- Freeradius-Users - lists.freeradius.org

Re: Does Freeradius support IAPP (802.11f)??
by David Mitton 15 Aug '06

15 Aug '06

IEEE 802.11f was a Recommended Practice (not a Standard) issued by IEEE Standards Association, 802.11 group. I know it was deprecated due to reading minutes of recent meetings, accessible to participants. They are the ones that maintain it's status. They have websites, but none dedicated to it in particular. http://standards.ieee.org/ http://grouper.ieee.org/groups/802/11/ You'll have to ask them, for "official" word. Dave. ----- Original Message ----- From: "zhu yunwu" To: "FreeRadius users mailing list" Subject: Re: Does Freeradius support IAPP (802.11f)?? Date: Mon, 14 Aug 2006 15:52:33 +0800 On 8/11/06, David Mitton <david(a)mitton.com> wrote: >One should be aware that 802.11f has been deprecated by the IEEE. >To use it requires support in all your Access Points and the RADIUS >server(s). Thank you very much. This information is very important for me. But would you please tell me where you get it or know about it? I want to get more detail informatioin about it from official website. (Woodland) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: read_groups in cvs
by Duane Cox 14 Aug '06

14 Aug '06

> > On the todo list for Monday, if additional debug output is needed. > > I wouldn't have asked for it if I didn't need it... > <debug radiusd -X> rad_recv: Access-Request packet from host 10.0.0.11 port 1145, id=104, length=56 User-Name = "dcox(a)illicom.net" User-Password = "XXXX" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_realm: Looking up realm "illicom.net" for User-Name = "dcox(a)illicom.net" rlm_realm: Found realm "illicom.net" rlm_realm: Adding Stripped-User-Name = "dcox" rlm_realm: Proxying request from user dcox to realm illicom.net rlm_realm: Adding Realm = "illicom.net" rlm_realm: Authentication realm is LOCAL. rlm_realm: Request already proxied. Ignoring. radius_xlat: 'dcox' radius_xlat: 'dcox' rlm_sql (sql): sql_set_user escaped user --> 'dcox' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'select id, username, attribute, value, op from radcheck where username = 'dcox' order by id' rlm_sql (sql): User found in radcheck table radius_xlat: 'select id, username, attribute, value, op from radreply where username = 'dcox' order by id' rlm_sql (sql): Released sql socket id: 7 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 1 rlm_pap: login attempt with password eldon rlm_pap: Using clear text password. rlm_pap: User authenticated succesfully modcall: group PAP returns ok for request 1 Login OK: [dcox(a)illicom.net] (from client webclient port 0) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: 'dcox' rlm_sql (sql): sql_set_user escaped user --> 'dcox' radius_xlat: Running registered xlat function of module config for string 'client[%{Packet-Src-IP-Address}].shortname' radius_xlat: 'client[10.0.0.11]' radius_xlat: 'exec radpostauth 'dcox(a)illicom.net', 'XXX', 'Access-Accept', '10.0.0.11', '', '', '', '', '', 'webclient'' rlm_sql (sql) in sql_postauth: query is exec radpostauth 'dcox(a)illicom.net', 'XXX', 'Access-Accept', '10.0.0.11', '', '', '', '', '', 'webclient' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 104 to 10.0.0.11 port 1145 Service-Type = Authenticate-Only Session-Timeout = 86400 Finished request 1 Going to the next request > > > But I am using a recent (-7 days ago) cvs checkout of 2.0.0pre0 > > > > I don't have any debug output right now, but it's rather obvious to > > me that the server doesn't process the radcheckgroup / > > radreplygroup in rlm_sql unless the fall-through = yes is found in > > the radreply for the user, which contradicts the docs (3d) as > > posted below. > > That's all well and good, but I need the debug output to see *what* > the server is doing for/to you and *why* its doing it, especially if > you want *me* to fix it... > > > > Meanwhile, I have set the fall-through = yes during the radreply > > for now to get it to process the groups... > > Make sure your debug output is *without* having "Fall-Through" set in > radreply. done as requested. > > > --Mike

1 0

assign a value to an attribute via a script
by Philippe Bacquaert 14 Aug '06

14 Aug '06

Hello, I'm searching how to use a script to modify the value of an attribute. When I try the example of radiusd.conf : Attribute-Name = `%{echo:/path/to/program args}` In my test I try to use a script to assign an IP address to the Attribute Framed-IP-Address : Framed-IP-Address = `%{dhcp:/etc/raddb/test %{User-Name} %{NAS-IP-Address}}` I've added this in the accounting module with the same result as I want to fic this value in the attribute Framed-IP-Address during the time of an active accounting session. I've created an exec module : exec dhcp { wait = yes input_pairs = request output_pairs = reply packet_type = Access-Accept } I get an error message when I try to start : ERROR: Cannot find a configuration entry for module "Framed-IP-Address". The rest of the radiusd.conf configuration is pointing to a MySQL database and works well. I've tested successfully the script itself alone in the echo module configuration : program = "/var/log/radius/test %{User-Name} %{NAS-IP-Address}" What am I doing wrong ? Is something missing ? Sincerely, Philippe BACQUAERT Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34 /mn) ; tél : 08 92 68 13 50 (0,34/mn)

3 2

Managing connection on Freeradius
by Nataniel Klug 14 Aug '06

14 Aug '06

Hello all, I am quite new to freeradius and I am with a doubt. I have a PPPoE-Server that authenticate the users into my FreeRadius server. The problem is that if a client, by some reason, get lost of connection the freeradius mantain the log about that connection and, if the client try to connect again, it say that siomultaneos use is not allowed. So I have to delete radutmp and radwtmp, restart radius, and lost the track of connections. There is any tool to make it easier? Or some configuration that if there is no package coming from the cliente for 60 seconds it will disconect the client? Att, Nataniel Klug

3 5

Freeradius and prepaid extension
by deborah malka 14 Aug '06

14 Aug '06

Hello all, I have heard about Freeradius, that it is a very powerfull server. Thank you to all for the work you have done !! I need a Radius server to perform prepaid VOIP telephony. For that the server must implement the RFCs 2865, 2866, 3539, and the extension for Prepaid follows the specifications : X.S0011-005-C and X.S0011-006-C. Does Freeradius implements all this ? I need these informations, because I have to install a platform demo, so if someone can help me ... thank you so much by advance. Deborah ================= Déborah Malka --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta.

6 11

(no subject)
by c k 14 Aug '06

14 Aug '06

I m using EAP-TLS as an authentication protocol.I want to authorize the clients in my network to access only certain protocol traffics.For some users i want to allow only http,while for others http and ftp.How can i create such kind of profiles and perform access control on routers.Sorry friends i m new to radius...plz help me out. --------------------------------- See the all-new, redesigned Yahoo.com. Check it out.

2 1

Re: Does Freeradius support IAPP (802.11f)??
by David Mitton 14 Aug '06

14 Aug '06

One should be aware that 802.11f has been deprecated by the IEEE. To use it requires support in all your Access Points and the RADIUS server(s). Windows IAS certainly does not support it. Using the hostap only helps if you are using that software for your APs. And it says "minimal". Exactly what that means should be discussed with the maintainer(s) of that software. I'm not aware of an availible implementation in commercial APs. But I would like to hear of any. (not sure that further discussion really belongs on this list) Dave. ----- Original Message ----- From: "zhu yunwu" To: "FreeRadius users mailing list" Subject: Re: Does Freeradius support IAPP (802.11f)?? Date: Fri, 11 Aug 2006 15:45:50 +0800 Thank you for your help. I have another question: 1) does the radius server provided by windows 2003 support the IAPP (802.11F)? if yes, how to configure it? 2) Is IAPP function in hostapd able to work properly without further development? On 8/11/06, Alan DeKok <aland(a)deployingradius.com> wrote:"zhu yunwu" <zhuywtwin(a)gmail.com> wrote: > Now I am using the Freeradius. Could you tell me whether IAPP ( > 802.11f) is really suppported in Freeradius? No, sorry. > if not,could you please kindly advise that > what kind of radius server support IAPP and how to configure it? http://hostap.epitest.fi/ It has documentation. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Reject packet with zero length
by muralidhar.gangaraju＠wipro.com 13 Aug '06

13 Aug '06

Hi all, We are using FreeRADIUS server for one of our requirements and we saw freeradius server sending a reject packet with zero length attributes. Could anybody of u can help me in understanding in what circumstances FreeRadius server will send a reject packet with zero length attributes in between the access challenges OR access requests. In the normal scenario when the password or certificate mismatch is found the FreeRADIUS sends an access-Reject packet with EAP-Message and message Authenticator. But in the below case it does not send any attributes. One such instance where we observed radius server sending reject packet with zero attributes is as follows. Going to the next request Cleaning up request 17 ID 243 with timestamp 44dd6e90 Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 246 to 10.201.114.29:1050 Waking up in 4 seconds... rad_recv: Access-Request packet from host 10.201.114.29:1050, id=165, length=158 NAS-IP-Address = 10.201.114.147 NAS-Port = 2 Framed-MTU = 1388 NAS-Port-Type = Wireless-802.11 Service-Type = 128 Called-Station-Id = "60-c4-b6-48-80-00:" Calling-Station-Id = "fc-50-d1-ba-70-00" NAS-Port-Id = "fc-50-d1-ba-70-00" State = 0xe92296731885b23183f47834fb748272 User-Name = "root" EAP-Message = 0x020500060d00 Message-Authenticator = 0x035037019647238daa63c6f29829afd2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 modcall[authorize]: module "preprocess" returns ok for request 20 modcall[authorize]: module "chap" returns noop for request 20 modcall[authorize]: module "mschap" returns noop for request 20 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" Please let me know if u need any more information. Thanks in advance. Regards, G Muralidhar Raju. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

freeradius web manage
by Marwan Sultan 13 Aug '06

13 Aug '06

Hello Everyone, Would please anyone recommend for me any interface web package that allowes me to controll and manage freeradius users ? I'm on freebsd 6.1, mysql 4.1 ChilliSpot and freeradius. I tried myprepaid but its so buggy. So anyone knows about similar interface please? Marwan Sultan. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2

Unresponsive child
by Matt Dunkin 12 Aug '06

12 Aug '06

After some recent changes to my rlm_perl perl script I am getting the following messages all the time... Tue Aug 8 08:08:50 2006 : Error: WARNING: Unresponsive child (id 2966633392) for request 28 Tue Aug 8 08:08:50 2006 : Error: WARNING: Unresponsive child (id 2977528752) for request 27 Tue Aug 8 08:08:50 2006 : Error: WARNING: Unresponsive child (id 2988153776) for request 25 Usually after a lot of these radius will crash and will need to be restarted. I was receiving the sql running out of connections error but I am not getting those anymore after tuning my tables. I don't believe at this point that this is a mysql issue however any suggestions would be appreciated. I do access mysql from my perl script so that could be the problem. Each function in the perl script opens a mysql connection then closes it before finishing the function. Could this be the problem? Should I create an initial connection and use it throughout the script? Thanks Guys, I know you will know what the problem is.

4 5