- Freeradius-Users - lists.freeradius.org

stripping a slash?
by Chris Sigler 18 Jun '05

18 Jun '05

For some reason, when we run a query against radius and the username starts with a slash, it seems to ignore the slash. As a result, a user is able to log in with both "bob" and "/bob", although only one is right. Any ideas what could be the cause of this? Thanks! Chris Sigler

2 5

Auth: Login incorrect: [user/<CHAP-Password>]
by Adil Azmi Bikarbass 17 Jun '05

17 Jun '05

Dear FreeRadius list members, I'm really stuck with an authentication problem here: I'm getting the following error meesage anytime a user try to connect through my Freeradius server : Auth: Login incorrect: [user/<CHAP-Password>] (from client MT2_ADSL port 1476461184) Auth: rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". Here is the radius entry for that user: user Password = "somepass", Simultaneous-Use = 2, Huntgroup-Name = "adsl-dialup" Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, NAS-Port-Type = Async, Service-Type = Framed-User, The Huntgroup-name : adsl-dialup is to specify the IP addresses of all the remote access servers we use Once i add the following line at the bottom of my users file the user get connected with no problem: DEFAULT Auth-Type := Accept Please advise what could be the problem Thanks in advance Adil -- |-Adil Azmi Bikarbass |-IT Manager, MTDS |-tel +212.3.767.4861 |-fax +212.3.767.4863 |-gsm +212.6.139. 4541 |-14, rue 16 novembre |-Rabat, Kingdom of Morocco

4 7

Inncorect link on the website.
by Marcin Jessa 17 Jun '05

17 Jun '05

Hi guys. The link to email archive page at http://www.freeradius.org/list/users.html points to http://lists.freeradius.org/archives/freeradius-users/ which does not exist. It should be pointed to https://list.xs4all.nl/pipermail/freeradius-users/ or have a header redirection in http://lists.freeradius.org/archives/freeradius-users/ for that address. Cheers, Marcin.

2 3

PPPOE Incorrect Subnet
by Cris Boisvert 17 Jun '05

17 Jun '05

I'm using a Microtik PPPOE Router solution All my users are up and autheticated fine But some of them are recieveing an incorrect Subnet Currently the customers are all receiving public IP addresses when authenticated, from a Pool. Of 64 I want them to received a 255.255.255.255 subnet... But currently they are getting different ones.. 255.255.255.192 255.255.255.240 255.255.255.224 I have tried setting them in Freeradius but to no avail. 192 I would understand because that's the subnet their in.. But Not the others. Is this something that should be defined in radius.. Or should the pppoe concentrator know To give them the correct subnet their? Thanx Cris

3 2

Login-Time, huntgroup and mysql
by alexander＠infomed.sld.cu 17 Jun '05

17 Jun '05

Hi I'm have using freeradius+mysql. All the users are on a mysql database, and we have our owns NAS pointed to the radius servers, everything work fine. Recently, in order to increase our capabilities was introduced an other NAS that points to an other freeradius server who proxied the requests to our server. We were trying to control the trafic to the remote NAS by using the Login-Time attribute and "huntgroups" file to distinguish the requests that come from the remote NAS. So, we have an entry on huntgroup file like this: huntgroup file: . . . remote_nas NAS-IP-Address == 1.2.3.4 . . . then on the users file: . . . DEFAULT Service-Type == Framed-User, Login-Time := "al0600-1800", Huntgroup-Name == "remote_nas" Fall-Through = Yes . . . then on radiusd.conf, at the authorize we have files and sql The above configuration work O.K! But all peoples that try to connect to NAS 1.2.3.4 out of time will be reject. So we define 3 users categories: 1- the useres that only can login by day ("al0600-1800"); 2- users that only can login by night ("al1800-0600"); and 3- users than can login any time at the romote NAS. If the same user try to connect to an other NAS, then the Login-Time have'n effect, so that it can connect any time. How we can do that without have to do any change on the users names and groups of the data base? We probe the fallowing: huntgroup file: . . . remote_nas NAS-IP-Address == 1.2.3.4 . . . then on the users file: . . . DEFAULT Service-Type == Framed-User, User-Category == "day", Login-Time := "al0600-1800", Huntgroup-Name == "remote_nas" Fall-Through = Yes DEFAULT Service-Type == Framed-User, User-Category == "night", Login-Time := "al1800-0600", Huntgroup-Name == "remote_nas" Fall-Through = Yes DEFAULT Service-Type == Framed-User, User-Category == "fulltime", Huntgroup-Name == "remote_nas" Fall-Through = Yes . . . on mysql: radcheck +----+-----------+----------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+-----------+----------------+----+------------------------------------+ | 1 | alexander | Crypt-Password | == | $1$9D9s.vO6$GlVbRFf7qRaUXTAJ1gGGe. | | 4 | alexander | User-Category | := | day | +----+-----------+----------------+----+------------------------------------+ and radiusd.conf, at the authorize we have files and sql But this configuration don't work because the request never match any of 3 entries of users file due to User-Category attribute, maybe cause sql is the last module that the server call: . . . authorize { . . preprocess . . files . . sql . . } We would be grateful for any suggestion. Thanks. ------------------------------------------------- Este mensaje fue enviado usando el servicio de correo en web de Infomed http://webmail.sld.cu

1 0

proxy wildcard realms (subdomains)
by Tariq Rashid 17 Jun '05

17 Jun '05

hi - i after much searching the archives i couldn't find a good way to proxy to subdomains of a domain: user(a)xxx.yyy.zz.domain.com for any number of subdomains under a given domain.com (inlcuding nil). is this possible? (i don't want the username stripped) thanks tariq

4 7

Looking for advice
by Benoit LELONG 17 Jun '05

17 Jun '05

Hello, I would like to build a freeradius plateform and I am looking for return of experiences about : - the best choice of Linux distribution to support the last version of freeradius. - the use of JRadius Thanks for your help, Benoit.

3 2

use_tunneled_reply
by ragan_davis＠colstate.edu 17 Jun '05

17 Jun '05

Hi, Using FreeRADIUS 1.0.2, Cisco/Airespace 4100 WLAN switch as NAS, and Odyssey Client v4.01 as supplicant. Kept seeing the user as "anonymous" in the WCS management software for the client. Wanted to see the *real* username, meaning the username that was actually authenticated to the backend db (in this case eDirectory). So, in eap.conf I changed use_tunneled_reply to equal yes. Still, replies to NAS show User-Name = "anonymous". Have I missed something? Thanks for the help, mack

2 1

corrupt UDP packets sent to proxy
by Taylor, Graham 17 Jun '05

17 Jun '05

Hi People, I hope you can shed some light on a problem I am having with freeradius acting as a proxy. As you can see the packet below has a corrupt UDP header ( Checksum: 0x5b10 (incorrect, should be 0x9f2d) ). If I use radtest then the packet is fine and I get authenticated, the problem only occurs when the request is proxied out, all of the packets forwarded to the secondary radius server have the UDP checksum error, I have tried the latest version of freeradius with exactly the same results, so I have gone back to the version supplied with RedHat, on a fresh build. Versions are as follows: radiusd: FreeRADIUS Version 1.0.1, for host , built on Nov 26 2004 at 10:48:39 OpenSSL 0.9.7g 11 Apr 2005 Linux <MY HOST NAME> 2.6.9-5.ELsmp #1 SMP Wed Jan 5 19:30:39 EST 2005 i686 i686 i386 GNU/Linux This is RedHat ES version 4 Please let me know if you need any further information Regards Graham Frame 12 (197 bytes on wire, 197 bytes captured) Arrival Time: Jun 17, 2005 11:19:35.560228000 Time delta from previous packet: 4.660183000 seconds Time since reference or first frame: 111.704161000 seconds Frame Number: 12 Packet Length: 197 bytes Capture Length: 197 bytes Protocols in frame: eth:ip:udp:radius:eap Ethernet II, Src: 00:12:79:3c:9c:61, Dst: 00:00:0c:07:ac:14 Destination: 00:00:0c:07:ac:14 (All-HSRP-routers_14) Source: 00:12:79:3c:9c:61 (HewlettP_3c:9c:61) Type: IP (0x0800) Internet Protocol, Src Addr: XXX.XXX.XXX.XXX (XXX.XXX.XXX.XXX), Dst Addr: XXX.XXX.XXX.XXX (XXX.XXX.XXX.XXX) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 183 Identification: 0x0005 (5) Flags: 0x04 (Don't Fragment) 0... = Reserved bit: Not set .1.. = Don't fragment: Set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (0x11) Header checksum: 0xdfd5 (correct) Source: XXX.XXX.XXX.XXX (XXX.XXX.XXX.XXX) Destination: XXX.XXX.XXX.XXX (XXX.XXX.XXX.XXX) User Datagram Protocol, Src Port: 1814 (1814), Dst Port: radius (1812) Source port: 1814 (1814) Destination port: radius (1812) Length: 163 Checksum: 0x5b10 (incorrect, should be 0x9f2d) Radius Protocol Code: Access Request (1) Packet identifier: 0x1 (1) Length: 155 Authenticator: 0x22840C6BAE7ECB8E4FE8A8A3773B1A08 Attribute value pairs t:User Name(1) l:8, Value:"graham" User-Name: graham t:Framed MTU(12) l:6, Value:1400 t:Called Station Id(30) l:16, Value:"000e.842e.8230" Called-Station-Id: 000e.842e.8230 t:Calling Station Id(31) l:16, Value:"0040.96a7.f8d2" Calling-Station-Id: 0040.96a7.f8d2 t:Service Type(6) l:6, Value:Login(1) Service-Type: Login (1) t:Message Authenticator(80) l:18, Value:C77E1EE1C2A7E98B00E464AB0DB0DE48 t:EAP Message(79) l:34 Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 32 Type: Identity [RFC3748] (1) Identity (27 bytes): graham(a)test.com t:NAS Port Type(61) l:6, Value:Wireless IEEE 802.11(19) t:NAS Port(5) l:6, Value:1646 t:NAS IP Address(4) l:6, Value:172.23.1.201 Nas IP Address: 172.23.1.201 (172.23.1.201) t:NAS identifier(32) l:8, Value:"ap1200" t:Proxy State(33) l:5, Value:323533

2 1

Don't work
by synackrst 17 Jun '05

17 Jun '05

Hello, I found a article wich explains how to use experimental counter of freeradius, but that seems not working. I can not find more documentation about that. Anyone know about that? http://www.chillispot.org/forum/viewtopic.php?t=37 Regards, Paulo Leitao

3 2