- Freeradius-Users - lists.freeradius.org

Chap support
by Sinan Ulker 15 Dec '06

15 Dec '06

0 *H÷ 010 +0 *H÷ $Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit how can I add chap support to the free radius? ë00l¹/`Ì¡zF ž[pl¯0 *H÷ 0Á10 UUS10U VeriSign, Inc.1<0:U3Class 2 Public Primary Certification Authority - G21:08U1(c) 1998 VeriSign, Inc. - For authorized use only10UVeriSign Trust Network0 980518000000Z 280801235959Z0Á10 UUS10U VeriSign, Inc.1<0:U3Class 2 Public Primary Certification Authority - G21:08U1(c) 1998 VeriSign, Inc. - For authorized use only10UVeriSign Trust Network00 *H÷ 0§!t,çðá<!ñÛéüÂŸ_RÈÌ,V,ži,Ì°®yò9Á{º,èÂ,ªié ôÇ©€BÂ#OJØð¢û1lÉæo'õæôLxmëFú¹ÉTò²Ä¯ÔFZÉ0ÿ lõ-mÎw0 *H÷ r.ùÑñqûÄöÅ^Q@žhøØâœÿí¡æfê/ ôÊ×ê¥+ö$`MD.¥Ä- Ó®xiorÚl®ðc7æ»Ä0wÌI5ªÏØÑŸ·GsjT"4d-¶Y[ŽQY:³ôßg ô2d^±Fr'{ÅDŽ®0Ä0- y£òš"ihTÚÕšï_0 *H÷ 010 UTR1907U 0Siemens Business Services Sistem Hizmetleri A.S.10UVeriSign Trust Network10USBS Turkey Class 2 CA0 050126000000Z 140413235959Z010 UTR1907U 0Siemens Business Services Sistem Hizmetleri A.S.10UVeriSign Trust Network1$0"UE-Guven Sertifika Otoritesi00 *H÷ 0ñJ6DSñ`ž Æ¡á<{ÆçfV°4BªŽëÊïöeGT§õ&³_érÜÃUÌÔ3žG^óåÙé©6l2wÁÍGvâGky} _ßXŸ2åÐÍ#°ùsüÙ P}MYaá[zí54Å£#00Uÿ0ÿ0BU ;0907`HøE0(0&+https://www.sbs.com.tr/rpa0RUK0I0G E CAhttp://crl.trustcenter.sbs.com.tr/SBSTurkeyClass2CA/LatestCRL.crl0U0$U0€010UAffSCC2-1-180U¬ö]šnñLôì2Ø0U#0UkõP^dQ³xK×ŠS/W0 *H÷ ¹º(sµÃµp¡w%M¶¥ãö[a;þxc£:y=Ca® Ì(Í4§ã3£ej)\@ ¡D©âó0z:ÓÿÞ_Æ\ oDÅÈ ÌÊuÌójQü#«.ª²gñ{%ù$ øò§k^BŠSË0[0Ä Åž9zŸy?0 *H÷ 0Á10 UUS10U VeriSign, Inc.1<0:U3Class 2 Public Primary Certification Authority - G21:08U1(c) 1998 VeriSign, Inc. - For authorized use only10UVeriSign Trust Network0 040415000000Z 140414235959Z010 UTR1907U 0Siemens Business Services Sistem Hizmetleri A.S.10UVeriSign Trust Network10USBS Turkey Class 2 CA00 *H÷ 0ßÞÂ¿sÓòvÂ CfÊQnVÔÍüî®xal|2tñÇhbÑÎóïEBxQÍ(lÕ,Õ?Œ€Ò°1$í.uÛA5çe9Pâ5!U«}k|š7Y0Üšçøµå¡÷ XÌYz%í(ËýXã£00Uÿ0ÿ04U-0+0) ' %#http://crl.verisign.com/pca2-g2.crl0U0$U0€010UAffSCC2-1-150UUkõP^dQ³xK×ŠS/W0èU#à0Ý¡Ç€Ä0Á10 UUS10U VeriSign, Inc.1<0:U3Class 2 Public Primary Certification Authority - G21:08U1(c) 1998 VeriSign, Inc. - For authorized use only10UVeriSign Trust Network¹/`Ì¡zF ž[pl¯0 *H÷ DiÛâ[&=oõb»ú(f<p]m HuýÞ(ŒGÚ.ž0;±sÄ8µñA*6£Ášr[au)7ÉÒ§yMà& þöÌ V:¶¥.Ô³t^)\±Øòæç/1·PvêM^¡ûïæP ¿¢RÆ¬ðÕõ0æ0O Ç{õÛŠæ,U+¯0 *H÷ 010 UTR1907U 0Siemens Business Services Sistem Hizmetleri A.S.10UVeriSign Trust Network1$0"UE-Guven Sertifika Otoritesi0 050613000000Z 100612235959Z010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority0"0 *H÷ 0 žNQoÕò*ñ÷ý2¥ÉøÞA¿QaU ÅZ0tÑa3MxXbŠDíÐ|*fqojöHöðºÝüñðð€p<;ŠT?øËŠÑ>Ob¹bÃÂaPõc÷`Š1bdHŠKNÁ_g=Ô`tœïŠÕ,u£^ÞPYì#×RûóûðMó£ZQFÞg^ÐÛL:(Pšš?«Ž¡¡ÒÛ[40Þ®€ÅGÊ_Š=ñH÷%õNä0ÖœVnRUWœšÕ¿Ë¯+Š¹ª?¹·Éø3qÖV²8 5§±Ãc^8Úá³Ð"<£>0:0Uÿ0ÿ0BU ;0907`HøE0(0&+https://www.sbs.com.tr/rpa0YUR0P0N L JHhttp://crl.trustcenter.sbs.com.tr/EGuvenSertifikaOtoritesi/LatestCRL.crl0U0 `HøB0%U0€010U C1C2-1-2048-10U'aS~2åò^â{48û² ª0U#0¬ö]šnñLôì2Ø0 *H÷ ð_A°ÀÛ_·êâ[¶ìÿø¬M{yËÈkÍêN1Õ6/A}èàa!WoÝ^ÍÛ8j:öV±%ªBg«Ô[6MÈ€dPŠ{éü)bh{²Èm&òhYàÅ±®hŒY?[º8IzÀÐAms³)y`Èmô3Uö0Ï0· }Ð¯€¬Õ»Í¡-0 *H÷ 010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority0 060922000000Z 080921235959Z01D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10USECURITY AND MESSAGING1F0DU=www.verisign.com/repository/CPS Incorp. by Ref.,LIAB.LTD(c)9610UCompany - Ford Otosan10UJobTitle - 10USinan Ulker1!0 *H÷ sulker@ford.com.tr00 *H÷ 0è^1Ì]ÌùñüÚØìD(Õâ'SÏVö¢ÒRUµPCš?ºÊþOÅÓ^íú&ÔÍÔT ÿ$»Îg¶_ðÓ,ïÊM!zÅ¯êVp<bÑó§AëzšMB; é»ëÑàÁk(l!€-JÕÕ3£00Uð0 U00U00 ~|http://mpki-crl.trustcenter.sbs.com.tr/KOCNETHABERLESMETEKNOLOJILERIVEILETISIMHIZMETLERIASSECURITYANDMESSAGING/LatestCRL.crl0NU G0E0C`HøE0402+&https://www.trustcenter.sbs.com.tr/rpa0 `HøB0BU%;09++ +7 +7 +70-U&0$ " +7 sulker(a)ford.com.tr0 `HøE ÿ0 *H÷ 8.°ŒWª#ª¯ûØO{Ùgÿ+FE#ÙÁ[ÅD[§žT"³11]tf|8._XË² ÊÂe+VØs&¹=Àôûí°*Êa3ÚSU7¡|œ€Yk W?º=ñ+öóµï0ÌpÒ3cU5~VÆéK{ŠñÓíI ©`Õ©Fø*Þ{œ¡';cP TAø×ÖýÒ÷z$·òSxîª÷'+¶ÀLŠ¢€ŒÍ»ÿ<GôkC£¡ýîµIšÑ¯möÚqŽèêã®Jë&wl*Æ©100!010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority}Ð¯€¬Õ»Í¡-0 + 80 *H÷ 1 *H÷ 0 *H÷ 1 061215142345Z0# *H÷ 12ÔÏ}AãçÌ\¬jÊd\:&0g *H÷ 1Z0X0 *H÷ 0*H÷ 0 *H÷ @0+0 *H÷ (0+0 *H÷ 04 +71%0!010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority}Ð¯€¬Õ»Í¡-06*H÷ 1% !010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority}Ð¯€¬Õ»Í¡-0 *H÷ $ü\wtñ\º:-)ìð^öº/¬Mà`¹jçêd¬d§°!èúûs?'Üç%Y8ÎÏY#;ÇL$^KæEH+NŠÙnó å€UÕËÏÑÜŠáãUnŽµAÝ9»ED}JaÒ,Ÿ8W€'%ëíÅþ¬E

2 1

FREERADIUS USING IP POOLS
by Tomas Eduardo Lotina Ramos 15 Dec '06

15 Dec '06

3 2

R: Session section misconfiguration?
by Francesco Cristofori 14 Dec '06

14 Dec '06

Alan, thanks for quick answering. > You should probably upgrade to 1.1.3. It's the next thing in the todo list, after I have understood configuration. :-) Are there any particular caveats on upgrading or best practices I should know? > If you're not using it, sure. Hmmm... I need to make a little investigation on this, but I think the only thing we use is Dialup Admin interface, and it should use sql session accounting, isn't it? > Alan DeKok. Thanks again, Francesco Cristofori.

2 1

Accounting data not being properly written to mySQL database.
by Dave Martin 14 Dec '06

14 Dec '06

GentlePersons, I'm in the process of converting from flat file to mySQL database for our RADIUS accounting. I've modified the accounting_start_query entry in sql.conf to: accounting_start_query = "INSERT into ${acct_table1} \ SET \ AcctSessionId = '%{Acct-Session-id}', \ AcctUniqueId = '%{Acct-Unique-Session-Id}', \ UserName = '%{SQL-User-Name}', \ Realm = '%{Realm}', \ NASIdentifier = '%{NAS-Identifier}', \ NASPortId = '%{NAS-Port}', \ NASPortType = '%{NAS-Port-Type}', \ AcctStartTime = '%S', \ AcctStopTime = '0', \ AcctSessionTime = '0', \ AcctAuthentic = '%{Acct-Authentic}', \ ConnectInfo_start = '%{Connect-Info}', \ ConnectInfo_stop = '0', \ AcctInputOctets = '0', \ AcctOutputOctets = '0', \ CalledStationId = '%{Called-Station-Id}', \ CallingStationId = '%{Calling-Station-Id}', \ AcctTerminateCause = '', \ ServiceType = '%{Service-Type}', \ FramedProtocol = '%{Framed-Protocol}', \ FramedIPAddress = '%{Framed-IP-Address}', \ AcctStartDelay = '%{Acct-Delay-Time}', \ AcctStopDelay = '0', \ XAscendDataRate = '%{X-Ascend-Data-Rate}', \ XAscendDisconnectCause = '%{X-Ascend-Disconnect-Cause}', \ XAscendModemPortNo = '%{X-Ascend-Modem-Port-No}', \ XAscendModemShelfNo = '%{X-Ascend-Modem-Shelf-No}', \ XAscendModemSlotNo = '%{X-Ascend-Modem-Slot-No}', \ XAscendXmitRate = '%{X-Ascend-Xmit-Rate}'" I'm seeing all the fields written to the database as expected, but several of them (all the 'XAscend' parameters) are being written to the database as '0'. I still have flat file logging enabled and the values are being written properly there in the Start records. e.g.: Wed Dec 13 06:47:37 2006 Event-Timestamp = "Dec 13 2006 06:47:25 PST" *User-Name = "*******" *NAS-IP-Address = 1.2.3.4 *NAS-Identifier = "nasid" Ascend-Owner-IP-Addr = 0.0.0.0 NAS-Port = 101072015 Ascend-NAS-Port-Format = 5 NAS-Port-Type = Async Service-Type = Framed-User Acct-Status-Type = Start Acct-Delay-Time = 0 Acct-Session-Id = "521456215" Acct-Authentic = RADIUS Ascend-Auth-Delay = 240 X-Ascend-Data-Rate = 24000 X-Ascend-Xmit-Rate = 49333 X-Ascend-Modem-PortNo = 192 X-Ascend-Modem-SlotNo = 34 X-Ascend-Modem-ShelfNo = 1 *Calling-Station-Id = "1234567890" Ascend-Calling-Id-Type-Of-Num = National-Number Ascend-Calling-Id-Number-Plan = ISDN-Telephony Ascend-Calling-Id-Presentatn = Allowed Ascend-Calling-Id-Screening = Network-Provided *Called-Station-Id = "1234567890" X-Ascend-Data-Svc = 0 Framed-Protocol = PPP *Framed-IP-Address = 1.2.3.4 *Client-IP-Address = 1.2.3.4 Acct-Unique-Session-Id = "90bb5c1dcbf6939d" *Stripped-User-Name = "user" Realm = "NULL" Timestamp = 1166021257 (fields beginning with '*' have been sanitized). Any ideas? Thanks! Dave Martin -- ------------------------------------------------------------------------ Dave Martin Netcetera, Inc. dpm(a)netcetera.com ------------------------------------------------------------------------

1 0

Chap authentication
by fjlagos＠vtr.net 14 Dec '06

14 Dec '06

Hello: How can i set a basic CHAP authentication? What parameters and files i must set? Can you send me an example? Saludos y Gracias Francisco

3 2

Proxy-State problem
by Cory Robson 14 Dec '06

14 Dec '06

freeradius <https://10.0.2.61:10000/software/edit_pack.cgi?search=freeradius&package=fr eeradius&version=1%2E1%2E3%2D1%2E1> 1.1.3-1.1 build from latest rpm for for fedora 6. Commindico/Soul NAS List Authentication packets are received and the radius daemon passes an auth ok but doesn't return the proxy-state packet correctly, as a result the user is not authorized. All that is passed seems to be a hex dump and not the same as what is received. I obviously must have missed something in the config files so I'm hoping someone here might be able to point me in the right direction. Cory

2 1

Session section misconfiguration?
by Francesco Cristofori 14 Dec '06

14 Dec '06

Hi all, I'm a newbie on with radius in general and freeradius and this is my first post on this list, so please be patient, I apologize if my questions are silly. :-) I'm trying to understand a freeradius 1.0.0 + mysql 3.23.45 installation (solaris8) someone else made some years ago: in radiusd.conf i have this section: session { radutmp sql } I believe it's not a wise choice to make double session accounting, so I was thinking to remove the radutmp statement. Is it a good idea? What happens if I leave everything untouched (no radutmp statement removal)? Thanks in advance, Francesco.

2 1

configuring groups in sql tables
by Alexander Serkin 14 Dec '06

14 Dec '06

Hi, Wther i'm missing something in docs or it is impossible to do more than one groupcheck for the same username by sql. I have two groups which should be authorized differently - group1: DEFAULT Huntgroup-Name == MSK, Realm == domain.com, Auth-Type := Accept Service-Type = Outbound-User, Tunnel-Type = L2TP, Tunnel-Server-Endpoint = xxx.yyy.97.71, Cisco-AVpair += "vpdn:l2tp-tunnel-password=secret" and group2: DEFAULT Realm == domain.com, NAS-IP-Address == xxx.yyy.117.1 Framed-Protocol = PPP, Service-Type = Framed, Framed-IP-Netmask = 255.255.255.255, cisco-avpair = "lcp:interface-config=peer default ip address pool VRFNAM\nppp ipcp dns aaa.bbb.1.253 aaa.bbb.1.253\nppp ipcp wins aaa.bbb.1.253\n" What i can do: insert into RADGROUPCHECK values('','group2','Realm','==','domain.com'); insert into RADGROUPCHECK values('','group2','NAS-IP-Address','==','xxx.yyy.117.1'); insert into RADGROUPREPLY values('','group2','Framed-Protocol','=','PPP'); insert into RADGROUPREPLY values('','group2','Service-Type','=','Framed'); insert into RADGROUPREPLY values('','group2','Framed-IP-Netmask','=','255.255.255.255'); insert into RADGROUPREPLY values('','group2','cisco-avpair','=','lcp:interface-config=peer default ip address pool group1\nppp ipcp dns aaa.bbb.1.253 aaa.bbb.1.253\nppp ipcp wins aaa.bbb.1.253\n'); and insert into USERGROUP values('','user(a)domain.com','','group2','5'); Then i can remove group2 description from users file and it works. But when i do the same with group1 - both groups 1 and 2 stop working. The difference is that both radgroupcheck and radgroupreply sql queries now return two attribute sets for group 1 and 2 simultaneously. I thought that radiusd should follow check items and select the proper group according to attributes present in the request, but sqlauth module returns notfound. So the users file and sql tables are not processed in the same manner. What am i missing? -- Sincerely Yours, Alexander

2 4

RE: help
by John Wan 14 Dec '06

14 Dec '06

Hi Alan, Many thanks for the informatiom. I have experenced the following issues after following your instructures on your webpage: 1.) [root@chilli ~]# net join -U Administrator Administrator's password: [2006/12/12 12:39:38, 0] utils/net_ads.c:ads_startup(186) ads_connect: Invalid credentials Joined domain MBUS. 2.) [root@chilli ~]# wbinfo -a administrator%test plaintext password authentication failed Could not authenticate user administrator%test with plaintext password could not obtain winbind separator! could not obtain winbind domain name! challenge/response password authentication failed Could not authenticate user administrator with challenge/response 3.) Kerberos server has been installed but I could not start it. Would you please give me some hints how to start the Kerberos server and how to solve the issue of "ads_connect: Invalid credentials". Many thanks agin and much appreciated. Regards John -----Original Message----- From: freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, 8 December 2006 1:21 PM To: FreeRadius users mailing list Subject: Re: help John Wan wrote: > But I would like to use the Windows 2k3 AD to authenticate the > username and password instead of using the user name and password from > the file "/etc/raddb/users" or in mysql. See the Wiki & my web site for instructions on using Active Directory. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

3 2

RE: Multiple entries for a realm
by Santiago Balaguer García 14 Dec '06

14 Dec '06

I try both but without success. I know if freeradius choose one server or another because for each radius we stablish a VPN, so I can see in my Cisco VPN concentrator which radius server my freeradius choosed. For each realm entry my roaming partner and we get up a VPN. > Date: Wed, 13 Dec 2006 18:01:45 +0000> From: A.L.M.Buxey(a)lboro.ac.uk> To: freeradius-users(a)lists.freeradius.org> Subject: Re: Multiple entries for a realm> > Hi,> > Hi people,> > > > I do roaming with other companies successfully. My roaming partner has two RADIUS servers, so in the proxy.conf I have two entries for the realm weroam/. > > However, only the first entry works because if I change the IP for a incorrect one (case of fallback), freeradius does not redirect to the second entry. > > The option ldflag is ignored. > > which ldflag option did you use? failover, roundrobin?> > alan> - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Busca desde cualquier página Web con una protección excepcional. Consigue la Barra de herramientas de Windows Live hoy mismo y GRATUITAMENTE. http://www.toolbar.live.com

1 0