- Freeradius-Users - lists.freeradius.org

Standalone FreeRadius EAP-SIM Configuration Recipe?
by Duncan Glendinning 07 Jul '06

07 Jul '06

Hello, I'm attempting to configure FreeRadius to use EAP-SIM, in a standalone fashion (i.e., the GSM tuples are stored locally). Does a 'recipe' exist to appropriately FreeRadius to do so? It appears that the documentation is not complete, and I haven't found reference to such a configuration in the last 6 months or archives. I want to be able to use a USB SIM card reader along with EAP-SIM to authenticate a wireless supplicant. Thanks for your help, Duncan --- <mailto:Duncan.Glendinning@cox.net> Duncan.Glendinning(a)cox.net

2 1

Re: Radius ip pool
by Stefan Winter 07 Jul '06

07 Jul '06

Hi, (please respond to the list, not me privately. Others may have the same question) > yes, my clients using 802.1X. > I make a DHCP Server together with freeradius, but he don't deliver ip's. > I want to know if the radius have any configuration for this, to work > with a DHCP server. In fact, others _did_ have the same question. Reading the list archives would have helped. .1X authentication and DHCP have *nothing* to do with each other. If you have a DHCP server and it doesn't talk to your authenticated clients, that's a completely FreeRADIUS unrelated problem. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Error: rlm_sql_mysql: MYSQL Error
by jayesh 07 Jul '06

07 Jul '06

Hi all, I am using freeradius 1.1.0. The backend is mysql 5.0.22 which is located on a different server on the same network. My configuration is as follows: I am doing some stress testing to benchmark my infrastructure. I use SIPp for the same. The SIPp sends the calls to cisco gateway, the cisco gateway sends the authentication request to freeradius server. The radius server queries the mysql database and once the authentication is successful and the call is completed; the accounting request is also passed to the radius server by cisco which in turn is sent to the mysql database. Now I kept the SIPp at rate of 45 calls per second, but after say 10 to 15 minutes the radius server dies. This is the message I could see in the log: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Error: rlm_sql_mysql: MYSQL Error: Cannot get result Fri Jul 7 14:18:46 2006 : Error: rlm_sql_mysql: MYSQL Error: Fri Jul 7 14:18:46 2006 : Error: rlm_sql_mysql: MYSQL Error: No Fields Fri Jul 7 14:18:46 2006 : Error: rlm_sql_mysql: MYSQL error: Fri Jul 7 14:18:46 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri Jul 7 14:18:46 2006 : Error: rlm_sql (sql): failed after re-connect. I tried googling the archive but could not get a proper solution. One more thing; I had configured rlm_mysql using the following command: ./configure --without-thread. Could this be a cause of some problem, I did this as the radius was not finding mysql libraries. Can someone please help on this. Thanks in advance. w/regards, Jayesh Nambiar

1 0

RE: FW: mpd+freeradius+AD
by Егоров Сергей 07 Jul '06

07 Jul '06

Thank you so much Nikos! -----Original Message----- From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] Sent: Friday, June 30, 2006 4:57 PM To: freeradius-users(a)lists.freeradius.org Cc: Егоров Сергей Subject: Re: FW: mpd+freeradius+AD On Friday 30 June 2006 11:57, Егоров Сергей wrote: > Ok, this is my users file > > > test Auth-Type := MS-CHAP > Framed-IP-Address = 192.168.10.65 > DEFAULT Auth-Type := MS-CHAP > > And this is freeradius log, then I connect to mpd via test account: > > Login OK: [test/<no User-Password attribute>] (from client localhost port 0 > cli 192.168.12.126) Sending Access-Accept of id 121 to 127.0.0.1 port 49791 > Framed-IP-Address = 192.168.10.65 > MS-CHAP2-Success = > 0x01533d4245433430393843434139344338323441384444443146393830364138413345323 >6394441413430 MS-MPPE-Recv-Key = 0x0bbdc1d49670112e799bd5a86b084808 > MS-MPPE-Send-Key = 0x0df81127464f94a443c13e7e683f5251 > MS-MPPE-Encryption-Policy = 0x00000002 > MS-MPPE-Encryption-Types = 0x00000004 > rad_recv: Accounting-Request packet from host 127.0.0.1:54511, id=119, > length=139 NAS-Identifier = "testradius.ion.ru" > NAS-Port = 0 > NAS-Port-Type = Virtual > Service-Type = Framed-User > Framed-Protocol = PPP > Calling-Station-Id = "192.168.12.126" > User-Name = "test" > Framed-IP-Address = 192.168.10.12 > Acct-Status-Type = Start > Acct-Session-Id = "1652038-pptp0" > Acct-Multi-Session-Id = "1652038-pptp0" > Acct-Link-Count = 1 > Acct-Authentic = RADIUS > Sending Accounting-Response of id 119 to 127.0.0.1 port 54511 > > In this log freeradius said that account test OK, and his address > 192.168.10.65. But mpd replace it this his own. How could I improve it? > use radius-ip read more here /usr/local/share/doc/mpd/mpd22.html > > > -----Original Message----- > From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] > Sent: Thursday, June 29, 2006 7:05 PM > To: Undisclosed.Recipients : > Cc: Егоров Сергей > Subject: Re: FW: mpd+freeradius+AD > > On Thursday 29 June 2006 15:28, Егоров Сергей wrote: > > >This is Framed-IP-Address in radius dialect. > > > > Thanks for explaining freeradius basic concepts. I understood, that to > > assign IP to user I should use users freeradius file. But I couldn't > > configure it correctly. Now I have only one line in this file > > > > DEFAULT Auth-Type := MS-CHAP > > > > I've add another string (for user test), but it doesn't correct > > > > test Auth-Type := MS-CHAP, > > Try without the comma > > run the server in debug mode(radiusd -X) > and use radclient > > > Framed-IP-Address = 192.168.10.65, > > I think you can put this in AD. Don't know... > > > That should I fix? > > > > > > -----Original Message----- > > From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] > > Sent: Monday, June 26, 2006 5:09 PM > > To: freeradius-users(a)lists.freeradius.org > > Cc: Егоров Сергей > > Subject: Re: mpd+freeradius+AD > > > > On Monday 26 June 2006 14:04, Егоров Сергей wrote: > > > Thanks for reply. > > > > > > >You can use one of the three firewalls avaliable in the base > > > > system(ipfw, > > > > > > > > >ipf and pf), however mpd comes with a small dictionary that uses > > > > > > > > ipfw(8) >and you can easily define some filter bound to an interface > > > > (bound to a >username) via a radius reply attribute, let filter be a > > > > pipe(for bandwidth >control) or a packet filtering expression. > > > > > > That's fine for filtering vpn users access to local net. But how could > > > I assign specific IP for specific user in AD? > > > > > > > Your questions don't clearly tell where your problem is. > > > >Active Directory? mpd? or FreeRADIUS? You should define > > > >them better in order to get help from the list. > > > > > > My goal is to replace VPN server, based on win2003, with FreeBSD one. > > > WIN 2003 can do 1 and 2 in my questions, so I have to realize how to > > > setup this in mpd + freeradius. I already authenticate users from AD > > > group: > > > > > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > > --challenge=%{mschap:Challenge:-00} > > > --nt-response=%{mschap:NT-Response:-00} > > > --require-membership-of=EXAMPLE+VPN_Allowed". > > > > > > But I have several vpn groups and need to setup timeouts on each one. > > > > setup timeout? This looks like Session-Timeout in radius dialect. > > > > > Also > > > I need to I assign specific IP for specific user in AD. > > > > This is Framed-IP-Address in radius dialect. > > > > > Looks like > > > FreeRadius should respond for this. > > > > Yes, you have to have basic understanding of what radius is. All of these > > are very basic setup. I don't know how FreeRADIUS interacts with AD and > > what info it should get from AD. So, try searching (or asking) for active > > directory and FreeRADIUS. Keep the mpd part out of it, since it will > > add unneeded complexity. Or perhaps start from setting up mpd and > > FreeRADIUS. And then you could add AD. > > > > A few suggestions, Nikos > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

1 0

Defining different Service-Types for different equipment for the same user
by Nuno Cervaens 06 Jul '06

06 Jul '06

Hi, I have to install a Radius Server that is going to authenticate and autorize users in the CLI of a mix of router brands and switches. The server will have a bunch of users that will have defined the Service-Type Administrative or NAS-Prompt. My problem is that when a user logs in to an Enterasys SSR with the Service-Type = Administrative, it goes immediately to the configure mode, and I dont want that, just the enable mode. So for a user that has Serv.Type = Administrative I would like to specifically define for the SSRs the Service-Type as NAS-Prompt (which goes to enable mode, equivalent for Administrative for CISCO that goes as well to enable mode for example). Do you know the best way to implement this? Thanks, Nuno

2 3

Mysql Authentication
by Max Clark 06 Jul '06

06 Jul '06

Hi all, We are migrating from an old installation of Radiator onto Freeradius. Local test accounts work fine, however I am getting an error on mysql based authentication. I am sure I'm missing something basic, here is the output from the radiusd process. Thanks, Max Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:59269, id=53, length=75 User-Name = "cisp1(a)foo.com" User-Password = "testdial" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "foo.com" for User-Name = "cisp1(a)foo.com" rlm_realm: Found realm "foo.com" rlm_realm: Proxying request from user cisp1 to realm foo.com rlm_realm: Adding Realm = "foo.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'cisp1(a)foo.com' rlm_sql (sql): sql_set_user escaped user --> 'cisp1(a)foo.com' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'cisp1(a)foo.com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'cisp1(a)foo.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'cisp1(a)foo.com' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'cisp1(a)foo.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 53 to 127.0.0.1 port 59269 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 53 with timestamp 44ad4ca3 -- Max Clark http://www.clarksys.com

3 3

Radius ip pool service !!
by Emerson 06 Jul '06

06 Jul '06

Hi, I read about ip pool service in freeradius. I need to deliver ip to my clients postauth. I need to know if "ip pool" is the tool for this..... Thank's Emerson

2 1

CHAP and Windows 2003 AD LDAP
by Luke 06 Jul '06

06 Jul '06

Hi, I'm trying to get a freeradius server (v1.0.1) to work with CHAP and querying a Windows 2003 Active Directory server using LDAP. I've got LDAP working for PAP queries, but CHAP comes back with the "rlm_chap: Could not find clear text password". Now I've read the FAQ and followed those notes, but I'm not sure what the values should be for the "password_header", "password_attribute" and "password_radius_attribute"? Any help would be much appreciated, Thanks, Luke

5 7

cisco 3550
by fhcom＠club-internet.fr 06 Jul '06

06 Jul '06

1 0

module install
by Cihan DEMİR 06 Jul '06

06 Jul '06

Hi all, I'm new to radius and i'm searching "authentication without username/password but calling number" about a week. After all, i find rlm_checkval module. We are using version 0.9.3 and rlm_checkval module doesn't exist. I want to install it but it's not in "stable" list. So, here is the question : in 1.1.2 version, it is in stable list. If i want to install rlm_checkval module which exists in 1.1.2 version to 0.9.3 , what happens? I think there is no difference. Thanks in advance. Cihan. -------------------------------------------------------------------------------- Omsan'in sundugu hizmetleri nasil degerlendiriyorsunuz? Görüsleriniz bizim için degerli. Aldiginiz hizmetin beklentilerinizi ve ihtiyaçlarinizi ne ölçüde karsiladigi konusunda benimle irtibata geçebilir veya pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr veya innovate(a)omsan.com.tr adreslerine e-mail gönderebilirsiniz. How do you evaluate the services of Omsan? Your opinions are valuable for us. You can contact me or send an e-mail to , pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr or innovate(a)omsan.com.tr to inform us about the extent to which the services provided fulfill your expectations and needs. -------------------------------------------------------------------------------- Bu e-posta mesaji kisiye özel olup, gizli bilgiler içeriyor olabilir. Eger bu e-posta mesaji size yanlislikla ulasmissa, içerigini hiç bir sekilde kullanmayiniz ve ekli dosyalari açmayiniz. Bu durumda lütfen e-posta mesajini kullaniciya hemen geri gönderiniz ve tüm kopyalarini mesaj kutunuzdan siliniz. Bu e-posta mesaji, hiç bir sekilde, herhangi bir amaç için çogaltilamaz, yayinlanamaz ve para karsiligi satilamaz. Bu e-posta mesaji virüslere karsi anti-virüs sistemleri tarafindan taranmistir. Ancak yollayici, bu e-posta mesajinin - virüs koruma sistemleri ile kontrol ediliyor olsa bile - virüs içermedigini garanti etmez ve meydana gelebilecek zararlardan dogacak hiçbir sorumlulugu kabul etmez. This message is intended solely for the use of the individual or entity to whom it is addressed, and may contain confidential information. If you are not the intended recipient of this message or you receive this mail in error, you should refrain from making any use of the contents and from opening any attachment. In that case, please notify the sender immediately and return the message to the sender, then, delete and destroy all copies. This e-mail message, can not be copied, published or sold for any reason. This e-mail message has been swept by anti-virus systems for the presence of computer viruses. In doing so, however, sender cannot warrant that virus or other forms of data corruption may not be present and do not take any responsibility in any occurrence.

2 1