- Freeradius-Users - lists.freeradius.org

RE: Cisco and No NAS-Port seen (checkrad)
by Jonathan De Graeve 25 Oct '05

25 Oct '05

>Ok, i know what the problem is, but how can i instruct the cisco that it >must send the NAS-Port attribute?, is this even posible? Depends on the nas. Which nas? J.

2 1

Problem with Password and MySQL
by Fabio 25 Oct '05

25 Oct '05

Hi, I am trying to use MySQL to autenticate users of a wireless network, using EAP-TTLS-PAP or PEAP-MS-CHAPv2. I use the following users file: user1 User-Password == "user1" DEFAULT Suffix == "@mydomain.org", Autz-Type := SQL while I have the following user in radcheck in MySQL mysql> select * from radcheck; +----+----------+---------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-------+ | 11 | sql1 | User-Password | == | sql1 | +----+----------+---------------+----+-------+ 1 row in set (0.00 sec) Logging with the user "user1" work fo both TTLS-PAP and PEAP-MS-CHAP-V2 (Tested with wpa_supplicant (both TTLS and PEAP) and MS Windows XP (PEAP)). When i try to authenticate as the user sql1 (which is in the MySQL DB), works for TTLS-PAP but doesn't work with PEAP. Seems that inside the file "users" are handled both PAP and MS-CHAPv2 password, while with MySQL I can use only PAP. The relevant part of the log with radiusd -X is provided below. Thanks to anyone helping with this. auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user.

2 1

How config the Linux to let the freeradius auto-boot when the rad ius bootup.
by Yan-GTAC Li 25 Oct '05

25 Oct '05

The Linux version is RedHat 9. Thanks a lot! Rico

2 1

EAP-SIM test
by Raoul Demour 25 Oct '05

25 Oct '05

Hello! I just started using free radius. Why? because I need to make a supplicant for my studies which which support EAP-SIM.I am studying Computer Science at University of Applied Sciences (Yverdon-les-Bains / Switzerland). And so I hope that my questions are not too stupid... Does someboby know which programme or library was use to test freeRADIUS (as long as it support EAP-SIM)? How they do on the supplicant side? Or does someone know a any library to make EAP-SIM message? If somebody has install a authentification with smart card, what do you use? USB dongle for SC? Other readers? Any ideas or experiences would be appreciated. Best regards. __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

2 1

RE: adding a stop packet
by Jonathan De Graeve 25 Oct '05

25 Oct '05

I use automatic timestamps on update /default and run a script every minute to check if there are some records which hasn't been updated for 15minutes or more J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Michael Markstaller Verzonden: dinsdag 25 oktober 2005 20:58 Aan: FreeRadius users mailing list Onderwerp: RE: adding a stop packet I'm running something like this from crontab: UPDATE radacct SET AcctStopTime = FROM_UNIXTIME(unix_timestamp(AcctStartTime) + AcctSessionTime), AcctTerminateCause = 'NoStopRecv', AcctStopDelay = (unix_timestamp(now()) - (unix_timestamp(AcctStartTime) + AcctSessionTime)), AcctSessionTime = AcctSessionTime + 300 WHERE AcctStopTime = '' AND (unix_timestamp(now()) - (unix_timestamp(AcctStartTime) + AcctSessionTime)) > 3660 AND AcctSessiontime > 0 ; UPDATE radacct SET AcctStopTime = AcctStartTime, AcctTerminateCause = 'NoStop-AliveRecv', AcctStopDelay = (unix_timestamp(now()) - (unix_timestamp(AcctStartTime))) WHERE AcctStopTime = '' AND AcctSessionTime = 0 AND (unix_timestamp(now()) - unix_timestamp(AcctStartTime)) > 86400 ; /* Purge failed attempts */ DELETE FROM radacct WHERE AcctStopTime > 0 AND AcctSessionTime = 0 AND AcctStopTime <= DATE_SUB(CURDATE(),INTERVAL 7 DAY); Michael > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Chuck > Sent: Tuesday, October 25, 2005 8:30 PM > To: freeradius-users(a)lists.freeradius.org > Subject: adding a stop packet > > > We are using freeradius with mysql. Is there some kind of > script to easily add > a fake stop date/time to a user when one gets missed? > Currently I am looking > them up in the accounting table and manually editing the > entry. Would like to > find something that just takes username as input and creates > a stop based on > current date/time. We don't use the accounting for anything > other than > getting usage reports so if a few users are incorrect , no matter. > > This happens frequently ( several times a week) that we don't > get stop packets > from our upstream. Then when users attempt a login, > simultaneous use check > item kicks in and denies them. They claim there is nothing > they can do about > it. > > -- > > Chuck > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: adding a stop packet
by Michael Markstaller 25 Oct '05

25 Oct '05

I'm running something like this from crontab: UPDATE radacct SET AcctStopTime = FROM_UNIXTIME(unix_timestamp(AcctStartTime) + AcctSessionTime), AcctTerminateCause = 'NoStopRecv', AcctStopDelay = (unix_timestamp(now()) - (unix_timestamp(AcctStartTime) + AcctSessionTime)), AcctSessionTime = AcctSessionTime + 300 WHERE AcctStopTime = '' AND (unix_timestamp(now()) - (unix_timestamp(AcctStartTime) + AcctSessionTime)) > 3660 AND AcctSessiontime > 0 ; UPDATE radacct SET AcctStopTime = AcctStartTime, AcctTerminateCause = 'NoStop-AliveRecv', AcctStopDelay = (unix_timestamp(now()) - (unix_timestamp(AcctStartTime))) WHERE AcctStopTime = '' AND AcctSessionTime = 0 AND (unix_timestamp(now()) - unix_timestamp(AcctStartTime)) > 86400 ; /* Purge failed attempts */ DELETE FROM radacct WHERE AcctStopTime > 0 AND AcctSessionTime = 0 AND AcctStopTime <= DATE_SUB(CURDATE(),INTERVAL 7 DAY); Michael > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Chuck > Sent: Tuesday, October 25, 2005 8:30 PM > To: freeradius-users(a)lists.freeradius.org > Subject: adding a stop packet > > > We are using freeradius with mysql. Is there some kind of > script to easily add > a fake stop date/time to a user when one gets missed? > Currently I am looking > them up in the accounting table and manually editing the > entry. Would like to > find something that just takes username as input and creates > a stop based on > current date/time. We don't use the accounting for anything > other than > getting usage reports so if a few users are incorrect , no matter. > > This happens frequently ( several times a week) that we don't > get stop packets > from our upstream. Then when users attempt a login, > simultaneous use check > item kicks in and denies them. They claim there is nothing > they can do about > it. > > -- > > Chuck > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

RE: SUSPENSION OF ACCOUNT
by Jonathan De Graeve 25 Oct '05

25 Oct '05

>I don't think it's possible with the module sqlcounter. You have >to change the value of the attribute Expiration when the account >is renewed. Its possible with Expiration AND/OR Sqlcounter J.

3 3

FreeRadius with NTLM
by Jaygopal Upadhyay 25 Oct '05

25 Oct '05

Hello, I have a Wireless Access Point which support radius. I want to install and configure FreeRadius to authenticate against NT 4.0 (Primary Domain Controller), so that only authenticated users gain access via the Wireless Access Point. Samba on the linux machine where FreeRadius is installed is able to authenticate NT users. Can anyone provide me with steps on how to configure FreeRadius to use samba and allow access to WI-FI to valid domain users? Regards, Jaygopal. "The information contained in this message and the attachments (if any) may be privileged and confidential and protected from disclosure. You are hereby notified that any unauthorized use, dissemination, distribution or copying of this communication, review, retransmission, or taking of any action based upon this information, by persons or entities other than the intended recipient, is strictly prohibited. If you are not the intended recipient or an employee or agent responsible for delivering this message, and have received this communication in error, please notify us immediately by replying to the message and kindly delete the original message, attachments, if any, and all its copies from your computer system. Thank you for your cooperation."

2 1

RE: counter with Session Octet Limit
by Jonathan De Graeve 25 Oct '05

25 Oct '05

When I tried todo this a while ago I encountered a limit of 4GB in the sqlcounter module. J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Ilia Chipitsine Verzonden: dinsdag 25 oktober 2005 8:40 Aan: edvin.seferovic(a)kolp.at; FreeRadius users mailing list Onderwerp: Re: counter with Session Octet Limit I did the same thing by: 1) adding "quota" script to authorize section, it just calculates how many bytes (if any) can be downloaded 2) patching VPN server in order to understand passed parameter > Hello, > > > > I am using freeRadius 1.0.2, and I would like to limit weekly bandwidth for > my VPN ( pptp ) users. So Ive changed the example counter part in my > radiusd.conf > > > > counter weekly_traffic { > > filename = ${raddbdir}/db.weekly > > key = User-Name > > count-attribute = Acct-Input-Octets > > reset = weekly > > counter-name = Weekly-Traffic > > check-name = Max-Weekly-Traffic > > allowed-servicetype = Framed-User > > } > > > > The counter works for it self - It checks the Max-Weekly-Traffic attribute > in my ldap tree for a specific user, calculates the rest, but then it tries > to add Session-Timeout attribute to Access-Accept packet. This is not > working / attribute is not being added, and besides - it is the wrong > attribute. Is it possible for the counter module to add the value, which is > usualy added as Session-Timeout, as Session-Octets-Limit? > > > > Regards, > > > > Edvin Seferovic > > > > > > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 4

Profiles Text File
by Global Net, LLC 25 Oct '05

25 Oct '05

Hello, I am new to the freeradius and am use to VOPRadius for several years My problem in migrating is that VOPRadius used a profiles.txt file to add certain items to a user login detail. items are called in the users logon text file as one of the items. username=billy password=1234 profile="smtpfilter" This way one can call a global item for several users How can I accomplish this with freeradius? Here are a couple of items from the old vopradius tab demented profiles.txt so you will have an idea what I am doing if unfamilar with what vopradius did, that i need to adapt around Profile="smtpfilter" Ascend-Data-Filter="ip in forward tcp est" Ascend-Data-Filter="ip in forward dstip 68.22.89.5/32" Ascend-Data-Filter="ip in forward dstip 65.174.134.5/32" Ascend-Data-Filter="ip in forward dstip 64.79.161.16/32" Ascend-Data-Filter="ip in forward dstip 204.17.24.53/32" Ascend-Data-Filter="ip in forward dstip 204.13.240.5/32" Ascend-Data-Filter="ip in forward dstip 63.110.140.0/24" Ascend-Data-Filter="ip in forward dstip 162.42.148.0/24" Ascend-Data-Filter="ip in forward dstip 162.42.195.0/24" Ascend-Data-Filter="ip in drop tcp dstport = 25" Ascend-Data-Filter="ip in forward" Profile="ISDNFramed" Service-Type = Framed-User Framed-Protocol = PPP Port-Limit = 2 Analog-Access = FALSE Digital-Access = TRUE

2 1