- Freeradius-Users - lists.freeradius.org

Re: Freeradius and PPPoe Server ?
by Paweł Małkowski 15 Sep '05

15 Sep '05

2005/9/13, Charles Price <charlie.price(a)w3z.co.uk>: > > I have the same problem. I have a radius server with ldap oracle. > > I dont know how to configure freeradius to use pppoe. > > > You have to configure pppd to authenticate using freeradius. In short: > > 1. Make sure you have a recent version of ppp and rp-pppoe (getting ppp from > CVS is a good idea) ok I installed ppp and rp-pppoe > 2. Make sure that the radius plugins for pppd have been installed > in /etc/ppp/plugins and the radiusclient configuration is > in /etc/radiusclient In default, plugin radius.so wasn't there, but I found one in another dict. > 3. Enter your specific radius server details into /etc/radiusclient/servers > and /etc/radiusclient/radiusclient.conf I would like to use Windows XP as a client :) > 4. Make sure you have some user information in your freeradius backend. I am > assuming you have configured freeradius to see your LDAP server... :) yes > 5. Put 'plugin /etc/ppp/plugins/radius.so' (no quotes) > in /etc/ppp/pppoe-server-options I put this line in pppoe-server-options > 6. Start the pppoe-server process. I started the serwer > 7. pppd should now ask freeradius for authentication. And here I have problem :( My ppp server and freeradius are still not connected. Do you have any idea? Maybe this is Windows and its pppoe fault? -- Pawel volfen Malkowski

1 0

Wrong Dialins
by Dominik Sennfelder 15 Sep '05

15 Sep '05

Hello With our old Redback we have been able to see Authentication failures in den the Freeradius Detail file. At the Moment this is not logged any more in the Details file. But I don't know why. We changed the Redback some time ago. The new one uses the same config file like the old one. Is this an Option in the Freeraius config for logging Authentication failures? And is it possible to log the Passwords the users entered?. Thanks Dominik Sennfelder

1 0

chap authentication failure
by dilip simha 15 Sep '05

15 Sep '05

hi, i have problems using chap with my radius server(FreeRADIUS Version 1.0.4). please help me out.. my users file on radius server: simha Auth-Type := CHAP , CHAP-Password == "hello" on the packet from radclient: User-Name = "simha" , CHAP-Password = "40c567281480e959747ddd9ea7589015" , CHAP-Challenge = "challenge" i use a request-id of 200 to generate the chap password as: 200hellochallenge when i run md5sum on this ..i get: 40c567281480e959747ddd9ea7589015 which i use as CHAP-Password attribute in radclient. in radiusd.conf: chap { authtype = CHAP } this is what i have. now when i use radclient as : radclient -f packet_chap 10.91.0.167 auth testing123 -i 200 where packet_chap(a file) has the contents: User-Name = "simha" , CHAP-Password = "40c567281480e959747ddd9ea7589015" , CHAP-Challenge = "challenge" 200 is the request id 10.91.0.167 is the radius server. on the radius server ..i get : rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "simha" with CHAP password rlm_chap: Using clear text password for user simha authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. so what is wrong with the process i have followed? bye simha

2 2

status of rlm_python in 1.1.0 release
by Ilia Chipitsine 15 Sep '05

15 Sep '05

Dear Sirs, I just made diff between 1.0.4 and 1.1.0 rlm_python sources and they appear to be the same. When that module will become non-experimental ? It has not been changing for years, maybe it can become regular module in 1.1.0 ? We develop an application that uses rlm_python and we would like our customers to be able to run it against "out of box" compiled freeradius. It would be bad to tell each customer "You know, our application uses rlm_python, which is still marked experimental and therefore You need to recompile freeradius ..." We confirm that we didn't experience any problem with rlm_python. It behave quite robust and predictable. Cheers, Ilia Chipitsine

3 3

duplicate records
by Callis 14 Sep '05

14 Sep '05

Hi all, I am trying to use freeradius(1.0.1-1 on FC3) to collect AAA records from a CISCOAS5300. I keep getting this error in my radius.log and my cisco also reports most of radius timeout. A ping test give <10ms on my network. Any suggestions would be of great help. Thank you. === Wed Sep 14 15:49:19 2005 : Error: rlm_sql (pgsql-voip): failed after re-connect Wed Sep 14 15:49:19 2005 : Error: rlm_sql (pgsql-voip): Couldn't update SQL accounting STOP record - ERROR: duplicate key violates unique constraint "stoptelephonycombo" Wed Sep 14 15:49:19 2005 : Error: rlm_sql (pgsql-voip): failed after re-connect Wed Sep 14 15:49:19 2005 : Error: rlm_sql (pgsql-voip): Couldn't update SQL accounting STOP record - ERROR: duplicate key violates unique constraint "stoptelephonycombo" ==

2 1

One question
by Sinan Ulker 14 Sep '05

14 Sep '05

Hi all, How can I setup EAP support on freeradius? Regards,

2 1

SQL Documentation
by Sean 14 Sep '05

14 Sep '05

Hi All, Can anyone recommend a good source for documentation for FreeRadius. I'm trying to understand the processes that occur between Chillispot, FreeRadius and MySql. In particular I need to understand how the Counter works and how to use the counter in MySQL. Regards, Sean

2 1

radgroupreply table
by N White 14 Sep '05

14 Sep '05

Can anyone explain to me the purpose and usage of the 'prio' column in the radgroupreply table? Much Googling has returned nothing, accept other questions. -- --------------------------- | Nick White | | Network Administrator | | Tele-NET Internet | | http://www.tele-net.net | | nwtech(a)tele-net.net | ---------------------------

4 6

El tercero... a ver si entiende lo que quiero decir
by Paolo Rotela 14 Sep '05

14 Sep '05

Ing. Paolo Rotela Jefe Técnico Blue Telecom ----- Original Message ----- From: "Paolo Rotela" <paolo.rotela(a)bluetelecom.com> To: "Freeradius Users" <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, September 14, 2005 10:20 AM Subject: Re: FreeRadius Proxying and Message-Authenticator >I wonder if it is correct to discard a packet based on the presence of an >attribute witch use is not defined by any standard. I've read the >"aboba-radext-fixes" and I see that FR is calculating Message-Authenticator >in Accounting packets this way. But there is no RFC about it... RFC2869 >describes how to handle incorrect or missing Message-Authenticator in >Access-* packets, it doesn't say that you must discard an Accounting packet >with invalid Message Authenticator, because as you say there is no standard >about how to calculate it. > > I suggest at least a configuration option that can help to avoid this > compatibility issue, giving the user the option of accepting or not > "incorrect" MAs in Accounting. > > I'll try to find out the algorithm used by Cisco... If I happen to be > successful, I'll post it. > > Thanks > > > Date: Tue, 13 Sep 2005 17:57:05 -0400 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: FreeRadius Proxying and Message-Authenticator > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20050913215705.0B8CA170D2(a)mail.nitros9.org> > > "Paolo Rotela" <paolo.rotela(a)bluetelecom.com> wrote: >> Hi. I've downloaded FR 1.0.5 whch is supposed to have a bugfix for >> Message-Authenticator handling in Accounting-* messages. > > The issue is that the suggested method of calculatin > Message-Authenticator MAY NOT be the same as what Cisco's using. > Because there's no standard, Cisco may be doing almost *anything*. > >> I'am missing something? > > If you can find out the algorithm used by Cisco, we may be able to > update FreeRADIUS to handle it. Until then, there isn't much we can > do. > > > Ing. Paolo Rotela > Jefe Técnico > Blue Telecom

1 0

Lengths
by Iandc Davies 14 Sep '05

14 Sep '05

All, In the standard header there is a code, Identifier, length and authenticator fields. For the length, is that the sum of all the vp->lengths + 20 for the standard header. My reason for this question is that I'm trying to rationalise an example I've got. I.e. how do you get 164 See below: Code =1 Identifier =1 Length =164 Authenticator = 56 7b e6 9a 8e 43 cf b6 fb a6 c0 f0 9a 92 6f 0e These are standard header, therefore 164 - 20 = 144 Attributes: NAS-IP-Address =d5 89 45 26 4 NAS-PORT-TYPE =5 (virtual) 1 User-Name ="12345678" 8 Disgest-Response ="2ae133421cda65d67dc50d13ba0eb9bc" 32 Digest-Attributes= Realm(1) = "deltathree" 10 Nonce(2) = "3bada1a0" 8 Method(3) = "INVITE" 6 URI(4) = "sip:96226491335@213.137.69.38" 29 Algorithm(5) = "md5" 3 User-Name(10) = "12345678" 8 Equals = 109 (35 not accounted for ?) Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1