- Freeradius-Users - lists.freeradius.org

MySql and calling-station-id help please
by Ackbar Joolia 08 Jan '07

08 Jan '07

Dear all, I want to do authentication based on calling-station-id and then to assign a static IP from my database to that requester. SO basically, all the requests coming in will have the same username and password, and I will only identify each of them through their calling-station-id, and then assign a Framed-IP-Address to them. I cannot get the above to work at all, can anyone please give me an idea of how to do the above? Thanks Al -- Internal Virus Database is out-of-date. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.15.29/607 - Release Date: 28/12/2006 12:31

3 2

Authomated Access Accept/Deny
by Tamba Ben-Jusu 08 Jan '07

08 Jan '07

Hi All, I am running the freeradius server on an ubuntu server platform and it is running fine. However, I want to include a time factor in the operations: Users to be set in the following groups 1. Grant Access-Accept only between 8am to 6pm every day 2. Grant Access-Accept only between 6pm to 8am every day 3. Grant Access-Accept only weekends etc Please help me with information on how to set it up in the users file, other means of achieving this. Thanks Tamba -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.7/619 - Release Date: 07/01/2007 18:29

3 2

overwriting ldap radiusprofile according to realms?
by Markus Krause 08 Jan '07

08 Jan '07

Hi list, we are storing our user data in openLDAP with a radiusProfileDN attribute, which is sent back by the freeradius server (v.1.1.3, on SLES10) as expected. The profile contains information for the vlan of user. We now would like to have the possibility to let the user login in a special vlan (the "internetcafe") and thought of doing this with realms, which means the user has to login with "username" or "username@ic", setting the following in the users file: ---- /etc/raddb/users DEFAULT User-Name =~ "@ic$", User-Profile := "cn=InternetCafe,ou=Netconfig,o=Test" ---- This works if the users has no radiusprofileDN stored in LDAP, but if he has such an attribute the profile data from the user is used, not the "cn=InternetCafe". How can I overwrite the value for radiusprofiledn if the user appends "@ic" to this username? Or is there a better way to achieve this (changing the profile data / vlan according to login)? Thanks in advance for any help! Reagards Markus -- Markus Krause email: krause(a)biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

1 0

Strip @domain.com before auth.
by Shaun Medvec 07 Jan '07

07 Jan '07

Hi, Currently, I am accepting users with and without a realm name. I am satisfied with the acceptance of users without a realm name, but not with users that do have the realm name. I do have set up in my proxy.conf to accept the realm as so: realm domainexample.com { type = radius authhost = LOCAL accthost = LOCAL } This lets me authenticate against the same user base as users that dont include the @domain.com in their user name. My problem is this. I would to strip the @domain from the username before the authentication takes place? how and where is this done? Thank you in advance.

2 2

Help with peap-eap/mschapv2
by adreas Polyxronopoulos 07 Jan '07

07 Jan '07

Hi everyone Merry Christmas and a Happy new year , I am trying to set up freeradius-1.1.3 for a wlan using peap - eap/mschapv2. I have downloaded the source of freeradius-1.1.3 and compile it (./configure , make , make install). My wireless supplicant is on windows xp SP2. I use users file for authentication . I will show you the radiusd -X output and the freeradius behavior when the supplicant tries to connect to the wlan: root@apolyxrono2:~# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.0.15 IP address [10.0.0.15] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.0.0.15:1812 Listening on accounting 10.0.0.15:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.10:3794, id=160, length=132 NAS-IP-Address = 10.0.0.10 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "someone" Calling-Station-Id = "00166f122595" Called-Station-Id = "000d545c4190" NAS-Identifier = "3Com Access Point" EAP-Message = 0x0201000c01736f6d656f6e65 Message-Authenticator = 0x160e121c6c28afb7f18ee9f0862390d0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "someone", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry someone at line 219 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 160 to 10.0.0.10 port 3794 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 160 with timestamp 4596dbfe Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 10.0.0.10:3791, id=45, length=166 Acct-Status-Type = Start Acct-Session-Id = "00166f122595-000d54fdb5ea-bcf9" NAS-IP-Address = 10.0.0.10 Acct-Input-Octets = 198 Acct-Output-Octets = 122 Acct-Input-Packets = 3 Acct-Output-Packets = 3 User-Name = "not available" Vendor-Specific = 0x564c414e2049442069733a2030 Vendor-Specific = 0x4553534944203d206d794170 Vendor-Specific = 0x45415020547970652069733a206e6f7420617661696c61626c65 Acct-Session-Time = 26 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = 10.0.0.10,NAS-IP-Address = 10.0.0.10,Acct-Session-Id = "00166f122595-000d54fdb5ea-bcf9",User-Name = "not available"' rlm_acct_unique: Acct-Unique-Session-ID = "11a74fb405c72016". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "not available", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.10/detail-20061230' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.10/detail-20061230 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns noop for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'not available' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 45 to 10.0.0.10 port 3791 Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 1 ID 45 with timestamp 4596dc07 Nothing to do. Sleeping until we see a request. .............................. Why the authentication of "someone" user failed ? What does it means : module "mschap" returns noop for request 0 ? Is it important debug info ? thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Re: 0.9.3 > 1.1.0 sql errors
by Long 06 Jan '07

06 Jan '07

3 "invalid operator" messages from debug mode... 3 lines in the hints file with the Suffix attribute. I think we have a winner. See 'man 5 users' or the Wiki Operators page to see why that is invalid. I think the hints file in the latest release (1.1.4) has correct defaults. -Kevin Sure 'nuf, things are changed here. >From the 1.1.4 hints file... 37:DEFAULT Suffix == ".ppp", Strip-User-Name = Yes 42:DEFAULT Suffix == ".slip", Strip-User-Name = Yes 47:DEFAULT Suffix == ".cslip", Strip-User-Name = Yes why doesn't 0.9.3 yield errors when the operator is wrong? - Andrew

2 1

How to proxy to multiple accounting hosts not using load balancing
by Rene 06 Jan '07

06 Jan '07

Hello all, I am trying to proxy/relay accounting records I receive on my Radius server to two remote Radius servers. I don't want to use load balancing, so both remote Radius servers should get the proxied/forwarded records. Questions: how can this be done? I checked the proxy.conf file, but it looks that you can do only load balancing and that's not what I want. I use FreeRadius version 1.0.2 Thanks, Rene

3 2

how to log Disconnects/Stop (Acct-Status-Type)
by Adrian 06 Jan '07

06 Jan '07

Hello Everyone, We recently moved from Merit Radius to Freeradius (1.0.4). Everything works great however we want to log Stop/Alive packets (the Acct-Status-Type request) to the radius.log as we did before. Right now this information is only logged to the detail file. With Merit Radius we were able to see when a client disconnected in the regular log file and with Freeradius we only see the Auth Login OK messages but no disconnects. Is there an easy way to log the Acct-Status-Type to the radius.log file also? Much appreciated, Adrian

3 4

postgresql or mysql
by jerrrry＠voila.fr 06 Jan '07

06 Jan '07

Hi, i'd like to know which DB (postgresql or mysql) you advice me, to store accounting and see it thanks to the GUI dailupadmin ? can i find the same freeradius features with this 2 DB ? i don't see 2 features , in postgresql.conf: - readclients = yes -Default profile that i see in sql.conf. are they implemented with postgre ? Thank you for your help. Thomas

3 2

Re: 0.9.3 > 1.1.0 sql errors
by Long 05 Jan '07

05 Jan '07

>Andrew Long wrote: >> rlm_sql: Failed to create the pair: Unknown value Administrative for attribute Service-Type >> rlm_sql (sql): Error getting data from database >> >> I am trying to get a second server (ver. 1.1.0) running mostly on the >> configs from an older (0.9.3). The sql tables are identical (except >> for some ip changes) and the radiusd.conf, sql.conf, etc are identical >> except for small details particular to system (I hope). > > The problem you're running into is likely that the dictionaries have >changed. Some of the older dictionaries were, quite frankly, wrong. > > You'll have to update your configuration to use the new names for the >attributes & values. Compare th 0.9.3 dictionaries to the new ones to >see what the values mean... > > Alan DeKok. >-- Thanks Alan. (Sorry for the reply that went to you alone). How do you recommend I proceed when the A-V pair in question (Service-Type:Administrative-user) no longer exists in 1.1.0? The 1.1.0 dictionary only defines about 5 internal service types... VALUE Service-Type Voice 12 VALUE Service-Type Fax 13 VALUE Service-Type Modem-Relay 14 VALUE Service-Type IAPP-Register 15 VALUE Service-Type IAPP-AP-Check 16 ...whereas 0.9.3 defined many more (about 17, including Administrative-user). Would it be possible to simply use the old dictionaries (/usr/local/share/freeradius/*) on 1.1.0 as an interim solution until we have the new server built. We are trying to get this up asap. Not an elegent solution, but would it work? Or, do I need to dig deeper into some of those dictionary files to find a suitable A-V pair? Andrew

4 12