- Freeradius-Users - lists.freeradius.org

Can I add extra fields to the radius accounting database?
by Miguel Angel Quiles 06 Sep '05

06 Sep '05

Hi, I've got freeradius 1.0.2 on a SUSE 9.3. I was thinking if I could add a new field to the radius accounting. I'm using mysql. I already added the field to the radacct table in the radius database. And I've tried to modify the sql.conf file in the raddb directory. When I restart the service the freeradius won't start because off an error. I've created the field "TunnelType", and I added the values in the different queries, such as: accounting_update_query_alt = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, TunnelType) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Tunnel-Type:0}')" I hope somebody can help me. Thanks

2 2

Authenticating between a Cisco 3640 and radius server
by Amos Cottrill 06 Sep '05

06 Sep '05

I setup free radius on a linux box and am trying to authenticate a user from a cisco 3640 router. Below is the output I am receiving when using radiusd -xxyz -l stdout. The router will not let me login, so something isn't working properly. Any suggestions??? I set the radius server up to use port 1645, so it resembles the cisco settings. Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 5 got semaphore Thread 5 handling request 0, (1 handled so far) NAS-IP-Address = 192.168.82.50 NAS-Port = 131 NAS-Port-Type = Virtual User-Name = "cisco" Calling-Station-Id = "10.0.1.19" User-Password = "harley" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched cisco at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [cisco] (from client spare_3640 port 131 cli 10.0.1.19) Sending Access-Accept of id 3 to 192.168.82.50:1645 Service-Type = Login-User Login-Service = Telnet Finished request 0 Going to the next request Thread 5 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 Sending duplicate reply to client spare_3640:1645 - ID: 3 Re-sending Access-Accept of id 3 to 192.168.82.50:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 43171770 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 --- Walking the entire request list --- Waking up in 31 seconds... Thread 4 got semaphore Thread 4 handling request 1, (1 handled so far) NAS-IP-Address = 192.168.82.50 NAS-Port = 131 NAS-Port-Type = Virtual User-Name = "cisco" Calling-Station-Id = "10.0.1.19" User-Password = "harley" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cisco", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched cisco at 152 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [cisco] (from client spare_3640 port 131 cli 10.0.1.19) Sending Access-Accept of id 3 to 192.168.82.50:1645 Service-Type = Login-User Login-Service = Telnet Finished request 1 Going to the next request Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.82.50:1645, id=3, length=74 Sending duplicate reply to client spare_3640:1645 - ID: 3 Re-sending Access-Accept of id 3 to 192.168.82.50:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 3 with timestamp 4317177a Nothing to do. Sleeping until we see a request. -- Amos Cottrill Assistant Network Coordinator - SEOVEC amos(a)seovec.org Ph:(740) 594-7663 ext 119 Fax:(740) 592-6251

1 0

linux newby attempts freeradius (unsuxesfull)
by Fred Zinsli 06 Sep '05

06 Sep '05

Rather that tell me what I an doing wrong (apart from attempting this) can someone point me to where I can find out what I need to know. Scenario: Debian sarge installed (no probs or errors) on i386 machine. Attempting to install freeradius-1.0.4.tar.gz will not ./configure without errors. As I don't know what I am ment to be looking for, I can't find what I am doing wrong. Trying to be smart, I went to the debian site and downloaded freeradius_1.0.4-2_i386.deb from http://packages.debian.org/testing/net/freeradius I can't find documentation for this, so don't know what to do with it now I have it. Given I am NOT familiar with linux at all, and have ventured into this reluctently, can someone point me to some really bullet proof documentation that doesn't assume people already have an extensive knowledge of linux before they start. I have been working on this for 3 weeks now, searched gallaxies far away for info, god is now refusing to take my calls, and my wife has threatened to lock me in my room so she doesn't have to put up with me. I have also learned some very colorful words. Someone please save me. Fred

3 2

PEAP TLS establishment and certificates
by Juan Daniel Moreno 06 Sep '05

06 Sep '05

Hi everyone, I would like to configure a freeradius 1.0.4 with PEAP protocol and OpenSSL certificates. My first question is where should I place the generated certificates with Openssl? As I am developing a client's interface, can anybody tell me how to "create" the Client_Hello packet? Thank you very much!! Juan Daniel MORENO

1 0

user authorization pam radius
by Pablo Rodriguez Dominguez 06 Sep '05

06 Sep '05

Hi all. Do yo now if its posible to do user authorization using pam radius and freeradius?. How can i do it. Tks -----Original Message----- From: Sam Njenga To: freeradius-users(a)lists.freeradius.org Sent: 05/09/2005 18:24 Subject: freeradius-mysql-clid Hi all I have downloaded the latest freeradius and compiled ok. I have tested it and it works fine. I would like to authenticate calls based on Caller-Id. What do I have to have in the tables. A small example will be highly appreciated. /Sam - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

freeraduis + pppoe-server on linux
by Wassim abbas 05 Sep '05

05 Sep '05

Hi i need help with how to setup freeradius + pppoe-server , i searched on the net but no good docs so if anyone can help or send me some docs thanks

2 1

Windows XP supplicant limitation ?
by Jérémy Cluzel 05 Sep '05

05 Sep '05

Hi, >/ /Hi, >/ / >/ />/ //- user auth after the doain controler has accepted logon. />/ />/ Does anybody know if the windows XP supplicant is able to do this ? />/ />/ Do I need a better supplicant ? aegis? secureW2? Funk Odissey ? / >/ /i believe it wont do anything useful or multifunctional like >/ /you require. a good option would be to use the supplicant >/ /so authenticate the system, then use something like pGina >/ /to do the user authentication - that can then authenticate >/ /the user against a RADIUS server >/ / >/ /pgina - http://pgina.xpasystems.com/info/ >/ / >/ / >/ /alan In fact, XP supplicant seems to allow only one auth method (EAP-TLS or PEAP). If I use TLS machine auth will be OK, so I can log on my domain and get my roaming profile. But If want to keep my network connection, I have to use a user cert too or do the registry hack (AuthMode set to 2). If I choose to use PEAP, computer auth, as far as I understood, will never work, so I won't be able to log on my domain... A solution may be a supplicant which first tries to make a network connection (using username/password), and then, if it succeeds, tries to authenticate user against the domain. I don't see how pgina will help me... sorry. Regards, Jeremy

1 0

[PEAP] Authenticate aigainst OpenLDAP Directory with NT Hashes
by Sebastian Mauer 05 Sep '05

05 Sep '05

Hello there, I just researched a little bit in the freeradius-users list and found out that there have to be clear passwords in the LDAP Direcotry to get FreeRADIUS to work with LDAP. However I think it's not very secure to store the passwords in clear in the Directory, even if there are ACLs in Place. Is it really not possible to do PEAP (w. MSCHAPv2) when I have NT-Hashes in the Directory? My target is to use LDAP as authentication source for my UNIX Workstations (trough pam_ldap), my Windows Workstations (trough Samba accessing LDAP, therefor I have the NT-Hashes in the Dir) and RADIUS for dialup and wireless users. Has someone done this before? Does someone know a good Howto to achieve this? Sincerely, Sebastian Mauer

3 2

DialUp Admin And Crypt Passwords
by Geoffrey Cauchi 04 Sep '05

04 Sep '05

Hi I got the Freeradius version 1.0.4 setup with MySql. It is all working fine. However, when creating users through the dialup admin, the password is stored in the database without the salt key for md5, and this is causing the users' access request to be rejected. If the password is created through the unix passwd utility and then updated in the sql database, that user can authenticate successfully. Has anyone came across this problem? Thanks for your help Gef

1 1

Windows XP supplicant limitation ?
by Jérémy Cluzel 04 Sep '05

04 Sep '05

Hi, I want to use - EAP-TLS for machine auth (with cert.) then - EAP-PEAP for the user auth (with login/password) I managed to make both to work alone but not together... I just want to follow the xp supplicant behaviour: - computer auth. before logon to gain network access to the domain controler. - user auth after the doain controler has accepted logon. Does anybody know if the windows XP supplicant is able to do this ? Do I need a better supplicant ? aegis? secureW2? Funk Odissey ? Thanks Jeremy

2 1