- Freeradius-Users - lists.freeradius.org

RedHat Security updates for FR
by Dennis Skinner 04 Apr '06

04 Apr '06

RedHat Enterprise (and CentOS) has finally released security updates for their FreeRADIUS rpms: https://rhn.redhat.com/errata/RHSA-2006-0271.html Incase anyone is interested.... -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

3 3

L2tp and fixed Framed IP Address for ADSL customers
by Adil Bikarbass 04 Apr '06

04 Apr '06

Hello All Just to let you know that i finally find the solution to setup a fixed IP into an l2tp tunnel for my DSL subscribers I needed to tell Radius to send the fixed Framed IP address in the access-req packet by adding the following to my cisco config: radius-server attribute 8 include-in-access-req Hope this will help someone who will face the same problem -- |-Adil Bikarbass |-IT Manager, MTDS |-tel +212.3.767.4861 |-fax +212.3.767.4863 |-gsm +212.6.139. 4541 |-14, rue 16 novembre |-Rabat, Kingdom of Morocco -----Original Message----- From: freeradius-users-bounces+adil=mtds.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+adil=mtds.com@lists.freeradius.org] On Behalf Of Guy Fraser Sent: mardi 28 mars 2006 20:10 To: freeradius-users(a)lists.freeradius.org Subject: Re: L2tp and fixed Framed IP Address for ADSL customers On Tue, 2006-28-03 at 12:05 -0500, Alan DeKok wrote: > "Adil Bikarbass" <adil(a)mtds.com> wrote: > > My radius is listening on 1645 for auth and 1646 for acct, I can see the > > auth request coming into my radius box but the IP address is never got from > > the Framed-IP reply item but assigned from the Cisco pool > > > > Any clue about what could be the problem? > > The NAS. Fight with it some more. I don't think there's anything > you can do to FreeRADIUS to fix it. > Is the IP address in a valid range configured on the NAS? A Cisco will not assign an IP address that it is not configured to handle. It seems to me we used eigrp to handle the "static" ip address networks for our NAS servers. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

module programming
by Mingyur Koblensky 04 Apr '06

04 Apr '06

Hi, i would like to develop an authentication method based on EAP... I've look around a bit but didn't find much documentation, is there something I'm missing ? I've also looked in the /doc directory ( coding-methods.txt, module_interface ... ) thank you, kky

1 0

Error on compile with eap_peap_tls
by Franck 04 Apr '06

04 Apr '06

I have the error with the version 1.1.1, and the snapshot-20060604. I have the log available for people who want to have a look. best regards

2 3

L2tp and fixed Framed IP Address for ADSL customers
by Adil Bikarbass 04 Apr '06

04 Apr '06

Hello All, I've just setup an L2tp tunnel with my ADSL service provider and would like to have some of my ADSL subscribers get a fixed IP address instead of the dynamically assigned IP Pool I'm using a Cisco 3845. The ADSL users are connecting just fine over the L2tp tunnel the issue is that they're getting dynamically assigned address from the Cisco IP pool even if a fixed IP is set on FreeRadius attributes Do you have any idea on how make this subscribers get the Radius Fixed IP instead of the dynamic one? Thanks In Advance -- |-Adil Bikarbass |-IT Manager, MTDS |-tel +212.3.767.4861 |-fax +212.3.767.4863 |-gsm +212.6.139. 4541 |-14, rue 16 novembre |-Rabat, Kingdom of Morocco

4 8

change NAS-IP-Address before relaying
by Oliver.Stutzke＠atosorigin.com 04 Apr '06

04 Apr '06

sorry all, the first mail had no subject -------------------------------------------------------------------- > Hi all, > > i want to use FreeRADIUS (1.0.5) as an RADIUS Proxy, and must > change the NAS-IP-Address and the User-Realm before sending it to an > other Rasius Server. > I tried it within the preproxy_users file with > > DEFAULT > User-Name := > `%{Stripped-User-Name:-%{User-Name}}@mycompany.com`, > NAS-IP-Address := x.x.x.x > > The change of the User-Realm works, but not the NAS-IP-Address. The > server > sends the authentication requests with its hostname (in detail with > the aoutput of the /etc/hostname command). > > Any ideas of helpfull information are welcome. > Regards > Oliver Stutzke

2 2

Implimenting Capping with FreeRadius
by Shawn Hamman 04 Apr '06

04 Apr '06

Hi, OS: Fedora C4 FR: 1.0.2-2 DB: MySQL 4.1.11-2 I was wondering if anybody has a more elegant solution to implementing capping with FreeRadius than writing a script that totals the bytes in/out in the radacct table every couple of minutes and updates the radcheck table to deny further logins? Shawn

4 3

(no subject)
by Bugneac Constantin 04 Apr '06

04 Apr '06

Hi! I have Freeradius ver. 1.1.1 running with MySQL and configured for EAP-PEAP to work with Cisco AP1231AG Wi-Fi Access Point. It is used for user authentication and accounting. I configured AP for accounting updates every 1 minute. I observed a strange behavior. This I get when user is logged in: rad_recv: Accounting-Request packet from host 193.100.101.230:1646, id=11, length=298 Acct-Session-Id = "00000002" Called-Station-Id = "0012.7fce.63d0" Calling-Station-Id = "0004.238b.f5e5" Cisco-AVPair = "ssid=Registru_Networks" Cisco-AVPair = "vlan-id=0" Cisco-AVPair = "nas-location=Sala_de_Sedinte_et2" WISPr-Location-Name = "Sala_de_Sedinte_et2" User-Name = "cisco" Cisco-AVPair = "connect-progress=Call Up" Acct-Session-Time = 566 Acct-Input-Octets = 1853338 Acct-Output-Octets = 1811068 Acct-Input-Packets = 3317 Acct-Output-Packets = 2230 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "257" NAS-Port = 257 Service-Type = Framed-User NAS-IP-Address = 193.100.101.230 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 20 modcall[preacct]: module "preprocess" returns noop for request 20 rlm_acct_unique: Hashing 'NAS-Port = 257,Client-IP-Address = 193.100.101.230,NAS-IP-Address = 193.100.101.230,Acct-Session-Id = "00000002",User-Name = "cisco"' rlm_acct_unique: Acct-Unique-Session-ID = "08f82868ccd223c7". modcall[preacct]: module "acct_unique" returns ok for request 20 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 20 modcall: leaving group preacct (returns ok) for request 20 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 20 radius_xlat: 'cisco' rlm_sql (sql): sql_set_user escaped user --> 'cisco' radius_xlat: 'UPDATE radacct SET FramedIPAddress = if(''='VoIP','',''), AcctInputOctets = '1853338', AcctOutputOctets = '1811068' WHERE AcctSessionId = '00000002' AND UserName = 'cisco' AND NASIPAddress= '193.100.101.230' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 After 10 minutes of working AP sends Access-Request to Radius with Service-Type = Authenticate-Only: rad_recv: Access-Request packet from host 193.100.101.230:1645, id=11, length=119 User-Name = "cisco" Framed-MTU = 1400 Called-Station-Id = "0012.7fce.63d0" Calling-Station-Id = "0004.238b.f5e5" Service-Type = Authenticate-Only Message-Authenticator = 0x022a4d954819b3fd4dc515c7041f6335 EAP-Message = 0x0201000a01636973636f NAS-Port-Type = Wireless-802.11 NAS-Port = 257 NAS-IP-Address = 193.100.101.230 and after authenticating I get: Processing the preacct section of radiusd.conf modcall: entering group preacct for request 28 modcall[preacct]: module "preprocess" returns noop for request 28 rlm_acct_unique: Hashing 'NAS-Port = 257,Client-IP-Address = 127.0.0.1,NAS-IP-Address = 193.100.101.230,Acct-Session-Id = "00000002",User-Name = "cisco"' rlm_acct_unique: Acct-Unique-Session-ID = "006880115bf32fe3". modcall[preacct]: module "acct_unique" returns ok for request 28 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 28 modcall: leaving group preacct (returns ok) for request 28 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 28 radius_xlat: 'cisco' rlm_sql (sql): sql_set_user escaped user --> 'cisco' radius_xlat: 'UPDATE radacct SET RX='', TX='', AcctStopTime = '2006-04-04 11:45:21', AcctSessionTime = '0', AcctInputOctets = '0', AcctOutputOctets = '0', AcctTerminateCause = if(''='VoIP','',''), AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '00000002' AND UserName = 'cisco' AND NASIPAddress = '193.100.101.230' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 This clears the accounting with zero and I loose statistics. Why I get Client-IP-Address = 127.0.0.1 in second accounting hash calculation? In first accounting request Client-IP-Address is 193.100.101.230. I think this causes hases not to be the same (006880115bf32fe3 visa 08f82868ccd223c7) and the result is interim accounting clearing. Is this a BUG? Where I am wrong? Please help me to find the problem. Constantin.

1 0

Install freeradius 1.1.1 get error
by 杨呈飞 04 Apr '06

04 Apr '06

After ./configure �Cprefix=/usr/local/freeradius make make install I get: /home/test/freeradius-1.1.1/install-sh -c -c .libs/libradius-1.1.1.so /usr/local/freeradius/libradius-1.1.1.so (cd /usr/local/freeradius && rm -f libradius.so && ln -s libradius-1.1.1.so libradius.so) /home/test/freeradius-1.1.1/install-sh -c -c .libs/libradius.lai /usr/local/freeradius/libradius.la /home/test/freeradius-1.1.1/install-sh -c -c .libs/libradius.a /usr/local/freeradius/libradius.a ranlib /usr/local/freeradius/libradius.a chmod 644 /usr/local/freeradius/libradius.a libtool: install: warning: remember to run `libtool --finish /usr/local/freeradius/lib' rm -f /usr/local/freeradius/lib/libradius-1.1.1.la; ln -s libradius.la /usr/local/freeradius/lib/libradius-1.1.1.la ln: creating symbolic link `/usr/local/freeradius/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/home/test/freeradius-1.1.1/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/test/freeradius-1.1.1/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/home/test/freeradius-1.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/test/freeradius-1.1.1' make: *** [install] Error 2 how can I fix that?

3 2

Why must clients exist when radius starts?
by Douglas Phillipson 03 Apr '06

03 Apr '06

Is there a configuration option that will allow me to put a client IP in the clients file without the client actually existing yet? It seems when radius starts, if a client doesn't exist the daemon dies. I looked in the archives but I don't quite know what to query for. Also is it the case that when the log is rolled, the daemon re-reads the config files and would die if it can't contact a client at this time? Regards Doug P

3 2