- Freeradius-Users - lists.freeradius.org

FreeRadius Authentication-Please help
by Hamid Salim 03 Aug '05

03 Aug '05

I have a setup as follows: FreeRadius 1.0.4 openssl .098 Dell TrueMobile 1170 Access Pointv2.3.3 802.11b/g cards for AP and supplicant Windows XP SP2 FreeRadius is not authenticating, there are no messages on the screen or the logfile. The AP does not see the FreeRadius server! I think this is a configuration issue outside of FreeRadius. Has anyone had similar problem. Any help will be greatly appreciated as i have hit a wall here and i am on a deadline! thanks Hamid.

2 1

dialadmin question
by Carlo Paris 03 Aug '05

03 Aug '05

hi all, can I use dialadmin for create users and autenticate this in a lan and exit out the router?? LAN (many users) -> router/fw ---> internet | | freeradius server thanks in advance. damon

2 1

accounting - respose from freeradius, and forward
by Tariq Rashid 03 Aug '05

03 Aug '05

hi - is it possible for freeradius to do the following? we'd like freeradius to reply to accounting requests (start, stop, interim) with acknowledgements, but also to forward the accounting request to a backend radius server but to ignore the response from this prozy behaviour. this means that the querying NAS equipment doesn't spend time and resources waiting for a backend reply to an accounting request. however, the backend radius (possibly belionging to a 3rd party organisation) will need to see the accounting packets - we just ignore/drop their repsonse. diagramatically: 1. [NAS] ------ accounting -----> [freeradius] 2. [NAS] <----- accounting ------ [freeradius] -----------> [radius server] 3. [NAS] [freeradius] <----------- [radius server] is this possible? tariq

2 1

No accounting replies to NAS'es!
by Erling Paulsen 03 Aug '05

03 Aug '05

Hi. I might have missunderstood some concepts here! We have a freeradius server as proxy, but it's doing all the accounting by itself. Authentication is handled by remote servers, i.e. other freeradius'es and IAS'es. Accounting is logged fine to detail files and a remote Postgresql DB. So, as I understood it, I have made proxy.conf setups like the following example: realm student.X.Y { type = radius authhost = studentserv.X.Y:1812 accthost = LOCAL secret = <some secret> nostrip } Setting accthost to LOCAL for handling the accounting. The problem is that the NAS'es never recieves any accounting reply and I don't understand why? This causes the NAS'es (cisco switches) to timeout and retransmit lotsof duplicates. So, any hints to why replies are not sent back? - Erling -- ----------------|sig|--- Erling.Paulsen(a)cc.uit.no Nettseksjonen, ITavd UiT

3 2

re:Re: huntgroups/groups with sql
by Michel Jansens 03 Aug '05

03 Aug '05

Thanks, Michel Jansens >Michel Jansens <michel.jansens(a)ulb.ac.be> wrote: >> Tryed to add 'Fall-Through = Yes' to all 'radgroupcheck' entries, but it didn't work. > > It works in the CVS head, and will be in 1.1.x and following versions. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

Re: freeradius with EAP-TTLS and PAP auth
by Stefan.Neis＠t-online.de 03 Aug '05

03 Aug '05

Hi, > And forces (even if I encountered several times that may not be done like that) in the users conf : > testuser Auth-Type := PAP, User-Password == "testpass" > and also tested EAP, Don't. FreeRadius typically treats EAP-Requests as _two_ requests. It handles the EAP stuff and then generates a new request for the stuff that's contained in the tunnel (e.g. PAP) and sends that to itself. So, if you force Auth-Type to either EAP or PAP unconditionally, either the "inner" (PAP) or the outer (EAP) protocol cannot be handled. > and not specifying the Auth-Type (which then fallback to the System > module and obviously fail) Now, that's a problem... > Without Auth-Type : > > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 5 > rlm_unix: [testuser]: invalid password Apparently, it can't find a password (cleartext or uncrypted) for the user, so it falls back to Auth-Type System. Try to get PAP authentication working by itself, first, i.e. just use radtest to send username/password combinations to the server and fix their handling. Once that works, EAP-TTLS with PAP should work as well. HTH, Stefan

2 1

freeradius with EAP-TTLS and PAP auth
by Mathieu Geli 03 Aug '05

03 Aug '05

Hi folks, I'm trying to configure freeradius to authenticate users through a TTLS tunnel witth PA authentication scheme. Xsupplicant has been configured like : allow_types = eap_ttls eap-ttls { root_cert = /etc/xsupplicant/tls/ca_cert.pem phase2_type = pap pap { username = <BEGIN_UNAME>testuser<END_UNAME> password = <BEGIN_PASS>testpass<END_PASS> } } subsequently for freeradius, I enabled in radius.conf the pap module : pap { encryption_scheme = md5 } (tried also crypt and clear options without any success) But I do not see anything in eap.conf like ttls { ... pap { ... } } (the interesting part is the pap *inside* the ttls part) So I tried to enable PAP directly in radiusd.conf authenticate part : authenticate { Auth-Type PAP { pap } ... } And forces (even if I encountered several times that may not be done like that) in the users conf : testuser Auth-Type := PAP, User-Password == "testpass" and also tested EAP, and not specifying the Auth-Type (which then fallback to the System module and obviously fail) With EAP the error I get is : rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message (xsupplicant and freeradius are apparently not talking the same language) With PAP : rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: Attribute "Password" is required for authentication. modcall[authenticate]: module "pap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user (also tested to put 'Password' instead of 'User-Password' directive, still the same error.) Without Auth-Type : rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_unix: [testuser]: invalid password I'm maybe trying to test something that is not still finished ? By the way MD5 over TTLS works fine, tested with secureW2 WInXP supplicant. (Seems that xsupplicant does not support md5 as TTLS phase2) Thanks for your support ! -- Mathieu

1 0

Session-Timeout zero value
by Rashad Rustamoff 03 Aug '05

03 Aug '05

Plz, tell me the correct way. Our clients use prepaid hourly cards. I wrote external script that runs when Accounting-Stop packet received and decrements Session-Timeout attr. in database by value of Acct-Session-Time attr. in the Accounting-Stop packet. What method will be correct to reject user when Session-Timeout are exhausted. Has freeradius any built-in ability to realize a mechanism described above. Thanks. -----Original Message----- From: aland(a)nitros9.org [mailto:aland@nitros9.org]On Behalf Of Alan DeKok Sent: Tuesday, August 02, 2005 9:59 PM To: rashad(a)nakhchyvan.az; FreeRadius users mailing list Subject: Re: Session-Timeout zero value "Rashad Rustamoff" <rashad(a)nakhchyvan.az> wrote: > I'm wonder is it correct to reject user by setting Session-Timeout attribute > to zero. No. > In case of our NAS it works fine. That's blind luck. Alan DeKok.

2 1

sementation fault
by vicky 03 Aug '05

03 Aug '05

Hi all, I trying to install (compile from source) freeRADIUS 1.0.4 on a SuSe Linux system version 9.1. The configuration, compilation and installation goes well. The problem comes when I run it with -X -A. You can see the output from that attached with this mail. I have made sure the the mysql-devel packages is installed so I guess it is not that. The last two lines in the output are : sql: postauth_query = "INSERT into radpostauth (id, user, pass, session_id, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{Acct-Session-Id}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" It tries to insert to a table 'radpostauth' that doesn't exist and further more there are no tables at all in the database. Is that normal? Please help me shed some light on this, Thanks! --Vicky Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/sql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "psaadm" main: group = "psaadm" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradius/lib Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/opt/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded attr_rewrite attr_rewrite: attribute = "User-Name" attr_rewrite: searchfor = "promo.*" attr_rewrite: searchin = "packet" attr_rewrite: replacewith = "%{User-Password}" attr_rewrite: append = no attr_rewrite: ignore_case = no attr_rewrite: new_attribute = no attr_rewrite: max_matches = 10 Module: Instantiated attr_rewrite (attr_rewrite) Module: Loaded preprocess preprocess: huntgroups = "/opt/freeradius/etc/raddb/huntgroups" preprocess: hints = "/opt/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "prefix" realm: delimiter = "/" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (prefix) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = yes realm: ignore_null = yes Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/opt/freeradius/etc/raddb/users" files: acctusersfile = "/opt/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/opt/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "admin" sql: password = "sntrustive" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = yes sql: sqltracefile = "/opt/freeradius/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{Stripped-User-Name:-%{User-Name}}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Acct-Input-Octets}', ? AcctOutputOctets = '%{Acct-Output-Octets}' ? WHERE AcctSessionId = '%{Acct-Session-Id}' ? AND UserName = '%{SQL-User-Name}' ? AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASIdentifier, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, ClientIPAddress, WISPrLocationId, WISPrLocationName) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Identifier}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{Client-IP-Address}', '%{WISPr-Location-Id}', '%{WISPr-Location-Name}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, ClientIPAddress, WISPrLocationId, WISPrLocationName) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}', '%{Client-IP-Address}', '%{WISPr-Location-Id}', '%{WISPr-Location-Name}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, session_id, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{Acct-Session-Id}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Segmentation fault

3 7

slipstream and freeradius Reply-Message
by Paul Knibbs 03 Aug '05

03 Aug '05

I want to be able to specify a Reply-Message attribute which is passed to slipstream, which in turn picks up an replymsgs file. However, I only want this to happen when the login fails. Everything I do seems to make it return a Reply-message only when it is successful. I am using freeradius, mysql and slipstream 4.0.127. I have basic authentication working ok. What I am trying to do is create custom failure messages for each user <http://www.nitroglobal.com/clickthru.cgi?id=outside> Nitro Web Accelerator works in conjunction with acceleration servers on the Internet to provide dial-up users with the ability to rapidly access Web pages and e-mail, and to download files much faster than would otherwise be the case."

1 0