- Freeradius-Users - lists.freeradius.org

failed query & postgresql driver
by freeradius＠list.coretech.ro 17 Nov '06

17 Nov '06

hello, I am trying to use the redundant feature of freeradius and I do not understand why the sql module (postgresql driver) returns ok when a query fails. from radiusd -X rlm_sql (sql): Reserving sql socket id: 61 rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error column "aaa" does not exist rlm_sql_postgresql: Postgresql Fatal Error: [42703] Accured!! rlm_sql_postgresql: Postgresql Fatal Error: [UNDEFINED COLUMN] Occured!! radius_xlat: '' rlm_sql (sql): Released sql socket id: 61 modcall[accounting]: module "sql" returns ok for request 1 modcall: group returns ok for request 1 modcall: group accounting returns ok for request 1 in file sql_postgresql.c function sql_check_error I see that for non "SQL_DOWN" errors it returns 0 (OK) is this ok ? also in the compile stage I get: In file included from sql_postgresql.c:56: sql_postgresql.h:21: warning: missing braces around initializer sql_postgresql.h:21: warning: (near initialization for `errorcodes[0]') sql_postgresql.c: In function `sql_query': sql_postgresql.c:300: warning: enumeration value `PGRES_EMPTY_QUERY' not handled in switch sql_postgresql.c:300: warning: enumeration value `PGRES_COPY_OUT' not handled in switch sql_postgresql.c:300: warning: enumeration value `PGRES_COPY_IN' not handled in switch sql_postgresql.c:319: warning: control reaches end of non-void function sql_postgresql.c: At top level: sql_postgresql.c:68: warning: 'sql_num_fields' declared `static' but never defined sql_postgresql.c:75: warning: 'status_is_ok' defined but not used my gcc is: gcc (GCC) 3.4.4 20050721 (Red Hat 3.4.4-2) is it to old ? the rest of freeradius compiles ok thanks, razvan radu

1 0

problem with radrelay
by Riccardo Roasio 17 Nov '06

17 Nov '06

Hi, first of all hello to everybody! I have a problem with my freeradius installation. I'm using it to pass data from a softswitch to another radius server. The radiusd daemon receive data and put it into a file called "details". The radrelay should read from this file and send data away. The problem is that it seems not to read from file ... If i run it with -f -xxx options it read few data from the file and nothing else, while in the detail file there are a lot of data ... Anyone have an idea of which can be the problem? > Thanks,Riccardo > > >

2 3

Logging EAP conversation Access-Challenges
by Stefan Winter 17 Nov '06

17 Nov '06

Hello, is it possible to log an EAP conversation's Access-Challenge packets that leave the FR server? I mean, other than dumping the output of -X but with a detail { } instance. During looking that up, I took a look at Post-Auth-Type and the dictionary only knows about the value "Local" = 0, but since REJECT exists and is also used I suspect that there might be more values available. Having something like Post-Auth-Type EAP-CHALLENGE { detail } would probably do the trick - if it exists. If more values are available, updating doc/Post-Auth-Type would enlighten people for sure. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

caching mechanisms and clean disconnect
by Josh Shamir 17 Nov '06

17 Nov '06

Hi, I've a problem regarding the clean disconnect of a client and some caching mechanisms. I briefly illustrate my problem : My system is composed by freeradius and chillispot with WPA enterprise (LDAP as backend). When i connect a client 1 to my system all works fine, except for the time taked by authentication process, i'm using WinXP SP2 build-in supplicant. (How I can speed up this procedure?Could you suggest me some opensource supplicant?) The problem is that when I disconnect client 1 from my system (just connecting my client to another network) and then i reconnect client1 to the system the WPA authentication failed for about 10 minutes.After this time authentication of client 1 works fine. So I think that this fact is caused by some cache mechanism used by freeradius. How can I make sure that a Client is disconnected in clean way and remove his session after it has disconnected inside Freeradius? Thanks for attention Regards, Josh

2 3

Is this hack possible?
by Erling Paulsen 17 Nov '06

17 Nov '06

Hi. I'm using FreeRADIUS to authenticate Wireless users (WPA) to an LDAP backend. FreeRADIUS also rewrites attributes for dynamic Vlan assignments. Works like a charm. Is it possible to make FreeRADIUS rewrite/force an "Access Denied" reply into an "Access Accept" reply? Why on earth would I want this? Well, I would like to i.e. give a guest-net Vlan back to users that actually fail authentication, so that when they try to access the web they will instead get connected to a redirected guest-information webpage. - or does anyone have an idea of how such a functionality can be achieved through some kindof magic? We're using lightweight AP's connected to Cisco WISM controllers. - Erling Paulsen

5 5

Prompting for credentials
by sak 17 Nov '06

17 Nov '06

I have installed FreeRADIUS 1.1.3 on RHEL4. I want to authenticate clients who use the wireless network. Clients are connected to server via Linksys Wireless Router. Linksys Wireless Router is configured to have security mode as RADIUS. Protocol being used is Protected EAP (PEAP). So the RADIUS Configuration files are updated accordingly. Now RADIUS is working fine but the problem is "user is prompted for username and password for the first time only". When user tries to connect next time it does not prompt for the credentials but uses the same username and password. What I want is user should be asked everytime he tries to connect to the network, not for the first time only. is it possible that the information is being cached on the client system? So can anyone help me? -- View this message in context: http://www.nabble.com/Prompting-for-credentials-tf2635726.html#a7356712 Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

RE: Prompting for credentials
by Garber, Neal 17 Nov '06

17 Nov '06

>Is it possible that the information is being cached on the >client system? So can anyone help me? Windows XP caches credentials for PEAP. If you want it to reprompt, you'll need to delete a registry key (HKCU\Software\Microsoft\Eapol\UserEapInfo). See http://support.microsoft.com/kb/823731 for more info. Vista has the ability to control caching of credentials (i.e., you can tell it not to do so).

2 1

radcheck entry issue
by Sri 17 Nov '06

17 Nov '06

Hi, I need to add two users with same name, from different NASes/stations. I added the two groups for them in usergroup and corresponding entries in radcheck and radreply tables. So they look like this: usergroup: ----------------------------------- 1 Ronrobert dialup 2 Ronrobert conference ----------------------------------- radcheck ---------------------------------------- 1 Ronrobert Password == value 2 Ronrobert Password == value2 ---------------------------------------- radreply --------------------------------------------- 1 Ronrobert Reply-Message := value1 2 Ronrobert Reply-Message := value2 . . . ---------------------------------------------- But the authentication failed for both users as FR not able identify which user to consider? Is there any other way to address this problem? Thanks in advance.

1 0

redundant block in CVS 2006-11-16
by freeradius＠list.coretech.ro 17 Nov '06

17 Nov '06

hello, I am trying to switch from cvs version 2006-08-24 to cvs version 2006-11-16 and my accounting redundant group is processing the second module even if the first one is returning ok. why is detail_fail processed if sql returns ok ? Is something (I do not find in doc / changelog) changed ? thanks, Razvan Radu radiusd.conf: accounting { detail redundant { sql detail_fail } } radiusd -X Processing the accounting section of radiusd.conf modcall: entering group accounting for request 14 radius_xlat: '/acct/freeradius/accounting_full/192.168.0.1/20061116' rlm_detail: /acct/freeradius/accounting_full/%{Client-IP-Address}/%Y%m%d expands to /acct/freeradius/accounting_full/192.168.0.1/20061116 radius_xlat: 'Thu Nov 16 19:15:44 2006' modcall[accounting]: module "detail" returns ok for request 14 modcall: entering group for request 14 radius_xlat: ' ... LONG SQL QUERY ...' rlm_sql (sql): Reserving sql socket id: 46 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released sql socket id: 46 modcall[accounting]: module "sql" returns ok for request 14 radius_xlat: '/acct/freeradius/accounting_fail/192.168.0.1/1163697344' rlm_detail: /acct/freeradius/accounting_fail/%{Client-IP-Address}/%l expands to /acct/freeradius/accounting_fail/192.168.0.1/1163697344 radius_xlat: 'Thu Nov 16 19:15:44 2006' modcall[accounting]: module "detail_fail" returns ok for request 14 modcall: group returns ok for request 14 modcall: group accounting returns ok for request 14 Sending Accounting-Response of id 85 to 192.168.0.1 port 23148 Finished request 14

2 2

ldap attributes and spaces
by Stefan Winter 17 Nov '06

17 Nov '06

Hi, I'm trying to retrieve some replyItems from an AD backend. It works fine as expected with most attributes, but there are some string attributes which contain spaces like displayName = aaa Restena, Fondation with ldap.attrmap RESTENA-Full-Name displayName (RESTENA-Full-Name properly defined as dictionary item, in two tries once as string, once as octets) This gets picked up by rlm_ldap as RESTENA-Full-Name = aaa I.e. processing stops after the first space. I can work around this entering quotes literally in the appropriate AD attribute, like displayName = "aaa Restena, Fondation" then FR picks up the whole string, but without the quotes (which is what I want). Unfortunately, the AD is not mine and changes on their end are a no-go. Is there anything I can do on the FR side that gives me the whole attribute? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1