- Freeradius-Users - lists.freeradius.org

Freeradius 1.1.0 & Mysql 5.x
by Chadwick Sorrell 10 Jan '06

10 Jan '06

Hello, I am trying to get freeradius 1.1.0 up with mysql 5.0 and it is giving me trouble. radiusd -X shows that the sql connection is established but radiusd doesn't limit the connections based on num_sql_socks and it continues to connect until my mysql hits its max connections. At that point it begins this... rlm_sql ((null)): Attempting to connect rlm_sql_mysql #299 rlm_sql_mysql: Starting connect to MySQL server for #299 rlm_sql ((null)): Connected new DB handle, #299 rlm_sql ((null)): starting 300 rlm_sql ((null)): Attempting to connect rlm_sql_mysql #300 rlm_sql_mysql: Starting connect to MySQL server for #300 rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@localhost :radius rlm_sql_mysql: Mysql error 'Too many connections' rlm_sql ((null)): Failed to connect DB handle #300 rlm_sql ((null)): starting 301 rlm_sql ((null)): starting 302 rlm_sql ((null)): starting 303 rlm_sql ((null)): starting 304 and it continues until i Ctrl-C it Anyone have any ideas? Thanks, Chad

3 5

problems with CHAP authentication
by Przemysław Backiel 10 Jan '06

10 Jan '06

Hello, I have big problem with CHAP in Freeradius. I tried versions 1.0.2 and 1.0.5 and I heve the same error. While I'm loging using Rasppoe I have errors in freeradius debug: rad_recv: Access-Request packet from host 127.0.0.1:2294, id=219, length=88 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" CHAP-Password = 0x4cffb4ccb24a90a9c115c4827aa8748301 Calling-Station-Id = "00:13:D4:EB:68:01" NAS-IP-Address = 194.88.154.12 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry test at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "test" with CHAP password rlm_chap: Using clear text password rtest for user test authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. my user file look just like this: test Auth-Type = Local, Password == "rtest" Framed-Protocol = PPP, Framed-IP-Address = 10.0.0.22 in radiusclient i write localhost and secret i use rp-pppoe-server 3.7 but in 3.5 I have got the same errors where is the error? what I have to change? -- Z powazaniem Przemyslaw Backiel

1 0

EAP-TLS and accounting are incompatible
by Marcos González 10 Jan '06

10 Jan '06

Hello, my name is Marcos, I wrote to this list some weeks ago. My problem was the freeradius accounting was working only for "session time" but "input-octets" and "output-octets" attributes weren't being sent by the NAS to the freeradius server. I was using EAP-TLS authentication. The NAS is a Cisco Aironet 1200, it's a WiFi network. Freeradius runs on a Fedora Core4, and it's version 1.0.4. Trying everything, I finally deactivated authentication. Let the network open... and then "input-octets" and "output-octets" started to come included in the accounting packages from the NAS! Now I'll try other EAP methods, but don't think EAP-TLS preventing the packet tracking from working to be normal. I'm doing something worng? It's a Cisco IOS bug? Thanks in advance.

1 0

Cisco to FreeRadius to AD-LDAP authentication
by Dickson, John 09 Jan '06

09 Jan '06

I have tried and nearly completely succeeded in authentication and authorization. The user is identified in LDAP just not provided access (rad_recv: Access-Reject packet from host 10.1.1.27:1812, id=121, length=20). Another issue I have is with the user login. In Windowz, a new user is created by providing the First name, middle initial and last name which is not their "User logon name". These credentials are distributed within AD-LDAP in the "CN=" fields using spaces to break the name. If this is not exactly how the "User logon name" is installed then radius request rejects authentication. An example would be: User Tom Thumb Logon tthumb CN=Tom Thumb sAMAccountName=radtest So when a request of the database occurrs using ldap lookup with "cn=tthumb" it fails and I do not know if there is another way around this but using sAMAccountName doesn't work either. I am hopeful that I am missing something. My question is, how do I get an "Accept" from the request and is there a way around the basedn naming conventions that will alllow FreeRadius to work with Windowz? Below is user "testing" with a logon of "testing". rlm_ldap: - authorize rlm_ldap: performing user authorization for testing radius_xlat: '(cn=testing)' radius_xlat: 'ou=xxxx0,dc=xxxx1,dc=xxxx2,dc=EDU' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to xxxx1.xxxx2.EDU:389, authentication 0 rlm_ldap: bind as superuser(a)xxxx1.xxxx2.edu/password <mailto:superuser@xxxx1.xxxx2.edu/password> to xxxx1.xxxx2.EDU:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=xxxx0,dc=xxxx1,dc=xxxx2,dc=EDU, with filter (cn=testing) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testing authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 10.1.1.27:32803, id=121, length=59 Sending Access-Reject of id 121 to 10.1.1.27:32803 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 121 with timestamp 43c2d99f Nothing to do. Sleeping until we see a request.

2 1

What is this "group authentication"?
by Gary Algier 09 Jan '06

09 Jan '06

Hi: I am trying to use the WinXP supplied supplicant and I am getting: modcall: group authenticate returns invalid for request 41 Can someone give me a hint as to what this means? When I use the WinXP bulitin supplicant in "Automatically use my Windows login..." mode, Freeradius fails with the group authentication message. If I uncheck that and type a login and password (but not a domain), it works fine. It never does any sort of group check. If I supply a domain, it does the group check (and fails). When does it check groups? What is it checking? I am using Freeradius 1.0.5, Sun's DS (with Samba attributes loaded), and WinXP SP2. BTW: I am stripping the hostname when doing the user lookups in LDAP using this: filter = "(&(objectclass=person)(uid=%{exec:/etc/ulcmit/raddb/nodomain %{User-Name}}))" where "nodomain" strips the domain portion. My LDAP lookups work fine. -- Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758 Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033 Nielsen's First Law of Computer Manuals: People don't read documentation voluntarily.

2 4

router dies, takes radius with it
by RH Lists 09 Jan '06

09 Jan '06

Hi all, Has anyone experienced this? I have a Cisco router which is being used to terminate pppovpdn sessions over l2tp tunnels. It crashed and rebooted the other day, and took my radius servers down too! I have identified the problem with the router and will be upgrading it first chance I get, but I'm concerned that the router would cause radiusd to crash. Any thoughts? I'm using radiusd: FreeRADIUS Version 1.0.1, for host , built on Nov 2 2004 at 19:55:49 and will be upgrading that shortly. Thanks Rob --- Checked for viruses by Transact Bermuda

1 0

Exec-Program-Wait multiple reply items
by wrath＠geo.net.ge 09 Jan '06

09 Jan '06

Hello, I have recently migrated to freeradius (latest stable on debian sarge - 1.0.2-4) and faced with the following problem: I use Exec-Program-Wait attribute as a reply item in users file. It returns 3 attributes: NAS-Identifier, Framed-IP-Address and Framed-Route. These attributes are printed on stdout with trailing "\n". However they are not returned to the NAS as are not comma separated. Is there any known workaround for this problem? Thanks in advance. Best Regards, George

4 3

Freeradius as Proxy
by Nicola Iotti 09 Jan '06

09 Jan '06

Hi, I'm using freeradius 1.0.5 just as proxy to do a realm based messages redirection... I want freeradius does not change any attribute in communication messages from home server and nas, so I've commented all lines of attrs file, default realm attributes too....Is it correct ? And what about other particular configurations or suggestions Thank you Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

1 0

RE: MS LDAP connect OK users not found
by Dickson, John 09 Jan '06

09 Jan '06

In fact it is. My review of the debug shows that the radiusd.conf ldap connects (binds) yet the testing user is not located. -----Original Message----- From: freeradius-users-bounces+jdickson2=mccneb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jdickson2=mccneb.edu@lists.freeradius.o rg] On Behalf Of Dennis Skinner Sent: Friday, January 06, 2006 4:33 PM To: FreeRadius users mailing list Subject: Re: MS LDAP connect OK users not found Dickson, John wrote: > rlm_ldap: performing search in ou=Users,dc=XXXX1,dc=XXXX2,dc=edu, with > filter (uid=testing) > rlm_ldap: object not found or got ambiguous search result > rlm_ldap: search failed I read that as... uid=testing is not in the ldap database. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

User accounts that expire and timeout
by Jon Pipitone 09 Jan '06

09 Jan '06

Hey all, I'm working to set up a wireless hotspot using mikrotik, freeradius, and mysql. Actually the initial setup went pretty smoothly, so a big thank you to everyone that contributed to the documentation and mailing lists. Right now I'm looking to set up user accounts that are only valid for a certain date range (for instance, from today at noon until tomorrow at noon). In essence I want to set some sort of expiry date on the user account. But, as well, I'd like the session time limit for the user to be set so that the user can't stay logged in after the expire date (i.e. log in just before the expiry time and stay logged in for a few more hours.). During the time when the account is valid (i.e. hasn't expired) the user should be able to log in and out as much as the'd like, or stay logged in for the entire time. In other words, the Session-Timeout ought to be exactly the difference in time from when they log in to when the account expires. I've done a bit of reading through the mailing list archives and the documentation. I wasn't able to get the Expiration attribute to work (i can elaborate if need be), but then even if it did it isn't fine-grained enough (only down to the day) and I still wasn't sure how to automatically adjust the Session-Timeout. I was toying with using a sqlcounter somehow, but I thought it best to ask for ideas before I dive in again. Thanks in advance, Regards, jon

2 2