- Freeradius-Users - lists.freeradius.org

Server has no response
by openbsd shen 05 Feb '06

05 Feb '06

After I install freeradius 1.1.0, and I have not changed radiusd.conf, I start freeradius: ./radiusd -X it shows: Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Then I use the command to test: ./radtest test teset localhost 0 testing123 It shows: Sending Access-Request of id 71 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "teset" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 71 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "teset" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 ........ radclient: no response from server for ID 65 and the server has not any response. I don't know why?

2 1

Where is login.radius ?
by openbsd shen 05 Feb '06

05 Feb '06

In "radiusclient.conf", there are lines: # program to call for a RADIUS authenticated login # (default /usr/sbin/login.radius) login_radius /usr/local/sbin/login.radius But I cannot find login.radius in the hole linux system, I installed freeradius in /usr/local/freeradius, there're no this file in this dir. Thanks for help.

2 1

dial up users authentication problem
by Mohsen A. Momeni 04 Feb '06

04 Feb '06

Hi, I have two group of users connected to internet through a firewall for traffic control. Both should be authenticated by firewall through a RADIUS server before connecting to internet and there are different user policies for different users in firewall. 1) LAN users. 2) Dial-up users which are connected to a router, and are authenticated by a RADIUS server (for logging in) The problem is that I don't want a second authentication in firewall. I want the users logged in, can be automatically authenticated by the firewall. Firewall should somehow know their username to apply the policies. I think there should be a mapping from IP to username in RADIUS server. Is this possible? If yes, please tell me how.

1 0

Usage instead of time accounting
by Sean 03 Feb '06

03 Feb '06

Hi' I've been using FreeRadius authorisation and accounting for my Internet Hotspot service for some time. It performs perfectly. Up to now all of my clients use time based tickets(One hour, one day, one week and one month) I now have a client that wants to supply tickets that will limit the usage in bytes of a user. Can this be done and if so can anyone recommend a source for documentation. I've Googled for the last few days and checked the DD-WRT and Chillispot forums to no avail. Regards and rhanks in advance, Sean Bracken http://swarmhotspots.com On Fri, 2006-02-03 at 17:55 +0100, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. (Fwd) Detail Filter method (Breuer Nicolas) > 2. Re: Detail Filter method (Nicolas Baradakis) > 3. R: SQL.conf new query (Carlo Prestopino) > 4. Re: how to log username in uppercase in radacct > (Nicolas Baradakis) > 5. Root Certificate via ADS (Armin Kr?mer) > 6. Re: FDS + Freeradius = pain. (Joey McDonald) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 03 Feb 2006 14:14:54 +0100 > From: "Breuer Nicolas" <Nicolas.Breuer(a)Belcenter.biz> > Subject: (Fwd) Detail Filter method > To: freeradius-users(a)lists.freeradius.org > Message-ID: <43E3655E.29093.29B17267(a)Nicolas.Breuer.Belcenter.biz> > Content-Type: text/plain; charset="iso-8859-1" > > In /etc/raddb/acct_users file: > > DEFAULT Acct-Status-Type == Interim-Update, Acct-Type := empty > > And in /etc/raddb/radiusd.conf: > > modules { > > always ok { > rcode = ok > } > > ... > } > > ... > > accounting { > > # Log start & stop > detail > > Acct-Type empty { > ok > } > } > > -- > Nicolas Baradakis > > > > Can i also put the empty section only in detail module > because i have a sql line in account (to log everything) > > I wouldlike only to disable it in detail accounting. > > > > > > ------- Forwarded message follows ------- > From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> > To: freeradius-users(a)lists.freeradius.org > Subject: Detail Filter method > Send reply to: Nicolas.Breuer(a)BelCenter.biz > Date sent: Fri, 03 Feb 2006 10:54:43 +0100 > > > Hello all, > > I'm using the "detailled" logs with FreeRadius. > > I wouldlike to filter the interim updates to not logged > them. Is it possible ?? > > I wouldlike to only have a logs files with start & stop.. > > It would be a nice option, i think.. > > > > ------- End of forwarded message ------- > > Breuer Nicolas > Content & Marketing Manager. > Network Supervisor. > > BELCENTER ISP & PORTALS > Avenue Henri Conscience, 94 > B -1140 Bruxelles > Tl. :+32 2 243 0 243 > Fax :+32 2 243 0 244 > Mobile :+32 486 50 27 87 > E-Mail : Nicolas.Breuer(a)Belcenter.biz > http://www.BelCenter.be | http://www.BelCenter.net > http://www.BelCenter.lu | http://www.BelCenter.nl > >

3 2

Detail Filter method
by Breuer Nicolas 03 Feb '06

03 Feb '06

Hello all, I'm using the "detailled" logs with FreeRadius. I wouldlike to filter the interim updates to not logged them. Is it possible ?? I wouldlike to only have a logs files with start & stop.. It would be a nice option, i think..

4 3

FDS + Freeradius = pain.
by Joey McDonald 03 Feb '06

03 Feb '06

Greetings! I've been struggling to get PPTP authenticating through my freeradius server through to my LDAP server. I've got Fedora Directory Server as my LDAP database and I've configured freeradius according to the instructions I found for OpenLDAP (yes, this could be part of the problem but I didn't see anything specific to FDS). I've got authentication working via radtest, e.g. rad_recv: Access-Request packet from host 172.33.100.18:32811, id=116, length=56 User-Name = "joey" User-Password = "xxxxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for joey rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to ldap.example.net:389, authentication 0 rlm_ldap: bind as cn=Directory Manager/xxxxxxx to ldap.example.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value { & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user joey authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "joey" with password "xxxxxxxx" rlm_ldap: user DN: uid=joey,ou=People, dc=example,dc=net rlm_ldap: (re)connect to ldap.example.net:389, authentication 1 rlm_ldap: bind as uid=joey,ou=People, dc=example,dc=net/xxxxxxxx to ldap.example.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user joey authenticated succesfully Login OK: [joey/xxxxxxx] (from client el-oso port 0) Sending Access-Accept of id 116 to 172.33.100.18:32811 So that tells me that I've got the communication to my LDAP server properly configured. However when my PPTP server sends authentication requests to my radius server, I always get "Login incorrect: [joey/<no User-Password attribute>]" For example: rad_recv: Access-Request packet from host 172.33.100.1:32784, id=15, length=147 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "joey" MS-CHAP-Challenge = 0x47f01bcb27f52fa649fc0722f36c30c6 MS-CHAP2-Response = 0x92001b248ce93a1a352383f8836833afeb9a0000000000000000724f55d6a62231b22c33b33265212ecd3fa334aff76bb442 Calling-Station-Id = "67.41.208.129" NAS-Identifier = "pptp" NAS-Port = 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for joey rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value { & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user joey authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Login incorrect: [joey/<no User-Password attribute>] (from client vpn-external port 0 cli 67.41.208.129) Sending Access-Reject of id 15 to 71.39.18.170:32784 I have no idea where to troubleshoot this at this point. The usual suspects seem to be properly configured (ldap.attrmap, clients.conf, radiusd.conf and users). Anybody have thoughts? Thanks. --joey

5 7

lost authlog
by bunji＠iris.eonet.ne.jp 03 Feb '06

03 Feb '06

I tested load of freeradius. And I got the following results. OperationSystem FedoraCore4 freeradius:1.1.0 client [bunji@jason radius]$ radclient -d /usr/local/share/freeradius -f auth_1_man.txt -n 200 -p 200 192.168.0.205 auth test123 > auth.log 2>&1 [bunji@jason radius]$ cat auth.log|grep Received|wc -l 10000 [bunji@jason radius]$ [root@jason ~]# tcpdump -i eth0 -v > pckt_eth0.dat tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 20085 packets captured 20086 packets received by filter 0 packets dropped by kernel [root@jason ~]# cat pckt_eth0.dat|grep "Access Request"|wc -l 10000 [root@jason ~]# cat pckt_eth0.dat|grep "Access Accept"|wc -l 10000 [root@jason ~]# server (6636 lost) [radius@lee log]$ cat radius.log|grep "Login OK"|wc -l 3364 [radius@lee log]$ When load is high, log seems to be lost. How can this matter be settled ? Best regards, Bunji Nagahashi

2 1

how to log username in uppercase in radacct
by baynaa＠mobinet.mn 03 Feb '06

03 Feb '06

Hi all, Can anyone tell me how I can configure radius so that Username field is logged in uppercase for all records in RadAcct table. BR, Baynaa.

2 1

SQL.conf new query
by Paolo Pellicori 03 Feb '06

03 Feb '06

hello, type is possible to insert one new query in the rows sql.conf this: postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" modified in this way with name postauth_query_mac: postauth_query_mac = "INSERT into ${authcheck_table} (UserName, Attribute, op, Value) VALUES ('%{SQL-User-Name}', 'Calling-Station-Id', ':=', '%{Calling-Station-Id}' where UserName != '%{SQL-User-Name}'and Attribute != 'Calling-Station-Id' )" where I can find the rows for invocare the new query? Thanks Regards

5 14

(Fwd) Detail Filter method
by Breuer Nicolas 03 Feb '06

03 Feb '06

In /etc/raddb/acct_users file: DEFAULT Acct-Status-Type == Interim-Update, Acct-Type := empty And in /etc/raddb/radiusd.conf: modules { always ok { rcode = ok } ... } ... accounting { # Log start & stop detail Acct-Type empty { ok } } -- Nicolas Baradakis Can i also put the empty section only in detail module because i have a sql line in account (to log everything) I wouldlike only to disable it in detail accounting. ------- Forwarded message follows ------- From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> To: freeradius-users(a)lists.freeradius.org Subject: Detail Filter method Send reply to: Nicolas.Breuer(a)BelCenter.biz Date sent: Fri, 03 Feb 2006 10:54:43 +0100 Hello all, I'm using the "detailled" logs with FreeRadius. I wouldlike to filter the interim updates to not logged them. Is it possible ?? I wouldlike to only have a logs files with start & stop.. It would be a nice option, i think.. ------- End of forwarded message ------- Breuer Nicolas Content & Marketing Manager. Network Supervisor. BELCENTER ISP & PORTALS Avenue Henri Conscience, 94 B -1140 Bruxelles Tél. :+32 2 243 0 243 Fax :+32 2 243 0 244 Mobile :+32 486 50 27 87 E-Mail : Nicolas.Breuer(a)Belcenter.biz http://www.BelCenter.be | http://www.BelCenter.net http://www.BelCenter.lu | http://www.BelCenter.nl

2 1