- Freeradius-Users - lists.freeradius.org

counter and limiter in freeradius
by brad brock 14 Feb '07

14 Feb '07

Hi, I want to use counter module in free radius. Where can I find the reference to use it? What is the difference between counter and sqlcounter? Is there a kind of bandwidth limiter in freeradius? For example, I want to limit each client connection transfer rate about 300 Kbps. How can I do it? Thank you.

1 0

rlm_postgresql , accounting and Framed-IP-Address
by Francisco Gimeno 14 Feb '07

14 Feb '07

Hello I'm having some problems when accounting with postgreSQL. I'm using FreeRadius 1.1.3 with sqlippool and postgresql. Authentication is done via PAM to a LDAP server. Some authorization is done with LDAP (pool assignment, profiles...). I would like to use accounting and simultaneous use check with postgreSQL. It seems that everything is working well.. But for some reason I don't get the assigned IP in my accounting tables whenever the user is logged. I just get it whenever the user is disconnected. I would like to have that info in real-time for debugging purposes. This is my postgresql.sql related config: ---- sql_user_name = "%{Stripped-User-Name:-%{User-Name}}" accounting_start_query = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, \ ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', \ '%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', \ NULLIF('%{reply:Framed-IP-Address}', '')::inet, '%{Acct-Delay-Time:-0}')" ---- The %{reply:Framed-IP-Address} or %{Framed-IP-Address} isn't xlated at all... SQL module is executed after sqlippool, so, that variable should be available. The logs: --- rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'BEGIN' rlm_sql_postgresql: query: BEGIN rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = radius_xlat: 'UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE nasipaddress = '10.15.208.103' AND pool_name = 'Pool-VODA-IPdina'' rlm_sql_postgresql: query: UPDATE radippool SET expiry_time = 'now'::timestamp(0) + '3600 second'::interval WHERE nasipaddress = ' 10.15.208.103' AND pool_name = 'Pool-VODA-IPdina' rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 2 radius_xlat: 'COMMIT' rlm_sql_postgresql: query: COMMIT rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 2 modcall[accounting]: module "sqlippool" returns ok for request 6 radius_xlat: 'vodafone.dinamica@junta' rlm_sql (sql): sql_set_user escaped user --> 'vodafone.dinamica@junta' radius_xlat: 'INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) ??values('45D09AA81E8F00', '55addd923467ad3f', 'vodafone.dinamica@junta', '', '10.15.208.103', ??'0', 'Async', ('2007-02-12 17:51:15'::timestamp - '0'::interval), 'RADIUS', '', ??'', '10.15.208.106', 'Framed-User', 'PPP', ??NULLIF('', '')::inet, '0')' radius_xlat: '/var/log/freeradius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_postgresql: query: INSERT into radacct ??(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ??ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay ) ??values('45D09AA81E8F00', '55addd923467ad3f', ' vodafone.dinamica@junta', '', '10.15.208.103', ??'0', 'Async', ('2007-02-12 17:51:15'::timestamp - '0'::interval), 'RADIUS', '', ??'', '10.15.208.106', 'Framed-User', 'PPP', ??NULLIF('', '')::inet, '0') rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: affected rows = 1 rlm_sql (sql): Released sql socket id: 1 modcall[accounting]: module "sql" returns ok for request 6 --- The assigned IP is 10.247.254.3 (or 10.247.254.5)... The relevant part in radiusd.conf ---- accounting { sqlippool sql } ------------- By the way.. The username is not stripped, and @junta appears in the logs after the xlat call :/ what am I doing wrong? Thanks

2 3

mschap and unix
by Jean Frontin 14 Feb '07

14 Feb '07

Hello, I'm usinq freeradius + mysql. I should want that users use mschap protocol and I should want that freeradius uses unix shadow to authenticate them. tests return in "radius.log" : "no user password configured" Any ideas please Regards Jean Frontin

2 1

Mysql - radcheck, radreply, radgroupcheck and radgroupreply
by "Fabrício F. Kammer" 14 Feb '07

14 Feb '07

Anyone can help me with this??? ---- Hi, I'm using Freeradius + Mysql to do the MAC Address authentication of the clients that connection on my APs (Mikrotik machines). In the mysql I've the follow: Table usergroup: UserName = MAC address GroupName = NAS-Port-ID - (the name of the AP where the client will be connected - ex. "MyAP1") Table radgroupcheck: GroupName = NAS-Port-ID - (the name of the AP where the client will be connected - ex. "MyAP1") Then I've four lines for each GroupName with the follow: Attribute: "Auth-Type" // op: ":=" // Value: "Local" Attribute: "NAS-IP-Address" // op: "==" // Value: "IP of the AP" Attribute: "NAS-Port-Identify" // op: "==" // Value: "Name of the AP - Ex: MyAP1" On the table radcheck I don't have anything. This table is empty. In the table radreply I've one record: UserName: "MAC Address of the client" Attribute: "Mikrotik-Rate-Limite" op: "=" Value: "64000/128000" The problem is: If the Freeradius don't find the UserName on the table radcheck it doesn't return the attributes that are on the table radreply, just the records of the table radgroupreply are returned. I need to return the reply different for each client because this parameter is the speed of upload and download and this values are different for each client. My questio is: Is it possible that the Freeradius return the values of the table radreply if I don't have any value on the radcheck? (The authentication was made in the radgroupcheck table) Thanks in advanced, Fabrício F.: Kammer

2 1

nas table in rlm_sql module - usage
by tzieleniewski 13 Feb '07

13 Feb '07

Hi!! I was trying to find out what is this table nas really used for. I read the whole documentation in the doc directory of radius and dialup_admin but I still have many doubts. Is it used just for mapping and getting information about online users or it is somehow equivalent to clients.conf file?? Please give me o short explanation of this issue. Thank you in advance:) Cheers tomasz

5 10

Re: Error: Ignoring request from unknown client IP:1645
by Davide Molteni 13 Feb '07

13 Feb '07

I'm very sorry Alan for replying to your own email address and not on the list. Here it is Il giorno lun, 12/02/2007 alle 13.35 +0100, Alan DeKok ha scritto: > Davide Molteni wrote: > > > On the cisco I configured: > > radius-server host ipmyradius auth-port 1812 acct-port 1813 > > and the other aaa commands needed > > > > If I look at the radius.log file I always see > > > > Error: Ignoring request from unknown client ipmycisco:1645 > > Did you configure the server to have that IP in "clients.conf"? Sure! With the IP and the same shared key as the cisco NAS client > > > The Cisco router keeps always trying to connect to radius using port > > 1645 even if I specified to use 1812... > > That's a bug in the Cisco router. Yea but is this a problem for freeradius to properly work? I need to set freeradius to listen on 1645 in radiusd.conf? Or I need to change it in /etc/services ? > > > I have tried to configure radius > > server to listen on port 1645 but is the same. > > Listening on port 1645 won't make the server believe that "ipmycisco" > is a known client. Well I know this very well in fact, the client that is ignored is properly configured in clients.conf > > > The microsoft radius integration(server 2003) worked at first try with > > this cisco config... > > Really. Did you configure the Cisco box as a client in the MS RADIUS > server? Yes, sure I had to put in the ms radius the cisco box as a client otherwise it wouldn't work... Please notice that I would like to use this radius for simple PAP ONLY. Maybe I'm doing something wrong with users file? Please tell me the right way to configure a single test user for PAP only. I would like to disable unused modules (ldap,mysql...) It couldn't be a problem of authentication method? I forgot an important element to tell anyone wants to help. I tried to change the shared key on one side (radius) and noticed that log file continue to write again the same error Ignoring request from unknown client IP:1645 So the issue it's due to the fact that cisco client don't exchange shared key with radius... This can halp to focus better the problem? thanks in advance

3 7

wep encryption
by Hillary Marek 13 Feb '07

13 Feb '07

Hello. I have a FreeRadius 1.1.4 server setup on Fedora Core 6. Right Now I have it set up to filter Mac addresses and to authenticate against Active Directory. I am looking to add encryption, but unfortunately many of my wireless devices are older 802.11b devices that can't handle wpa. I am also restricted in how much I am allowed to put the end user through. Is there a way to cenralize a wep key in the server, as I have 26 access points that I would hope not to have to go into individually to add encryption (I already need to set up 70+ devices). Because I can't put any truly strong protection on the network, and I can't take the wlan off of the main network, I am trying to add as many layers of lesser protection as I can. Does anyone have any other ideas for me? Thanks Hillary Marek Hazen Paper Co.

2 1

EAP-PEAP/MS-ChapV2 password storing options
by Matt Ashfield 13 Feb '07

13 Feb '07

Hi All, I'm sure this is a simple question, and I thought I'd pose it here in hopes of a quick response. We're trying to implement username/password authentication and so far are using EAP-PAP (with secureW2 client) because our passwords are stored in LDAP in a 1-way encrypted hash. We're hoping to get away from this secureW2 implementation and would like to use Windows built-in authentication, which seems to be EAP-PEAP with MS-ChapV2 authentication. As such, we're meeting with the LDAP folks to negotiate how to store passwords in LDAP...soo...my question is: In order to get EAP-PEAP/MS-ChapV2 to work with FreeRadius, what are my options for storing the password in LDAP? Does it have to be clear-text? Thanks Matt mda(a)unb.ca

3 3

Re: Error: Ignoring request from unknown client IP:1645
by Walt Reynolds 13 Feb '07

13 Feb '07

I had the problem before and it was because in the clients.conf file I had written clients (with an s) and not client. > > Message: 1 > Date: Tue, 13 Feb 2007 12:13:08 +0100 > From: Davide Molteni <d.molteni(a)ntsitalia.com> > Subject: Re: Error: Ignoring request from unknown client IP:1645 > To: freeradius list <freeradius-users(a)lists.freeradius.org> > Message-ID: <1171365188.6512.39.camel@PRT-TOSHIBA> > Content-Type: text/plain > > I'm very sorry Alan for replying to your own email address and not on > the list. Here it is > > > Il giorno lun, 12/02/2007 alle 13.35 +0100, Alan DeKok ha scritto: >> Davide Molteni wrote: >> >>> On the cisco I configured: >>> radius-server host ipmyradius auth-port 1812 acct-port 1813 >>> and the other aaa commands needed >>> >>> If I look at the radius.log file I always see >>> >>> Error: Ignoring request from unknown client ipmycisco:1645 >> Did you configure the server to have that IP in "clients.conf"? > > Sure! With the IP and the same shared key as the cisco NAS client > >>> The Cisco router keeps always trying to connect to radius using port >>> 1645 even if I specified to use 1812... >> That's a bug in the Cisco router. > > Yea but is this a problem for freeradius to properly work? I need to set > freeradius to listen on 1645 in radiusd.conf? Or I need to change it > in /etc/services ? > >>> I have tried to configure radius >>> server to listen on port 1645 but is the same. >> Listening on port 1645 won't make the server believe that > "ipmycisco" >> is a known client. > > Well I know this very well in fact, the client that is ignored is > properly configured in clients.conf >>> The microsoft radius integration(server 2003) worked at first try > with >>> this cisco config... >> Really. Did you configure the Cisco box as a client in the MS > RADIUS >> server? > > Yes, sure I had to put in the ms radius the cisco box as a client > otherwise it wouldn't work... > > Please notice that I would like to use this radius for simple PAP ONLY. > Maybe I'm doing something wrong with users file? > Please tell me the right way to configure a single test user for PAP > only. I would like to disable unused modules (ldap,mysql...) > > It couldn't be a problem of authentication method? > > I forgot an important element to tell anyone wants to help. > I tried to change the shared key on one side (radius) and noticed that > log file continue to write again the same error > > Ignoring request from unknown client IP:1645 > > So the issue it's due to the fact that cisco client don't exchange > shared key with radius... > > This can halp to focus better the problem? > > thanks in advance > -- Walt Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

1 0

major problem with ntlm_auth and winbindd pipe
by Habegger Lukas, ERZ-AZD-AIL 13 Feb '07

13 Feb '07

Hi All, I use freeradius for peap-authentication and I have multiple samba/winbind services to authenticate against to different ADs. In my setup I use a perlscript to start the right winbindd for a request. Now I have the problem that the winbind-pipe sometime dies. Has anyone experiences with dieing winbind-pipes in a freeradius peap environment? Can anyone help me? Lukas

1 0