- Freeradius-Users - lists.freeradius.org

Configure FreeRadius to generate new accounting file by hour
by Foo JH 16 Feb '07

16 Feb '07

Hi all. Just want to pose this qn to the community: Is it possible to configure FreeRadius, so that instead of generate a new accouting file per-day, can it be per-hour (or better: per-n minutes)? Thanks

2 2

Getting error in radius server with dot1X and supplicant on windows XP...
by raghavendra.sadaramachandra＠wipro.com 16 Feb '07

16 Feb '07

Hi All, I am using free radius server with dot1X. and supplicant is on windows XP. Here when I use user name <= 3 letters I am getting following error... 1. Received packet from 192.168.112.90 with invalid Message-Authenticator! (Shared secret is incorrect.) and for user name <=3 my client is getting following error. 2. Malformed RADIUS packet from host 192.168.0.1: too short (length 17 < minimum 20). where as radius RFC say... user name length can be >= 3. since user name goes as part of attributes in radius packet... but errors we are getting are totally different. I mean first we are getting related to message-authenticator where as we are passing username with length <=3. and second error my client getting is related to packet length...another interesting thing is we get these errors only for PEAP configuration.... this will work for MD5 and others. can any one help me in this. whether we are getting different errors because both of us may be using different versions of RADIUS server? just a guess. This error may be because of RADIUS client or server? Thanx in Advance... ---Raghu. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

db.counter not found!
by Enrique Llanos V. 15 Feb '07

15 Feb '07

Dudes, i have this piece of configuration on radiusd.conf: ... counter { filename = ${raddbdir}/db.counter key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session #allowed-servicetype = Framed-User allowed-servicetype = NAS-Prompt-User cache-size = 5000 } ... And of course in my raddb (freeradius) path: bash-2.05b# locate db.counter /usr/local/etc/raddb/db.counter Yet when i start freeradius i obtain this error: bash-2.05b# tail -f /var/log/radius.log Wed Feb 14 17:02:40 2007 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Feb 14 17:02:40 2007 : Info: Using deprecated clients file. Support for this will go away soon. Wed Feb 14 17:02:40 2007 : Error: rlm_counter: Failed to open file /usr/local/etc/raddb/db.counter: No such file or directory Wed Feb 14 17:02:40 2007 : Error: radiusd.conf[917]: counter: Module instantiation failed. Wed Feb 14 17:02:40 2007 : Error: radiusd.conf[1053] Unknown module "counter". Wed Feb 14 17:02:40 2007 : Error: radiusd.conf[1050] Failed to parse accounting section. Any ideas in how to correct this error? Thanks in advance. Enrique. -- Enrique Llanos V. HTU Networks Peru www.htu.com.pe

3 4

rlm_sql question
by Norbert Wegener 15 Feb '07

15 Feb '07

I am using freeradius 1.1.4 with mysql. I had to change the authorize_check_query. authorize_check_query = "SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.op \ FROM radcheck,nas \ WHERE (Username = '%{SQL-User-Name}') \ and (nas.type='Enterasys Networks' and nas.nasname= '%{NAS-IP-Address}') \ ORDER BY id" Now radiusd -AX gives me: .. rlm_sql (enterasys): sql_set_user escaped user --> '000000007509' radius_xlat: 'SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.op FROM radcheck,nas WHERE (Username = '000000007509') and (nas.type='Enterasys Networks' and nas.nasname= '172.31.110.150') ORDER BY id' rlm_sql (enterasys): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.op FROM radcheck,nas WHERE (Username = '000000007509') and (nas.type='Enterasys Networks' and nas.nasname= '172.31.110.150') ORDER BY id rlm_sql (enterasys): User 000000007509 not found in radcheck .. where the same query in mysql shows: mysql> SELECT radcheck.id, radcheck.UserName, radcheck.Attribute, radcheck.Value, radcheck.op FROM radcheck,nas WHERE (Username = '000000007509') and (nas.type='Enterasys Networks' and nas.nasname= '172.31.110.150') ORDER BY id; +---------+--------------+-----------+--------+----+ | id | UserName | Attribute | Value | op | +---------+--------------+-----------+--------+----+ | 1180894 | 000000007509 | Auth-Type | Accept | += | +---------+--------------+-----------+--------+----+ 1 row in set (0.00 sec) I would have expected the same results as well from rlm_sql as from mysql directly. Why do the results differ? Thanks Norbert Wegener

1 1

Simple security
by Scott Hughes 15 Feb '07

15 Feb '07

I have friend that want some light security on the small network they have (15-25 PCs). What is the best way to secure his network so that someone can't just plug in his laptop and be on the network? He would prefer to make this seamless to his users. Thanks

3 3

Getting error in radius server with dot1X and supplicant on windows XP...
by raghavendra.sadaramachandra＠wipro.com 15 Feb '07

15 Feb '07

Hi All, I am using free radius server with dot1X. and supplicant is on windows XP. Here when I use user name <= 3 letters I am getting following error... 1. Received packet from 192.168.112.90 with invalid Message-Authenticator! (Shared secret is incorrect.) and for user name <=3 my client is getting following error. 2. Malformed RADIUS packet from host 192.168.0.1: too short (length 17 < minimum 20). where as radius RFC say... user name length can be >= 3. since user name goes as part of attributes in radius packet... but errors we are getting are totally different. I mean first we are getting related to message-authenticator where as we are passing username with length <=3. and second error my client getting is related to packet length...another interesting thing is we get these errors only for PEAP configuration.... this will work for MD5 and others. can any one help me in this. whether we are getting different errors because both of us may be using different versions of RADIUS server? just a guess. This error may be because of RADIUS client or server? Thanx in Advance... ---Raghu. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

Does the latest cvs support the read_groups parameter
by tzieleniewski 15 Feb '07

15 Feb '07

Hi! I am using the latest cvs version of freeradius. Does this version support the read_group parameter? In the conf file there is written that setting it to yes causes to read the group table. >From my observation freeradius works like this: 1 - checks records from radcheck 2 - if they match, add parameters from radreply 3 - if parameter Fall-Through is set then select group parameters and merge them together with those from radreply And this way it works. But when I set the read_group parameter in the conf file and remove the Fall_through from radreply the group table is not read. Is it the right behavior? Thanks in advance! Bests tomasz

1 0

Doubt about RADIUS server errors.
by raghavendra.sadaramachandra＠wipro.com 15 Feb '07

15 Feb '07

Hi All, I am using free radius server with dot1X. and supplicant is on windows XP. Here when I use user name <= 3 letters I am getting following error... 1. Received packet from 192.168.112.90 with invalid Message-Authenticator! (Shared secret is incorrect.) and for user name <=3 my client is getting following error. 2. Malformed RADIUS packet from host 192.168.0.1: too short (length 17 < minimum 20). where as radius RFC say... user name length can be >= 3. since user name goes as part of attributes in radius packet... but errors we are getting are totally different. I mean first we are getting related to message-authenticator where as we are passing username with length <=3. and second error my client getting is related to packet length...another interesting thing is we get these errors only for PEAP configuration.... this will work for MD5 and others. can any one help me in this. Thanx in Advance... ---Raghu. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

Linksys WRT54G - DD-WRT - Wireless Auth
by Richard Hamilton-Frost 15 Feb '07

15 Feb '07

Hi there, I'm new to Freeradius and have been bashing my head against this for the last week now, I've read the FAQ and now feel really silly not being able to work this out. Specs: RedHat 9 server (yes - I know prehistoric) Linksys WRT54GL router, running DD-WRT (embedded Linux OS) Freeradius version 1.1.4 (compiled from source) Windows/OSX clients. What I want: To be able to authenticate wireless users via the /etc/passwd and /etc/shadow files. I've setup the WRT54GL to talk to the Radius server, this all seems fine and dandy. The WRT54GL is using WPA TKIP, it has the option of WPA AES too, and WPA AES+TKIP, neither seem to work.. here is the output I get when trying to authenticate a user: rad_recv: Access-Request packet from host 10.0.10.254:2067, id=0, length=119 User-Name = "rhf" NAS-IP-Address = 10.0.10.254 Called-Station-Id = "0016b6edf28a" Calling-Station-Id = "003065263cf8" NAS-Identifier = "0016b6edf28a" NAS-Port = 34 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000801726866 Message-Authenticator = 0x8628dcec942afcd4d5fb5fd2f397ea1a rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_eap_md5: Issuing Challenge Sending Access-Challenge of id 0 to 10.0.10.254 port 2067 EAP-Message = 0x0101001604100c7c39402e54a1b2d4dace6a40ccda3a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xff0124fdb9484b5aa5164699172989f9 rad_recv: Access-Request packet from host 10.0.10.254:2067, id=0, length=135 User-Name = "rhf" NAS-IP-Address = 10.0.10.254 Called-Station-Id = "0016b6edf28a" Calling-Station-Id = "003065263cf8" NAS-Identifier = "0016b6edf28a" NAS-Port = 34 Framed-MTU = 1400 State = 0xff0124fdb9484b5aa5164699172989f9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100060319 Message-Authenticator = 0xe0b6669ef1d6b8aeac92c7ae00d0ff70 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. I've read the FAQ and am now really stuck, anyone please please come to my aid! Regards, R

2 2

MAC address authentication
by Shobhit Jindal 15 Feb '07

15 Feb '07

Hi list, Plz explain the overview of how to enable mac address based authentication where all the three parameters (uid, userPassword and radiusCallingStationId are matched from the ldap database).. at presently am able to do uid + userPassword successfully from openldap database -- Registerd Linux User #426561 - Shobhit Jindal B.Tech. Part-III, Department Of Electronics Engineering, ITBHU INDIA

1 0