- Freeradius-Users - lists.freeradius.org

realms and local user file processing question
by Michael Hare 19 Dec '06

19 Dec '06

Hello- Having some problems getting a match on the local users file after a successful realm proxy. I would like to have a user be able to log in with different realms and get different IP addresses. I have tried all sorts of formats in the users file. I would have thought that the first was the correct syntax but it didn't work, hence the trial and error. mdhare@test Framed-IP-Address = 146.151.211.254 mdhare Realm == "test" Framed-IP-Address = 146.151.211.254 "mdhare@test" Framed-IP-Address = 146.151.211.254 according to http://wiki.freeradius.org/Proxy#What_Happens "Then the users file is processed as usual. The username used at this point is the one after hints file processing (regardless of the "hints" option). It also includes the realm (regardless of the setting of the "nostrip" option) unless the realm is LOCAL." Here is the debug from a login. How do I further troubleshoot why the local users file is not being matched? -Michael ------------ rad_recv: Access-Request packet from host 144.92.44.114:2523, id=152, length=128 User-Name = "mdhare@test" User-Password = ***** NAS-Port = 1953 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 rlm_realm: Looking up realm "test" for User-Name = "mdhare@test" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "mdhare" rlm_realm: Proxying request from user mdhare to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns updated) for request 0 Sending Access-Request of id 0 to 144.92.254.243 port 1812 User-Name = "mdhare" User-Password = ********* NAS-Port = 1953 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Proxy-State = 0x313532 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 144.92.254.243:1812, id=0, length=31 Service-Type = NAS-Prompt-User Proxy-State = 0x313532 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 modcall[post-proxy]: module "eap" returns noop for request 0 modcall: leaving group post-proxy (returns noop) for request 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 attr_filter: Matched entry DEFAULT at line 84 modcall[authorize]: module "attr_filter" returns updated for request 0 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 ---------------------- problem ---------------------------------- modcall[authorize]: module "files" returns notfound for request 0 ---------------------- problem ---------------------------------- modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 152 to 144.92.44.114 port 2523 Finished request 0 Going to the next request Waking up in 6 seconds... -- =======================W=== Michael Hare UW-Madison + WiscNet Network Engineering Desk: 608-262-5236 24 Hr Noc: 608-263-4188

2 4

RE: Logging additional attributes into sql backend
by Cory Robson 19 Dec '06

19 Dec '06

My upstream provider sends me an account terminate cause in a stop packet in the format Ascend-Disconnect-Cause, how do I get freeradius to map and log this into the sql field 'AcctTerminateCause' I have checked and it is in my dictionary file. Cory

2 1

freeradius brake down
by S.L. 19 Dec '06

19 Dec '06

Hi all,I have built an Access Point with hostapd, and want to authenticate with FreeRADIUS via users file.I wnat to use MSCHAPv2 with PEAP and TLS. my eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no md5{ } leap{ } gtc{ auth-Type = PAP } tls{ privateprivate_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = /dev/null fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 } mschapv2{ } } my users file : test User-Password := "test123" RADIUS message : rad_recv: Access-Request packet from host 192.168.100.247:2055, id=242, length=151 User-Name = "test" NAS-IP-Address = 192.168.100.247 NAS-Port = 0 Called-Station-Id = "00-02-6F-23-86-93:testwlan" Calling-Station-Id = "00-0E-2E-89-44-8F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300090174657374 Message-Authenticator = 0x9938df4722da9c4c77a585cf1740d5ad Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 3 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry test at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 242 to 192.168.100.247:2055 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd75423f6525fdaace27f2535ef014611 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.100.247:2055, id=243, length=240 User-Name = "test" NAS-IP-Address = 192.168.100.247 NAS-Port = 0 Called-Station-Id = "00-02-6F-23-86-93:testwlan" Calling-Station-Id = "00-0E-2E-89-44-8F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0204005019800000004616030100410100003d03014587c6af195c3fedb8cea5b9600556a43091e389b2af29691ffbe412eb96478700001600040005000a000900640062000300060013001200630100 State = 0xd75423f6525fdaace27f2535ef014611 Message-Authenticator = 0x944c2fd4e01369d92e721a62300b6d6e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 4 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry test at line 1 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate freeradius: relocation error: /usr/lib/freeradius/rlm_eap_peap-1.0.2.so: undefined symbol: eaptls_process So I have no idea.... Could someone help me? --------------------------Hirdetés----------------------------- Akciós Szilveszteri ajánlatok

2 1

Long authentication times
by Umberto Ferraro Petrillo 19 Dec '06

19 Dec '06

Good morning to all, I am coordinating a project for installing a wireless network at the Faculty of Statistics of University of Rome. We have been using freeradius with PEAP and EAP-TTLS enabled. All seems to work fine except for the very long authentication times (about one minutes) we are experiencing when using the default Windows XP supplicant. After doing some searches on the previous discussions, I found the following thread where it is said that such a problem may be due to the way the Windows supplicant handles the EAP negotiation: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg30473.… I performed some further searches and discovered that this delay may be due to the four-way handshake protocol used by the client machine to establish a new connection with the AP. Do someone knows if there exists any tuning in the implementation of this protocol able to reduce the waiting time? Thanks in advance for any help! -- Umberto Ferraro Petrillo PhD Dipartimento di Statistica, Probabilita' e Statistiche Applicate Universita' di Roma -- La Sapienza P.le Aldo Moro, 5 00185 - Rome, Italy phone: +39 06 499 10513 e-mail: Umberto.Ferraro(a)uniroma1.it

3 4

need help
by Zion Somech 19 Dec '06

19 Dec '06

Subject: help Hi Team I need your help to set the following setup: Machine 1: freeradius server ---> working and running freeradius OS sled 10 (Suse) Machine 2: pam server ---> pam module foe radius install under /lib64/security I need your help to configure the files which file I need to add under /etc/pam.d (can tou send me an example file(s)) OS sles 10 (Suse) Machine 3: running radius client --- > tested with radclinet directly to the radius server I want to use for now ssh / su to the radius server thru machine #2 OS rdas 4 u4 (redhat How can I bring the above setup to work???? I hope you can help /advice Thanks in advance Zion

1 0

Bridging RADIUS Servers
by Jack Jackson 19 Dec '06

19 Dec '06

Dear All- Excuse my ignorance. Our company uses RADIUS today for network (802.1x) authentication. We're merging with another company who also uses RADIUS for the same purpose. Is there a config document which shows how I can configure Free Radius to proxy 2 completely different, existing RADIUS servers to authenticate users. The idea is that if one existing RADIUS server doesn't contain user information, a second RADIUS server can be queried for user info. Failing both lookups, the user will be declined. I'd appreciate any helpful tips. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: dialupadmin date woes
by Cory Robson 19 Dec '06

19 Dec '06

Now that Western Australia has daylight savings my dialup admin interface is showing the incorrect dates in user times. My server is sycronised with one of the local time servers and is correctly showing the valid time. How and where can I change this so that users usage is displayed and logged correctly, the data in the backend sql is being logged with the correct information it is only the dialup admin interface that is showing online usage calculated incorrectly. Cory

1 0

New Setup
by Scott Hughes 18 Dec '06

18 Dec '06

I am looking to change my freeradius setup. I would like to use EAP-TTLS, MySQL, and dialup-admin. All of these are installed and functioning. Is there a HOWTO, web page, etc that will guide me on this. Thanks, Scott

1 0

chap requests and users file
by Thor Spruyt 17 Dec '06

17 Dec '06

Hi, I was wondering how I should create an entry in the users file for a user that authenticates with CHAP. Normally I have entries like this: ausername Auth-Type := Local, User-Password == "apassword" This works for PAP requests, but is it also fine for CHAP? I actually need a method to let both PAP and CHAP succeed, it's up to the user to decide what to use. -- Thor Spruyt M: +32 475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com

2 1

Faisal Butt is out of the office.
by Faisal Butt 17 Dec '06

17 Dec '06

I will be out of the office starting 12/17/2006 and will not return until 12/26/2006. Please send all your queries to sales(a)sbm.net.sa. For any technical support, please send your emails to tech-support(a)sbm.net.sa.

1 0