- Freeradius-Users - lists.freeradius.org

Authentication problem
by Hamid Salim 03 Aug '05

03 Aug '05

Hi all, i was wondering if anyone has successfully implemented the following setup and/or had any issues. this is my second post. your help will be greatly appreciated. I have a setup as follows: Fedora core 3 FreeRadius 1.0.4 openssl .098 Dell TrueMobile 1170 Access Pointv2.3.3 802.11b/g cards for AP and supplicant Windows XP SP2 FreeRadius is not authenticating, there are no messages on the screen or the logfile. The AP does not see the FreeRadius server! I think this is a configuration issue outside of FreeRadius. Has anyone had similar problem. Any help will be greatly appreciated as i have hit a wall here and i am on a deadline! thanks Hamid.

3 2

Coa and Disconnect Message
by gennaro amelio 03 Aug '05

03 Aug '05

hi all, i' am an italian student and i' m a newbie with freeradius. So sorry if i ask stupid things... Can i use Freeradius to do a prepaid-billing system?? Freeradius supports CoA and Disconnect Mesage? Thanks

2 1

ldap basedn assignment
by ggreen＠olemiss.edu 03 Aug '05

03 Aug '05

I have freeradius setup to use 2 ldap servers as backend authentication. One is openldap and the other is windows active directory. They have different basedn structures and these are laid out separately in the conf file. I have it setup to authenticate off of active directory first and openldap second. Everything is working fine except for the case of a user who's openldap username is the same as someone in active directory. In the authorize stage it looks in both AD and ldap. In the authenticate stage it queries both AD and ldap. The problem is that in the authenticate stage it uses the basedn of the server that returns the first ok in the authorize stage. So if the username is in both AD and ldap, openldap rejects the user because it is using the AD basedn to query the openldap server. Is there a way for me to force the basedn for the ldap server regardless of which server returned the first ok? Thanks in advance g

2 1

rlm_sql post-auth variable bug?
by Fernando Schapachnik 03 Aug '05

03 Aug '05

Hi, In my AAA chain I have a module that *sometimes* adds a custom attribute (defined in my dictionary as ipaddr) called Auth-NAS. This module is called in the authorize section. Later on, in the post-auth session I have a SQL-module that has: postauth_query = "INSERT INTO ${postauth_table} (...) \ VALUES (.... \ '%{check:Auth-NAS:-0.0.0.0}', ...)" When run, and Auth-NAS is not present, it outputs: rlm_sql (sql-xxx) in sql_postauth: query is INSERT INTO table (...) ??VALUES (..., '=01', ...); Sometimes the '=01' is replaced by '255.255.255.255'. Is this a bug in some place or am I doing something wrong? Any ideas? Thanks in advance. Fernando.

1 1

FreeRadius Authentication-Please help
by Hamid Salim 03 Aug '05

03 Aug '05

I have a setup as follows: FreeRadius 1.0.4 openssl .098 Dell TrueMobile 1170 Access Pointv2.3.3 802.11b/g cards for AP and supplicant Windows XP SP2 FreeRadius is not authenticating, there are no messages on the screen or the logfile. The AP does not see the FreeRadius server! I think this is a configuration issue outside of FreeRadius. Has anyone had similar problem. Any help will be greatly appreciated as i have hit a wall here and i am on a deadline! thanks Hamid.

2 1

dialadmin question
by Carlo Paris 03 Aug '05

03 Aug '05

hi all, can I use dialadmin for create users and autenticate this in a lan and exit out the router?? LAN (many users) -> router/fw ---> internet | | freeradius server thanks in advance. damon

2 1

accounting - respose from freeradius, and forward
by Tariq Rashid 03 Aug '05

03 Aug '05

hi - is it possible for freeradius to do the following? we'd like freeradius to reply to accounting requests (start, stop, interim) with acknowledgements, but also to forward the accounting request to a backend radius server but to ignore the response from this prozy behaviour. this means that the querying NAS equipment doesn't spend time and resources waiting for a backend reply to an accounting request. however, the backend radius (possibly belionging to a 3rd party organisation) will need to see the accounting packets - we just ignore/drop their repsonse. diagramatically: 1. [NAS] ------ accounting -----> [freeradius] 2. [NAS] <----- accounting ------ [freeradius] -----------> [radius server] 3. [NAS] [freeradius] <----------- [radius server] is this possible? tariq

2 1

No accounting replies to NAS'es!
by Erling Paulsen 03 Aug '05

03 Aug '05

Hi. I might have missunderstood some concepts here! We have a freeradius server as proxy, but it's doing all the accounting by itself. Authentication is handled by remote servers, i.e. other freeradius'es and IAS'es. Accounting is logged fine to detail files and a remote Postgresql DB. So, as I understood it, I have made proxy.conf setups like the following example: realm student.X.Y { type = radius authhost = studentserv.X.Y:1812 accthost = LOCAL secret = <some secret> nostrip } Setting accthost to LOCAL for handling the accounting. The problem is that the NAS'es never recieves any accounting reply and I don't understand why? This causes the NAS'es (cisco switches) to timeout and retransmit lotsof duplicates. So, any hints to why replies are not sent back? - Erling -- ----------------|sig|--- Erling.Paulsen(a)cc.uit.no Nettseksjonen, ITavd UiT

3 2

re:Re: huntgroups/groups with sql
by Michel Jansens 03 Aug '05

03 Aug '05

Thanks, Michel Jansens >Michel Jansens <michel.jansens(a)ulb.ac.be> wrote: >> Tryed to add 'Fall-Through = Yes' to all 'radgroupcheck' entries, but it didn't work. > > It works in the CVS head, and will be in 1.1.x and following versions. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

Re: freeradius with EAP-TTLS and PAP auth
by Stefan.Neis＠t-online.de 03 Aug '05

03 Aug '05

Hi, > And forces (even if I encountered several times that may not be done like that) in the users conf : > testuser Auth-Type := PAP, User-Password == "testpass" > and also tested EAP, Don't. FreeRadius typically treats EAP-Requests as _two_ requests. It handles the EAP stuff and then generates a new request for the stuff that's contained in the tunnel (e.g. PAP) and sends that to itself. So, if you force Auth-Type to either EAP or PAP unconditionally, either the "inner" (PAP) or the outer (EAP) protocol cannot be handled. > and not specifying the Auth-Type (which then fallback to the System > module and obviously fail) Now, that's a problem... > Without Auth-Type : > > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 5 > rlm_unix: [testuser]: invalid password Apparently, it can't find a password (cleartext or uncrypted) for the user, so it falls back to Auth-Type System. Try to get PAP authentication working by itself, first, i.e. just use radtest to send username/password combinations to the server and fix their handling. Once that works, EAP-TTLS with PAP should work as well. HTH, Stefan

2 1