- Freeradius-Users - lists.freeradius.org

Re: Session-Octets-Limits
by Mordor Networks 31 May '06

31 May '06

ok thanks a lit edvin but one more question please Session-Octets-Limit := 1000 for example the "1000" = byte or kbyte or MB ? coz everything thing seems to be working i can see the attribute in the radius log and in the raddattr file and in the sql table but it is not disconnecting the user :| On 5/31/06, Seferovic Edvin <edvin.seferovic(a)kolp.at> wrote: > > shall i added it to the radclient on the nas box ? > > > > YES ! Both server and client have to know about what attribute are you > "talking about". > > > > Regards, > > > > Edvin > > > ------------------------------ > > *From:* Mordor Networks [mailto:mordor.networks@gmail.com] > *Sent:* Mittwoch, 31. Mai 2006 08:46 > *To:* edvin.seferovic(a)kolp.at; FreeRadius users mailing list > *Subject:* Re: Session-Octets-Limits > > > > > > On 5/31/06, *Seferovic Edvin *<edvin.seferovic(a)kolp.at> wrote: > > > Hi Edvin > > Session-Octets-Limit should only be in the reply table ( it is not a value > that should be checked – right ? ). > > yes youre right > > If the freeradius replies the attribute – the freeradius is finished with > his task. Now your RP-PPPoE server and the radiusclient should do the rest > of the work. Traffic limiting is done with PPProtocol on your NAS ( your > pppoe server ). Be sure that the radiusclient also has the attribute in his > dictionary file. Look at the output of the ppp and pppoe ( increase the log > level – or put both in debug mode ). > > i added the attributes to the /usr/local/share/dictionary file shall i > added it to the radclient on the nas box ? > > > Regards > > > > It seems that this is not problem of freeradius anymore ! > > > > Regards, > > > > Edvin > > > ------------------------------ > > *From:* freeradius-users-bounces+edvin.seferovic= > kolp.at(a)lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic=kolp.at@lists.freeradius.org > ] *On Behalf Of *Mordor Networks > *Sent:* Dienstag, 30. Mai 2006 22:56 > *To:* FreeRadius users mailing list > *Subject:* Session-Octets-Limits > > > > Hello users > > I'm trying to add Session-Octets-Limit to limit the user bandwidth i add > Session-Octets-Limit := 1000 in radcheck and radreply > and i can see it in the radiusd -X and in the radattr file : > > Framed-IP-Address > > <http://70.70.70.70> > > *70.70.70.70* > > Session-Octets-Limit 825241648 > > Framed-Protocol PPP > > Framed-IP-Netmask 255.255.255.255 > > Framed-MTU 1500 > > Session-Timeout 43200 > > > > Idle-Timeout 1200 > > Port-Limit 1 > > > > But it is not disconnecting the user when reach the limit , can someone help me please? > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > >

2 6

How to upgrade Freeradius?
by elimachi＠entelsa.entelnet.bo 31 May '06

31 May '06

Dear list: I don´t have experience installing and uninstalling applications as freeradius from source code. I´d like to upgrade my freeradius version from 1.1.1 to 1.1.2, however I don´t know what steps have I to do. I´ll be very grateful with your guide becauase I have fear to erase some files or damage my actual installation. Thank you. Edu.

4 3

Server Distro
by Craig Main 31 May '06

31 May '06

Hi all, Is there a distro that implements freeradius with a nice web gui etc. like the smoothwall/ipcop firewall disto's? Thanks and Regards Craig

2 1

Session-Octets-Limits
by Mordor Networks 31 May '06

31 May '06

Hello users I'm trying to add Session-Octets-Limit to limit the user bandwidth i add Session-Octets-Limit := 1000 in radcheck and radreply and i can see it in the radiusd -X and in the radattr file : Framed-IP-Address 70.70.70.70 Session-Octets-Limit 825241648 Framed-Protocol PPP Framed-IP-Netmask 255.255.255.255 Framed-MTU 1500 Session-Timeout 43200 Idle-Timeout 1200 Port-Limit 1 But it is not disconnecting the user when reach the limit , can someone help me please?

3 4

Re: Testing jradius+freeradius+oracle
by David Bird 31 May '06

31 May '06

Hello, please use the correct mailing list for these questions: jradius-users(a)lists.sourceforge.net Thanks David

1 0

Zero Session-Timeout
by Rohaizam Abu Bakar 31 May '06

31 May '06

Dear all, Using FB 6.0, FR 1.0.5 (will upgrade soon) I've problem with timeout... I've set in users file as below in order to load timeout value depending on type of connection (ISDN/PSTN) DEFAULT NAS-Port-Type == "Sync", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U ISDN}` DEFAULT NAS-Port-Type == "Async", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U PSTN}`value The problem is when "Session-Timeout =0", normally happen when script cannot load value... it will NOT timeout... user till can get connect until manually disconnect... Below is the debug log... Login OK: [integ36] (from client INFRANETTEST port 300 cli 55550000) Sending Access-Accept of id 111 to 10.1.1.1:1645 Session-Timeout = 0 Framed-Compression = Van-Jacobson-TCP-IP Framed-MTU = 1500 Framed-Protocol = PPP Service-Type = Framed-User Finished request 89 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.1.1.1:1646, id=97, length=131 Acct-Session-Id = "000000AE" Framed-Protocol = PPP User-Name = "integ36" Acct-Authentic = RADIUS Acct-Status-Type = Start Calling-Station-Id = "55550000" Called-Station-Id = "2426" NAS-Port-Type = Async Connect-Info = "50667/24000 V90/V44/LAPM" NAS-Port = 300 Service-Type = Framed-User NAS-IP-Address = 10.1.1.1 Acct-Delay-Time = 0 . . . . rad_recv: Accounting-Request packet from host 10.1.1.1:1646, id=98, length=173 Acct-Session-Id = "000000AE" Framed-Protocol = PPP Framed-IP-Address = 10.1.1.3 User-Name = "integ36" Acct-Authentic = RADIUS Acct-Session-Time = 26 Acct-Input-Octets = 8110 Acct-Output-Octets = 4998 Acct-Input-Packets = 92 Acct-Output-Packets = 37 Acct-Terminate-Cause = User-Request Acct-Status-Type = Stop Calling-Station-Id = "55550000" Called-Station-Id = "2426" NAS-Port-Type = Async Connect-Info = "50667/24000 V90/V44/LAPM" NAS-Port = 300 Service-Type = Framed-User NAS-IP-Address = 10.1.1.1 Acct-Delay-Time = 0

2 2

Testing jradius+freeradius+oracle
by Zhou Yong Jun 31 May '06

31 May '06

I get the reply message in java application from freeradius, but the reply message have only usergroup reply message and no user reply message. Why? Thanks! 周勇军 TD-TECH OMC 021-50992135

1 0

freeradius 1.1.0 with rp-pppoe 3.8 pppoe-server
by root linux 31 May '06

31 May '06

I have a Red Hat 9.0 system with the following software: - ppp 2.4.4b1 rp-pppoe 3.8 freeradius 1.1.0 I saw the following in /usr/local/share/freeradius/dictionary.roaringpenguin RP-Upstream-Speed-Limit RP-Downstream-Speed-Limit Below is my MySQL result: - mysql> select * from radcheck; +----+----------+-----------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+-------+ | 1 | guest | Password | == | guest | +----+----------+-----------+----+-------+ mysql> select * from radgroupcheck; +----+--------------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+--------------+------------------+----+-------+ | 1 | customer128k | Simultaneous-Use | := | 1 | | 2 | customer128k | Auth-Type | := | Local | +----+--------------+------------------+----+-------+ mysql> select * from radgroupreply; +----+--------------+---------------------------+----+---------------------+------+ | id | GroupName | Attribute | op | Value | prio | +----+--------------+---------------------------+----+---------------------+------+ | 1 | customer128k | Framed-Protocol | = | PPP | 0 | | 2 | customer128k | Framed-Routing | = | Broadcast-Listen | 0 | | 3 | customer128k | Framed-Compression | = | Van-Jacobson-TCP-IP | 0 | | 4 | customer128k | RP-Upstream-Speed-Limit | = | 64 | 0 | | 5 | customer128k | RP-Downstream-Speed-Limit | = | 128 | 0 | | 6 | customer128k | Service-Type | = | Framed-User | 0 | | 7 | customer128k | Framed-MTU | = | 1500 | 0 | +----+--------------+---------------------------+----+---------------------+------+ mysql> select * from usergroup; +----+----------+--------------+ | id | UserName | GroupName | +----+----------+--------------+ | 1 | guest | customer128k | +----+----------+--------------+ Below is my ppp options: - require-pap login lcp-echo-interval 10 lcp-echo-failure 2 ms-dns x.y.100.8 ms-dns x.y.100.2 plugin radius.so plugin radattr.so Below is the command I run for pppoe-server: - pppoe-server -I eth1 -k -L 10.3.0.1 -R 10.3.1.1 I configure a PPPoE client connecting in my Windows XP desktop and successfully connect to the PPPoE server. I did perform a download speed test and the download speed is not correct. I can't get 128kbits but I get the full speed of 1Mbps, why? Doest the attribute field below works for FreeRADIUS? RP-Upstream-Speed-Limit RP-Downstream-Speed-Limit Regards, rootlinux __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 10

1 client unable to authenticate via EAP-TLS
by Terry Zarelli 30 May '06

30 May '06

Hello, I have one client that is having a problem authenticating via wireless EAP-TLS. The client is a Windows XP SP2 computer using a an internal Dell wireless card. The client associates with the access point-a Cisco Aironet 1130-but is continually reports an "attempting to authenticate" message. After, performing a "radiusd -X", I do not see any EAP-start messages; I see the following: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation I continually see these messages for this particular client and subsequently do not see Freeradius process the certificate. Any clues on what may be going on. I am using version 1.1.0. Is any more info needed that I can provide? Below is the log of the EAP conversation: Thank you. ______________________________________________________________________________________________________________________________________________________________________ Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.200.249:32768, id=226, length=175 User-Name = "vallent.com" Calling-Station-Id = "00-90-96-AF-7D-D4" Called-Station-Id = "00-15-2C-49-D6-40:2xe1zpK0" NAS-Port = 4 NAS-IP-Address = 192.168.200.249 NAS-Identifier = "bvwlc01" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x025200060d00 State = 0xed546982f4966349530000881730f5c2 Message-Authenticator = 0x2d0b467fefd65f09ef445907438841a0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 modcall[authorize]: module "preprocess" returns ok for request 14 modcall[authorize]: module "chap" returns noop for request 14 modcall[authorize]: module "mschap" returns noop for request 14 rlm_realm: No '@' in User-Name = "vallent.com", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 14 rlm_eap: EAP packet type response id 82 length 6 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> modcall[authorize]: module "eap" returns updated for request 14 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 14 modcall: leaving group authorize (returns updated) for request 14 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 14 modcall: leaving group authenticate (returns handled) for request 14 Sending Access-Challenge of id 226 to 192.168.200.249 port 32768 EAP-Message = 0x0153040a0dc0000008bd79fa9a8201851f5f94cd707d99f056471b3463d26d105fd500040830820404308202eca003020102020900b257df81a5c93eb0300d06092a864886f70d0101050500308182310b3009060355040613025553311330110603550408130a57617368696e67746f6e311c301a060355040a131356616c6c656e7420436f72706f726174696f6e3121301f06035504031318636572742e62762e616d65722e76616c6c656e742e636f6d311d301b06092a864886f70d010901160e69744076616c6c656e742e636f6d301e170d3036303132363139333733365a170d3039303132353139333733365a308182310b30090603550406 EAP-Message = 0x13025553311330110603550408130a57617368696e67746f6e311c301a060355040a131356616c6c656e7420436f72706f726174696f6e3121301f06035504031318636572742e62762e616d65722e76616c6c656e742e636f6d311d301b06092a864886f70d010901160e69744076616c6c656e742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100e11a94e572aaf07801e8ed2702e2f5cf02a30420b854889d760ba754643aee948ed331fbe5a2a24af3a28bba69c8b6d85761972db0be17dff91e4228d19446e932837768eea8bdb65cc712932ff5b5eecc13f763db7d984b925eb47b7c0094db3ac765 EAP-Message = 0x8e38c4bd7d729957fe0c42343aa678872e499c04db70cbdc528f48f0ca93921e434ea7ac11a9a4fd857ba8507589063cc311370fcd6477e3bd4fadb89e842a64d10bf2d1f9deadbf8b8d79a05821712ba49b0478c4c96d55a43031f9951a1def7e12541f1352d36654c06864a540ebafaf21a7744e53f02f78a6c82ff2d7676afea5c576b231829851f10dd1c477677cdaebc7d7f0bb4e170f16d9d7130203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e041604149070be5fdb372c09f54ecbabfecc4cdc979783 EAP-Message = 0x6d301f0603551d230418301680149070be5fdb372c09f54ecbabfecc4cdc9797836d300d06092a864886f70d010105050003820101000e3e63fd403f29af1912cf95540307a47087bba7cdee6a0657ba7a1f28fd148d93d081abda825b858d9d1351e33dca9b4d8d8f1941995e20173fe22def775aceabd13101ffb42eca6a6497c41e6985d78740173fe1ba1f76db32677053ffa87891213b7df0c2a9d339d61e2595d7658d1e1c3f8a0438a2f91f2cd9060a4b027da0cc75443be746fca0605a37155c84b9e1bff1f84b2f41328aba6b03e55d922a49f70df090d240b1a398fc8dd74aa2450661fbf3cb0d1986863cf41cd0f84366e52251a55a9f70 EAP-Message = 0x0d6b2a92d2b3579d7dfa7601e92a703d17d20f6b0bdf Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf82a664f4f7328b73ffccc1f1773d09c Finished request 14 Going to the next request E

4 3

Auth-Type attribute and authorize section
by Nicolas Castel 30 May '06

30 May '06

Hi all, I'm developping some FreeRADIUS modules. In the authorize section, my module set the "Auth-Type" to a specific value to pick my own module in the authorize section. The last one in this section is the FreeRADIUS files module. I use it to perform some tasks if the request is not processed by other modules. Even the Auth-Type has already been set by a precedent module, the request goes through the files modules and match the DEFAULT entry. Is there any possibility not to go through following modules in the authorize section if the Auth-Type has already been set. I mean go directly to the authentication section once the configuration attribute Auth-Type has been set (I would like not to modify the files module code). Thanks in advance

2 2