- Freeradius-Users - lists.freeradius.org

(no subject)
by Walter Reynolds 21 Feb '06

21 Feb '06

On Mon, 20 Feb 2006, freeradius-users-request(a)lists.freeradius.org wrote: > Date: Mon, 20 Feb 2006 13:44:05 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: Log file format > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060220184405.5BEB016E17(a)mail.nitros9.org> > > Walter Reynolds <waltr(a)umich.edu> wrote: >> We have some tools that currently run some statistics on the radius >> accounting file. Well, we currently use a different radius server. With >> that in mind the log format is different. Is there a way to modify the >> format of the accounting log format? > > Which accounting log? The detail file? That's pretty much > unchanged since the original Livingston format 13 years ago. > > Could you be more specific, and say what should be changed, and to > what it should be changed? > > Alan DeKok. I apologize for not giving all the info, I am new to radius and am still learning. Yes I am refering to the detail file. Currently we have implemented a version of MERIT Radius. I know less about that than Freeradius, so forgive me if I do not give you what you need. Currently we have two files that appear to be accounting data to me. Following are what we get (I have removed IP info for safty sake) These two lines are from logfile.20060220 Mon Feb 20 13:07:12 2006: Received-Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP Mon Feb 20 13:07:12 2006: Authentication: 63/62890 'waltr' from XXX.XXX.XXX.XXX port 9126 PPP - OK -- total 0, holding 0 No, what is more important to me os from the session.20060220.las file (mainly the first line) This is strange though as because Pre-Auth the accounting data is sent to the merit radius then forwarded to a freeradius and back. Either way this is the format of the merit radius and our scripts. NA NA 1140458855 20 20 waltr@ NA 'PROFILE' NA NA XXX.XXX.XXX.XXX/9126 NA NA Framed/PPP/XXX.XXX.XXX.XXX ## User-Name:0='waltr' Calling-Station-Id:0='XXX.XXX.XXX.XXX' Acct-Status-Type:1=Stop ## Acct-Input-Octets:1=1208 Acct-Output-Octets:1=1648 Acct-Session-Id:0='0B901E52' ## Acct-Input-Packets:1=11 Acct-Output-Packets:1=9 Acct-Terminate-Cause:1=User-Request ## Tunnel-Client-Endpoint:10=:49:'XXX.XXX.XXX.XXX' Acct-Authentic:1=RADIUS Acct-Delay-Time:1=0 ## NAS-IP-Address:2=XXX.XXX.XXX.XXX NAS-Port-Type:1=Virtual I hope this helps clear up my question.

2 1

Win2K, PEAP, Authentication problem after install Novell Client
by Daniel Hesse 21 Feb '06

21 Feb '06

eDirectory LDAP, FreeRadius, 3com 7250 WAPs, EAP-TLS/PEAP WinXP clients authenticate perfectly. However the same hardware with Win2K fails. The weird part is it will work fine until I install the Novell Client, so, this may be the wrong forum, but I will try anyway. I experience this problem with Linksys, 3com and Ralink adapters. They authenticate fine until I install the Novell client (4.9 - 4.9.2). Once I install the NW client the machine wants a client certificate and then will authenticate intermittently and always fail re-authentication. The only adapter that functions in this setup is Gigabyte GN-WPEAG. I have ordered a more recent version of Gigabyte adapter which also uses an Atheros chipset. If anyone has come across this issue or may know of a patch for the Netware client, I would really appreciate a heads up. Daniel D. Hesse Director of Information Technology Methodist Manor Retirement Community 712-732-1120 Ext.116

1 0

Multiple values for check items - silly question
by Chris Knipe 21 Feb '06

21 Feb '06

Hi, This more than likely goes back to using the correct OP values, so I'm hoping someone can shed some light on this. I have a groupcheck requirement that requires a value of a attribute to be either one, or the other. NAS-Port-Type := ISDN, NAS-Port-Type := Virtual Now, obviously I can't add it like the above. I will only receive ISDN *or* Virtual, not both. What OP should I use to make it check of one or the other? Thanks, Chris

1 0

freeRadius Features
by Mohammad Flaifel 21 Feb '06

21 Feb '06

Hi all, I need to install a radius server and i already testes freeradius and seems is really good. i need to know if freeradius supports: - Change of Authorization while the subscriber's PPP session is still connected. - Disconnect users based on download volume limitation regards, Flaifel

1 0

RE: dictionary.cablelabs[168]: dict_addvalue: value name too long
by Ryan Melendez 21 Feb '06

21 Feb '06

Hey Alan, I don't have more than one version of freeradius running. This was my problem. ./configure LDFLAGS=/path/to/openssl/ export LDFLAGS make I needed to set LDFLAGS _before_ ./configure. This works well: LDFLAGS=/path/to/openssl/ export LDFLAGS ./configure make Thanks, Ryan -----Original Message----- From: freeradius-users-bounces+rmelendez=wayport.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+rmelendez=wayport.net@lists.freeradius. org] On Behalf Of Alan DeKok Sent: Thursday, February 16, 2006 4:24 PM To: FreeRadius users mailing list Subject: Re: dictionary.cablelabs[168]: dict_addvalue: value name too long "Ryan Melendez" <rmelendez(a)wayport.net> wrote: > I am using 1.1.0. Sorry I left that out. That message isn't produced when running the stock 1.1.0. What else is going on in your machine? Do you have multiple versions of FreeRADIUS installed? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 3

setting up on shared hosting webhost service
by eric＠gozippy.com 21 Feb '06

21 Feb '06

1st: I'm a newb to freeradius - not to the world... I have successfully installed freeradius with experiemental modules (for using mysql) on a mandrake mandriva 10.2 machine on my local lan... I got my scripts to work flawlessly... I uploaded my modified scripts to my webhost and nothing... I called my webhost (I am a reseller for them, and they are in my home town) and talked them into installing freeradius onto the servers my sites are located on. Shared webhost... I am not sure how they are limiting my virtual host server to just the /home/myuserid/ directory but that is the limnit of where I can see... I do not have root access, I can ssh, but only to the /home/userid and down thru my individual accounts cpanels and such... I have modified clients.conf and sql.conf to appropriate settings - I think... what am I missing? any ideas or tips I can relay to my webhost on setting up freeradius? It is a bit difficult and burdomsome on my webhost to have to physically modify or change the clients.conf each time I add a new client or access point in my network, plus how do I ensure my radius access to my "localhost" mysql databases within my hosting account are talking to eachother? I think there are some issues connecting as the radius server is installed on the webhost server - my personal site, abeit has a private ip, actually runs from the /home/myuserid/public_html/ on the server... further, some of the other domains I own or have sold and set up corresponding dns and webhosting space with cpanels for on the same server do not have private ip's (I can of course add them on to the service I am buying from the webhost for a minimal fee) - but currently they are shared ips... is there anyway to use freeradius on shared ips and still be able to keep individual virtual hosts seperate? if I need dedicated hosting and a box of my own to run this in the real world that would just add several thousand dollars of cost to my overall deplopyment and long term maintenance contracts in a co-lo somewhere... currently my webhost's servers are at a co-lo in dallas... ideas, tips and tricks to make it work are VERY welcomed... thanks in advance - Eric(a)GoZippy.com

1 0

Auth from LDAP, then add reply via SQL
by Robert Myers 21 Feb '06

21 Feb '06

I must be missing this in the documentation. If I authenticate via the users file/LDAP/SQL , is there a way to add replies from the radcheck table in sql? -Bob

1 2

Bug #86?
by Stefan Winter 20 Feb '06

20 Feb '06

Hi, it seems like bug #86 didn't make it into 1.1. Any chance of seeing this somewhen in the 1.1 branch? I'd work on it myself, but the path Alan describes in the bug comment sounds somewhat like spanish to me (and the patch I provided in #203 seems not clean enough, even to myself in retrospective) :-) Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Log file format
by Walter Reynolds 20 Feb '06

20 Feb '06

We have some tools that currently run some statistics on the radius accounting file. Well, we currently use a different radius server. With that in mind the log format is different. Is there a way to modify the format of the accounting log format? -- Walter Reynolds University of Michigan

2 1

cisco pptp+mppe problems on ios 12.3T and later
by jakobp 20 Feb '06

20 Feb '06

hi, maybe one of the cisco users here on the list can help me. I want to run dialin vpdn on a cisco 1712, using pptp tunnels with mppe encryption and authenticate against freeradius 1.1.0 The strange thing is, my setup used to work just fine, until i tried to upgrade IOS from 12.2 to 12.3T or 12.4. in both trains (> 12.2) mppe suddenly fails to work. a normal, unencrypted pptp works. "debug" shows that cisco gets a radius reply with ms-chap mppe attributes, but seems to miss/misunderstand something. "debug mppe" says: MPPE: keying material missing from radius the relevant parts of my cisco config: aaa authentication login vpnauth group radius aaa authentication ppp default group radius local aaa authorization network default if-authenticated aaa authorization network vpnauth group radius vpdn enable vpdn multihop vpdn source-ip 217.196.69.198 vpdn logging vpdn logging user vpdn logging tunnel-drop vpdn session-limit 10 vpdn search-order multihop-hostname vpdn-group pptp ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 lcp renegotiation on-mismatch interface Virtual-Template1 ip unnumbered FastEthernet0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly peer default ip address pool vpnpool compress mppc ppp encrypt mppe auto ppp authentication ms-chap ms-chap-v2 ppp eap refuse callin radius-server host x.x.x.x auth-port 1812 acct-port 1813 key xxx radius-server authorization default Framed-Protocol ppp radius-server vsa send accounting radius-server vsa send authentication ... and from radiusd.conf: mschap { authtype = MS-CHAP use_mppe = yes require_encryption = no require_strong = no } i already tried to find information or to change some of the config settings, but no luck :( thanks in advance, jakob

1 0