- Freeradius-Users - lists.freeradius.org

Problems with authentication usin Freeradius with mysql
by Daniel Bojczuk 01 Mar '07

01 Mar '07

3 5

Strange random disconnection (Lost-Carrier)
by Josh Shamir 01 Mar '07

01 Mar '07

Hello, some of my users have a strange problem; randomly, they have been disconnected after a few minutes get authenticated. Searching in log file, i've seen that the problem is "Lost Carrier" Wed Feb 28 09:16:24 2007 : Debug: Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 192.168.181.1:32919, id=227, length=184 Acct-Status-Type = Stop User-Name = "user1" Calling-Station-Id = "00-0A-1D-18-61-B5" Called-Station-Id = "00-23-F7-F2-C1-1C" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Port-Id = "00000000" NAS-IP-Address = 0.0.0.0 NAS-Identifier = "20" Framed-IP-Address = 192.168.182.41 Acct-Session-Id = "45e53a5100000000" Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Acct-Session-Time = 531 Acct-Terminate-Cause = Lost-Carrier Searching onf FreeRADIUS ML I have found that the Lost-Carrier is a problem between the NAS and the user, so the problem is between the Access Point and the Supplicant. Could be a signal problem (note that the distance between the AP and the NAS is short) or there could be other things that cause this disconnection? Thanks for help

1 0

not allowed user for few days
by satish patel 01 Mar '07

01 Mar '07

Dear all I have freeradius+mssql and i want to not allowed perticuler users so what solution for this Auth-Type:- Reject ??? is it best for anything else ? Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

freeradius users session stuck
by satish patel 01 Mar '07

01 Mar '07

Dear all I have useing freeradius + RHEL + cisco VPDN i have faceing some problem regarding session stuck in radius database tables means when user login in to radius its working fine but some time users session stuck in database and it show me it is currently login and user not able to login again i got this error Auth: Multiple logins (max 1) : [mlpm629/<CHAP-Password>] (from client cisco port 473) so how can i clear those session in my tables ?? is it any method for this ??? * Notes :- i am useing mssql database and simultanieous-uses features #Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

eap-ttls proxy and ldap
by basile 01 Mar '07

01 Mar '07

hi i try to proxy eap-ttls request from a freeradius server to another i use outer identity anonymous@domainename and username login@domainename first server proxy to the second a request with anonymous as username so it don t work if i use outer identity anonymous@anoterdomain ( anoterdomain is local to the first server ) all works fine , the proxy request is with login as username i use freeradius 1.1.3 on debian on this server here are my logs i have other proxy that works well thanks rad_recv: Access-Request packet from host xxx:1814, id=36, length=162 User-Name = "anonymous" Framed-MTU = 1400 Called-Station-Id = "000d.eddf.7aa6" Calling-Station-Id = "0002.2d70.02a2" Service-Type = Login-User Message-Authenticator = 0xdd3f8213af874ac3b02b2ad676fa70cc EAP-Message = 0x0202001e01616e6f6e796d6f757340656e632e736f72626f6e6e652e6672 NAS-Port-Type = Wireless-802.11 NAS-Port = 165300 NAS-IP-Address = xxx NAS-Identifier = "xxx" Proxy-State = 0x3336 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_eap: EAP packet type response id 2 length 30 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 14 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 Found Autz-Type enc Processing the authorize section of radiusd.conf modcall: entering group enc for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(uid=anonymous)' radius_xlat: 'dc=enc,dc=sorbonne,dc=fr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=enc,dc=sorbonne,dc=fr, with filter (uid=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "enc" returns notfound for request 2 modcall: leaving group enc (returns notfound) for request 2 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 2 rlm_pap: Attribute "Password" is required for authentication. modcall[authenticate]: module "pap" returns invalid for request 2 modcall: leaving group PAP (returns invalid) for request 2 auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request Waking up in 3 seconds...

2 4

Logging based on port request came in on
by Walt Reynolds 01 Mar '07

01 Mar '07

Hello, I have freeradius 1.1.2 set up to listen on both ports 1812/1813 and 1645/1646. This is simply to separate user and admin login. What I would like to do is to add logging based on the port. I could add %{NAS-Port-Type} to the Detail such as: detailfile = ${radacctdir}/%{NAS-Port-Type}/auth-detail-%Y%m%d The problem with doing this as it uses the string "Wireless-802.11" or "Virtual". I would instead like to use the port the request came in on (1812 or 1645) or even modify that string value. I tried to add the string %(request:Packet-Dst-Port) (from the dictionary.freeradius.internal) in the detailfile, but comes back blank. Am I misreading this in some way. I assume that internally freeradius knows what port the request came in on. Thanks. Walt

5 5

EAP-AKA patch for FreeRadius Server
by Shanta Ravi Kumar P 01 Mar '07

01 Mar '07

Hi, I am trying to use the patch for EAP-AKA on FreeRadius provided at ' http://bugs.freeradius.org/show_bug.cgi?id=386'. The patch file seems to contain some location information like '/nfs/build2/usr/bphaneuf/freeradius-1.1.X'. Is this correct? When I try to apply this patch, it is resulting in the following error: =========================== (Stripping trailing CRs from patch.) patching file share/dictionary.freeradius.internal Hunk #1 succeeded at 145 (offset 2 lines). Hunk #3 succeeded at 182 (offset 2 lines). Hunk #5 succeeded at 207 (offset 2 lines). patch: **** malformed patch at line 65: diff -urN freeradius1.1.2/src/modules/rlm_eap/libeap/eap_aka.h /nfs/build2/usr/bphaneuf/freeradius1.1.X/src/modules/rlm_eap/libeap/eap_aka.h ================================= Is this patch tested for EAP-AKA? Any pointers would be very much helpful. Thanks in advance, Best Regards, Ravi On 3/1/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Welcome to the Freeradius-Users(a)lists.freeradius.org mailing list! > > To post to this list, send your email to: > > freeradius-users(a)lists.freeradius.org > > General information about the mailing list is at: > > http://lists.freeradius.org/mailman/listinfo/freeradius-users > > If you ever want to unsubscribe or change your options (eg, switch to > or from digest mode, change your password, etc.), visit your > subscription page at: > > > http://lists.freeradius.org/mailman/options/freeradius-users/mailshark%40gm… > > > You can also make such adjustments via email by sending a message to: > > Freeradius-Users-request(a)lists.freeradius.org > > with the word `help' in the subject or body (don't include the > quotes), and you will get back a message with instructions. > > You must know your password to change your options (including changing > the password, itself) or to unsubscribe. It is: > > SaiBaba > > Normally, Mailman will remind you of your lists.freeradius.org mailing > list passwords once every month, although you can disable this if you > prefer. This reminder will also include instructions on how to > unsubscribe or change your account options. There is also a button on > your options page that will email your current password to you. >

1 0

disconnect users from radius
by satish patel 01 Mar '07

01 Mar '07

Dear all I have installed freeradius on RHEL with MSSQL server and it is working fine but now i have facing problem regarding disconnecting of users my NAS is cisco Router it is l2tp so what i do for this ??? problem ?? and i want to connect my dialupadmin with mssql ????? so it is possible?/ Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

4 4

How to remove accounting files in the Windows port of FreeRadius?
by Foo JH 01 Mar '07

01 Mar '07

Hi all, I've gotten FreeRadius on Windows (via the FreeRadius.net distro) up and running fine (thanks to all who helped with the setup details). Now I'm trying to purge old accounting records off the directory. Then I realise the files just cannot be deleted... Does anyone have this problem? I suspect it's to do with the 0666 permissions, which I have reset everything to 0777. But that does not seem to make any difference. Please help...thanks.

2 3

specify ip range in huntgroups (or similar functionality).
by Jason Murray 28 Feb '07

28 Feb '07

Is it possible to specify a range of IP addresses in a huntgroups file? What I am trying to accomplish is: 1) AAA authentication to our Cisco devices using radius 2) Only allow people in a specific group to access the devices 3) Reject everyone else. I am using the following: huntgroups: ------------------- netgear NAS-IP-Address == 172.20.120.75 users: ---------- test1@net Auth-Type := Local, User-Password == "testing", Huntgroup-Name == "netgear" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Auth-Type := Reject, Huntgroup-Name == "netgear" Reply-Message = "Not Authorized to access this gear" This works just fine, but we have well over 600 devices. If at all possible I would like to specify network ranges instead of individual IP addresses in the huntgroups file (similar to what I can do in the clients.conf file). Is this possible? If it is not possible in the huntgroups is there a better way to do what I want to accomplish? Thanks in advance! -- Jason E. Murray jemurray(a)zweck.net http://unixhosts.us/

2 1