- Freeradius-Users - lists.freeradius.org

freeradius 1.0.4 and Cisco WLSE
by M.McNeil 22 Aug '05

22 Aug '05

Hello, I am having an issue getting Cisco's WLSE 2.11 to successfully authenticate with FreeRadius 1.0.4. I read where Alan DeKok stated that the "supplicant" is broken, and was wondering if this is something Cisco has to fix with the WLSE? or is there a way for me to fix the supplicant? Finally, I read where there were some freeradius patches that would remedy this problem. Can someone provide me with a copy of those patches ? The ones posted on this site have errors in them and the LEAP patch fails consistently at line 147 of rlm_eap/types/rlm_leap/rlm_eap_leap.c Any help would be greatly appreciated. Best Regards, Mike McNeil Sr. Network Engineer University of California Berkeley

2 1

EAP TTLS Certificate - Re-sending Access-Challenge
by Michael Poser 22 Aug '05

22 Aug '05

Hello, i have a problem with EAP using TTLS. I set up a second Freeradius Server (1.04) with a valid certificate from TrustCenter (The certificate from the first FR-Server was selfsigning by openssl - it works very well) The certificate is installed and radiusd -X comes up with no error message. But when i want to authenticate with securew2 or odyssey Client the authentication stopps after the first Access-Request: --8<-- rad_recv: Access-Request packet from host 10.87.80.1:3072, id=151, length=117 User-Name = "anonymous" NAS-IP-Address = 10.87.80.1 NAS-Port = 16 Calling-Station-Id = "00:05:4e:43:f8:1c" NAS-Identifier = "Spielzimmer" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000e01616e6f6e796d6f7573 Message-Authenticator = 0x494893f6addf1946ac5be4d35596f0f3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 70 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 151 to 10.87.80.1:3072 EAP-Message = 0x010200160410573ff27c2d0f1c3dbaa4362e694da04f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc3115a008d79ac992dfde255f0e7ea2a Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.87.80.1:3072, id=151, length=117 Sending duplicate reply to client lancom-ap:3072 - ID: 151 Re-sending Access-Challenge of id 151 to 10.87.80.1:3072 --8<-- After this, the Client sends the same packet with the same id to the Server; it goes in circles. The working FR-Server continues after the first Access-Request with a second Access-Request with different id and the authentication process proceeds. The configuration is the same as the working FR-Server with selfsigning certificates. Does anybody has a little help for this strange behavior, maybe is the Trustcenter certifacte wrong? Regards, Michael

2 1

Database field lengths for radacct and radpostauth
by Thor Spruyt 22 Aug '05

22 Aug '05

I've reported bug 266 with a patch for postgresql http://bugs.freeradius.org/show_bug.cgi?id=266 You don't know the maximum length of the username and password of your roaming partners, but you need to store those as well into the database. -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

3 3

Re: Re: clients.conf problem
by dev_null 22 Aug '05

22 Aug '05

Hello, I tried what you said but the server ignored both localhost & 10.20.1.x requests. Could this be a bug in the 20050818 snapshot? The only way it works is when including both and only 10.20.1.0/24 & 10.20.1.100 but it wont' work if a third client is added. :( ----- Original Message Follows ----- > I have a hunch... > > How many clients are in your clients.conf file? Is it just those two or > do you have any more? Are those the *first* two clients? > > If you only have two clients, and its the two you listed there, try > putting the localhost (127.0.0.1) client declaration in first followed > by the 10.20.1.0/24 client declaration (leave out the 10.20.1.100 client > declaration) and see if that works. > > --Mike -- Naručite svoj XXLadsl - instalacija i modem i dalje za samo 1 kn! Postanite i vi korisnik ultra brzog Interneta! http://www.iskon.biz/xxladsl

3 3

Elapsed time billing.
by sean 22 Aug '05

22 Aug '05

Hi everyone, Thanks to the advice and help I got from the list I now have a fully working FreeRadius server with MySQL. I can issue user names and passwords for set amounts of time e.g. 1 hour or 24 hours.What I'd like to do is issue names and passwords that will last for passed time e.g. one day or one month. Has anyone done this and can you advise me on how to go about it. Thanks for all the help in the past. Regards, Sean

2 1

external script collecting invironment variables
by vicky 22 Aug '05

22 Aug '05

Hi all, I'm run a "home made" script whenever I receive an accounting- start, stop or alive. In the script I get the value of all the attributes set in the environment variables (example : val = getenv("USER_NAME") ). I want to count how many attributes contain no value (or doesn't not exist) so I have a check (example : if(val == NULL) ) and I have a counter variable. I check with NULL because I thought when an attribute has no value, the value would be NULL butt apparently it is not always the case. I guess it is different when the attribute is sent without a value and when it is not sent at all. I would like to know what value contains in these two cases. Anyone? Thanks! -- Vicky

2 1

mysql troubles
by Lewis Bergman 22 Aug '05

22 Aug '05

Versions: FreeRADIUS Version 1.0.4, for host , built on Aug 19 2005 at 12:44:42 mysql Ver 14.7 Distrib 4.1.12, for pc-linux-gnu (i686) using readline 4.3 mysql server version: 4.1.12-max Trouble: Per FAQ, started with the simple plain users file auth, which works. Moved to mysql which does not. radiusd -X shows the mysql connection being made and all appears well on startup as noted. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "before" main: nospace_pass = "before" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "10.10.0.51" sql: port = "" sql: login = "login" sql: password = "passwd" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = yes sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@10.10.0.51:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. When I make a request for a user that does exist in the db I get a reject: # radtest testuser testuser localhost:1812 500 cAn2paYme Sending Access-Request of id 184 to 127.0.0.1:1812 User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = auth1.ispdone.com NAS-Port = 500 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=184, length=20 And the radiusd says: rad_recv: Access-Request packet from host 127.0.0.1:45348, id=184, length=60 User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 255.255.255.255 NAS-Port = 500 rad_rmspace_pair: User-Name now 'testuser' rad_rmspace_pair: User-Password now 'testuser' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 2 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testuser' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testuser' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): No matching entry in the database for request from user [testuser] rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [testuser/testuser] (from client localhost port 500) auth: Failed to validate the user. Login incorrect: [testuser/testuser] (from client localhost port 500) Delaying request 2 for 1 seconds Finished request 2 But, when I run the same sql command from the radius server's mysql client I get: mysql> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' ORDER BY id; +----+----------+---------------+----------+----+ | id | UserName | Attribute | Value | op | +----+----------+---------------+----------+----+ | 8 | testuser | User-Password | testuser | == | +----+----------+---------------+----------+----+ 1 row in set (0.04 sec) If I put the user in the users file, the correct post-auth sql query is executed and the accounting record is correctly inserted into the db. So in summery, I am confused why radius says "rlm_sql (sql): No matching entry in the database for request from user [testuser]" when the above sql does find it. I know it must be something icredibly stupid I have missed but I can't seem to find it. Any help at this point would be greatly appreciated. -- Lewis Bergman Texas Communications 4309 Maple ST. Abilene, TX 79602 325-691-3301

2 3

PAP configuration problem
by Lee Bobby 22 Aug '05

22 Aug '05

hello,everyone, I have written a client which send RADIUS packet to my freeradius server.There is problem about the PAP,like this: ...... modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 86 to 222.28.113.244:1174 ....... I have check the radiusd.conf and find the configuration like this: ....... # MODULE CONFIGURATION modules { pap { encryption_scheme = md5 } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } eap { default_eap_type = md5 timer_expire = 60 md5 { } } mschap { authtype = MS-CHAP } } ...... # Authorization authorize { preprocess } .... # Authentication. authenticate { Auth-Type PAP { pap } } I don't whether I forget the PAP config and where to add the configure. Can anyone help me? thank you all so much~~

1 0

How to Disable RADIUS user logins if 'Session-Timeout' falls below 0
by sagar.patil＠bt.com 22 Aug '05

22 Aug '05

Hi All, I am using FreeRadius with PostgreSQL and everything is running like a charm besides a small issue. I am using 'session-timeout' attribute in radreply table to control user session time. I have added a trigger on RADACCT table which subtracts amount of time used by user from RADREPLY each time when he logs in. It does work but when time is below 0 or negative I need to stop user from getting into my system and I am failing to do so. Here are my RADREPLY Table entries INSERT INTO radreply (id, username, attribute, op, value) VALUES (2, 'sagar', 'Idle-Timeout', ':=', '300'); INSERT INTO radreply (id, username, attribute, op, value) VALUES (3, 'sagar', 'Reply-Message', ':=', 'You Have Logged in Successfully'); INSERT INTO radreply (id, username, attribute, op, value) VALUES (1, 'sagar', 'Acct-Interim-Interval', ':=', '120'); INSERT INTO radreply (id, username, attribute, op, value) VALUES (4, 'sagar', 'Session-Timeout', ':=', '-904'); The easiest way would be altering Authenticate SQL and adding a condition to check Session-Timeout to see it doesn't fall below 0 I am not very good in POSTGRES so can someone please let me know how to do it. The other way would be using a Function /Procedure to carry out this check but my question is how to use procedures/functions in postgres.conf authenticate_query = "SELECT Value,Attribute FROM ${authcheck_table} \ WHERE UserName = '%{User-Name}' AND ( Attribute = 'User-Password' OR Attribute = 'Crypt-Password' ) \ ORDER BY Attribute DESC" Sagar Patil British Telecommunications plc Registered office: 81 Newgate Street London EC1A 7AJ Registered in England no. 1800000. This electronic message contains information from British Telecommunications plc which may be privileged or confidential. The information is intended to be for the use of the individual(s) or entity named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. If you have received this electronic message in error, please notify us by telephone or email (to the numbers or address above) immediately.

3 2

How to use Framed-Pool
by Nirmal 22 Aug '05

22 Aug '05

Hi, m using freeradius with mysql. my dynamic ip addresses are stored in /etc/raddb/ip file... how can i use Framed-Pool attribute in order to assign ip from different pool ? i dont know which attr should be used ? Framed-Pool or Pool-Name TIA Nirmal __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0