- Freeradius-Users - lists.freeradius.org

RE: Proxy of accounting message
by Ashwin Gobind 30 Sep '05

30 Sep '05

Thanks nick. However when I proxy the message, the message-authenticator field has an <INVAILID TOKEN> (see trace below). Why is this Sending Accounting-Request of id 1 to 10.113.46.170:1813 Acct-Status-Type = Start Service-Type = Framed-User Called-Station-Id = "vlive" Framed-Protocol = GPRS-PDP-Context Framed-Protocol = GPRS-PDP-Context Acct-Delay-Time = 5 Calling-Station-Id = "27829800729" NAS-Identifier = "GMC-GGSN0-13-2" Acct-Session-Id = "20050529" User-Name = "27829800729" User-Name = "27829800729" NAS-Port = 6000 NAS-Port-Type = Virtual NAS-IP-Address = 10.111.14.46 Message-Authenticator <INVALID-TOKEN> 0x00000000000000000000000000000000 Proxy-State = 0x30 �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

Re: SSL3_GET_CLIENT_KEY_EXCHANGE
by Juan Daniel Moreno 30 Sep '05

30 Sep '05

>Juan Daniel Moreno <juanitomoreno(a)gmail.com> wrote: >> Thank you Alan, but now I have a new problem. I have been reading the >> src/modules/rlm_eap/ to understand my problem but I don't find the >> issue. In TLS establishment, the public key in the server.cert is 128 >> bytes length. I generate a random string of 46 bytes and the protocol >> version (TLS 1.0 (0x03, 0x01)) and I use the SSL function >> RSA_public_encrypt() with server's public key to encrypt the >> PreMasterSecret. As a result I get a 128 length string. As I send this >> data to the server, I get a "tls rsa encrypted length is wrong: >> s3_srvr.c: 1450:" > I have no idea what the problem is, sorry. >Alan DeKok. Can you please tell me the client's exchange packet form the server is attempting? How is it calculated? Or, can you show me a typical byte suite from this message? (I hope you understand me) Tank you. Juan Daniel MORENO

2 1

RE: Proxy accounting message
by Ashwin Gobind 30 Sep '05

30 Sep '05

But doesn't this mean there has to be a realm in the username eg name@realm1 The problem is the user-name attribute does not contain a realm. Is it still possible to proxy the accounting start and stop messages originating from as certain NAS-IP-ADDRESS. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 29 September 2005 06:22 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 5, Issue 98 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Proxy of Accounting Requests (Ashwin Gobind) 2. Re: Proxy of Accounting Requests (Nicolas Baradakis) 3. RE: Proxy of Accounting Requests (Jonathan De Graeve) 4. Re: LDAP and groups (Dusty Doris) 5. Re: LDAP and groups (Kenneth Grady) 6. Re: SSL3_GET_CLIENT_KEY_EXCHANGE (Juan Daniel Moreno) 7. (no subject) (msah(a)otitelecom.bj) 8. Postgresql+freeradius configuration (msah(a)otitelecom.bj) ---------------------------------------------------------------------- Message: 1 Date: Thu, 29 Sep 2005 12:18:37 +0200 From: "Ashwin Gobind" <Ashwin.Gobind(a)vodacom.co.za> Subject: Proxy of Accounting Requests To: <freeradius-users(a)lists.freeradius.org> Message-ID: <753BF83740BB6C48BF8A15B5C61C88470BB847D7(a)zamdc02100.vodacom.corp> Content-Type: text/plain; charset="us-ascii" Good day. I am using freeradius 1.05 I want to proxy accounting requests originating from certain hosts to another server, how can I do this. Also I am using Jradius to handle accounting request. But this certain request I don't want JRadius to handle, but freeradius just to proxy it. Here is an example of the request Thanks Acct-Session-Id = C42EA2A31F96530 Framed-Protocol = GPRS-PDP-Context Called-Station-Id = vlive Calling-Station-Id = 27829800529 Framed-IP-Address = 10.19.128.6 3GPP-IMSI = 655019800002252 3GPP-Charging-ID = 33121584 3GPP-PDP-Type = 0 3GPP-GGSN-Address = 196.46.162.163 3GPP-IMSI-MCC-MNC = 65501 3GPP-GGSN-MCC-MNC = 65501 3GPP-NSAPI = 5 3GPP-Selection-Mode = 0 3GPP-Charging-Gateway-Address = 10.25.0.10 3GPP-GPRS-Negotiated-QoS-profile = 99-23931F9396979774FB0808 3GPP-SGSN-Address = 196.6.254.49 User-Name = 27829800529 Cisco-AVPair = connect-progress=Call Up Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Virtual Cisco-NAS-Port = GGSN NAS-Port = 60000 Class = [Binary Data] Service-Type = Framed-User NAS-IP-Address = 10.31.1.122 NAS-Identifier = GMC-GGSN0-12-2 Acct-Delay-Time = 0 Client-IP-Address = 10.113.60.6 Acct-Unique-Session-Id = b30a3d4d494c8a87 "This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx " ------------------------------ Message: 2 Date: Thu, 29 Sep 2005 13:55:16 +0200 From: Nicolas Baradakis <nbk(a)sitadelle.com> Subject: Re: Proxy of Accounting Requests To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050929115516.GA2365(a)asuka.tech.sitadelle.com> Content-Type: text/plain; charset=us-ascii Ashwin Gobind wrote: > I want to proxy accounting requests originating from certain hosts to > another server, how can I do this. You could add something like this in file "acct_users": DEFAULT Client-IP-Address == 10.0.0.1, Proxy-To-Realm := realm1 DEFAULT Client-IP-Address == 10.0.0.2, Proxy-To-Realm := realm2 -- Nicolas Baradakis ------------------------------ Message: 3 Date: Thu, 29 Sep 2005 15:56:33 +0200 From: "Jonathan De Graeve" <Jonathan.De.Graeve(a)imelda.be> Subject: RE: Proxy of Accounting Requests To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <FFA36DAA4D9D62438D6DD1947C631316073263(a)exchangesrv.imz.be> Content-Type: text/plain; charset="us-ascii" Can you also do this in SQL? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Nicolas Baradakis Verzonden: donderdag 29 september 2005 13:55 Aan: FreeRadius users mailing list Onderwerp: Re: Proxy of Accounting Requests Ashwin Gobind wrote: > I want to proxy accounting requests originating from certain hosts to > another server, how can I do this. You could add something like this in file "acct_users": DEFAULT Client-IP-Address == 10.0.0.1, Proxy-To-Realm := realm1 DEFAULT Client-IP-Address == 10.0.0.2, Proxy-To-Realm := realm2 -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 4 Date: Thu, 29 Sep 2005 10:06:30 -0400 (EDT) From: Dusty Doris <freeradius(a)mail.doris.cc> Subject: Re: LDAP and groups To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050929100414.M98082(a)mail.doris.name> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > Hello there, > > I have a small problem. And I read the documentation. And I can't find > what's wrong. > > I have a corporate LDAP with users and group. > > Each group is a "groupOfUniqueNames", with "uniquemember". > In the user defintion, no group definition is set. > > I need to authenticate members of a certain groups, and not of another ... > > Every doc I read mention that you have to create an attribute "per user" ... > > Any other way ? > I chose to do groups per user with radiusgroupname attribute, which is in the ldap_howto. However, you don't have to do it that way. Try reading radiusd.conf in the ldap section under the default groupmembership_filter. Or reading doc/rlm_ldap. If you are trying that and not having success, then post your debug output. ------------------------------ Message: 5 Date: Thu, 29 Sep 2005 08:11:27 -0600 From: Kenneth Grady <klg(a)lanl.gov> Subject: Re: LDAP and groups To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <1128003087.27966.29.camel(a)grady.lanl.gov> Content-Type: text/plain ldapsearch -x cn=my_group # # filter: cn=my_group # requesting: ALL # # my_group, group, lanl, gov dn: cn=my_group,ou=group,dc=lanl,dc=gov objectClass: groupOfNames cn: my_group member: employeeNumber=0067,ou=people,dc=lanl,dc=gov member: employeeNumber=0068,ou=people,dc=lanl,dc=gov ... ---------------------------------- radiusd.conf (file) ...modules ldap My-group_Users { server = "ldap" net_timeout = 1 timeout = 3 timelimit = 4 ldap_connections_number = 5 basedn = "dc=lanl,dc=gov" #access_attr = "employeeNumber" filter = "(&(cn=my-group)(member=employeeNumber=%{Stripped-User-Name:-%{User-Name }},ou=people,dc=lanl,dc=gov))" start_tls = no groupname_attribute = cn groupmembership_filter = "" groupmembership_attribute = my_group dictionary_mapping = ${raddbdir}/ldap.attrmap compare_check_items = yes access_attr_used_for_allow = yes } ... authorize Autz-Type MY-GROUP { redundant { My-group_Users notfound = reject } } ---------------------------------- users (file) ... DEFAULT NAS-IP-Address =~ "^123.123", Autz-Type := MY-GROUP There's probably a better way, but this worked for what I wanted. On Thu, 2005-09-29 at 03:10, Jean-Francois Gobin wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello there, > > I have a small problem. And I read the documentation. And I can't find > what's wrong. > > I have a corporate LDAP with users and group. > > Each group is a "groupOfUniqueNames", with "uniquemember". > In the user defintion, no group definition is set. > > I need to authenticate members of a certain groups, and not of another ... > > Every doc I read mention that you have to create an attribute "per user" > ... > > Any other way ? > > Regards, > Jean-Francois Gobin > > - ---------- > Jean-Francois Gobin - Administrateur gobinjf.be > http://www.gobinjf.be mailto:gobin@gobinjf.be > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2 (FreeBSD) > Comment: Made with pgp4pine 1.76 > > iD8DBQFDO6+pkkg3QInH2uURAkoTAJ9CiiYoljx0B2zP/tInkSG4TwiwIgCbBWft > g16kNx6wUzO1va189DJmHRA= > =kTQn > -----END PGP SIGNATURE----- > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 6 Date: Thu, 29 Sep 2005 16:22:12 +0200 From: Juan Daniel Moreno <juanitomoreno(a)gmail.com> Subject: Re: SSL3_GET_CLIENT_KEY_EXCHANGE To: freeradius-users(a)lists.freeradius.org Message-ID: <2e33d53305092907226e2de3a4(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 > > The protocol specification describes this. The implementation in > src/modules/rlm_eap/ contains diagrams of the packets it expects to > receive. > > Alan DeKok. > > Thank you Alan, but now I have a new problem. I have been reading the src/modules/rlm_eap/ to understand my problem but I don't find the issue. In TLS establishment, the public key in the server.cert is 128 bytes length. I generate a random string of 46 bytes and the protocol version (TLS 1.0 (0x03, 0x01)) and I use the SSL function RSA_public_encrypt() with server's public key to encrypt the PreMasterSecret. As a result I get a 128 length string. As I send this data to the server, I get a "tls rsa encrypted length is wrong: s3_srvr.c: 1450:" Can anybody please tell me where can be my problem? Here is my code for exemple. void Client_Key_Exchange (SSLData *ClientSSLData, unsigned short *length, char *HandshakeMessages, unsigned short *length_Hndshk, char *buff) { char *PreMasterSecret = (char*) _MEMORY_Allocate (58 , true); char *EncryptedPreMasterSecret = (char*) _MEMORY_Allocate (128, true); char *temp = (char*) _MEMORY_Allocate (58 , true); unsigned char *tmpCert = _MEMORY_Allocate (ClientSSLData->certificate_len + 128, true); _RANDOM_MakeCharString (temp, 46); PreMasterSecret [0] = 0x03; PreMasterSecret [1] = 0x01; for (register int i = 0; i<46; i++) { PreMasterSecret[i+2] = temp [i]; ClientSSLData->PreMasterSecret[i] = PreMasterSecret[i]; } for (i = 0; i < ClientSSLData->certificate_len; i++) tmpCert[i] =(unsigned char) ClientSSLData->certificate[i]; //----- OpenSSL Functions ----- RSA *server_public_key; X509 *cert = X509_new (); EVP_PKEY *evp = EVP_PKEY_new (); X509 *err = d2i_X509 (&cert, (unsigned char**) &tmpCert, (ClientSSLData->certificate_len) ); //----- d2i_509 Function retrives tmpCert pointer advanced the number of bytes read ----- tmpCert = tmpCert - (ClientSSLData->certificate_len); //----- We get the public key from the Server certificate ----- evp = X509_get_pubkey(cert); server_public_key = (RSA *) evp->pkey.ptr; int rsasize = RSA_size(server_public_key); //----- We get the PreMasterSecret encrypted ----- int Encrypted_len = RSA_public_encrypt(48, (BYTE*) PreMasterSecret, (unsigned char*)EncryptedPreMasterSecret, server_public_key, RSA_PKCS1_PADDING); ClientSSLData->bufferSSL[(*length)++] = 0x16; // Handshake Message ClientSSLData->bufferSSL[(*length)++] = 0x03; // Version ClientSSLData->bufferSSL[(*length)++] = 0x01; // Version ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) % 256; // Length ClientSSLData->bufferSSL[(*length)++] = 0x10; // Client key exchange ClientSSLData->bufferSSL[(*length)++] = 0x00; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) % 256; // Length //----- Public key exchange ----- for (i = 0; i < Encrypted_len; i++) { buff[i] = EncryptedPreMasterSecret[i]; HandshakeMessages[(*length_Hndshk)++] = EncryptedPreMasterSecret[i]; } free (PreMasterSecret); free (EncryptedPreMasterSecret); free (temp); free (tmpCert); } Thank you for your help. Juan Daniel MORENO ------------------------------ Message: 7 Date: Thu, 29 Sep 2005 16:59:00 +0100 From: msah(a)otitelecom.bj Subject: (no subject) Cc: freeradius-users(a)lists.freeradius.org Message-ID: <20050929165900.j5qtkf92v5cso808(a)webmail.otitelecom.bj> Content-Type: text/plain; charset=ISO-8859-1 Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance. ------------------------------ Message: 8 Date: Thu, 29 Sep 2005 17:00:47 +0100 From: msah(a)otitelecom.bj Subject: Postgresql+freeradius configuration To: freeradius-users(a)lists.freeradius.org Message-ID: <20050929170047.yclw6uck1huss8g0(a)webmail.otitelecom.bj> Content-Type: text/plain; charset=ISO-8859-1 Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 5, Issue 98 *********************************************** �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

radiusd TLS error
by Riccardo Veraldi 30 Sep '05

30 Sep '05

Hello, my users authenticate with EAP-TLS and everything is working fine, but I Always have errors like this in hte log file Fri Sep 30 10:45:33 2005 : Error: TLS_accept:error in SSLv3 read client certificate A what could it be related to ? thanks Rick

1 0

Unexpected Accounting Response
by Giuseppe 30 Sep '05

30 Sep '05

Hi. I'm configuring the radius server so that no duplicate Calling-Station-Id values are found in the DB I'm logging to (Oracle), which is the only destination I'm logging onto (not even "detail"). The quickest way I thought of was to add a unique index to the RADACCT table so that any Accounting Start for a Calling-Station-Id already present in the DB would fail. Indeed I can see through the server log (started with -X) that the INSERT statement fails because it attempts to violate the unique constraint: ------ rlm_sql (sql): Couldn't insert SQL accounting START record - ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated ------ However, just a few lines below I see: ------ modcall[accounting]: module "sql" returns ok for request 0 ------ which probably is the root cause of unexpected (to me): ------ Sending Accounting-Response of id 241 to XXX.XXX.XXX.XXX:33863 ------ This Accounting Response is unexpected to me because RFC 2866 says: "If the RADIUS accounting server is unable to successfully record the accounting packet it MUST NOT send an Accounting-Response acknowledgment to the client". Any help ? Thanks in advance Giuseppe P.S. Here there's the whole log section related to the request processing that raises the above issue: --------- rad_recv: Accounting-Request packet from host XXX.XXX.XXX.XX:33863, id=241, length=92 User-Name = "testuser" User-Password = "\001\272O\257UN\214\307\245\333%\261 <\020d" Acct-Status-Type = Start Calling-Station-Id = "393480000000" Framed-IP-Address = XXX.XXX.XXX.XX Acct-Session-Id = "c16a444a16927797" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = XXX.XXX.XXX.XXX,NAS-IP-Address = XXX.XXX.XXX.XXX,Acct-Session-Id = "c16a444a16927797",User-Name = "testuser"' rlm_acct_unique: Acct-Unique-Session-ID = "aecc66663df0011c". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: group preacct returns ok for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XXX', '', '0')' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Reserving sql socket id: 4 INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XXX', '', '0') rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated rlm_sql (sql): Attempting to connect rlm_sql_oracle #4 rlm_sql (sql): Connected new DB handle, #4 INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', 'c16a444a16927797', 'aecc66663df0011c', 'testuser', '', 'XXX.XXX.XXX.XXX', '', '', TO_DATE('2005-09-28 19:46:43','yyyy-mm-dd hh24:mi:ss'), NULL, '0', '', '', '', '0', '0', '', '393480000000', '', '', '', 'XXX.XXX.XXX.XX', '', '0') rlm_sql_oracle: execute query failed in sql_query: ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated rlm_sql (sql): failed after re-connect rlm_sql (sql): Couldn't insert SQL accounting START record - ORA-00001: unique constraint (RADUSER.RADACCT_IDX2) violated radius_xlat: '' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql): Released sql socket id: 4 modcall[accounting]: module "sql" returns ok for request 0 modcall: group accounting returns ok for request 0 Sending Accounting-Response of id 241 to XXX.XXX.XXX.XX:33863 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 241 with timestamp 433b0133 Nothing to do. Sleeping until we see a request. -------------

2 2

Freeradius + EAP-TLS + DHCP = not working. Help!
by AIbarra＠mex.boehringer-ingelheim.com 30 Sep '05

30 Sep '05

I have the same problem do you have any solution? Saludos Alberto Ibarrarán G. Information Technology Boehringer Ingelheim Promeco (52) 55 56 29 8300 ext. 8631

2 1

how to config radiusclient!
by zhangshuai 30 Sep '05

30 Sep '05

Dear all, I wish to use softphone X-lite on SER and radius in db_mode. When I installed both freeradius 1.0.4 and radiusclient 0.4.3 on the same server which ser 0.8.14 has installed on, I could log in X-lite through radius authorization. And now I want radiusclient (on server A) to send the request to a remote radius server (on server B) to realize authorization. I have changed those config files: /usr/local/etc/radiusclient/servers, /usr/local/etc/radiusclient/radiusclient.conf and /usr/local/etc/raddb/clients.conf as the document (http://www.iptel.org/ser/doc/ser_radius/ser_radius.html#AEN193) did. Then I test the radius server as the above document said on server A: radclient -f digest server B auth testing123 and I received expected replied message from server B. But when I log in x-lite (UA), there are error messages: Sep 29 17:11:06 localhost ser[4408]: rc_ip_hostname: couldn't look up host by addr: DA61FC29 Sep 29 17:11:06 localhost ser[4408]: rc_send_server: no reply from RADIUS server unknown:1812 And the number "DA61FC29" is exactly the hexadecimal value of the ip address of radius server. How come? Did I mis-config anything? Many thanks for your reply! Shuai http://www.goldentek.biz

1 0

PEAP and ntlm_auth
by Dick 29 Sep '05

29 Sep '05

Hi all, I've got a small problem with FreeRadius, I'm trying to forward NTLM authentication to a NT domain by using ntlm_auth but the %{Stripped-User-Name} is empty. I've enabled ntdomain in authorize { } and preacct { }, but it doesn't seem to translate "%{User-name}" as "NTCORP01\\USER" to "%{Stripped-User-Name}" as"USER". When I use "ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=USER" it works (but only for USER ;-)). with_ntdomain_hack in preprocess { } it breaks PEAP (as mentioned earlier on this list). Should I create a wrapper script for ntlm_auth (to strip the %{User-name}) as a workaround or can I use another FreeRadius trick? Thanks, Dick

1 0

setting password from an application
by Nagaraj Venkatapuram 29 Sep '05

29 Sep '05

All, I am having a problem setting password from the http application. It is getting reset to NULL inside pam_authenticate somehow. The only place I can see password is set to NULL is in the function *void _pam_sanitize(pam_handle_t *pamh)* in pam_misc.c file. I've also commented out the invocation of _pam_sanitize from pam api. Also I have syslog trace in the *pam_sanitize *function. However, for some reason I am losing the password inside pam_authenticate inspite of all the changes and also I don't see any trace from the function *pam_sanitize. *If anybody has any idea about this, please reply. retval = pam_start("http", auth_userpass, &conv, &pamh); syslog(LOG_INFO, "before pam_set_item..........................\n"); pam_set_item(pamh, PAM_AUTHTOK, pwd); if (retval == PAM_SUCCESS) { retval = pam_authenticate(pamh, 0); /* is user really user? */ } else { syslog(LOG_INFO, "--Not authenticated - pam start failed\n"); } /* This is where we have been authorized or not. */ if (retval == PAM_SUCCESS) { syslog(LOG_INFO, "Authentication successful for %s from %s\n", auth_userpass, req->remote_ip_addr); strncpy(req->user, auth_userpass, 15); req->user[15] = '\0'; if (pam_end(pamh,retval) != PAM_SUCCESS) { /* close Linux-PAM */ pamh = NULL; syslog(LOG_ERR, "http: failed to release pam authenticator\n"); } return 1; } Thanks, N

1 0

Freeradius + oracle
by chabral - 29 Sep '05

29 Sep '05

Hi, Is it possible to install and run freeradius on an Oracle App Server?. The database server is another server located at another local network. Is it possible to achieve this configuration? Which are the requirements of freeradius for compiling with oracle support? Can I download the code and compile it in the app server? I'll really appreciate your advice. Best regards, -- chabral

1 0