- Freeradius-Users - lists.freeradius.org

Accounting-Request with invalid signature!
by 艳华杨 06 Mar '06

06 Mar '06

Hi, everyone I use Hostap(0.2.0, the hostapd is 0.4.7)+Freeradius(1.0.2)+Xsupplicant(1.0.1_, and both of the hostap and freeradius are located in the same machine. So I set 127.0.0.1 in clients.conf as freeradius server's client and set 127.0.0.1 as the radius server in hostapd.conf, and the secret of them is the same. But When I setup the authentication, I got the following informantion on radius server: rad_recv: Accounting-Request packet from host 127.0.0.1:32773, id=0, length=70 Received Accounting-Request packet from 127.0.0.1 with invalid signature! (Shared secret is incorrect.) Server rejecting request 1. Finished request 1 Then I checked the "Shared secret" set in both configure file, they are the same. Why did the error appear? On the other hand, everytime I run the xsupplicant, the destination MAC address will change for a while. And this is what I got: [INT] Called event_core_setup()! [INT] Called cardif_linux_rtnetlink_init()! [INT] ADDING INTERFACE : eth1 [INT] Flags are : 06 [INT] Initializing socket for interface eth1.. [INT] Index : 4 Interface initalized! [INT] Interface eth1 is wireless! [INT] The card reported that the destination MAC address is now 00 40 05 AE B7 7C [INT] Userdata is NULL! [INT] Working with ESSID : hostap [CONFIG] Working from config file /etc/xsupplicant.conf. [CONFIG] Opened socket descriptor #7 [ALL] Processing command : /usr/local/etc/1x/startup.sh [ALL] Returning command : /usr/local/etc/1x/startup.sh [ALL] Actual command being called is /usr/local/etc/1x/startup.sh [INT] Got an RTM_NEWLINK! [INT] Working with an interface with index of 4. [INT] -- Got a new interface request. [INT] Found interface eth1, with index of 4! (Ignored) [ALL] Processing interface eth1... (Flags : 05) [INT] The card reported that the destination MAC address is now 44 44 44 44 44 44 [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [INT] All 4s for dest mac! [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [CONFIG] MAC address changed! Updating config! [CONFIG] Working from config file /etc/xsupplicant.conf. [ALL] Unknown error (-1) [ALL] Clock tick! authWhile=29 heldWhile=59 startWhen=0 curState=LOGOFF [STATE] (global) -> DISCONNECTED [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [INT] All 4s for dest mac! [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [CONFIG] MAC address changed! Updating config! [CONFIG] Working from config file /etc/xsupplicant.conf. [ALL] Unknown error (-1) [ALL] Clock tick! authWhile=29 heldWhile=59 startWhen=0 curState=LOGOFF [STATE] (global) -> DISCONNECTED Why the destination MAC address could change? And I have checked the address "44 44 44 44 44 44" which means no network is detected. So what's wrong? Anyone can help me? Thanks a lot! Helen --------------------------------- 雅虎1G免费邮箱百分百防垃圾信

1 0

ZyAir B-3000 and freeradius
by Luciano PELLE 05 Mar '06

05 Mar '06

Hi all! I'm new to this list and probably this is not the place where to post this kind of questions. I've searched all over the net and read a lot about various configurations for freeradius, but nothing so simple to solve my problem. Hence here is the problem: I'm using Debian Sarge (kernel 2.6.8-2-686) and I'm trying to use freeradius 1.0.2 with quite all extensions available for my distro (dialupadmin, ldap, mysql, perl etc ...). Freeradius is installed correctly (no error messages, during the setup process) and when I launch it with #freeradius -X I get this output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-% Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. ... I suppose that this means that the server works fine. Now I'd like (and this is the real question) to use the server with a Zyxel ZyAir B-3000 that has a built in RADIUS function to authenticate users and authorize to access my LAN (mostly for using an Internet connection). What is the simplest way to configure the server and the client (ZyAir) to make them works together? How can I test the settings, before to make them operative? If I can't get help here is there anybody that knows a step-by-step tutorial I can download on the Internet (in italian?)? Thanks in advance for your help and support Luciano PELLE

2 1

no username attribute
by Norbert Grochal 05 Mar '06

05 Mar '06

Hi! My users don't use windows xp "zero configuration" service for wifi. They use Ralink Configurator with profiles. Auth EAP/PEAP. Sometimes after reboot AP or 'unhibernate' Windows XP freeradius logs packets with no User-Name attribute: rad_recv: Access-Request packet from host 10.10.10.9:2048, id=115, length=155 NAS-IP-Address = 10.10.10.9 NAS-Port = 0 Called-Station-Id = "00304f41e217" Calling-Station-Id = "000e2e74b798" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000501 Message-Authenticator = 0xebaa8690af8e44f2aa18020db98b43a2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 340 modcall[authorize]: module "preprocess" returns ok for request 340 radius_xlat: '/usr/local/var/log/radius/radacct/10.10.10.9/auth-detail-20060304' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.9/auth-detail-20060304 modcall[authorize]: module "auth_log" returns ok for request 340 modcall[authorize]: module "chap" returns noop for request 340 modcall[authorize]: module "mschap" returns noop for request 340 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 340 rlm_eap: EAP packet type response id 0 length 5 !!!!!! rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 340 modcall[authorize]: module "files" returns notfound for request 340 !!!!!! rlm_sql (sql): zero length username not permitted modcall[authorize]: module "sql" returns invalid for request 340 modcall: leaving group authorize (returns invalid) for request 340 !!!!!! Invalid user: [<no User-Name attribute>] (from client AP9 port 0 cli 000e2e74b798) Delaying request 340 for 1 seconds And user must restart computer to connect to AP... It is possible to set freeradius not to check User-Name? I use User-Name for logging purposes only. freeradius gets login and password from PEAP and authorize even if User-Name is anything. What should I do? Norbert

2 3

oracle question
by Victor Polukcht 05 Mar '06

05 Mar '06

Can i configure FR to use oracle stored procedures for authentication & accounting? -- Victor Polukcht

2 2

Wrapping @2GB why?
by Jonathan De Graeve 04 Mar '06

04 Mar '06

I am programming my own nas and I keep having the problem that my input-octets and output-octets wrap @2GB instead of 4GB I use rad_put_int(struct rad_handle *h, int type, u_int32_t value) so that's unsigned and in fact should work. I keep getting this in the detail file and in my database: Fri Mar 3 17:26:39 2006 NAS-IP-Address = x.x.x.x NAS-Identifier = "hotspot-2.wlan.imz.be" User-Name = "jonathan" Acct-Status-Type = Stop Acct-Session-Time = 1599 Acct-Authentic = RADIUS Service-Type = Outbound-User NAS-Port-Type = Ethernet NAS-Port = 6 Acct-Session-Id = "c8a1d1e3b8cd5dce" Framed-IP-Address = 192.168.2.255 Called-Station-Id = "00:13:21:cf:fe:02" Calling-Station-Id = "00:c0:9f:84:9e:c8" Acct-Input-Packets = 1345474 Acct-Input-Octets = 53843836 Acct-Input-Gigawords = 0 Acct-Output-Packets = 2041756 Acct-Output-Octets = 2147483648 Acct-Output-Gigawords = 0 Acct-Terminate-Cause = Admin-Reboot Client-IP-Address = x.x.x.x Acct-Unique-Session-Id = "3165ff1f761edd81" Stripped-User-Name = "jonathan" Realm = "NULL" Timestamp = 1141403199 It stops at 2147483648, even if my own NAS internal data is bigger then that. My database has the same problem: +-----------------+------------------+ | AcctInputOctets | AcctOutputOctets | +-----------------+------------------+ | 53843836 | 2147483648 | +-----------------+------------------+ The Mysql AcctInputOctets and AcctOutputOctets are bigint(12) Anyone knows why this happens? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be

2 1

Proxy or not based on Client-IP-Address
by Dennis Skinner 03 Mar '06

03 Mar '06

Hello all, Looking for a pointer in the right direction. I want to reject requests from a particular realm that are not coming from a particular set of Client-IP-Addresses. This realm is normally proxied through my servers, so I don't authorize/authenticate them at the moment, they are simply passed to the next RADIUS server. However, some of those users are not using the proper upstream modem provider that they should be and I want to stop that. Other realms coming through that modem provider should be handled like normal. I have looked at the rlm_passwd module, but I'm not sure that is the way to go. I'm thinking that whatever I do should be in the pre_proxy section rather than the post_proxy so the downstream RADIUS server isn't sending back ACCEPT and the user getting REJECT. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

1 0

Sending Access-Accept for everyone.
by Robert Myers 03 Mar '06

03 Mar '06

Is there a way to send access-accept all of the time? I've tried to do the DEFAULT in username, but that didn't seem to work for me. -Bob

1 0

virus through freeradius-user-request mail??
by Seferovic Edvin 03 Mar '06

03 Mar '06

I've got 2 mail containing viruses sent through freeradius-user-request.. was this email spoofed ( my antivirus software deleted the email so I had no chance to look at the headers etc ) or were email really sent through mailman? Regards, Edvin

2 1

type of lvalue in VALUE_PAIR
by Seferovic Edvin 03 Mar '06

03 Mar '06

Hi, I know this question is probably for the developer list, but I think someone can answer me without any further complications ;) As I "promised", I am patching freeradius ( sqlcounter actually ) so it can do traffic accounting. I have patched it but since I want to have the ability to set the limit by entering the amount of bytes ( in my backend ), I am limited by lvalue of value_pair struct. So values above a (ca) 4 GB are above the limit of uint32 right? What can I do to increase the limit without crashing the freeradius functions. Can I simply change it to uint64_t ( 2 ^64 should be enough ;) ) ??? Regards, Edvin PS: the patched freeradius is working and is able to account traffic, but I think it would not be RFC compliant because I haven't found the needed attributes in the dictionaries

2 4

Dual Server free radius
by Vasco Santos 03 Mar '06

03 Mar '06

Hi, I have question, its possible to put two radius servers runnig in same server with diferents ports?

3 2