- Freeradius-Users - lists.freeradius.org

Help!
by Mordor Networks 27 May '06

27 May '06

Hello please can some one tell me how to disconnect a user when reach the bandwidth qouta? ex: if user joe reachs 100MB daily i want to lock his account and disconnect him anyhelp?

2 2

rlm_sql_getvpdata: database query error
by Giuseppe Parlato 27 May '06

27 May '06

I upgraded freeradius from 1.0.1 to 1.1.1 and I get the following error: rlm_sql_getvpdata: database query error can anyone help me please? Giuseppe

3 13

Freeradius with TTLS-MSCHAPV2 authentication
by sumi thra 27 May '06

27 May '06

Hey All, I have a question. Plz reply me if you have any idea. Does freeradius-1.1.1 version with TTLS-MSCHAPV2 & odyssey client - 3.00.0.976 configured to use the same authentication works ? Freeradius works fine with other clients like cisco ACS & others. Have any idea ? Where can i find the solution ? Thanks in advance. -- Sumi

2 2

RAdius with peap/ms-chapv2
by Jordi Soriano Terol 27 May '06

27 May '06

Hi! I'm configuring freeradius to work with a wireless network with peap/ms-chapv2. Attached you can see the configuration files i changed. I changed the listen ports with the correct ones to listen correctly the cisco access point. My problem is that when the server is running, it seems that receives nothing from the access point, and server produces no output. I dunno if it's radius misconfiguration, or some problem in the switch that connects ap with radius server. I've analyzed the traffic in the server with ethereal and the only interesting traffic is several DHCP discover entries. Can somebody help me? Thanks a lot

2 1

authing clients - Debug Mode !!!!
by emerson 26 May '06

26 May '06

Pessoal, i have a server linux running slackware 10.1, with freeradius 1.1.1 with auth eap/tls/ttls + openssl-0.97d + mysql. My freeradius client is a ap wl-5460AP. When i try to authenticate any user on my freeradius, in debug MODE appear this messages: I'm can not to stabilished connections..... Message-Authenticator = 0x59373d130f801019b116e042690ff3e1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_eap: EAP packet type response id 2 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 radius_xlat: 'mobile' rlm_sql (sql): sql_set_user escaped user --> 'mobile' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'mobile' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mobile' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'mobile' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'mobile' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005b], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00b1], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 112 to 10.254.0.2 port 2048 Password == "teste" Framed-Protocol := PPP EAP-Message = 0x0103040a0dc00000079e160301004a020000460301447767ef3e6132404c0c6c02a315774554397970ac027074a9f45e5248c032e820822e232b79be2b75ef379cf751e7d12d6b25d4b841b1c2655efa85382cc1e66000350016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcbde73c73ebd72307d8bcd5336508bf1 Finished request 2 Going to the next request Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 10.254.0.2:2048, id=113, length=176 Waking up in 31 seconds... Thread 4 got semaphore Thread 4 handling request 3, (1 handled so far) User-Name = "mobile" NAS-IP-Address = 10.254.0.2 NAS-Port = 0 Called-Station-Id = "004f6207b40c" Calling-Station-Id = "0014a53c478d" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0xcbde73c73ebd72307d8bcd5336508bf1 Message-Authenticator = 0xf8b549edcba04ccf14c3a35cd5e00886 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 radius_xlat: 'mobile' rlm_sql (sql): sql_set_user escaped user --> 'mobile' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'mobile' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mobile' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'mobile' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'mobile' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 113 to 10.254.0.2 port 2048 Password == "teste" Framed-Protocol := PPP EAP-Message = 0x010403a80d800000079e170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52cc EAP-Message = 0xb99b41e80ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e EAP-Message = 0x31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100b1 EAP-Message = 0x0d0000a902010200a400a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x125b8a5ad0f76e326bbc4e2087260bbe Finished request 3 Going to the next request Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 10.254.0.2:2048, id=114, length=187 Waking up in 31 seconds... Thread 5 got semaphore Thread 5 handling request 4, (1 handled so far) User-Name = "mobile" NAS-IP-Address = 10.254.0.2 NAS-Port = 0 Called-Station-Id = "004f6207b40c" Calling-Station-Id = "0014a53c478d" NAS-Identifier = "Realtek Access Point. 8181" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400110d800000000715030100020230 State = 0x125b8a5ad0f76e326bbc4e2087260bbe Message-Authenticator = 0x1c5b117a3ea7e7026abb5ec89890adc2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 rlm_eap: EAP packet type response id 4 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 radius_xlat: 'mobile' rlm_sql (sql): sql_set_user escaped user --> 'mobile' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'mobile' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mobile' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'mobile' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'mobile' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 22289:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 22289:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 4 modcall: leaving group authenticate (returns reject) for request 4 auth: Failed to validate the user. Login incorrect: [mobile/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) Delaying request 4 for 1 seconds Finished request 4 Going to the next request Thread 5 waiting to be assigned a request --- Walking the entire request list --- Cleaning up request 0 ID 110 with timestamp 447767ef Cleaning up request 1 ID 111 with timestamp 447767ef Cleaning up request 2 ID 112 with timestamp 447767ef Cleaning up request 3 ID 113 with timestamp 447767ef Sending Access-Reject of id 114 to 10.254.0.2 port 2048 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 4 ID 114 with timestamp 447767ef Nothing to do. Sleeping until we see a request.

2 1

authing clients - Debug Mode - More Output!!!!
by emerson 26 May '06

26 May '06

Ready to process requests. rad_recv: Access-Request packet from host 10.254.0.2:2048, id=115, length=165 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) User-Name = "joao" NAS-IP-Address = 10.254.0.2 NAS-Port = 0 Called-Station-Id = "004f6207b40c" Calling-Station-Id = "0014a53c478d" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000009016a6f616f Message-Authenticator = 0xdcc560812d6c0bad0bc665744157e53a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: EAP packet type response id 0 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 radius_xlat: 'joao' rlm_sql (sql): sql_set_user escaped user --> 'joao' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'joao' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'joao' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'joao' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'joao' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [joao/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) Delaying request 0 for 1 seconds Finished request 0

1 0

May be of interest to some (or many)?
by Laker Netman 26 May '06

26 May '06

I found these two links while digging for something else. They are both pertinent to [free]RADIUS and someone may find them useful for their environment: http://www.pgina.org/ https://wpsynch.dev.java.net/ Cheers, Laker __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

802.11 AP Access-Accept problem
by Drew Linsalata 26 May '06

26 May '06

We have a working freeradius install authenticating clients via a Proxim/Orinoco AP-700 access point. The AP is configured to do EAP authentication via the radius server. No problem with that. Freeradius is authenticating users as per our requirements, and is and sending Access-Accept to the AP. rad_recv: Access-Request packet from host W.X.Y.Z:6001, id=3, length=154 User-Name = "testuser" NAS-IP-Address = W.X.Y.Z Called-Station-Id = "00-20-a6-5d-9c-d1:ourSSID" Calling-Station-Id = "00-06-25-2f-8c-4e" NAS-Identifier = "ORiNOCO-AP-700-5d-9c-d1" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204000c01746573746f6e65 Message-Authenticator = 0x75e8339aab77b394dab2beef5e9228dd Sending Access-Accept of id 3 to W.X.Y.Z port 6001 Problem is, the AP isn't getting the accepts. The EAP request counter increments on the AP when we attempt a connection. The EAP reject counter increments on the AP when we connect with bad credentials. The EAP accept counter never increments even with successful authentication. The Windows client is left in "Validating Identity" state. -- Drew Linsalata The Gotham Bus Company, Inc. Dedicated Servers and Colocation Solutions Long Island, New York http://www.gothambus.com

2 2

dict_addvalue: Duplicate value name
by Alan 26 May '06

26 May '06

I am trying to compile Freeradius Version 1.1.0 on a Sunfire 20z running RH3 enterprise 3 (AMD x86_64 Architecture). I am stumped in result of many errors I cannot find a fix for. Are there any special environment configurations or compile options to use before compiling FreeRadius on a 64 bit machine? Please advise. ~Alan dict_addvalue: Duplicate value name Route-IPX-No for attribute X-Ascend Route-IPX dict_addvalue: Duplicate value name Local for attribute Post-Auth-Type dict_addvalue: Duplicate value name PAP for attribute Auth-Type dict_addvalue: Duplicate value name LAC-Only for attribute Tunnel-Function dict_addvalue: Duplicate value name unix for attribute Auth-Type dict_addvalue: Duplicate value name MS-CHAP for attribute Auth-Type

2 3

authing clients !!!
by emerson 26 May '06

26 May '06

Pessoal, i have a server linux running slackware 10.1, with freeradius 1.1.1 with auth eap/tls/ttls + openssl-0.97d + mysql. My freeradius client is a ap wl-5460AP. When i try to authenticate any user on my freeradius, in logs appear this messages: Fri May 26 09:06:07 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri May 26 09:06:07 2006 : Info: Ready to process requests. Fri May 26 09:10:56 2006 : Info: rlm_eap_md5: Issuing Challenge Fri May 26 09:10:56 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Fri May 26 09:10:56 2006 : Error: TLS Alert read:fatal:unknown CA Fri May 26 09:10:56 2006 : Error: TLS_accept:failed in SSLv3 read client certificate A Fri May 26 09:10:56 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Fri May 26 09:10:56 2006 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. Fri May 26 09:10:56 2006 : Auth: Login incorrect: [mobile/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) Fri May 26 09:35:44 2006 : Auth: Login incorrect: [joao/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) what it can be ? thanks... Emerson

2 1