- Freeradius-Users - lists.freeradius.org

VSA in Local User Profile
by A. K. 15 Sep '06

15 Sep '06

User profile is as follows: "test" Auth-Type := Local, User-Password == "test" Idle-Timeout = 300, Session-Timeout = 1560, Acct-Interim-Interval = 600, Account-Info = "QU;8000;4000;D;8000;4000", Reply-Message = Authenticated, Cisco-Account-Info = Axxx All attributes are returned in the Access-Accept message except for: Account-Info = "QU;8000;4000;D;8000;4000" Am I violating some sort of syntax restriction?

2 3

Pattern Matching in users file
by Garber, Neal 15 Sep '06

15 Sep '06

I have the following entry in my users file: DEFAULT Cisco-AVPair =~ "ssid=(.*)", Group := "%{1}" I added a perl module after files in my authorize section and data::dumper'ed %RAD_REQUEST, %RAD_CHECK and %RAD_CONFIG for debugging purposes. The Cisco-AVPair value in the request is "ssid=EE-Corp". I would expect that the value of Group would be "EE-Corp". Instead, the value of Group was "(.*)". I tried using backticks around the %{1}. I tried "=" as opposed to ":=". Also, the Group attribute was added to %RAD_CHECK as opposed to %RAD_REQUEST (Group was not an attribute in the original request). This prevented me from using module checkval to test it. I ended up using the attr_rewrite module to change Cisco-AVPair so it could be tested by checkval.. So, if it's supported, what is the syntax for regex pattern matching and substitution in the users file? Also, if it's possible, what is the syntax to create a new request attribute in the users file? Thank you for creating/supporting/maintaining the best and most flexible Radius server.

2 1

RE: AAA configuration for given attributes - need help please !!!
by Garber, Neal 15 Sep '06

15 Sep '06

> EAP Message Exchange will occure (EAP-TTLS MS-CHAP-v2 authentication or any other authentication What are you planning to use for authentication? No one else can decide for you! > Hope that clarify the problem. It's still not clear exactly what you are trying to accomplish. Instead of describing the workings of the RADIUS protocol, describe what you are trying to do.

1 0

AAA configuration for given attributes - need help please !!!
by Rafiqul Ahsan 15 Sep '06

15 Sep '06

Hi, I am new to this AAA freeradius area, I need to configure the AAA radius server for following mentioned attributes according to the message, Access-req, Access-Accept, and Access-Challenge, and Access-Reject (pls see below). Also, I looked at the configuration files at radius server like clients.conf, users, radiusd.conf - I am not sure where this attributes to configure. Could any body help me getting started with this that would be highly appreciated. Also, please comment on the VSA attribute below - I am tryign to understand on section 5.26, RFC 2865 - but not sure where to start. Your help would be highly appreciated. Below the attributes : Access Request attributes User-Name User-Password NAS-IPAddress NAS-Port Service-Type State Vendor-Specific Session-Timeout NAS-Identifier Called-Station-ID Calling-Station-ID NAS-Port-Type EAP-Message Message-Authenticator Access-Challenge attributes Reply-Message State Session-Timeout EAP-Message Message-Authenticator Access-Accept attributes User-Name State Service-Type Session-Timeout EAP-Message VSA (Vendor Suitable Attributes) VSA ( ---) Message-Authenticator Access-Reject Attributes Reply-Message State Session-Timeout EAP-Message Message-Authenticator Thanks Rafi

4 4

Cisco AP1200 - Freeradius - LDAP configuration
by Tho Nguyen 15 Sep '06

15 Sep '06

Hello Everyone, I am trying to configure Cisco AP1200, FreeRadius, and LDAP. I use EAP Authentication. I tried many ways, but it didn't go anywhere. If any of you have good configuration or have documents to show me how to set it up, please let me know. Thanks very much in advance. Tho Nguyen

2 2

Attribute Operators
by Cliff Hayes 15 Sep '06

15 Sep '06

Hello everyone, Does anyone know of a good reference site for the attribute operators (:=, ==, +=) that shows what each means? I can't find them anywhere. I even bought the book Radius by Jonathan Hassell. Not there either. Thanks in advance, Cliff

5 8

non existing account can still login / freeradius only runs in debugmode ?
by Tom De Wispelaere 15 Sep '06

15 Sep '06

Hello guys, we have a server setup running freeradius (= 1.1.2-2) with a mysql backend on debian Linux. We receive a lot of authorization requests and accounting requests from the equipment of an isp. Setup is as follows : server A with master freeradius and mysql, server B with backup radius that uses mysql on server A. The mysql is of course still single point of failure. We tried it first with a local mysql server on server B but did find it difficult to process the accounting records in an easy and simple way when they are scattered over two databases on two different servers. Any suggestions on this setup would be greatly appreciated. Everything seems to work except for the following: - if we try to start the server threaded and as it is supposed to work (ie /etc/init.d/freeradius start), it crashes regularly under load without any further explanation... If we run freeradius in debugmode (/usr/sbin/freeradius -X) , everything keeps working just fine... I have done several upgrades (coming from version 0.9) but i still see the same problem and i cannot get it to work without a crash (sooner or later) in threaded mode. Do any of you experience similar problems ? Is there a remedy or things i could try to find the cause ? - usernames that can't (and should not be able to) login (username not present anymore in the mysql database, nor any passwd file) and get a "Login incorrect" most of the time, sometimes get through and get authenticated (!)... Its very strange behavior and i have been trying to find a cause for this. At first i thought the culprit would be the equipment at the other side that did something wrong, but apparently it receives explicitly a Login OK from our radius (togheter with profile info etc) as i see in the packetflow. I cannot find a single Login OK for these specific users in the debuginfo however, only the login incorrects and acct records (see below). rlm_chap: login attempt by "USERNAME1" with CHAP password rlm_chap: Could not find clear text password for user USERNAME1 Login incorrect (rlm_chap: Clear text password not available): [USERNAME1/<CHAP-Password>] (from clie nt adsl port xxxxxxx) The mysql acct records do show traffic and alive records for these logins (a few) and a lot of Login Failures. Is there an easy way to dig deeper into this problem and find the cause for these spooky logins that should not happen ? Any help or suggestions greatly appreciated, Best regards, Tom

1 0

MySQL.conf
by Dan Massey 15 Sep '06

15 Sep '06

Hi List I'm running Freeradius with MySQL I am trying to log parts of the accounting data to a different table than 'radacct', but am struggling to get the sysntax for adding an 'INSERT INTO XXXX' line to the 'accounting_update_query', is there a way to get it to execute 2 SQL commands? Thanks in advance Dan

2 1

FreeRadius autentication delay
by Josep Martí Colomina 15 Sep '06

15 Sep '06

Hi, I am using the version of Free Radius 1.0.5 to authenticate the users of a net wireless, with eDirectory. Since the first day, I am experimenting problems of delays on the freeRadius authentication of the wireless net. There are moments that it works well, itauthenticates in 2 seconds, this happens after restarting the FreeRadius, but during the normal operation one time delay 2 seconds and two more times delay 30 seconds, it seems that some timeout expires, it is late of the order of 30 seconds on authenticating. The configuration is the following one: - Red Hat Enterprise Linux AS release 3 (Taroon Update 5) - FreeRadius 1.0.5 - The ldap server is eDirectory in (two nodes) with load balancing. I can discard that the problem is from the load balancing since I have reconfigured the Freeradius with the ip of each eDirectory and reacts in the same way in both nodes. Have you can make some suggestion in order to solve this problem, maybe him the parametrization of the FreeRadius?, any help will be from great value for me, thank you -- josep.colominaATgmail.com

1 0

URGENT! User does not get VSA attribute If override = yes and in radiusd.conf and using PROXY
by Guilherme Franco 15 Sep '06

15 Sep '06

Hi, I need to set override = yes in radiusd.conf in order to the user get an IP. This way because it's a proxy request. i.e: user(a)realm.com -> proxy to realm -> realm authorize user -> myradius sets the IP The IP assignment does not work with override = no, because the proxy radius tends to set the IP 255.255.255.254. Ok, if override = yes, the users get the correcty ip from the pool, but not the VSA, as below: DEFAULT Pool-Name := test X-Ascend-Client-Primary-DNS = x.x.x.x, X-Ascend-Client-Secondary-DNS = x.x.x.x, X-Ascend-Client-Assign-DNS = 1, ERX-Virtual-Router-Name = "default", Framed-Routing == None, Framed-Protocol = PPP, Service-Type = Framed-User note: those vsa works correctly when I specify local users like this (not proxy): testuser Auth-Type := local, User-Password == "foo", Pool-Name := test X-Ascend-Client-Primary-DNS = x.x.x.x, X-Ascend-Client-Secondary-DNS = x.x.x.x, X-Ascend-Client-Assign-DNS = 1, ERX-Virtual-Router-Name = "default", Fall-Through = Yes Please HELP! THANKS!

1 0