- Freeradius-Users - lists.freeradius.org

no sql log for proxied Accounting
by Ryan Melendez 31 Mar '06

31 Mar '06

Hello, I'm trying to configure freeradius to only sql log Accounting packets that are not proxied. I see the note in the config file that reads "accounting requests which are proxied are also logged in the detail file". That is fine, but I can't have it log to sql. In general I would only like to sql log Accounting records associated with realms configured for accthost = LOCAL. Has anyone else had success with this? radiusd: FreeRADIUS Version 1.1.0, for host , built on Mar 6 2006 at 20:41:50 Copyright (C) 2000-2003 The FreeRADIUS server project. Thanks, Ryan

1 0

VSA and other attributes in Access-Accept
by Mohammed Petiwala 30 Mar '06

30 Mar '06

Hi: First thanks to the freeRADIUS team - this is one of the most flexibile and powerful AAA available... I've 2 questions: 1. I've set up my clients to authenticate using EAP-TTLS with MSCHAPv2 as the inner authentication protocol. This works fine with the wpa_suppicant with intel 2200b/g as well as the Cisco Aironet 350. I've created my own dictionary file with VSAs that are useful for my NAS once Access-Accept is returned. The 'users' file has the VSAs Attrib = Value listed after each user entry and I do see the attributes being returned correctly on Access-Accept. My question is (please correct me if I am wrong) - I see the VSAs being returned during the intermediate Access-Challenge messages too even before authentication is complete. Is this the normal behavior, is there a way to setup the freeRADIUS server so that the VSAs are only returned on Access-Accept and not during the Access-Challenge. The NAS does ignore the VSAs in any case during the challenge - but would be good if there was a way to limit the message size for the Access-Challenge messages (only if this is valid from RADIUS RFC perspective - if someone could clarify). 2. How can I set users in the 'users' file (an example would be very helpful if someone can send) so that some users are only allowed to authenticate using EAP-TTLS while others are only allowed to use PEAP. Once I create an entry into the users file (and both authentications are EAP types) - the user can authenticate using any eap type - I would like to limit this per user. Is it possible?? Thx. Regards, Mohammed. --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.

1 0

== error
by Cris Boisvert 30 Mar '06

30 Mar '06

Radius is up and running and authenticates fine.. But everytimes someone authenticates I get the "Error: Invalid operator for item Suffix: reverting to '=='" Message in the radius.log This is the error log below. Wed Mar 29 19:35:09 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Mar 29 19:35:09 2006 : Info: Ready to process requests. Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Auth: Login OK: [test(a)domain.com/test] (from client gw2.domain.com port 0) Thanx

4 6

Problem with ntlm winbind - No User-Password configured. Cannot create LM-Password
by Konne 30 Mar '06

30 Mar '06

hi my problem is following: ....... auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for lehrer with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 5b radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --domain=XXXXX --username=USER --challenge=921647d950709696 --nt-response=5882778194e622a6b9da392d2852d62ceb17144f53e7ced2' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=XXXXX --username=USER --challenge=921647d950709696 --nt-response=5882778194e622a6b9da392d2852d62ceb17144f53e7ced2 Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xa050d40 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 67 to 10.92.124.2:1645 EAP-Message = 0x010900261900170301001b0e5cfcbdba58b6fa4dff4d6d233650499c90b171a8c8a5ea5c7269 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd4008f5215934f6b818f5c3915e05b3 Finished request 6 Going to the next request Waking up in 5 seconds... i searched on the web but i found nothing. someone has an idea? thx

3 4

Telephony-Summit Announcment
by Peter Nixon 30 Mar '06

30 Mar '06

Hi Guys I will be giving the keynote speech on "AAA for fun and profit" at the Free Software/Open Source Telephony-Summit 2006. Hope to see some of you there. -Peter Free Software/Open Source Telephony-Summit 2006 Tuesday, May 2nd 2006 Wiesbaden, Germany For the third time the German Unix User Group (GUUG - www.guug.de) organises the Free Software/Open Source Telephony-Summit, an international workshop and technical conference for developers and users of Free Software/Open Source telephony applications and for those who want to know more about what the Free Software/Open Source world has to offer in the telephony and VoIP sector. For the first time the event will this year be held in association with LinuxTag (www.linuxtag.org) Europe's most important Open Source event. This way participants of the Telephony-Summit can profit from other LinuxTag events to deepen their knowledge. The all-day conference with two parallel tracks will take place in Wiesbaden, Germany. In the evening a social event is planned and included in the price of 360 EUR. (Students only pay 120 EUR.) Members of the German Unix User Group will get a 10% discount. If you register before April 13th 2006, you'll get an additional 10% early bird discount. Conference participants can visit the LinuxTag exhibition and talks on the next days, which take place nearby. You can also book additional tutorials. The conference program includes presentations from many Open Source projects like Asterisk, Ekiga, and OpenPBX. There are talks about SIP security, RADIUS and LDAP integration as well as reports about efforts to create carrier-class telephony switches. On the weekend before the conference a workshop will be held. This workshop is for invited Free Software/Open Source developers who can meet their peers and work together on new versions of their software, do interoperability tests and discuss their projects. Most developers will also be at the conference, so this is your chance to talk to the developers of your favourite projects. For more information and registration see the website at: http://www.linuxtag.org/2006/en/besucher/konferenzen/3rd-telephony-summit.h… -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

Mac address help
by Mordor Networks 30 Mar '06

30 Mar '06

Hello I have pppoe-server with freeradius and mysql backend working pretty good , thus i still want to know if it is possible to use mac adders with user name and password ? thanks in advanced

1 0

FC5
by Sam Sein Muan Tie 30 Mar '06

30 Mar '06

hi all Got a bug from freeradius of FC5, i ended up using FC4 and radiusd. dont have the server no more but here's some debug information for those who might be able to help out on Redhat Fedora Core 5 Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. bt rad_recv: Access-Request packet from host 130.95.80.25:1812, id=84, length=149 NAS-IP-Address = 130.95.80.25 NAS-Port = 50002 NAS-Port-Type = Ethernet User-Name = "host/CSSE clients" Called-Station-Id = "00-16-C7-12-AE-C2" Calling-Station-Id = "00-50-BA-7E-22-7C" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001601686f73742f4353534520636c69656e7473 Message-Authenticator = 0x29a5526ff95c708b434eb6beefe28ac5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1208936784 (LWP 3491)] 0x0019acbd in ?? () from /usr/lib/rlm_preprocess.so (gdb) bt #0 0x0019acbd in ?? () from /usr/lib/rlm_preprocess.so #1 0x0019b2b1 in ?? () from /usr/lib/rlm_preprocess.so #2 0x080544eb in modcall () #3 0x08054ab7 in modcall () #4 0x080546bc in modcall () #5 0x08052a4e in read_mainconfig () #6 0x0804ca4c in rad_authenticate () #7 0x08055a75 in rad_respond () #8 0x080570b7 in main () (gdb) bt #0 0x0019acbd in ?? () from /usr/lib/rlm_preprocess.so #1 0x0019b2b1 in ?? () from /usr/lib/rlm_preprocess.so #2 0x080544eb in modcall () #3 0x08054ab7 in modcall () #4 0x080546bc in modcall () #5 0x08052a4e in read_mainconfig () #6 0x0804ca4c in rad_authenticate () #7 0x08055a75 in rad_respond () #8 0x080570b7 in main () (gdb) bt Sam

1 0

need to free string returned by cf_section_value_find ?
by jasonatx0001 30 Mar '06

30 Mar '06

Is the caller responsible for freeing the memory pointed to by the return value from cf_section_value_find ? Or does this just point to the memory owned by the conf_section which free radius will free on its own ? -- View this message in context: http://www.nabble.com/need-to-free-string-returned-by-cf_section_value_find… Sent from the FreeRadius - User forum at Nabble.com.

2 1

Adding 2 or more Framed-Routes
by Brent 29 Mar '06

29 Mar '06

Anyone know the correct way to add more then 1 framed-route? Here is what is setup now and this works. af_user Service-Type = Framed-User, Simultaneous-Use=1 Framed-IP-Address = 206.40.yyy.yyy, Framed-Route = "206.40.xxx.xxx/29 206.40.yyy.yyy 1", Do I just need to add a second Frame-Route like this? af_user Service-Type = Framed-User, Simultaneous-Use=1 Framed-IP-Address = 206.40.yyy.yyy, Framed-Route = "206.40.xxx.xxx/29 206.40.yyy.yyy 1", Framed-Route = "206.40.zzz.zzz/29 206.40.yyy.yyy 1", Thanks, Brent -- Yeah, I've Got Gmail! Yeah!

2 1

Re: Expiration Date using Freeradius 1.1.1 and mysql
by Atkins, Dwane P 29 Mar '06

29 Mar '06

I appreciate the input, I am looking for the README that will tell me how to use the Expiration attribute in the Users file, but how does one correlate it to the mysql database? Is there field in the radius database tables? Can I do a bulk add with dates that will allow me to do this? Thanks Dwane Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

1 0