- Freeradius-Users - lists.freeradius.org

RE: Two different sources, one with a single value
by Þórður Ívarsson 13 Sep '05

13 Sep '05

or "Auth-type = mac_address" ? > -----Original Message----- > From: Martin.Ward(a)uk.neceur.com [mailto:Martin.Ward@uk.neceur.com] > Sent: 13. september 2005 10:28 > To: FreeRadius users mailing list > Subject: Two different sources, one with a single value > > > Hi all, > > I'm just about getting the hang of FreeRadius now, thanks to > the various emails and stuff that people have been asking, > but I've not been able to find the answer to one particular question. > > I have a radius server that will process two types of request: > 1. A user name and password login. Currently it's a flat file > but I will change that the use the rlm_unix module in the near future. > 2. A MAC address, which is passed in as two attributes, > "User-Name=MAC Address" and "User-Password=MAC Address" > > For the MAC address I want a flat file with just the MAC > addresses in it. I have tried using the passwd module and > just ignoring the User-Password attribute like so: > > passwd mac_address { > filename = /var/mac_addresses > format = "*User-Name" > } > > but this fails to authenticate even though it gets through > the Authorize section OK: > > rad_recv: Access-Request packet from host > 172.29.252.228:1026, id=98, length=160 > NAS-IP-Address = 172.29.252.228 > NAS-Port-Id = "10:2" > Extreme-Attr-208 = 0x556e6b6e6f776e204c6f636174696f6e > NAS-Port-Type = Wireless-802.11 > User-Name = "000e359ec2ce" > User-Password = "000e359ec2ce" > Calling-Station-Id = "000e359ec2ce" > Called-Station-Id = "0004960e2e00" > NAS-Identifier = "Altitude 300" > Proxy-State = 0x31303a32040436c236c236c236c236c236c236c236c2 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 42 > modcall[authorize]: module "preprocess" returns ok for request 42 > radius_xlat: '/var/log/freeradius/radacct/172.29.252.228 > /auth-detail-20050913' > rlm_detail: > /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d > expands to > /var/log/freeradius/radacct/172.29.252.228/auth-detail-20050913 > modcall[authorize]: module "auth_log" returns ok for request 42 > modcall[authorize]: module "mac_address" returns ok for request 42 > modcall: group authorize returns ok for request 42 > auth: No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user > auth: Failed to validate the user. > Login incorrect: [000e359ec2ce/000e359ec2ce] (from client > wlan-switch port 0 cli 000e359ec2ce) > > Am I simply doing the impossible, or am I missing something > obvious (again)? > > |\/|artin > -- > Senior Network Administrator, NEC (Europe) Ltd. > Acton extension: 3379 > NEC*Net: 800-44-21-3379 > Direct: +44 20 8752 3379 > Fax: +44 20 8752 3389 > Mobile: +44 7721 869 356 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

1 0

RE: Two different sources, one with a single value
by Þórður Ívarsson 13 Sep '05

13 Sep '05

Has the user file "Auth-type=password" or similar? > -----Original Message----- > From: Martin.Ward(a)uk.neceur.com [mailto:Martin.Ward@uk.neceur.com] > Sent: 13. september 2005 10:28 > To: FreeRadius users mailing list > Subject: Two different sources, one with a single value > > > Hi all, > > I'm just about getting the hang of FreeRadius now, thanks to > the various emails and stuff that people have been asking, > but I've not been able to find the answer to one particular question. > > I have a radius server that will process two types of request: > 1. A user name and password login. Currently it's a flat file > but I will change that the use the rlm_unix module in the near future. > 2. A MAC address, which is passed in as two attributes, > "User-Name=MAC Address" and "User-Password=MAC Address" > > For the MAC address I want a flat file with just the MAC > addresses in it. I have tried using the passwd module and > just ignoring the User-Password attribute like so: > > passwd mac_address { > filename = /var/mac_addresses > format = "*User-Name" > } > > but this fails to authenticate even though it gets through > the Authorize section OK: > > rad_recv: Access-Request packet from host > 172.29.252.228:1026, id=98, length=160 > NAS-IP-Address = 172.29.252.228 > NAS-Port-Id = "10:2" > Extreme-Attr-208 = 0x556e6b6e6f776e204c6f636174696f6e > NAS-Port-Type = Wireless-802.11 > User-Name = "000e359ec2ce" > User-Password = "000e359ec2ce" > Calling-Station-Id = "000e359ec2ce" > Called-Station-Id = "0004960e2e00" > NAS-Identifier = "Altitude 300" > Proxy-State = 0x31303a32040436c236c236c236c236c236c236c236c2 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 42 > modcall[authorize]: module "preprocess" returns ok for request 42 > radius_xlat: '/var/log/freeradius/radacct/172.29.252.228 > /auth-detail-20050913' > rlm_detail: > /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d > expands to > /var/log/freeradius/radacct/172.29.252.228/auth-detail-20050913 > modcall[authorize]: module "auth_log" returns ok for request 42 > modcall[authorize]: module "mac_address" returns ok for request 42 > modcall: group authorize returns ok for request 42 > auth: No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user > auth: Failed to validate the user. > Login incorrect: [000e359ec2ce/000e359ec2ce] (from client > wlan-switch port 0 cli 000e359ec2ce) > > Am I simply doing the impossible, or am I missing something > obvious (again)? > > |\/|artin > -- > Senior Network Administrator, NEC (Europe) Ltd. > Acton extension: 3379 > NEC*Net: 800-44-21-3379 > Direct: +44 20 8752 3379 > Fax: +44 20 8752 3389 > Mobile: +44 7721 869 356 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > >

1 0

accounting file with belkin 54g wireless router
by Michael Ding 13 Sep '05

13 Sep '05

Hi all, I have set up the freeraiuds to authenticate the user using WPA TKIP authentication method. The router I use is belkin 54g wireless router. I am able to authenticate the user correctly and the auth log file records all activities, but I am not able to get the accounting file. I rememeber a while back when I browsing this thread, someone mentioned that no every router sends accounting data to radius. Is this right? If so, what are the router sent acct data? If no, what do I need to do to get the acct data? Thanks a lot! Michael

2 2

Freeradius and PPPoe Server ?
by Dumpfbacke 102731 12 Sep '05

12 Sep '05

Hello, I search a HowTo for Freeradius+PPPoe. MFG. -- 5 GB Mailbox, 50 FreeSMS http://www.gmx.net/de/go/promail +++ GMX - die erste Adresse f�r Mail, Message, More +++

5 5

one question
by Richie Lee 12 Sep '05

12 Sep '05

My company is a security vendor company(www.fortinet.com). How to add dictionary.fortinet to the server's list of vendor dictionaries in later freeradius version? Does anyone know it? _________________________________________________________________ Designer Mail isn't just fun to send, it's fun to receive. Use special stationery, fonts and colors. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

2 5

Re: FR with MySQL. Proxying and repeated entries
by Paolo Rotela 12 Sep '05

12 Sep '05

Hi. I've downloaded, compiled and installed FR 1.0.5, but I'm still receiving the same results. the packet is discarded because of an invalid Message-Authenticator. This is part of the output (IP address hidden) for a "radclient" with "-s" and "-x" options rad_recv: Accounting-Response packet from host ******, id=83, length=38 rad_decode: Received packet from ****** with invalid Message-Authenticator! (Shared secret is incorrect.) radclient: radclient.c:440: send_one_packet: Assertion `radclient->reply == ((void *)0)' failed. Aborted Should I modify something at the config to let the Message Authenticator get handled correctly? Also, from a TCPDump I don't see any "Message Authenticator" in the Accounting-Request constructed by Radclient. I only see "Message Authenticator" in the "Accounting-Response" packet constructed by Cisco ACS and received (and discarded) by FR. Date: Fri, 19 Aug 2005 15:09:23 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: FR with MySQL. Proxying and repeated entries To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050819190923.3D22B16CCA(a)mail.nitros9.org> "Paolo Rotela" <paolo.rotela(a)bluetelecom.com> wrote: > With this one, Access-* packets go OK, but when the NAS (Cisco AS5300) > sends > an Accounting-Request to that realm and I proxy it to the home server, it > sends me an Accounting-Response with an (I think) irregular attribute: > Message-Authenticator (Ext. Attr. 80), wich I think is not permitted in > the > RFC for accounting packets. The IETF RADIUS extensions working group has a document which proposes fixes to a number of issues like this. > 1) Am I reading OK the RFC? I mean ¿Is it right that Attribute 80 is NOT > permitted in Accounting-* packets? I don't think it's specifically permitted, but it shouldn't be a problem. > 2) Each time the NAS re-sends packets, FR handles it as it were a new > packet, for a new call/connection. The RFC's say that's what the NAS is supposed to do. So for FreeRADIUS, it looks like a new connection. > 3) Is there any known bug or propietary feature from Cisco wich causes > this > incompatibility thing? I've searched about it and didn't find anything. No. It's a bug in FreeRADIUS. I'll put a patch into 1.0.5 that should fix it. Alan DeKok.

1 0

undefined reference 'md4_calc' compile error...
by Harris Christian D SSgt 1 CS/SCBAM 12 Sep '05

12 Sep '05

I am trying to build freeradius-1.0.5 on my NSLU2 running openembedded. Believe me when I say it is and has been a hard road. I've managed to fix the openssl install. I now have the openssl headers that were MIA. I managed to fix the libtool. I can now build libraries that use libtool -mode=link **** -lresolve -ltdl -lthreads and such without errors. I even modified all the Makefiles to include '--tag=thisisjunk' that could not be inferred and had to be specified. It seems like I am running into every problem out there trying to install the server. I have been able to successfully fix them all by myself, but now I stuck with this... gcc -I../../include -o smbencrypt smbencrypt.o smbdes.o ../../lib/libradius.a smbencrypt.o: In function `ntpwdhash': /home/slug/freeradius-1.0.5/src/modules/rlm_mschap/smbencrypt.c:60: undefined reference to `md4_calc' collect2: ld returned 1 exit status make: *** [smbencrypt] Error 1 The line in question from smbencrypt.c read as follows: md4_calc (szHash, szUnicodePass, (nPasswordLen<<1) ); and the #include "md4.h" defines the md4_calc function as: void md4_calc (unsigned char *, const unsigned char *, unsigned int); I not really much of a programmer, but this looks right to me. I'm at a loss as to why this won't compile. I've read postings on how other people fixed this. And they are all in some foreign programmer language I don't understand. What is it I'm messing up here?

1 0

Wireless authentication
by Dan Johansson 12 Sep '05

12 Sep '05

I know there are a handful of ways to set up wireless authentication. Some better than others. We have a customer oriented wireless network and we are trying to build a central authentication system for it, so that we can add and easily control customer radios from one location. What types of authentication should we be using? What should be avoided? Any experiences to share? Additionally, would we be able to route traffic to a captive page if the customer is placed on hold or doesn't have an account yet? I suppose that more of a microtik list question, but I'm just asking in case anyone knows. Thanks, Dan Johansson

2 1

Users file
by TK Lew 12 Sep '05

12 Sep '05

Hello, I have configured my users file to have the following entries :: steve Auth-Type := System Calling-Station-ID = calling-station-id I want freeradius to reply back with Calling-Station-Id whic basically the MSISDN but instead I got the "calling-station-id"? What is the correct syntax for calling-station-id ? Thanks for all ! TK

2 1

Session Time
by Sean 12 Sep '05

12 Sep '05

Hi All, I want to allow the SQL counter to continue deducting time from users after they log out until they reach a certain amount of time left. I have tried several ways to do it for example the following in sql.conf. accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' where Acct-Session-Time < 3600" I'm fairly sure that it's a question of creating the right sql command into radacc. I hope I have explained myself properly. Any advice will be much appreciated. Regards, Sean Bracken

1 0