying the possibility to use freeradius with authentication server being used biometria, using data base Mysql, would like to know as to implement this type of authentication Fábio Roberto da Silva __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

1 0

Re: dyndns.org domain in Clients.conf
by AS Alex 08 May '07

08 May '07

How i can use nas identifier attribute?? client.conf needs an ip however ?? i'm very confused. ----- Original Message ----- *From:* YvesDM <ydmlog(a)gmail.com> *To:* FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> *Sent:* Friday, May 04, 2007 1:21 PM *Subject:* Re: dyndns.org domain in Clients.conf On 5/4/07, AS Alex <asblackdevils(a)gmail.com> wrote: > > Yes i have enabled hostname_lookups but nothing. > > Hostname lookups are only done at FR startup, so as soon as the ip changes you have a problem :-) Use the Nas identifier attribute. Kind regards, Yves ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: eap-tls authentication with free radius 1.1.5 (Alan DeKok)
by anoop_c＠sifycorp.com 08 May '07

08 May '07

Hi i didn\'t get the exact problem. I have gone through eap.conf. Pls make little bit clear abt the problem Anoop freeradius-users-request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body \'help\' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than \"Re: Contents of Freeradius-Users digest...\" > > > Today\'s Topics: > > 1. Re: MySQL and postauth_query (George Embrey) > 2. Re: FreeRadius crash (A.L.M.Buxey(a)lboro.ac.uk) > 3. Re: MySQL and postauth_query (Peter Nixon) > 4. Re: rlm_sqlippool in freeradius 1.1.6 (Peter Nixon) > 5. Re: IP billing with freeradius (satish patel) > 6. Re: IP billing with freeradius (Peter Nixon) > 7. Re: eap-tls authentication with free radius 1.1.5 (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 08 May 2007 14:38:39 +1000 > From: George Embrey <george(a)vmail.net.au> > Subject: Re: MySQL and postauth_query > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <463FFECF.7080101(a)vmail.net.au> > Content-Type: text/plain; charset=\"us-ascii\" > > Hugh Messenger wrote: > > >George Embrey <george(a)vmail.net.au> says: > > > > > >>Queries to Windows MySQL servers from Linux Systems often fail unless > >>the lower_case_table_names parameter is set to 0 in the my.ini file > in > >>the MySQL directory. > >> > >> > > > >I\'m familiar with that issue, and I checked all the table case-ness. > The > >problem seems to be with providing an empty string (\'\') as the value > for an > >auto-incrementing integer primary index. > > > > > Yes that is true \'\' or empty strings are not nulls or integers... I > suggest replacing the \'\' with the word null, this will sort out the > issue based on the query you specified. > > >The problem with setting lower_case_table_names to 0 is that I could > end up > >blowing away my MyISAM tables elsewhere in that server, as per the > warning > >the service control gives, if I moof a query on those and use the > \"wrong\" > >case: > > > > > > > I would rename the MyISAM tables using phpmyadmin or using SQL and sort > out the Database to run case sensitive in the first place like the ANSI > standard. > > Or much better still mysqldump the entire MySQL server into a file > \"textfilename.sql\", sort out the table names etc... using a good text > editor, place a drop table if exists before each create table entry, > save the file then run mysql -uroot -p < \"textfilename.sql\" to recreate > all of the databases including data with tablenames in the correct > case... > > Maybe I am just too fussy... > > >\"You have forced lower_case_table_names to 0 through a command-line > option, > >even though your file system \'E:MySQLData\' is case insensitive. > This > >means that you can corrupt a MyISAM table by accessing it with > different > >cases. You should consider changing lower_case_table_names to 1 or 2\" > > > > > > > Only if you live in an all windows world... \"Compatability is a bitch > it > demands the use of standards, the little things which M$ don\'t adhere > to > very well\" ;-) > > >It\'s working fine with my modifie query, so I\'m just going to put this > down > >to \"a 5.x thing\" and live with my change. Compared to the wholesale > hack > >and slash job I\'ve had to do on the sqlippool queries to get them to > work, > >it\'s no Big Whoop, LOL! > > > >But thanks for the suggestion, I appreciate your time. > > > > -- hugh > > > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > George Embrey > CEO / Senior Systems Architect. > Vmail Internet Services Pty Ltd. > 318 Shoal Point Road > Shoal Point QLD 4750 > Australia >

1 0

IP billing with freeradius
by satish patel 08 May '07

08 May '07

Dear Sir I am working in data center so i need ip base billing means which ip address useing how much bandwidth means i give 10 GB data transfer to my one customer and 10GB data transfer reached then i got mesge or i can block the port of server what ever this is example so it is possible can i accouting of data transfer through my core switch ?? Reghards Satish Patel $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Office firewalls, cyber cafes, college labs, don't allow you to download CHAT? Here's a solution!

4 6

eap-tls authentication with free radius 1.1.5
by anoop_c＠sifycorp.com 08 May '07

08 May '07

Hi list I am tryinmg to do EAP_TLS certificate based authentication with free radius 1.1.5.The setup worked well with freeradius-snapshot-20021028.But as Windows vista is not supporting the same.So i am trying to do the authentication with 1.1.5 version Pls find the debug message. ot@anoop raddb]# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = \"/usr/local\" main: localstatedir = \"/usr/local/var\" main: logdir = \"/usr/local/var/log/radius\" main: libdir = \"/usr/local/lib\" main: radacctdir = \"/usr/local/var/log/radius/radacct\" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = \"/usr/local/var/log/radius/radius.log\" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = \"/usr/local/var/run/radiusd/radiusd.pid\" main: user = \"(null)\" main: group = \"(null)\" main: usercollide = no main: lower_user = \"no\" main: lower_pass = \"no\" main: nospace_user = \"no\" main: nospace_pass = \"no\" main: checkrad = \"/usr/local/sbin/checkrad\" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = \"(null)\" exec: input_pairs = \"request\" exec: output_pairs = \"(null)\" exec: packet_type = \"(null)\" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = \"crypt\" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = \"(null)\" mschap: ntlm_auth = \"(null)\" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = \"(null)\" unix: shadow = \"(null)\" unix: group = \"(null)\" unix: radwtmp = \"/usr/local/var/log/radius/radwtmp\" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = \"tls\" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = \"(null)\" tls: pem_file_type = yes tls: private_key_file = \"/etc/1x/07xwifi.pem\" tls: certificate_file = \"/etc/1x/07xwifi.pem\" tls: CA_file = \"/etc/1x/root.pem\" tls: private_key_password = \"password\" tls: dh_file = \"/etc/1x/DH\" tls: random_file = \"/etc/1x/random\" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = \"(null)\" tls: cipher_list = \"(null)\" tls: check_cert_issuer = \"(null)\" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = \"/etc/raddb/huntgroups\" preprocess: hints = \"/etc/raddb/hints\" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = \"suffix\" realm: delimiter = \"@\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = \"/etc/raddb/users\" files: acctusersfile = \"/etc/raddb/acct_users\" files: preproxy_usersfile = \"/etc/raddb/preproxy_users\" files: compat = \"no\" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = \"User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port\" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = \"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de tail-%Y%m%d\" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = \"/usr/local/var/log/radius/radutmp\" radutmp: username = \"%{User-Name}\" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.50:1027, id=0, length=197 Message-Authenticator = 0x6e5c5bee98e478bb919a0a4779945e06 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x0200000c01616e6f6f703037 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module \"preprocess\" returns ok for request 0 modcall[authorize]: module \"chap\" returns noop for request 0 modcall[authorize]: module \"mschap\" returns noop for request 0 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry anoop07 at line 216 modcall[authorize]: module \"files\" returns ok for request 0 rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \"pap\" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module \"eap\" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.0.50 port 1027 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3957d24037304516214893f00a023efe Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1027, id=1, length=299 Message-Authenticator = 0xe5ccf77d7f2a7d5bda0a2665725fae25 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x3957d24037304516214893f00a023efe Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020100600d800000005616030100510100004d0301463f12ed420bc1 a3110cd23ccfe6e0215058e72b53ff50e5459ca7dead7b55ec105817a39fe5ba38d7d5235bd73179 a4a7001600040005000a000900640062000300060013001200630100 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module \"preprocess\" returns ok for request 1 modcall[authorize]: module \"chap\" returns noop for request 1 modcall[authorize]: module \"mschap\" returns noop for request 1 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 96 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry anoop07 at line 216 modcall[authorize]: module \"files\" returns ok for request 1 rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \"pap\" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0051], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 04bf], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004c], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 192.168.0.50 port 1027 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0102040a0dc000000564160301004a020000460301463f12e8d54cc3 719cd6999605c885dc3423a304826384417e2c404a7c15cf8d20358795671f2005a10e6e59ed4499 f218aa670ff33e7f13d2139860164d3b7e7f00040016030104bf0b0004bb0004b800022c30820228 30820191a003020102020101300d06092a864886f70d0101040500303b310b300906035504061302 494e310b300906035504081302544e310d300b060355040a1304536966793110300e060355040313 0730377877696669301e170d3037303131323135333533305a170d3038303131323135333533305a 3060310b300906035504061302494e310b3009060355040813 EAP-Message = 0x02544e310d300b060355040a1304536966793110300e060355040313 07303778776966693123302106092a864886f70d0109011614616e6f6f705f634073696679636f72 702e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d2bbbe35bc8a 47709632284aff484695385e69c3522f63da46834f9586a420bda380889693fa77fedd9ed4290e6f 9ff4436721775294fc65a38fea098f18975b34b5063de27220e18a07d433cbb6e19aeb3f84b012f7 c20071dd280457a932634bbe50f438cc2ee6f4d65fa395a10bdecc4bf9087979ec45af000940e186 ed290203010001a317301530130603551d25040c300a06082b EAP-Message = 0x06010505070301300d06092a864886f70d0101040500038181000afe a7f2a8a9cffe60baa8f779353c523457f8237faeff81ba5f2c22664c70b6b2fb58c8967ca4a4c847 b80e1d5a6cc4558ffa1d161614f374d8b5efd565aa66045b192b3ac3da82c81c4a99fc10cfe473f9 ac258ef99b16cbd335004677694a05addae48c6a9dcdb26b86ddb56c635266c33c7de75865435326 92e5220d30b100028630820282308201eba003020102020100300d06092a864886f70d0101040500 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e0603550403130730377877696669301e170d EAP-Message = 0x3037303131323135333435305a170d3038303131323135333435305a 303b310b300906035504061302494e310b300906035504081302544e310d300b060355040a130453 6966793110300e060355040313073037787769666930819f300d06092a864886f70d010101050003 818d0030818902818100ba8b07a479bb6ce9adf2d8bc6ac9cf214506dfc039cb10c3b4d27d1bbc08 2caff0bb77424819728977f04b32e231a3c4755a65823b366f1a604f15ce6c499883ab7d2757a5a2 c07a11e75b7a00d6c55a8fb7443b202a25a3cdaad39579b2d8f4c09c974056f0c8666fff754d5748 36fcaf105200fcd5df5158e2b387310c4ed90203010001a381 EAP-Message = 0x95308192301d0603551d0e041604149eda6f69065423 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8328be193d596d8f0b13c977aaaf5cbc Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1027, id=2, length=209 Message-Authenticator = 0xb1f2bd76ec8b4badf29ea01180d76374 Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0x8328be193d596d8f0b13c977aaaf5cbc Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020200060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module \"preprocess\" returns ok for request 2 modcall[authorize]: module \"chap\" returns noop for request 2 modcall[authorize]: module \"mschap\" returns noop for request 2 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry anoop07 at line 216 modcall[authorize]: module \"files\" returns ok for request 2 rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \"pap\" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 2 to 192.168.0.50 port 1027 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103016e0d80000005647ec1c9e4d07a608e0e6dcd730f3063060355 1d23045c305a80149eda6f690654237ec1c9e4d07a608e0e6dcd730fa13fa43d303b310b30090603 5504061302494e310b300906035504081302544e310d300b060355040a1304536966793110300e06 03550403130730377877696669820100300c0603551d13040530030101ff300d06092a864886f70d 0101040500038181006b514f008b6a77757fc73ddbe9d54e4ea925a1ab9ce80ad7895d6d19661d8b 8558d0e359876aac023aa52d4273e00407b9b588b30dbc35c5911bc89d2d99677e0ec8dea17fece3 5d0b4dfab8775ba73eaeb0a0998bcdf1437cff0a1031f6a5b1 EAP-Message = 0x7e8bcdc01e2e964cb256f49d947eea2cfd42989aef397fa438be294f a3dc7a3d160301004c0d000044020102003f003d303b310b300906035504061302494e310b300906 035504081302544e310d300b060355040a1304536966793110300e06035504031307303778776966 690e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdbfcbbd6812a2502176f76dd96d6e645 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.0.50:1027, id=3, length=209 Message-Authenticator = 0xc2de18c894d86c7bb8dff575c8db658b Service-Type = Framed-User User-Name = \"anoop07\" Framed-MTU = 1488 State = 0xdbfcbbd6812a2502176f76dd96d6e645 Called-Station-Id = \"00-0F-3D-AF-DD-C2:default\" Calling-Station-Id = \"00-0E-35-F3-A1-67\" NAS-Identifier = \"D-Link Access Point\" NAS-Port-Type = Wireless-802.11 Connect-Info = \"CONNECT 54Mbps 802.11g\" EAP-Message = 0x020300060d00 NAS-IP-Address = 192.168.0.50 NAS-Port = 1 NAS-Port-Id = \"STA port # 1\" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module \"preprocess\" returns ok for request 3 modcall[authorize]: module \"chap\" returns noop for request 3 modcall[authorize]: module \"mschap\" returns noop for request 3 rlm_realm: No \'@\' in User-Name = \"anoop07\", looking up realm NULL rlm_realm: No such realm \"NULL\" modcall[authorize]: module \"suffix\" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it\'s an on-going EAP conversation modcall[authorize]: module \"eap\" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 users: Matched entry anoop07 at line 216 modcall[authorize]: module \"files\" returns ok for request 3 rlm_pap: WARNING! No \"known good\" password found for the user. Authentication m ay fail because of this. modcall[authorize]: module \"pap\" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type \"EAP\" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module \"eap\" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 3 to 192.168.0.50 port 1027 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed801abad54d9d77e26d58fe30c791cc Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 463f12e8 Cleaning up request 1 ID 1 with timestamp 463f12e8 Cleaning up request 2 ID 2 with timestamp 463f12e8 Cleaning up request 3 ID 3 with timestamp 463f12e8 Nothing to do. Sleeping until we see a request. Pls suggest Regards Anoop

2 1

Re: rlm_sqlippool in freeradius 1.1.6
by Hugh Messenger 08 May '07

08 May '07

I said: > Is the rlm_sqlippool in 1.1.6 known to work with MySQL 5? > > Actually, I'm fairly sure it's not even getting as far as talking to the > db. No matter what I try, it just tells me 'missing pool_name'. Turns out I borked something else in the users file which was breaking the Pool-Name statement in sqlippool mode. The next problem was getting the sqlippool queries to work. After more head / desk pounding, just after I finally got them working, I found this post with pretty much the same changes for MySQL in it: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg30520.… So ... I'm now happily autenticating against my Windows AD (using PAM and winbind), assigning PPPOE rate limit information via per user radreply table entries, assigning IP's from sqlippools based on 'Called-Station-ID', and accounting in the database. I am now officially a Happy Camper. Thanks to everyone who has answered my questions over the last week or so. -- hugh

2 1

Re: MySQL and postauth_query
by Hugh Messenger 08 May '07

08 May '07

George Embrey <george(a)vmail.net.au> says: > Queries to Windows MySQL servers from Linux Systems often fail unless > the lower_case_table_names parameter is set to 0 in the my.ini file in > the MySQL directory. I'm familiar with that issue, and I checked all the table case-ness. The problem seems to be with providing an empty string ('') as the value for an auto-incrementing integer primary index. The problem with setting lower_case_table_names to 0 is that I could end up blowing away my MyISAM tables elsewhere in that server, as per the warning the service control gives, if I moof a query on those and use the "wrong" case: "You have forced lower_case_table_names to 0 through a command-line option, even though your file system 'E:\MySQL\Data\' is case insensitive. This means that you can corrupt a MyISAM table by accessing it with different cases. You should consider changing lower_case_table_names to 1 or 2" It's working fine with my modifie query, so I'm just going to put this down to "a 5.x thing" and live with my change. Compared to the wholesale hack and slash job I've had to do on the sqlippool queries to get them to work, it's no Big Whoop, LOL! But thanks for the suggestion, I appreciate your time. -- hugh

3 2

MySQL and postauth_query
by Hugh Messenger 08 May '07

08 May '07

Dear freeradius Alpha Geeks, Am I loosing my mind or is there a bug in the postauth_query in the MySQL version of sql.conf? I'm running freeradius 1.1.6 on RHEL4, and MySQL 5.0.37 on W2k. Don't ask. Out-of-box, this postauth query ... postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" ... fails with: Incorrect integer value: '' for column 'id' at row 1 If I change this to remove the (auto incrementing) 'id' column ... postauth_query = "INSERT into ${postauth_table} (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" ... it works. -- hugh

3 2

rlm_sqlippool in freeradius 1.1.6
by Hugh Messenger 08 May '07

08 May '07

Is the rlm_sqlippool in 1.1.6 known to work with MySQL 5? Actually, I'm fairly sure it's not even getting as far as talking to the db. No matter what I try, it just tells me 'missing pool_name'. Which would seem to indicate that the Pool-Name checklist attribute isn't getting set. But If I then turn off sqlippool and switch to using the regular ippool, without changing the DEFAULT's in the users file that define the per-NAS Pool-Name attributes, that works. Which seems to imply that my Pool-Name attrribute is getting set, as ippool has no problems, but for some reason sqlippool isn't grokking it. I would really like to run sqlippool, as it makes it (almost) a zillion times easier for me to keep my pools provisioned properly, and do other neato nifty peachy keen management stuff on the back end. But I've banged my head on this one about as hard as I can. If anyone has any ideas, could I prevail upon you to Cc me direct on your reply? I do the digest thing, but I'm a little pressed for time on this one. TIA for any help, -- hugh

1 0

Accept users by NAS-Identifier
by AS Alex 07 May '07

07 May '07

How i can accept users by NAS-Identifier and not with NAS-AP-Address ?? How i can modify clients.conf (or other file) for use only nas identifier?? Thank

1 0