- Freeradius-Users - lists.freeradius.org

Re: FR with MySQL. Proxying and repeated entries
by Paolo Rotela 12 Sep '05

12 Sep '05

Hi. I've downloaded, compiled and installed FR 1.0.5, but I'm still receiving the same results. the packet is discarded because of an invalid Message-Authenticator. This is part of the output (IP address hidden) for a "radclient" with "-s" and "-x" options rad_recv: Accounting-Response packet from host ******, id=83, length=38 rad_decode: Received packet from ****** with invalid Message-Authenticator! (Shared secret is incorrect.) radclient: radclient.c:440: send_one_packet: Assertion `radclient->reply == ((void *)0)' failed. Aborted Should I modify something at the config to let the Message Authenticator get handled correctly? Also, from a TCPDump I don't see any "Message Authenticator" in the Accounting-Request constructed by Radclient. I only see "Message Authenticator" in the "Accounting-Response" packet constructed by Cisco ACS and received (and discarded) by FR. Date: Fri, 19 Aug 2005 15:09:23 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: FR with MySQL. Proxying and repeated entries To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050819190923.3D22B16CCA(a)mail.nitros9.org> "Paolo Rotela" <paolo.rotela(a)bluetelecom.com> wrote: > With this one, Access-* packets go OK, but when the NAS (Cisco AS5300) > sends > an Accounting-Request to that realm and I proxy it to the home server, it > sends me an Accounting-Response with an (I think) irregular attribute: > Message-Authenticator (Ext. Attr. 80), wich I think is not permitted in > the > RFC for accounting packets. The IETF RADIUS extensions working group has a document which proposes fixes to a number of issues like this. > 1) Am I reading OK the RFC? I mean ¿Is it right that Attribute 80 is NOT > permitted in Accounting-* packets? I don't think it's specifically permitted, but it shouldn't be a problem. > 2) Each time the NAS re-sends packets, FR handles it as it were a new > packet, for a new call/connection. The RFC's say that's what the NAS is supposed to do. So for FreeRADIUS, it looks like a new connection. > 3) Is there any known bug or propietary feature from Cisco wich causes > this > incompatibility thing? I've searched about it and didn't find anything. No. It's a bug in FreeRADIUS. I'll put a patch into 1.0.5 that should fix it. Alan DeKok.

1 0

undefined reference 'md4_calc' compile error...
by Harris Christian D SSgt 1 CS/SCBAM 12 Sep '05

12 Sep '05

I am trying to build freeradius-1.0.5 on my NSLU2 running openembedded. Believe me when I say it is and has been a hard road. I've managed to fix the openssl install. I now have the openssl headers that were MIA. I managed to fix the libtool. I can now build libraries that use libtool -mode=link **** -lresolve -ltdl -lthreads and such without errors. I even modified all the Makefiles to include '--tag=thisisjunk' that could not be inferred and had to be specified. It seems like I am running into every problem out there trying to install the server. I have been able to successfully fix them all by myself, but now I stuck with this... gcc -I../../include -o smbencrypt smbencrypt.o smbdes.o ../../lib/libradius.a smbencrypt.o: In function `ntpwdhash': /home/slug/freeradius-1.0.5/src/modules/rlm_mschap/smbencrypt.c:60: undefined reference to `md4_calc' collect2: ld returned 1 exit status make: *** [smbencrypt] Error 1 The line in question from smbencrypt.c read as follows: md4_calc (szHash, szUnicodePass, (nPasswordLen<<1) ); and the #include "md4.h" defines the md4_calc function as: void md4_calc (unsigned char *, const unsigned char *, unsigned int); I not really much of a programmer, but this looks right to me. I'm at a loss as to why this won't compile. I've read postings on how other people fixed this. And they are all in some foreign programmer language I don't understand. What is it I'm messing up here?

1 0

Wireless authentication
by Dan Johansson 12 Sep '05

12 Sep '05

I know there are a handful of ways to set up wireless authentication. Some better than others. We have a customer oriented wireless network and we are trying to build a central authentication system for it, so that we can add and easily control customer radios from one location. What types of authentication should we be using? What should be avoided? Any experiences to share? Additionally, would we be able to route traffic to a captive page if the customer is placed on hold or doesn't have an account yet? I suppose that more of a microtik list question, but I'm just asking in case anyone knows. Thanks, Dan Johansson

2 1

Users file
by TK Lew 12 Sep '05

12 Sep '05

Hello, I have configured my users file to have the following entries :: steve Auth-Type := System Calling-Station-ID = calling-station-id I want freeradius to reply back with Calling-Station-Id whic basically the MSISDN but instead I got the "calling-station-id"? What is the correct syntax for calling-station-id ? Thanks for all ! TK

2 1

Session Time
by Sean 12 Sep '05

12 Sep '05

Hi All, I want to allow the SQL counter to continue deducting time from users after they log out until they reach a certain amount of time left. I have tried several ways to do it for example the following in sql.conf. accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' where Acct-Session-Time < 3600" I'm fairly sure that it's a question of creating the right sql command into radacc. I hope I have explained myself properly. Any advice will be much appreciated. Regards, Sean Bracken

1 0

freeradius and RSA SecurID
by mukherji rakesh 12 Sep '05

12 Sep '05

Hello, Can any one pl give the steps to configure redhat linux 8 and 9 client to integrate with RSA Securid server?I have done my RSA server with radius daemon and tested successfuly with ntradping tool.but I am not able to authenticate users from my linux client with RSA.I am using ssh application and after it asks for the username and password I am giving the passcode and the ssh ( through putty) application says" Server unexpectedly closed network connection and it quits.Though I am getting passcode accepted log message in my RSA server log. I am looking for ur help as i am trapped and under pressure on my client side. Thanks in advance. My yahoo chat id is india_n77(a)yahoo.com,if any one pl message me will be a great achivement for me. Looking for ur help. regards, Rakesh Mukherjee Send instant messages to your online friends http://in.messenger.yahoo.com

1 0

freeradius-mysql-clid
by Sam Njenga 12 Sep '05

12 Sep '05

Hi all I have downloaded the latest freeradius and compiled ok. I have tested it and it works fine. I would like to authenticate calls based on Caller-Id. What do I have to have in the tables. A small example will be highly appreciated. /Sam

2 2

mysql connections - segmentation fault
by Andreas M. 12 Sep '05

12 Sep '05

Hello, i´ve installed FR 1.0.4, now when i start the server, during the connection to a mysql database, after the first one there is a segmentation fault. It is working with just one connection , but i can´t find the reason for this. Maybe it has already been reported, i found similar in the internet, but no solution. I´m running FR on a Debian 3.01 machine. Thanks for all, Andreas M

2 5

RE: Huntgroup-Name
by Jonathan De Graeve 12 Sep '05

12 Sep '05

Putted this into the database: \"^(vpn|ras)$\" I also tried this: ^(vpn|ras)$ Any idea's? -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Nicolas Baradakis Verzonden: zondag 11 september 2005 18:07 Aan: FreeRadius users mailing list Onderwerp: Re: Huntgroup-Name Jonathan De Graeve wrote: > Is it possible to specify multiple huntgroup names in sql? Lets say > sqlgroup IT can connect to devices in the huntgroup vpn and ras > (something like Huntgroup-Name == vpn,ras in sql??) Huntgroup-Name =~ "^(vpn|ras)$" -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Problems when using Cisco-AVPairs[*]
by Admin 12 Sep '05

12 Sep '05

I need some help with Cisco AVPAirs, I am using freeradius + postgresql. When I have the following entries in my radreply table - database=# SELECT * from radreply where username='test' order by id; id | username | attribute | op | value ----+----------+--------------+----+------------------------------------ 72 | test | Cisco-AVPair | = | ip:inacl#1=deny tcp any any eq 25 73 | test | Cisco-AVPair | += | ip:inacl#1=permit ip any any 74 | test | Cisco-AVPair | += | ip:outacl#2=deny tcp any any eq 25 75 | test | Cisco-AVPair | += | ip:outacl#2=permit ip any any the access list works. However, when I modify the entries database=# SELECT * from radreply where username='test' order by id; id | username | attribute | op | value ----+----------+-----------------+----+------------------------------------ 76 | test | Cisco-AVPair[0] | = | ip:inacl#1=deny tcp any any eq 25 77 | test | Cisco-AVPair[1] | = | ip:inacl#1=permit ip any any 78 | test | Cisco-AVPair[2] | = | ip:outacl#2=deny tcp any any eq 25 79 | test | Cisco-AVPair[3] | = | ip:outacl#2=permit ip any any none of the Cisco-AVPairs are passed to the Cisco NAS ( I can see that in the /var/log/radacct/{NAS-IP}/reply-detail file ). A radiusd -v shows radiusd: FreeRADIUS Version 1.0.4, for host , built on Jul 31 2005 at 16:53:35 Thanks In advance. Nat

2 1