- Freeradius-Users - lists.freeradius.org

multiple attribute instaces and radius variables (xlat)
by Andriy Gapon 31 Mar '06

31 Mar '06

FreeRAIUS documentation in 1.1.1 mentions a possibility of referencing specific AVPs in case of multiple instances of an attribute (%{Attr-Name[N]}). This is quite useful (and a nice addition!), but it doesn't seem to cover some situations (especially related to logging/accounting) where number of attribute instances is not known in advance. Is it possible to add something like %{Attr-Name[*]} that would expand to all values of an attribute and something like %{Attr-Name[#]} that would expand to number of attribute instances ? The toughest part of the above suggestion is which delimiter to use in case of [*] and if it is possible to make that delimiter configurable. -- Andriy Gapon

2 2

frontend for freeradius???
by Olaf Schäfer 31 Mar '06

31 Mar '06

@Guy Fraser Hi, I read that you've been working 'on some PHP functions to manage FreeRadius'. I'm goning to do some efforts in the same direction: extending dialup admin with managing abilities for ip-pools, simultaneous-use, rlm_counter etc. Especially I'm interested in your functions to acquire information from configuration files. best regards, Olaf

1 0

RE: Different user attributes based onNAS-IP-Address?AlsoSuffixwildcards available?
by John Mylchreest 31 Mar '06

31 Mar '06

Using the standard schema, no it doesn't. However adding an nshortname field on *check/*reply allows us to define either a shortname from the nas table, or a null to achieve this. I was however hoping there was a nicer way. Regardless, I appreciate the time :) Cheers, John -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 31 March 2006 04:03 To: FreeRadius users mailing list Subject: Re: Different user attributes based onNAS-IP-Address?AlsoSuffixwildcards available? "John Mylchreest" <John.Mylchreest(a)ioko.com> wrote: > This is a single username, but the return being selective based on NAS. > > For example: > > Radreply will reply with an IP of 1.2.0.1 if NAS=1 else it will respond with IP of 1.1.0.1 if NAS=2, else it will respond with an IP of 1.3.0.1 I'm not sure that the SQL module supports this. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Re: PsionTeklogix 9150
by Magnus Willigens 31 Mar '06

31 Mar '06

tried to get it working with handhelds of seriestype 7035... they just do leap (cisco) but the first series of the basestations are build with orinocco cards. ==> so this does not work. with xp clients md5 worked fine. tried tls and peap: the authentification worked but it does not share ip (no static and no dhcp). i don't know what i did wrong. i read that the authentificator has to do a workaround for the transmitted eapol package because microsoft changes the first 2 bits of the haeder (????). with xsupplicant it worked quiet well, so there must be a option for the 9150... if you get it working i would be very pleased if you could inform me how to do it. the ap only provides tx changing for the 4 static wep-keys and changes it after a standard period of 60 sec i think. there is no dynamic rekeying possible. our ap was too old to get it working with radius. and because of the fact that this are ap's for industrial use it would be very expensive to buy about 15 new ones... :) > -----Ursprüngliche Nachricht----- > Von: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Gesendet: 30.03.06 00:32:37 > An: <freeradius-users(a)lists.freeradius.org> > Betreff: PsionTeklogix 9150 > Hello, > > i would like to use freeradius authentication for psionteklogix 9150, instead of local authentication. > > Has sombody an experience with such client? > > thks, daniel > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192

1 0

RE: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available?
by John Mylchreest 31 Mar '06

31 Mar '06

I think you missed the question then. This is a single username, but the return being selective based on NAS. For example: Radreply will reply with an IP of 1.2.0.1 if NAS=1 else it will respond with IP of 1.1.0.1 if NAS=2, else it will respond with an IP of 1.3.0.1 The radcheck would be at the wrong phase to do this. -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 29 March 2006 18:56 To: FreeRadius users mailing list Subject: Re: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available? "John Mylchreest" <John.Mylchreest(a)ioko.com> wrote: > Can you give me an example in SQL please of how I might implement it using this fashion? You put the attribute name, operator, and value into SQL. > Is it not just a case of if it passes radcheck, then it will respond with radreply? Yes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

2 1

Freeradius Expiration Date
by Atkins, Dwane P 31 Mar '06

31 Mar '06

I have looked into the db_mysql.sql and found that their was start and stop dates in the radacct. If I can get freeradius to use the radcheck table, does this mean it will automatically see the radacct table and use input from this table as well? Thanks Dwane Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

4 3

no sql log for proxied Accounting
by Ryan Melendez 31 Mar '06

31 Mar '06

Hello, I'm trying to configure freeradius to only sql log Accounting packets that are not proxied. I see the note in the config file that reads "accounting requests which are proxied are also logged in the detail file". That is fine, but I can't have it log to sql. In general I would only like to sql log Accounting records associated with realms configured for accthost = LOCAL. Has anyone else had success with this? radiusd: FreeRADIUS Version 1.1.0, for host , built on Mar 6 2006 at 20:41:50 Copyright (C) 2000-2003 The FreeRADIUS server project. Thanks, Ryan

1 0

VSA and other attributes in Access-Accept
by Mohammed Petiwala 30 Mar '06

30 Mar '06

Hi: First thanks to the freeRADIUS team - this is one of the most flexibile and powerful AAA available... I've 2 questions: 1. I've set up my clients to authenticate using EAP-TTLS with MSCHAPv2 as the inner authentication protocol. This works fine with the wpa_suppicant with intel 2200b/g as well as the Cisco Aironet 350. I've created my own dictionary file with VSAs that are useful for my NAS once Access-Accept is returned. The 'users' file has the VSAs Attrib = Value listed after each user entry and I do see the attributes being returned correctly on Access-Accept. My question is (please correct me if I am wrong) - I see the VSAs being returned during the intermediate Access-Challenge messages too even before authentication is complete. Is this the normal behavior, is there a way to setup the freeRADIUS server so that the VSAs are only returned on Access-Accept and not during the Access-Challenge. The NAS does ignore the VSAs in any case during the challenge - but would be good if there was a way to limit the message size for the Access-Challenge messages (only if this is valid from RADIUS RFC perspective - if someone could clarify). 2. How can I set users in the 'users' file (an example would be very helpful if someone can send) so that some users are only allowed to authenticate using EAP-TTLS while others are only allowed to use PEAP. Once I create an entry into the users file (and both authentications are EAP types) - the user can authenticate using any eap type - I would like to limit this per user. Is it possible?? Thx. Regards, Mohammed. --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.

1 0

== error
by Cris Boisvert 30 Mar '06

30 Mar '06

Radius is up and running and authenticates fine.. But everytimes someone authenticates I get the "Error: Invalid operator for item Suffix: reverting to '=='" Message in the radius.log This is the error log below. Wed Mar 29 19:35:09 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Mar 29 19:35:09 2006 : Info: Ready to process requests. Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Error: Invalid operator for item Suffix: reverting to '==' Wed Mar 29 19:35:12 2006 : Auth: Login OK: [test(a)domain.com/test] (from client gw2.domain.com port 0) Thanx

4 6

Problem with ntlm winbind - No User-Password configured. Cannot create LM-Password
by Konne 30 Mar '06

30 Mar '06

hi my problem is following: ....... auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for lehrer with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 5b radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --domain=XXXXX --username=USER --challenge=921647d950709696 --nt-response=5882778194e622a6b9da392d2852d62ceb17144f53e7ced2' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=XXXXX --username=USER --challenge=921647d950709696 --nt-response=5882778194e622a6b9da392d2852d62ceb17144f53e7ced2 Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xa050d40 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 67 to 10.92.124.2:1645 EAP-Message = 0x010900261900170301001b0e5cfcbdba58b6fa4dff4d6d233650499c90b171a8c8a5ea5c7269 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd4008f5215934f6b818f5c3915e05b3 Finished request 6 Going to the next request Waking up in 5 seconds... i searched on the web but i found nothing. someone has an idea? thx

3 4