- Freeradius-Users - lists.freeradius.org

Windows 2000 Server using FreeRadius
by Rick Robinson 18 Apr '06

18 Apr '06

I am trying to get a Windows 2000 server (stand alone NOT running AD) to use FreeRadius instead of IAS. I have set the FreeRadius server in Windows Routing and Remote Access as the authentication provider, and set the secret password the same on both servers. When trying to authenticate via VPN, the W2K server passes it to the FreeRadius server, but it ends up no authenticating. I checked the radius.log file, and it indicates the secret is not correct even though they are set the same. If I change W2K to use IAS it works, and if I use a Cisco router instead of W2K with FreeRadius it works!

2 1

php manager for freeradius
by teoh 18 Apr '06

18 Apr '06

i only use local file "USERS" to store my dial up users. I"m not using any database system for freeradius. Is there any lite php manager for freeradius? which one do u re command beside dialupadmin? the reason i'm not using dialupadmin is because my linux distro freeradius package doesn't come with it. any recommendation for any cool php manager? --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.

2 1

Problem with Accounting.
by Alejandro Sanchez 18 Apr '06

18 Apr '06

Hi. evrybody. I am using freeradius with Sip Express Router (SER) and i am enable accounting on freeradius 1.1.1 but in the log files and the tables of freeradius only save the start request, in other words when i finish a call the method BYE of SIP dosen't trigger the stop of the accounting or the update of it. Anybody knows why? Thank's Alex. ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

2 2

Cisco-AVPair Route Map
by Alan Lumb 18 Apr '06

18 Apr '06

Hi Everyone. I'm struggling to find concise documentation on Cisco-AVPairs (and what pairs cisco support) - can anyone help me with this? Mainly I am trying to setup a walled garden system based on radius reply, using a route map with set next hop e.g. route-map walled-garden permit 10 set ip next-hop 1.1.1.1 My problem is how to apply this to a specific connection, do I just use "lcp:interface-config=ip policy route-map walled-garden" or are there better ways of doing this?

2 1

Freeradius performance x336
by JF Suret 18 Apr '06

18 Apr '06

Hello, I would like to know if someone has done performence test using server (in my case it will be a x336)? If someone has done this type of test could he provide results he has obtained ? ;-) It's just to have an idea of how many request an server can handle, I'll need a few request/seconds and I think that a x336 will be far far faster than required but it's just to confirm it ... Thanks JF

2 1

how to add attributes
by DilipSimha.N.M 18 Apr '06

18 Apr '06

hello, what's the way to add user-defined attribute into reply-items?(name,value) i tried by adding 2 attributes in the dictionary file in raddb, with the index of 998 and 999. *file:* /usr/local/etc/raddb/dictionary ATTRIBUTE aa 998 string ATTRIBUTE bb 999 string But it didn't work. (i tried it by making my own dictionary file and included it in standard dictionary file) *file:* /usr/local/share/freeradius/dictionary.netd VENDOR netd 1459 # # These attributes contain the access-level value. # ATTRIBUTE netd-temp-str 1 string netd ATTRIBUTE netd-temp-int 1 integer netd # Read-only access to manageable (not security) parameters VALUE netd-temp-int 4 3 *file:* /usr/local/share/freeradius/dictionary added this at the last. $INCLUDE dictionary.netd But it didn't work. I don't want to use vendor-specific attribute, because i have more than 2 attributes to be sent to the radius client. somebody plz explain the correct process of doing this. --DilipSimha

3 4

Fecora Core 5 & FR 1.1.1 & MySQL 5 -> segmention fault
by Olaf Schaefer 18 Apr '06

18 Apr '06

Hallo, First, I hope you all had Hapy Easter. :) Today I tried to setup the first of my 2 production radius servers. On my testing machines Fedora Core 4 was running (MySQL 4.1.16-log,FR 1.1.1, 2.6.11-1.1369_FC4). Now I've got FC5 with MySQL 5.0.18, FR 1.1.1, and 2.6.16-1.2080_FC5) I did the same I did with the testing machines before, installing Fedora, setting up MySQL-DB , building FR1.1.1. Then I copied my configuration files, did the necessary changes in the configuration files and finally tried to start radiusd. All I got was "Speicherzugriffsfehler" (segmentation fault) :( sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01 23456789.-_: /" Speicherzugriffsfehler ^ This are the last lines if I try to start radiusd (radiusd -X). I've never seen this before. I doesn't matter if I use my or the original (after build) configuration. As soon as I want to use SQL it crashes. Thus I figured out that it must be something concerning MySQL because it's besides the kernel the biggest change compared to my testing machines. If I switch off all sql modules I can start radiusd without any problems. The strange thing is that I haven't any problems accessing my mysql-database with Dialup Admin. Before I (have to) fall back to MySQL 4.1 or even FC4... Any ideas? Thanks in advance! Olaf -- Olaf Schaefer <olaf_freeradius(a)ojsch.de>

1 1

Advice on using FreeRadius client
by Chandra mohan 18 Apr '06

18 Apr '06

Hi, I am planning to use FreeRadius client in our commercial embedded product. The server can be from any vendor. It will be helpful, if any one can provide the statistics on stability, leak issues etc. Please advise me whether it is a wise decision to use FreeRadius client for this purpose. Thanks Chandra __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Problem with Cisco-AVPair
by Antonio Matera 18 Apr '06

18 Apr '06

Hi all, I have a problem with the user authentication with EAP TLS or PEAP on different SSID and VLAN. My objective is to authenticate one user only on a select SSID. At the moment I have this user with EAP-TLS, but if I use PEAP and I insert a user password, the problem is the same: TEST4 Auth-Type := EAP, Cisco-AVPair := "ssid=SSID1" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN user2 Auth-Type := EAP, Cisco-AVPair := "ssid=VLAN3" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN and the log is the following: rad_recv: Access-Request packet from host 192.168.9.104:1645, id=19, length=166 User-Name = "TEST4" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=VLAN3" Service-Type = Login-User Message-Authenticator = 0xb2a3f1fd52d9d6ff9702cc8f1f480f46 EAP-Message = 0x020600060d00 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "260" NAS-Port = 260 State = 0x0491685cf8ece3184d685dedfedbb3d4 NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: No '@' in User-Name = "TEST4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 18 users: Matched entry TEST4 at line 11 modcall[authorize]: module "files" returns ok for request 18 modcall: leaving group authorize (returns updated) for request 18 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 18 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 18 modcall: leaving group authenticate (returns ok) for request 18 Login OK: [TEST4/<no User-Password attribute>] (from client ap-test port 260 cli 000c.f135.f1ba) Sending Access-Accept of id 19 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN MS-MPPE-Recv-Key = 0x9cb007ac1a5c0cc6da1deaf25177ef52e7f8c195d876f95b2d18ac6106b497da MS-MPPE-Send-Key = 0x5cbd4de84c364538ec07001adad683cbbf80a349d0299d4790f4f16389aff161 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "TEST4" Finished request 18 The user TEST4 is authenticated with the bad SSID. the check Cisco-AVPair := "ssid=SSID1" does't work. What is wrong? I read a lot of mail on this mailing list, I tried the option with_cisco_hack = yes in the radiusd.conf file but but the problem is always the same. I don't understand what is the problem... Can someone help me? Thanks a lot to all Bye Antonio

7 14

ippool seems to be consistent about the IP addresses that it's giving out
by Nikos Vassiliadis 18 Apr '06

18 Apr '06

Hi all, I am using ippool and it seems that it is using the same IP addresses all the time(given that they are available). So when I am testing with just one client, I get two alternating addresses. Am I missing something or this is the wanted behaviour? ippool related information: Module: Loaded IPPOOL ippool: session-db = "/usr/local/etc/raddb/db.ippool" ippool: ip-index = "/usr/local/etc/raddb/db.ipindex" ippool: range-start = 213.142.157.1 IP address [213.142.157.1] ippool: range-stop = 213.142.157.254 IP address [213.142.157.254] ippool: netmask = 255.255.255.255 IP address [255.255.255.255] ippool: cache-size = 254 ippool: override = no ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) radlast: nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:39 still logged in nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:38 - 16:38 (00:00) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:37 - 16:38 (00:00) nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:37 - 16:37 (00:00) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:37 - 16:37 (00:00) nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:37 - 16:37 (00:00) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:36 - 16:36 (00:00) nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:10 - 16:35 (00:25) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:09 - 16:10 (00:00) nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:03 - 16:09 (00:05) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 15:54 - 16:00 (00:06) nikos.2048 000:mpd 213.142.157.160 Mon Apr 17 15:53 - 15:54 (00:01) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 15:52 - 15:53 (00:00) nikos.2048 000:mpd 213.142.157.160 Mon Apr 17 15:41 - 15:52 (00:11) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 14:50 - 15:40 (00:50) nikos.2048 000:mpd 213.142.157.160 Mon Apr 17 14:50 - 14:50 (00:00) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 14:47 - 14:50 (00:02) nikos.2048 000:mpd 213.142.157.160 Mon Apr 17 14:41 - 14:47 (00:06) BTW I am using FreeRADIUS 1.1.0 Thanks in advance, Nikos

2 2