- Freeradius-Users - lists.freeradius.org

Strip @domain.com before auth.
by Shaun Medvec 07 Jan '07

07 Jan '07

Hi, Currently, I am accepting users with and without a realm name. I am satisfied with the acceptance of users without a realm name, but not with users that do have the realm name. I do have set up in my proxy.conf to accept the realm as so: realm domainexample.com { type = radius authhost = LOCAL accthost = LOCAL } This lets me authenticate against the same user base as users that dont include the @domain.com in their user name. My problem is this. I would to strip the @domain from the username before the authentication takes place? how and where is this done? Thank you in advance.

2 2

Help with peap-eap/mschapv2
by adreas Polyxronopoulos 07 Jan '07

07 Jan '07

Hi everyone Merry Christmas and a Happy new year , I am trying to set up freeradius-1.1.3 for a wlan using peap - eap/mschapv2. I have downloaded the source of freeradius-1.1.3 and compile it (./configure , make , make install). My wireless supplicant is on windows xp SP2. I use users file for authentication . I will show you the radiusd -X output and the freeradius behavior when the supplicant tries to connect to the wlan: root@apolyxrono2:~# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.0.15 IP address [10.0.0.15] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.0.0.15:1812 Listening on accounting 10.0.0.15:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.10:3794, id=160, length=132 NAS-IP-Address = 10.0.0.10 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "someone" Calling-Station-Id = "00166f122595" Called-Station-Id = "000d545c4190" NAS-Identifier = "3Com Access Point" EAP-Message = 0x0201000c01736f6d656f6e65 Message-Authenticator = 0x160e121c6c28afb7f18ee9f0862390d0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "someone", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry someone at line 219 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 160 to 10.0.0.10 port 3794 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 160 with timestamp 4596dbfe Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host 10.0.0.10:3791, id=45, length=166 Acct-Status-Type = Start Acct-Session-Id = "00166f122595-000d54fdb5ea-bcf9" NAS-IP-Address = 10.0.0.10 Acct-Input-Octets = 198 Acct-Output-Octets = 122 Acct-Input-Packets = 3 Acct-Output-Packets = 3 User-Name = "not available" Vendor-Specific = 0x564c414e2049442069733a2030 Vendor-Specific = 0x4553534944203d206d794170 Vendor-Specific = 0x45415020547970652069733a206e6f7420617661696c61626c65 Acct-Session-Time = 26 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = 10.0.0.10,NAS-IP-Address = 10.0.0.10,Acct-Session-Id = "00166f122595-000d54fdb5ea-bcf9",User-Name = "not available"' rlm_acct_unique: Acct-Unique-Session-ID = "11a74fb405c72016". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "not available", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.10/detail-20061230' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.10/detail-20061230 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns noop for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'not available' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 45 to 10.0.0.10 port 3791 Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 1 ID 45 with timestamp 4596dc07 Nothing to do. Sleeping until we see a request. .............................. Why the authentication of "someone" user failed ? What does it means : module "mschap" returns noop for request 0 ? Is it important debug info ? thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com Send instant messages to your online friends http://uk.messenger.yahoo.com

3 2

Re: 0.9.3 > 1.1.0 sql errors
by Long 06 Jan '07

06 Jan '07

3 "invalid operator" messages from debug mode... 3 lines in the hints file with the Suffix attribute. I think we have a winner. See 'man 5 users' or the Wiki Operators page to see why that is invalid. I think the hints file in the latest release (1.1.4) has correct defaults. -Kevin Sure 'nuf, things are changed here. >From the 1.1.4 hints file... 37:DEFAULT Suffix == ".ppp", Strip-User-Name = Yes 42:DEFAULT Suffix == ".slip", Strip-User-Name = Yes 47:DEFAULT Suffix == ".cslip", Strip-User-Name = Yes why doesn't 0.9.3 yield errors when the operator is wrong? - Andrew

2 1

How to proxy to multiple accounting hosts not using load balancing
by Rene 06 Jan '07

06 Jan '07

Hello all, I am trying to proxy/relay accounting records I receive on my Radius server to two remote Radius servers. I don't want to use load balancing, so both remote Radius servers should get the proxied/forwarded records. Questions: how can this be done? I checked the proxy.conf file, but it looks that you can do only load balancing and that's not what I want. I use FreeRadius version 1.0.2 Thanks, Rene

3 2

how to log Disconnects/Stop (Acct-Status-Type)
by Adrian 06 Jan '07

06 Jan '07

Hello Everyone, We recently moved from Merit Radius to Freeradius (1.0.4). Everything works great however we want to log Stop/Alive packets (the Acct-Status-Type request) to the radius.log as we did before. Right now this information is only logged to the detail file. With Merit Radius we were able to see when a client disconnected in the regular log file and with Freeradius we only see the Auth Login OK messages but no disconnects. Is there an easy way to log the Acct-Status-Type to the radius.log file also? Much appreciated, Adrian

3 4

postgresql or mysql
by jerrrry＠voila.fr 06 Jan '07

06 Jan '07

Hi, i'd like to know which DB (postgresql or mysql) you advice me, to store accounting and see it thanks to the GUI dailupadmin ? can i find the same freeradius features with this 2 DB ? i don't see 2 features , in postgresql.conf: - readclients = yes -Default profile that i see in sql.conf. are they implemented with postgre ? Thank you for your help. Thomas

3 2

Re: 0.9.3 > 1.1.0 sql errors
by Long 05 Jan '07

05 Jan '07

>Andrew Long wrote: >> rlm_sql: Failed to create the pair: Unknown value Administrative for attribute Service-Type >> rlm_sql (sql): Error getting data from database >> >> I am trying to get a second server (ver. 1.1.0) running mostly on the >> configs from an older (0.9.3). The sql tables are identical (except >> for some ip changes) and the radiusd.conf, sql.conf, etc are identical >> except for small details particular to system (I hope). > > The problem you're running into is likely that the dictionaries have >changed. Some of the older dictionaries were, quite frankly, wrong. > > You'll have to update your configuration to use the new names for the >attributes & values. Compare th 0.9.3 dictionaries to the new ones to >see what the values mean... > > Alan DeKok. >-- Thanks Alan. (Sorry for the reply that went to you alone). How do you recommend I proceed when the A-V pair in question (Service-Type:Administrative-user) no longer exists in 1.1.0? The 1.1.0 dictionary only defines about 5 internal service types... VALUE Service-Type Voice 12 VALUE Service-Type Fax 13 VALUE Service-Type Modem-Relay 14 VALUE Service-Type IAPP-Register 15 VALUE Service-Type IAPP-AP-Check 16 ...whereas 0.9.3 defined many more (about 17, including Administrative-user). Would it be possible to simply use the old dictionaries (/usr/local/share/freeradius/*) on 1.1.0 as an interim solution until we have the new server built. We are trying to get this up asap. Not an elegent solution, but would it work? Or, do I need to dig deeper into some of those dictionary files to find a suitable A-V pair? Andrew

4 12

modify sql table structure for additional logging
by Cory Robson 05 Jan '07

05 Jan '07

Is it possible to modify the existing radacct table with some extra fields for logging. My upstream also sends Attr-151 X-Ascend-Session-Svr-Key which I would also like logged (its used for terminating a user if need be). I could use it in the unique session server key field instead of the calculated one but would need a step by step on how to go about that. Alternatively as stated above if I could add additional fields then I would also like to log the Ascend-Xmit-Rate & Ascend-data-rate into my database as well as the Ascend-Session-Server-Key. But I don't want to stuff up function ability with Dialup Admin. Thoughts and suggestions please

3 4

unsubscribe
by Cihan DEMİR 05 Jan '07

05 Jan '07

1 0

Freeradius and biometric devices
by Kenneth Penza 05 Jan '07

05 Jan '07

Hi, I am trying to setup a biometric authentication using freeradius, first the user gives his/her password and then uses fingerprint information. On positive matches the user is authenticated. Can it be implemented? Is there literature that I need to have a look at? Thanks in advance Kenneth ____________________________________________________________________________________ Need a quick answer? Get one in minutes from people who know. Ask your question on www.Answers.yahoo.com

7 11