- Freeradius-Users - lists.freeradius.org

MSCHAP-SUCCESS message in TTLS/MSChapV2
by Andrew 24 Aug '06

24 Aug '06

Hi, I am trying to use wpa_supplicant with freeradius server. I am using FreeRadius server version 1.1.2. I read a wpa_supplicant document saying the FreeRadius server does not send MSChap-Success message at the end of a successful TTLS/MSCHAPV2 authentication. It only sends EAP-Success. Is that true? Is there anyway to fix this? Thanks, Andrew -- http://www.fastmail.fm - Access your email from home and the web

2 1

freeradius vs vlan
by Szabolcs Géczi 24 Aug '06

24 Aug '06

Hello, I have installed freeradius (1.1.2) on freebsd and would like to use for authorizing ieee-802.1x request coming from hp 2524 switch. But fails to start correctly. radiusd -sfxxyz -l stdout result: /usr/local/etc/raddb/users[217]: Parse error (check) for entry Tunnel-Type:0: expecting '=' Errors reading /usr/local/etc/raddb/users radiusd.conf[1059]: files: Module instantiation failed. radiusd.conf[1817] Unknown module "files". radiusd.conf[1753] Failed to parse authorize section. the relevant part of users.conf: "username" Auth-Type := EAP, User-Password == "password" Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = 12 what do I wrong? sz

2 1

No Such Object available on this agent at this OID
by Hasan Ovuc 24 Aug '06

24 Aug '06

- I copied all mib directory into /usr/share/snmp/mibs/ and added the following lines to my original snmpd.conf : dlmod /usr/share/snmp/mibs/RADIUS-ACC-SERVER-MIB.txt dlmod /usr/share/snmp/mibs/RADIUS-AUTH-SERVER-MIB.txt dlmod /usr/share/snmp/mibs/GNOME-PRODUCT-RADIUSD-MIB dlmod /usr/share/snmp/mibs/RADIUS-STAT-MIB.txt dlmod /usr/share/snmp/mibs/RADIUS-ACC-SERVER-MIB.chart dlmod /usr/share/snmp/mibs/RADIUS-AUTH-SERVER-MIB.chart - smuxpeer .1.3.6.1.4.1.3317.1.3.1 pass I added the following line to radiusd's snmp.conf: - smux_password = pass Uncommented the following lines in radiusd.conf : snmp = yes $INCLUDE ${confdir}/snmp.conf Then I walked over the MIBs to see what can I get with : snmptranslate -m /usr/share/snmp/mibs/RADIUS-STAT-MIB.txt -Tl And tried to get radiusStatUpTime, but got the following error: #snmpwalk -m /usr/share/snmp/mibs/RADIUS-STAT-MIB.txt -v 2c -c sol localhost .1.3.6.1.2.1.67.3.1.2 RADIUS-STAT-MIB::radiusStatUpTime = No Such Object available on this agent at this OID So we can read the MIB but can't get the OID correspondent from the SNMPD which means that SNMPD can't communicate with RADIUS. Also, as another example, I've started the radius server with -X flag and got the following lines on the screen, and couldnt get an answer when I tried 1.3.6.1.4.1.3317.1.3.1, 1.3.6.1.2.1.67.1.1.1.1 or 1.3.6.1.2.1.67.2.1.1.1 : Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

2 1

IAS acting as Proxy
by Fitzner Daniel 24 Aug '06

24 Aug '06

Hi folks, we have the following scenario: Radius-Client (Checkpoint-Firewall NGX) -> IAS-Agent (Windows 2K3) acting as Proxy -> Freeradius-Server (1.0.2) All authentication requests are denied by the Freeradius-Server. It seems that Freeradius cannot read/decrypt the password sended by the IAS, because in logfile the password is like "\226\231\....." Is there any special configuration needed for this scenarion? btw: the scenario without proxy (Radius-Client -> Freeradius-Server) works perfectly... best regards and thanks

2 1

Problem with character Ä in username/password
by Velusamy, Vinodh 24 Aug '06

24 Aug '06

Hi, There seems to be a problem if the username/password contain the character Ä, when trying to authenticate via freeradius. rad_recv: Access-Request packet from host 127.0.0.1:33292, id=245, length=98 User-Name = "\303\251\303\242\303\244\303\245\303\247\303\252\303\250\303\257\303\256\303\254\303\204\303\246\303\264\303\262\303\273" User-Password = "\222\023S~\345v\322\250\207\216\261\206\242J\301\301\251\006\233\026N\374\014\213\036c\022'\220\r\370\210" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "éâäåçêëèïîì@?æôòû", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_unix: [éâäåçêëèïîì@?æôòû]: invalid password modcall[authenticate]: module "unix" returns reject for request 1 modcall: leaving group authenticate (returns reject) for request 1 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- I am using version 1.1.0 on Ubuntu Does anyone know of a workaround or solution to this. Thanks in advance. V~ --- Vinodh Velusamy Software Engineer Ubizen - a Cybertrust company Ubicenter, Philipssite 5, 3001 Leuven, Belgium T: +32 16 28 73 14 F: +32 16 28 71 00 E-mail: vinodh.velusamy(a)ubizen.com www.ubizen.com - www.cybertrust.com

2 8

Simultaneous-Use is not working
by Marwan Sultan 24 Aug '06

24 Aug '06

Hello everyone.. Please help in this issue.. Im on freebsd 6.1, freeradius, chillispot, phpmyprepaid, all latest..and mysql4.1. Everything works good for me, I can create hourly accounts monthly accounts, and on time it will stop.. But there is 1 big major problem.. Im able to use the same username to log again and again from the same username and same online time.. I checked the radcheck in mysql i found Simultaneous-Use =1 (which is created by phpmyprepaid) but its not working ?? I checked my radiusd.conf and found the follow: (this is part of my radiusd.conf) Please tell me if you need to see any file.PLEASE. # This file is used mainly for Simultaneous-Use checking, # and also 'radwho', to see who's currently logged in. # radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. filename = /var/log/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = yes # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes" } # "Safe" radutmp - does not contain caller ID, so it can be # world-readable, and radwho can work for normal users, without # exposing any information that isn't already exposed by who(1). # # This is another 'instance' of the radutmp module, but it is given # then name "sradutmp" to identify it later in the "accounting" # section. radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } Thank you, Marwan _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

download of 1.1.2.tar.gz broken
by Elizabeth Murray 24 Aug '06

24 Aug '06

I've been trying to download your latest and greatest. The link is not working. Error message is 550 /pub/radius/freeradius-1.1.2.tar.gz: No such file or directory The same is true for the PGP Signature V. Elizabeth Murray, CNE5, CNE6, MCP Information Technology Specialist V Information Technology Bureau Iowa Department of Natural Resources 515-281-8565 elizabeth.murray(a)dnr.state.ia.us

3 2

User-Password and regular expression problem
by V.Kukushkin 24 Aug '06

24 Aug '06

Hi I want to disable login users with empty passwords So, the entry in my "users" file is: --------------------------------- DEFAULT User-Password !~ "^$" Framed-MTU = 576, Acct-Interim-Interval := 60 DEFAULT Auth-Type := Reject Reply-Message = "Unknown user subscription type" --------------------------------- And I expected Access-Reject with reply message. Instead I got Access-Reject but for another reason - Incorrect password (see debugging output below). Password is not empty and stored in MySQL database as clear text. Same result I saw when used simple (not regular) expression: ---------------------------------------- DEFAULT User-Password != "" Framed-MTU = 576, Acct-Interim-Interval := 60 DEFAULT Auth-Type := Reject Reply-Message = "Unknown user subscription type" --------------------------------------- 1) If I remove this check from users file, the user can log in successfuly. 2) Regular expression for User-Name is working well, e.g. DEFAULT User-Name =~ "^[-_[:alnum:]]+$", NAS-Port-Type == Ethernet Framed-MTU = 576, Acct-Interim-Interval := 60 It seems to me that the Value of User-Password is broken during check and not equal to Value taken from database. My questions is: Is User-Password handled in the same way as another attributes in "user" file OR not ? How to disable users with empty passwords ? PS: The problem occured with versions 1.0.1 and 1.0.5 My backend - MySQL with standard radius database. OS - Redhat 9.x, i386. Debugging output of "radiusd -X" looks like this: --------------------------------- rad_recv: Access-Request packet from host 127.0.0.1:1112, id=47, length=65 User-Name = "cftest" User-Password = "1234567890" Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = "r9999" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20060824' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20060824 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cftest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 14 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'cftest' rlm_sql (sql): sql_set_user escaped user --> 'cftest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username=(SELECT distinct username FROM usergroup WHERE groupname&(SELECT regionid FROM regionslist WHERE routerid='r9999') AND username='cftest') ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: num_fields 5 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'cftest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: num_fields 5 radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'cftest' ORDER BY id' rlm_sql_mysql: num_fields 5 radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'cftest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: num_fields 5 rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 -- regards, Vladimir

2 1

Re: Help to modify the reply list for accounting response packets.
by Shankar Ganesh C 24 Aug '06

24 Aug '06

Hi Allan, I understand from the mail archive and the source code that i need to use the paircreate and pairadd functions to add the value pairs to the radius packet and use the Rad_send library call to send the accounting packets. Can i use the above approach to send the accounting response packet with attributes? Pls let me know if the understanding is correct or do i need to adopt some other mechnasism to add the support of sending the accounting response packets with attributes? Thanks for your time. Rgds Shankar ganesh

1 0

RE: Report Generator
by Edward.Shih＠rcc.edu 24 Aug '06

24 Aug '06

Yes, Sean. May I have a copy? Thanks a bunch. Edward -----Original Message----- From: freeradius-users-bounces+edward.shih=rcc.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+edward.shih=rcc.edu@lists.freeradius.or g] On Behalf Of Sean Sent: Wednesday, August 23, 2006 12:58 PM To: freeradius-users(a)lists.freeradius.org Subject: Report Generator Hi, Ive written a report generator in PHP and HTML that will allow your clients to generate usage reports from the FreeRadius log files. When the user logs in he/she is asked for their IP address and the Month that they want to display. If anyone wants a copy let me know. If there is enough interest I'll make it available for public download. Regards, Sean Bracken http://swarmhotspots.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1