- Freeradius-Users - lists.freeradius.org

Re: Windows WPA
by Stefan Adams 23 Dec '05

23 Dec '05

Phil, thanks for the information! "Finally you need an AD domain (not NT4) to do that." Are you saying I actually need a Microsoft Server? A Samba domain control won't suffice? Being that I have no (ZERO) Microsoft servers, are my chances of doing machine authentication nil? Stefan > Date: Thu, 22 Dec 2005 12:44:04 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Windows WPA > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <43AA9F94.5070108(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Stefan Adams wrote: > > Does anyone know how it's possible to log into a windows domain (no > > local account) from a Windows XP computer using WPA when the user has > > never logged in before (making cached credentials impossible)? > > > > I work at a high school. We have several mobile carts with laptop > > computers that do NOT have local accounts for each student. > > Therefore, each student is required to logon to the windows domain > > using wireless. This works fine using WEP. > > > > However, using WPA, with the automatically supply windows > > username/password/domain checkbox selected, a user that has never > > logged into that machine before is not able to log on. The Windows > > computer complains that the domain controller is not available. This, > > of course, is true because there are no 'up' network interfaces. > > > > But wouldn't it be logical for Windows to first supply the entered > > credentials to the access point for authorization to the WPA WLAN and > > then supply those same credentials to the domain controller? > > It would be logical. It does not do that. > > See the archives for "machine AND PEAP" - basically, you need to make > the machines authenticate themselves with their machine account first, > then those creds are used for the network login during profile download, > at which point windows will switch to the user creds. > > One point to note: apparently the inbuilt windows supplicant has to use > the *same method* for both the machine and user creds (e.g. both TLS or > both PEAP+MS-CHAP). > > Also note that in order to authenticate a machine (as opposed to user) > account, FreeRadius needs to be talking to an "ntlm_auth" which in turn > talks to a patched samba (the messages you find with the above search > should reference the location of the patch and/or the version from which > it's integrated). Finally you need an AD domain (not NT4) to do that. > > > > > Is that the way it works, is there some other way, or are people that > > have never logged on to these laptops before condemned to never logon > > at all given our new WPA infrastructure? > > No, you just have to work hard to fix microsoft's broken behaviour. As > always.

4 5

Re: [FREERADIUS] Re: patch for sqlcounter, please test!
by Damjan 23 Dec '05

23 Dec '05

> Hello. I'm also interested in this. > What Expire attribute? The attribute name is actually "Expiration". You set it in rad(group)check to something like Expiration == "24 Dec 2005 14:00:00", and if the user connects in 13:48, he'll get a 12 minutes of Session-Timeout. > Can't find any reference of that attribute in the dictionaries. It is in the dictionary, unfortunenatelly it's seems it's not documented anywhere. -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

1 0

default gateway per user basis
by Igor Smitran 23 Dec '05

23 Dec '05

Hello. I am new to this list and also to freeradius server. Can someone please help me? I have a pppoe server on freebsd. I want to setup freeradius to give different ip address block and gateway to users. I need two pools, and i have a two gateways. One gateway is more expensive than the otherone. So, users that pay less will use chiper gateway and vice versa. Is this possible? 10x in advance.

3 9

mysql account and users account using exec-program-wait
by SantaYeh 23 Dec '05

23 Dec '05

I store all user account in mysql, and freeradius works fine. And now, we have some special account that need to write a external program to do authentication. So we use the users file using DEFAULT auth-type = Accept with exec-program-wait. The problem is all mysql accounts doesn't work any more. We check with radiusd -X and find all mysql accounts will pass to users and run exec-program-wait. I just want to know how can we stop the users checking if mysql return OK. Regards, Santa Yeh

2 1

patch for sqlcounter, please test!
by Markus Krause 23 Dec '05

23 Dec '05

hi list! part of a radius-related project is to allow access to our guests and visitors at our institute to parts of our network, of course only with username and password, and do some logging. the idea is that guests get an account and a password which they can use for a period of one to seven days (according to setup). to achieve this i am using the sqlcounter module using the following query: query = "SELECT TO_DAYS(NOW()) - MIN(TO_DAYS(AcctStartTime)) FROM radacct WHERE UserName = '%{%k}' LIMIT 1"; this actually works very well, a user logs in and is allowed to access to the network until the date changes e.g. the second time if he is allowed access for two days. but as i am saving the days as "days" in the mysql database, i run into trouble with "Session-Timeout" because rlm_sqlcounter assumes that the query returns seconds and the user gets a session timeout of the remaining days as seconds (a value between 1 and 7!). putting the day limit as seconds into the database does (in my case/opinion) not make any sense here. as i posted a question about this some two months ago to the freeradius users list unfortunately nobody had a solution available, but i can remember several answers (to the list an by private mail) that this feature would be nice! so i finaly tried some coding today and now here is my proposal: add an optional parameter 'timeunit' to sqlcounter.conf that represents the time unit used in the query and the check value (in the sql db), my config then reads: +++++ /etc/raddb/sqlcounter.conf sqlcounter shorttermaccounts { counter-name = Short-Term-Account check-name = Max-Days-Passed sqlmod-inst = sql key = User-Name reset = never timeunit = days query = "SELECT TO_DAYS(NOW()) - MIN(TO_DAYS(AcctStartTime)) FROM radacct WHERE UserName = '%{%k}' LIMIT 1"; } ----- /etc/raddb/sqlcounter.conf in rlm_sqlcounter.c i added some lines which (if 'timeunit' is set) multiply the value of 'res' (i assume this is the remaining time of allowd success) by an appropriate value to get seconds. in this case Session-Timeout is returned "correctly". possible values for timeunit are minutes, hours, days, and weeks (for now). a patch to version 1.0.5 can be found as attachment to this email. i ran several tests and it is also working with different queries (like the ones in the doc), but i would appreciate others to do some testing if it really works. but as it seems that nobody has made a proposal/code for this yet, what do think about it? i put this also on bugs.freeradius.org but could not find the component "rlm_sqlcounter" so i put it in "modules", i hope i did not mess up things! hoping for many feedback! ;-) with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Any Good Documentation for newbies
by Manuj 23 Dec '05

23 Dec '05

Hello As I am new to this free radius, could you please suggest me a good documentation(free) available on the net. Version I am using is Free RADIUS 1.0.5. Regards Manuj

2 1

Radius SIP billing
by Lenir 23 Dec '05

23 Dec '05

Hey guys, I'm running FR1.0.5 with unixODBC (Sybase) backend and I'm trying to bill calls generated from Sip Express Router (SER). The problem that I have is the following scenario: When UserA calls UserB: SER generates a star-record where the Calling-Station-Id is UserA and the Called-Station-Id is UserB, this is the desired and always the correct behavior. When UserA hangs up on UserB: SER generates a stop-record where the Calling-Station-Id is UserA and the Called-Station-Id is UserB, this is the desired and correct behavior. But if UserB hangs up on UserA: SER generates a stop-record where the Calling-Station-Id is UserB and the Called-Station-Id is UserA, this is the undesired and incorrect behavior. To me the Calling-Station-Id and the Called-Station-Id should be the same for both start and stop records, am I right by thinking that? According to the developers of SER/OpenSER, this is the correct behavior, whoever sends the hangup signal (BYE or CANCEL) is considered the Calling-Station-Id, and they are unwilling to modify or create a patch to "fix" this. So for my purposes, i need the Calling-Station-Id and the Called-Station-Id to be the same on both the star and stop records, since the start record is always correct, what do I need to do to have FR "fix" the stop record when it receives it to show the same Calling-Station-Id and the Called-Station-Id as the Start Record? Thanks in advance, Lenir

2 1

rlm_sql_mysql.so where do I locate this file and its associated files for Redhat ES4 to run Radius and MySQL
by Frank Reiss 22 Dec '05

22 Dec '05

Hi, I am trying to build a radius server using MySQL and am getting a message about missing rlm_sql_mysql.so. I could use some help in locating the required modules. Thanks Frank Reiss

3 2

Bind radius authentication with mac address? so radius will check username, password and mac address from radius database
by Yudi Wijaya 22 Dec '05

22 Dec '05

Hello FreeRadius, as subject.. I don't find any clue of this.. even with google :( I already set up this in sql.conf authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM ${authcheck_table} WHERE STRCMP(Username, '%{SQL-User-Name}') = 0 and (mac='%{Calling-Station-Id}' or isnull(mac) or mac='') ORDER BY id" postauth_query = "UPDATE ${authcheck_table} set mac='%{Calling-Station-Id}' WHERE Username = '%{SQL-User-Name}' and (mac='' or isnull(mac))" then add this to radreply table in radius database: UserName Attribute op value hendy Calling-Station-Id = 00:0D:87:C7:13:81 i use MikroTik and PPPoE then i try reconnect from different mac address with username: hendy but still connected :( -- Best regards, Yudi mailto:yudiw@centrin.net.id

2 1

Auth/Autz Windows Guest
by Stefan Adams 22 Dec '05

22 Dec '05

Hypothetically: I notice that when you choose "authenticate as guest when computer and user information are not available" in the Windows XP wZc utility, that it passes a User-Name of "". Let's say I wanted to just automatically authorize and authenticate the user "". How could this be done? To try and answer this hypothetical situation, I tried it myself in my test lab but my eap/ldap settings kept jumping in and denying the request. Thanks to all!! Stefan

1 0