- Freeradius-Users - lists.freeradius.org

Get Username providing IP to radius in accounting mode!
by Mohsen A. Momeni 13 Feb '06

13 Feb '06

Hi, I have a router (NAS) configured to authenticate from a RADIUS server, and then send accounting information to it (i.e. IP frame address). Then the traffic is redirected through a firewall. Is there any way that the firewall can get the accounting information (Specially username) from RADIUS by providing the IP frame address to it? Firewall needs authentication (to know the username to apply policies) but I don't want to authenticate the user for the second time. If this is not possible, Can RADIUS be configured to send the accounting information (Specially username and IP frame address) to a LDAP server so that the firewall can query the LDAP server for the information? Regards,

2 1

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 13 Feb '06

13 Feb '06

Yohoo! >> I hope, I could help some people trying to use AD for radius. >there is another way - use the krb module to authenticate against AD Are there any advantages/ disadvantages ldap <-> krb5?

5 13

Free radius with MySQL
by Radius User 13 Feb '06

13 Feb '06

Hi all. How can I configure freeradius-1.1.0 with MySQL for authenticating and accounting. from http://www.frontios.com/freeradius.html, it says that, authorise { preprocess chap mschap #counter #attr_filter #eap suffix sql #files #etc_smbpasswd } but, there is none as follows in radiusd.conf........... regards...

2 1

(Cannot assign requested address) bind() failed
by tommy garsia 13 Feb '06

13 Feb '06

Hello all, I'm trying to run chilli with external radius server....e.g....the chilli machine's IP is 172.17.1.200 and then the radius is 172.17.1.222....this is the chilli.conf #radiuslisten 127.0.0.1 radiusserver1 172.17.1.222 radiusserver2 172.17.1.222 but, after i start chilli...it shows error like this:: hotspot: chilli --fg --debug ChilliSpot version 1.0 started. chillispot[3181]: ChilliSpot 1.0. Copyright 2002-2005 Mondru AB. Licensed under GPL. See http://www.chillispot.org for credits. chillispot[3181]: redir.c: 532: 99 (Cannot assign requested address) bind() failed chillispot[3181]: chilli.c: 3558: Failed to create redir is this a chilli error or radius error?? what should i do with my configuration?? regards, --------------------------------- Yahoo! Mail Use Photomail to share photos without annoying attachments.

3 3

freeradius src for mysql
by Radius User 13 Feb '06

13 Feb '06

hi members, can anyone inform me that what is the source file in freeradius-1.1.0, in where the mysql quiries for authentication and accounting is executed. thanks and regards...

2 1

Problem with PPTP and LDAP authentication.
by Joey McDonald 13 Feb '06

13 Feb '06

Hey gang, I'm still struggling getting freeradius and LDAP working to authenticate my PPTP users. I'd really appreciate if one of the guru's could have a look. I've wiped my old install and installed a fresh copy of freeradius and all the config files. Reading the list postings it's clearly best to make as few changes as posible to the config files. So, the bit's I've changed in radiusd.conf are as follows: modules { ldap { server = "ldap.mycompany.net" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "ou=people,dc=mycompany,dc=net" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" password_attribute = userPassword I uncommented the ldap section under authenticate: authenticate { ... Auth-Type LDAP { ldap } Then, I added my client in clients.conf. In users I added: DEFAULT Auth-Type := LDAP Fall-Through = 1 Those are all the changes I've made to the default configurations. I'm now storing my password(s) in the ldap directory in plain text. Using radtest from another machine on the network authenticates from the LDAP server just fine. Authentication from my PPTP server always gives me the following: rad_recv: Access-Request packet from host x.x.x.x:32792, id=112, length=149 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "joey" MS-CHAP-Challenge = 0x0a5f7e5035f0d2306105161cdf7060c4 MS-CHAP2-Response = 0xb600a2aa1bab3836758fcf6e48643de987c900000000000000003e30dd6e4b9c0b1d9bebde2c68fbab2aa625a5246217a002 Calling-Station-Id = "165.236.229.162" NAS-Identifier = "pptp" NAS-Port = 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Login incorrect: [joey/<no User-Password attribute>] (from client vpn-external port 0 cli 165.236.229.162) Sending Access-Reject of id 112 to x.x.x.x:32792 What am I doing wrong? Thanks so much! --joey

4 5

Kerberos 5
by John Metcalfe 13 Feb '06

13 Feb '06

Hello: We are having trouble compiling freeRADIUS version 1.1.0 rlm_krb5 module. Is this required for RADIUS with TLS and PEAP? Thank you John Metcalfe, Jr. IT Specialist - AIS IBM Business Consulting Services, Public Sector Telephone: 240-396-5305 email: metcalfej(a)us.ibm.com

7 11

Source file MySQL
by Radius User 13 Feb '06

13 Feb '06

hi members, can anyone inform me that what is the source file in freeradius-1.1.0, in where the mysql quiries for authentication and accounting is executed. thanks and regards...

1 0

Realm proxy HOW-TO??
by Danai Chudthong 12 Feb '06

12 Feb '06

Dear all I setup freeradius for my EAP-TLS with realm configuration and everything is fine. But I have some problem about database. The realm name is shown in table raddpostauth but it's not shown in table radacct which is more important. I checked in debug mode and found that freeradius send username with out realm to AP during post-auth process then AP send only username to freeradius for accounting. How to set freeradius to send user@realm to AP in post-auth? I'm not sure what I miss.. Any idea please? For more information, please review in sql query below. Thanks Danai mysql> select username, Realm, NASIPAddress, AcctStartTime, AcctStopTime from radacct where AcctStartTime >= 20060212; +----------+-------+--------------+---------------------+---------------------+ | username | Realm | NASIPAddress | AcctStartTime | AcctStopTime | +----------+-------+--------------+---------------------+---------------------+ | danai | | 192.168.1.2 | 2006-02-12 12:29:47 | 2006-02-12 12:44:32 | | danai | | 192.168.1.2 | 2006-02-12 12:44:34 | 2006-02-12 12:52:33 | | danai | | 192.168.1.2 | 2006-02-12 12:52:35 | 2006-02-12 16:23:09 | | danai | | 192.168.1.2 | 2006-02-12 16:23:10 | 2006-02-12 17:27:56 | | danai | | 192.168.1.2 | 2006-02-12 17:28:01 | 2006-02-12 17:30:48 | | danai | | 192.168.1.2 | 2006-02-12 17:30:52 | 2006-02-12 17:32:58 | | danai | | 192.168.1.2 | 2006-02-12 17:35:39 | 2006-02-12 17:35:45 | | danai | | 192.168.1.2 | 2006-02-12 17:35:46 | 2006-02-12 17:36:58 | | danai | | 192.168.1.2 | 2006-02-12 17:37:33 | 2006-02-12 21:56:37 | | danai | | 192.168.1.2 | 2006-02-12 17:53:49 | 2006-02-12 17:54:09 | | danai | | 192.168.1.2 | 2006-02-12 17:54:16 | 2006-02-12 18:03:05 | | danai | | 192.168.1.2 | 2006-02-12 18:03:09 | 0000-00-00 00:00:00 | | danai | | 192.168.1.2 | 2006-02-12 21:54:47 | 2006-02-12 21:55:06 | | danai | | 192.168.1.2 | 2006-02-12 21:55:39 | 2006-02-12 21:56:10 | | danai | | 192.168.1.2 | 2006-02-12 21:56:39 | 2006-02-12 22:25:04 | | danai | | 192.168.1.2 | 2006-02-12 22:12:11 | 2006-02-12 22:18:44 | | danai | | 192.168.1.2 | 2006-02-12 22:19:01 | 2006-02-12 22:19:23 | | danai | | 192.168.1.2 | 2006-02-12 22:20:01 | 0000-00-00 00:00:00 | | danai | | 192.168.1.2 | 2006-02-12 22:26:12 | 2006-02-12 22:26:34 | | danai | | 192.168.1.2 | 2006-02-12 22:26:35 | 0000-00-00 00:00:00 | +----------+-------+--------------+---------------------+---------------------+ 20 rows in set (0.00 sec) mysql> select user, NASIPAddress, date from radpostauth where date >= 20060212; +--------------------+--------------+---------------------+ | user | NASIPAddress | date | +--------------------+--------------+---------------------+ | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:29:47 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:44:33 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:52:34 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 16:23:10 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:28:01 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:30:51 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:35:39 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:35:46 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:37:33 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 17:53:49 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 17:54:15 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 18:03:09 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 21:54:47 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 21:55:39 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 21:56:39 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:12:11 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:19:01 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:20:01 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:26:12 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:26:35 | +--------------------+--------------+---------------------+ 20 rows in set (0.00 sec) __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

problem with checkrad
by Fazal Ahmed Malik 12 Feb '06

12 Feb '06

Hi, I am facing problem with checkrad in icradius. I am sorry for mailing this question on this mailing list because i could not find solution any where.We have recently added ascend MAX TNT in list of NAS, before that simultenous use was working fine, now with Max simultenous use is not working, in checkrad logs i have found that session id is 8 digits long but in NAS session id is 9 digits long so it get the user login. If any body has solution for this please help. Thanks, fam

1 0