- Freeradius-Users - lists.freeradius.org

Freeradius 1.0.4 Update - No Chap logins
by Radius 05 Jul '05

05 Jul '05

I did not see this one hit the list. No chap logins are working since the 1.0.4 installation Here is what is showing when I run radius -x This is only happening with those that are logging in through our wholesale service. Anyone logs in locally with the realm does fine. Some log errors. It's not accepting chap log ins. Any help where to look. rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". Login incorrect: [rniclh/<CHAP-Password>] (from client usa1 port 228 cli 5208778389) rad_recv: Access-Request packet from host 216.127.146.29:52982, id=50, length=213 User-Name = "rniclh(a)surftheusa.com" >>>> CHAP-Password = 0x014d582cee62362d9063da8b99c2f83c94 Why is it coming through like this? NAS-IP-Address = 63.215.26.191 NAS-Port = 228 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 31200 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 46667 Called-Station-Id = "5208294055" Calling-Station-Id = "5208778389" NAS-Identifier = "nas8.tcs1.Level3.net" Acct-Session-Id = "436987031" NAS-Port-Type = Async Ascend-NAS-Port-Format = 2_4_5_5 Attr-102 = 0x6c33 rlm_chap: Setting 'Auth-Type := CHAP' >>>>> Warning: Found 2 auth-types on request for user 'rniclh' But when I do it from another system and radtest it seems to work. rad_recv: Access-Request packet from host 64.240.77.3:33574, id=228, length=73 User-Name = "rniclh(a)surftheusa.com" User-Password = "deleted" NAS-IP-Address = 255.255.255.255 NAS-Port = 500 rlm_sql (sql): Reserving sql socket id: 4

1 2

Freeradius/MySql problem
by Radius 04 Jul '05

04 Jul '05

I currently run ver.0.9.3 I have MySql database that is used with FreeRadius. What were are having a problem with is that if the user logs in with UPPER-NAME or lower-name either one works. I have tried lower_user & lower_pass before/after/no and the radius system still authenticates all UPPER-CASE. With this we are getting double billed by our wholesale provider because they run unix based also and it sees both as valid log ins because we authenticated them. When we built our MySql we use with the setup in FreeRadius. Has anyone else had this and how did you fix this to keep everyone lower case. Thanks Bob Ross

5 31

forming tunnel between two RADIUS server
by kiran kumar gullapalli 04 Jul '05

04 Jul '05

Hi all, actually I formed my question confusingly in previous post. question goes like this Is it possible to form a tunnel between two RADIUS servers which don't have any shared secret between them and knows only IP address of each other and having a certificate issued by same CA. Thanx

2 1

attr_rewrite & regexp
by Jérémy Cluzel 04 Jul '05

04 Jul '05

Hi, I try to rewrite User-Name attr. from "COMPUTER_NAME\\User-Name" to "User-Name". I prefer not to use the "proxy.conf" file because I've a lots of differents "COMPUTER_NAME". I think attr_rewrite will do the job, but I don't know (I'm not very good at regexp...) Thanks Jeremy

1 0

RE: sql counter clarification and issues
by Ross Tsolakidis 04 Jul '05

04 Jul '05

Hi all, Ok I've set it all up, it looks like it's working, when I look in the debug I see: Module: Instantiated sql (sql) Module: Loaded SQL Counter sqlcounter: counter-name = "Daily-Session-Time" sqlcounter: check-name = "Max-Daily-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sqlcca3" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "daily" rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1671 rlm_sqlcounter: Check attribute Max-Daily-Session is number 1672 rlm_sqlcounter: Current Time: 1120445182 [2005-07-04 12:46:22], Next reset 1120485600 [2005-07-05 00:00:00] rlm_sqlcounter: Current Time: 1120445182 [2005-07-04 12:46:22], Prev reset 1120399200 [2005-07-04 00:00:00] Module: Instantiated sqlcounter (dailycounter) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) So I understand what it's meant to do: At midnight every night will it begin a new row in SQL ? So let's say that someone has maintained a connection all day, SQL will create a new row ? Am I understanding this correctly ? Because at the moment there are no new rows being created, no counters being reset. Cheers, thanks again. Regards, -- Ross -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, 30 June 2005 1:41 AM To: FreeRadius users mailing list Subject: Re: sql counter clarification and issues "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > Can you give me an example of how to set the counter to reset in SQL ? No, I said "sqlcounter". It's a separate module. See "experimental.conf" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Acct-Unique-Session-Id changing mid-session?
by Roger Kristiansen 04 Jul '05

04 Jul '05

Hi, I'm working on a script for parsing some freeradius log files and getting them into a database, and I've noticed some (to me) strange behaviour. It looks like a few sessions change Acct-Unique-Session-ID mid-session. What I see is that there is issued a "Acct-Status-Type = Start" entry and a few "Alive"-entries, before the "Acct-Unique-Session-Id" field suddenly changes, seemingly out of nowhere, and more "Alive"-entries keep coming with this new ID. This while the user is the same, there has been no new "Stop" and/or "Start" entry, and the "Alive"-entries enter the log at the correct times (15 min. apart). The MAC addressand IP-adress are also the same over all entries. Is this a known issue or some easily explainable behaviour? As far as I know, the server is running version 0.93. I'm sorry if this mail is a bit lacking in technical detail, but I'm not very familiar with RADIUS at all. If some some essential technical info is missing, please tell me, and I will get it from the administrator. :) Regards, Roger Kristiansen

2 1

Unable to install FreeRadius 1.0.4 [HELP PLEASE]
by TeemX 04 Jul '05

04 Jul '05

Hi Guys & Gals, I am having problem on installing my FreeRadius Server Version 1.0.4. I am running at Linux RedHat 9. Errors message as below: gmake[10]: *** [sql_mysql.o] error 1 gmake[10]: leaving directory '/root/freeradius-1.0.4/src/modules/rim_sql/drivers/rlm_sql_mysql' all the way down to gmake[1]: *** [common] Error 1 gmake[1]: Leaving director '/root/freeradius-1.0.4' make: *** [all] Error 2 Could anyone help me on this, I am totally new to FreeRadius. Thanks. Jackie

3 2

Client with Window OS?
by Yam Biz 04 Jul '05

04 Jul '05

-I want to have a small FreeRadius Server with AAA, billing system but i don't have any NAS in NAS list, can you advise me? -Can i have i client with Window OS? -How can FreeRadius supports billing system with pre-paid or post-paid? --Thanks so much-- Yam Biz __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

5 6

Traffic does not pass trought AP1300
by Sergey Velikanov 04 Jul '05

04 Jul '05

I setup my Radius as described at http://web.archive.org/web/20031206113912/http://www.alphacore.net/spipen/a… My Windows XP SP2 successful Authenticate using EAP-TLS, in radius log i see Sending Access-Accept of id 39 to 192.168.10.100:1645 MS-MPPE-Recv-Key = 0xefc02ac383a3a2faddaad9a7aea6cdab9cfe5a2a8ab6523225b11a321da469f9 MS-MPPE-Send-Key = 0x3d64ab1c9fe9f3aaf81115320f7e1253561415ee882671dda23cbd9181b1c6c1 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "Sergey Velikanov" Everything works fine, but from my Windows I can ping nothing I use Cisco AP1300 as AP, and when I type bridge#show dot11 associations 0060.1d1e.245c bridge#show dot11 associations 0060.1d1e.245c Address : 0060.1d1e.245c Name : NONE IP Address : 0.0.0.0 Interface : Dot11Radio 0 Device : unknown Software Version : NONE CCX Version : NONE State : EAP-Assoc Parent : self SSID : protected VLAN : 0 Hops to Infra : 1 Association Id : 84 Clients Associated: 0 Repeaters associated: 0 Tunnel Address : 0.0.0.0 Key Mgmt type : NONE Encryption : WEP Current Rate : 11.0 Capability : Supported Rates : 1.0 2.0 5.5 11.0 Signal Strength : -48 dBm Connected for : 19 seconds Signal Quality : N/A Activity Timeout : 59 seconds Power-save : Off Last Activity : 1 seconds ago Packets Input : 56 Packets Output : 16 Bytes Input : 6723 Bytes Output : 3108 Duplicates Rcvd : 0 Data Retries : 0 >Decrypt Failed : 45 RTS Retries : 0 MIC Failed : 0 MIC Missing : 0 Packets Redirected: 0 Redirect Filtered: 0 it seems that all traffic rejected by AP1300m why? Is it Radius, Cisco or my old orinoco card(I've bought it about 4 years ago) also in cisco's log I see *Mar 1 05:08:00.483: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 0060.1d1e.245c Associated KEY_MGMT[NONE] Is it normal that KEY_MGMT = NONE ? PS: This is my AP1300 config bridge#sh run int dot11Radio 0 Building configuration... Current configuration : 423 bytes ! interface Dot11Radio0 no ip address no ip route-cache ! encryption mode wep mandatory ! ssid protected authentication open eap eap_methods authentication network-eap eap_methods guest-mode ! short-slot-time concatenation speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 rts threshold 4000 station-role root ap-only infrastructure-client bridge-group 1 end

2 1

EAP-TTLS and PEAP auth problem ... sorry!!
by Gandalf the Gray 04 Jul '05

04 Jul '05

I forgot to explain the real problem! I cannot authenticate any user, try to connect to my network through a supplicant, both from Windows and from WPA-supplicant under Linux. It seems no EAP-challenge is really going on. this is the output from tre radius server after a try made by AEGIS client under windows XP, with PEAP __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0