- Freeradius-Users - lists.freeradius.org

how to disconnect user after quota given to him finishes ?
by Rupesh Amatya 15 Feb '06

15 Feb '06

Dear all, I am using Freeradius(with mysql as database for users ) with Mikrotik as NAS. This for PPPOE users. I used Dialup Admin to manage freeradius. There is default package of 4hours/day but the users do not get disconnect after 4 hours. It just shows " Out of Quota". What needs to be done to automatically disconnect user after the daily quota is finished ? Hope to get help ..... Thanking you Rupesh

2 1

using scripts for sql.conf
by Maqbool Hashim 15 Feb '06

15 Feb '06

Hi, Is it possible to reference a script from within sql.conf? I'd like to do some checks and inserts on the sql database just before the auth_check query in sql.conf. Whats the best way of doing this? Thanks Maqbool

3 4

ascend-data-filters
by squirrel＠isot.com 15 Feb '06

15 Feb '06

I been told that I need to configure "ascend-data-filters" to pass ADF's to make port 25 work for our dialup users. Does he mean something like this? Ascend-Data-Filter = "ip in forward destport = 25" ************************************** Computer problems? ................... ..............http://www.multibyte.net

3 3

Question about Authentication flow.
by Robert Myers 15 Feb '06

15 Feb '06

I'm trying to understand how to send dynamic replies based on user. If I authenticate via LDAP or some other mechanism, I can authorize via the sql tables? Is that right? -Bob

2 4

hints and stripped-user-name
by Lewis Bergman 14 Feb '06

14 Feb '06

I have more hints trouble on another radius server. I want to look for a realm and strip it if it is there, else, send on the username untouched. Using a config that Alan gave me a while back to do the opposite I entered the below in my hints. Thought this would be easy but I am just not getting something. I think the two values I have tried to use (Stripped-User-Name and Strip-User-Name) are not yet set which is why the username comes up blank. So, how to strip the realm from the username and set User-Name to that? I have this in my hints: DEFAULT User-Name =~ ".*@", NAS-IP-Address == "69.39.33.242" User-Name := "%{Stripped-User-Name}" # also tried Strip-User-Name in place of Stripped-User-Name with same #result The parts of the radiusd -X I think are pertinent follow: rad_recv: Access-Request packet from host 69.39.33.242:1812, id=177, length=205 User-Name = "renisdn(a)camalott.com" --snip-- hints: Matched DEFAULT at 80 <-- this is the entry above from hints radius_xlat: '' <-- Stripped-User-Name not set yet? --snip-- rlm_realm: No '@' in User-Name = "", looking up realm NULL --snip-- auth: Failed to validate the user. Login incorrect: [/boilers1] (from client NAS0hpr1ABI port 14081) ^^-- so username is definately set to null Here is the full radiusd -X for this user: rad_recv: Access-Request packet from host 69.39.33.242:1812, id=177, length=205 User-Name = "renisdn(a)camalott.com" User-Password = "passhere" NAS-IP-Address = 69.39.33.242 NAS-Identifier = "69.39.33.242" NAS-Port = 14081 Acct-Session-Id = "renisdn(a)camalott.com1" USR-Interface-Index = 0 USR-Supports-Tags = 0 Service-Type = Login-User USR-Chassis-Call-Slot = 56 USR-Chassis-Call-Span = 1 USR-Chassis-Call-Channel = 1 USR-Connect-Speed = NONE NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 hints: Matched DEFAULT at 80 radius_xlat: '' modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall[authorize]: module "digest" returns noop for request 2 rlm_realm: No '@' in User-Name = "", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched DEFAULT at 151 users: Matched DEFAULT at 330 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: group authenticate returns notfound for request 2 auth: Failed to validate the user. Login incorrect: [/boilers1] (from client NAS0hpr1ABI port 14081) As always, help is greatly appreciated. -- Lewis Bergman Texas Communications 4309 Maple St. Abilene, TX 79602-8044 Off. 325-691-1301 Cell 325-439-0533 fax 325-695-6841

2 1

freeradius and winxp
by Piotr Salwerowicz 14 Feb '06

14 Feb '06

Hello I have problem proably with freeradius server, i try to start 802.1x authentication on the dell and catalyst switch. My workstation is Wxp sp2 and w2k sp4. I run radius witx -X to debug and when i logging, the radius server still counting and counting something and never stop. It is strange for me when i type inncorect password or incorect user radius also still counting and counting. Now i don't have any idea, please help me or give me some clue my conf : users : popo User-Password == "popo" clients.conf: client 10.10.10.227 { secret = 0110 shortname = dell6k nastype = dell6k my logs when radius is in normal mode: logi z freeradiusa: Thu Feb 9 14:05:04 2006 : Info: rlm_eap_md5: Issuing Challenge Thu Feb 9 14:05:04 2006 : Auth: Login OK: [popo/<no User-Password attribute>] (from client dell6k port 18) and radiusd -X : Going to the next request rl_next: returning NULL Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.10.227 :49155, id=0, length=112 NAS-IP-Address = 10.10.10.227 NAS-Port-Type = Ethernet NAS-Port = 18 User-Name = "popopopo" State = 0xba656fbffecb7e21f8b14a205592085e4740eb4323fd697caf72865dba5e93af6a7c622a EAP-Message = 0x020400060319 Message-Authenticator = 0x805e7511c4ffddd5eff70207a317843b modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok rlm_eap: EAP packet type notification id 4 length 6 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated modcall: group authorize returns updated rad_check_password: Found Auth-Type EAP auth: type "EAP" modcall: entering group authenticate rlm_eap: EAP packet type notification id 4 length 6 rlm_eap: EAP Start not found rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: Unknown EAP type 25, reverting to default_eap_type rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns ok modcall: group authenticate returns ok Login OK: [popopopo/<no User-Password attribute>] (from client dell6k port 18) Sending Access-Challenge of id 0 to 10.10.10.227 :49155 EAP-Message = 0x01050016041068f7366937700d3b64c7935a1dc54b4e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8278bc4bd4c26c472df0bd2aadc6ec2a4740eb439efee1da2feaaa6028a9dd491d3a50b9 Finished request 5657 Going to the next request thx for help best regards popo ------------------------------------------------------------------- .pl 42,70 zl z VAT/rok >> http://link.interia.pl/f1902 <<

3 3

802.1x EAP-PEAP log parsing
by gARetH baBB 14 Feb '06

14 Feb '06

Couldn't find any references to this exact problem, so apologises if it actually has been talked about before. I'm trying to parse the auth-detail log files for 802.1x EAP-PEAP and trying to consolidate the inner authentication (from 127.0.0.1) with the outer authentication (from the real NAS), so I can generate log reports which include the real (inner) user name and real (outer) IP etc. etc. There is no obvious way of doing this, apart from the not-that-ideal method of time stamp matching. Is there something which can be derived from State or EAP-Message to match authentications up ? Is there another method ?

3 2

CVS web interface down ?
by Craig Huckabee 14 Feb '06

14 Feb '06

Has anyone reported that the FreeRADIUS cvs web interface is down ? If this is a known issue I apologize, didn't find any posts on this list or the developers list. Thanks, Craig

2 1

RE: $INCLUDE dictionary.fortinet is missed in dictionary infreeradius-1.1.0
by Jonathan De Graeve 14 Feb '06

14 Feb '06

Can you also include the changes for the bay dictionary which I send 2weeks ago? Kind Regards, J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst +32 15/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Alan > DeKok > Verzonden: dinsdag 14 februari 2006 1:19 > Aan: FreeRadius users mailing list > Onderwerp: Re: $INCLUDE dictionary.fortinet is missed in dictionary > infreeradius-1.1.0 > > "Richie Lee" <richielee_69(a)hotmail.com> wrote: > > Could you please add the line to dictionary file? > > It should be in 1.1.1. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

TLS error
by warp core 14 Feb '06

14 Feb '06

I get a TLS_accept error when the server reads the client certificate. All used certificates (client, server) were generated by the same CA (OpenSSL). What can it be wrong? Can someone show a log with a successful EAP-TLS authentication? from the freeRADIUS log------------------------------------------- TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A TLS_accept: SSLv3 write certificate A TLS_accept: SSLv3 write key exchange A TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A ------------------------------------------------------------------------------- The authentication goes on and terminates with the following: from the freeRADIUS log------------------------------------------- TLS Alert read:fatal:certificate unknown TLS_accept:failed in SSLv3 read client certificate A 5294:error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown:s3_pkt.c:1052:SSL alert number 46 5294:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.

1 0