- Freeradius-Users - lists.freeradius.org

Re: Authenticate/Attributes based on NAS-IP-Address
by Mike Lampson 08 Jun '05

08 Jun '05

Nick, Extend the MySQL schema and change the SQL queries in sql.conf to do what you want. You could extend by HuntGroup, NAS-IP, Client-IP, whatever. See my previous post to this list archived here: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg16842.h tml Cheers, _Mike -----Original Message----- Message: 6 Date: Tue, 07 Jun 2005 19:20:28 -0700 From: N White <nwtech(a)tele-net.net> Subject: Re: Authenticate/Attributes based on NAS-IP-Address To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <42A655EC.7050009(a)tele-net.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Actually I already have two running FreeRADIUS servers with SQL. That isn't the hard part. The problem with your instructions is that I'm not using ippool to assign dynamic IPs, our NASes are doing that (Portmaster 2/3). I don't have a problem setting up static IPs either, as we have several Dial-Up users who need those also. The problem lies in that I want to use the RADIUS server for PPPoE authentication also. But I want to allow users who log in through PPPoE to also be able to log in regularly(Dial-Up), when their PPPoE isn't logged in. BUT, when they log in through PPPoE, I want them to be assigned a static IP, when they login via Portmasters/Dial-Up, then they don't get the static IP, they get a regular dynamic one. Basically if a user logs in through NAS1, they are assigned X attributes with dynamic IP, if they log in through NAS2, they are assigned Y attributes with a static IP. And all this needs to be done in MySQL, that way my own PHP frontend(which I intend to release GPL) can work with it. Also I think MySQL scales better. -Nick -- ------------------------ | Nick White | | Network Consultant | | http://www.edge9.net | | nwtech(a)tele-net.net | ------------------------

3 4

RE: Authenticate/Attributes based on NAS-IP-Address
by Jeff Green 08 Jun '05

08 Jun '05

Hi Nick, I've modified FreeRadius to retrieve NAS specific reply items from a (Postgresql) table as I have three different NAS h/w that users can connect using - they have different IP pools. Is this similar to what you want to do ? Regards, -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of N White Sent: 07 June 2005 22:29 To: FreeRadius users mailing list Subject: Authenticate/Attributes based on NAS-IP-Address Using MySQL as a backend, is there any way to configure Authentication and Attribute (replies), based on the NAS-IP-Address sent to the FreeRADIUS server? Allow requests from NAS1 to authenticate and have certain attributes for users in that group and then allow requests from NAS2 to authenticate and have different attributes. Would there be anyway to allow a user to be a part of both groups? Thanks, Nick - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------ Confidentiality Note: The information contained in this email and document(s) attached are for the exclusive use of the addressee and may contain confidential, privileged and non-disclosable information. If the recipient of this email is not the addressee, such recipient is strictly prohibited from reading, photocopying, distribution or otherwise using this email or its contents in any way. Please notify the Sapiens (UK) Ltd. Systems Administrator via e-mail immediately at networksupport(a)sapiens.co.uk, if you have received this email in error. Disclaimer: The views, opinions and guidelines contained in this confidential e-mail are those of the originating author and may not be representative of Sapiens (UK) Ltd. ------------------------------------------------------------------------

2 1

RE: MSChap/LDAP Question
by alan walters 08 Jun '05

08 Jun '05

Cant use crypt with chap and ldap -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Douglas Phillips Sent: 08 June 2005 18:19 To: freeradius-users(a)lists.freeradius.org Subject: MSChap/LDAP Question I'm trying to authenticate MSChap with LDAP (LDAP has crypted passwords) for PPTP from a Cisco VPN box. I'm getting a strange error. Here's the logs: rad_recv: Access-Request packet from host ************:1071, id=138, length=153 User-Name = "csdgp" NAS-Port = 2311 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "**********" MS-CHAP-Challenge = 0x6ad5d5a423e76b09aeb8ac329215d4b1 MS-CHAP2-Response = 0x02000b2f32af6a677146bd81ec222958a45f00000000000000007249bfd5eb81dd31ee 0af1a17712be08a7bc758820949d71 NAS-IP-Address = ********** NAS-Port-Type = Virtual rlm_ldap: - authorize rlm_ldap: performing user authorization for csdgp rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as *************** to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user csdgp authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 Login incorrect: [csdgp/<no User-Password attribute>] (from client vpn1 port 2311) rad_recv: Access-Request packet from host ********:1071, id=138, length=153 Sending Access-Reject of id 138 to ********:1071 MS-CHAP-Error = "\002E=691 R=1" Here's the config: chap { authtype = CHAP } mschap { authtype = MS-CHAP use_mppe = yes } ldap { server = "localhost" identity = *************** password = *************** basedn = *************** filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}}) (host=ux1))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = "userPassword" timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess auth_log chap mschap suffix ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } -- End of config -- Am I up a creek here or is there something I can do? I haven't been able to find much online, but I may not be hitting the right things. -- Douglas G. Phillips Development Information Technology Services Eastern Illinois University (217) 581-7631 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.322 / Virus Database: 267.5.1 - Release Date: 02/06/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.322 / Virus Database: 267.5.1 - Release Date: 02/06/2005

1 0

MSChap/LDAP Question
by Douglas Phillips 08 Jun '05

08 Jun '05

I'm trying to authenticate MSChap with LDAP (LDAP has crypted passwords) for PPTP from a Cisco VPN box. I'm getting a strange error. Here's the logs: rad_recv: Access-Request packet from host ************:1071, id=138, length=153 User-Name = "csdgp" NAS-Port = 2311 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "**********" MS-CHAP-Challenge = 0x6ad5d5a423e76b09aeb8ac329215d4b1 MS-CHAP2-Response = 0x02000b2f32af6a677146bd81ec222958a45f00000000000000007249bfd5eb81dd31ee 0af1a17712be08a7bc758820949d71 NAS-IP-Address = ********** NAS-Port-Type = Virtual rlm_ldap: - authorize rlm_ldap: performing user authorization for csdgp rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as *************** to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user csdgp authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 Login incorrect: [csdgp/<no User-Password attribute>] (from client vpn1 port 2311) rad_recv: Access-Request packet from host ********:1071, id=138, length=153 Sending Access-Reject of id 138 to ********:1071 MS-CHAP-Error = "\002E=691 R=1" Here's the config: chap { authtype = CHAP } mschap { authtype = MS-CHAP use_mppe = yes } ldap { server = "localhost" identity = *************** password = *************** basedn = *************** filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}}) (host=ux1))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = "userPassword" timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess auth_log chap mschap suffix ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } -- End of config -- Am I up a creek here or is there something I can do? I haven't been able to find much online, but I may not be hitting the right things. -- Douglas G. Phillips Development Information Technology Services Eastern Illinois University (217) 581-7631

2 1

Question about reauthentication
by Ignacio Siles 08 Jun '05

08 Jun '05

Hi all, I have a problem with reauthenticacion, because my AP doesn't have the option to set "reauthenticacion interval". Is there any possibility that freeradius "force" reauthenticacion? My system is as follows: - Gemtek P-560 as AP. - Freeradius 1.0.1 in a Red Hat Enterprise 3. - Windows XP SP2 EAP/PEAP clients. Thanks in advance, Ignacio.

3 3

Couldn't load plugin radius.so
by Marios Maravelias 08 Jun '05

08 Jun '05

I cannot connect to the VPN and the error i get in the logs is : pptpd[14191]: CTRL: Client 213.16.179.235 control connection started Jun 8 13:30:51 linux7 pptpd[14191]: CTRL: Starting call (launching pppd, opening GRE) Jun 8 13:30:51 linux7 pppd[14192]: /usr/lib/pppd/2.4.3/radius.so: undefined symbol: chap_auth_hook Jun 8 13:30:51 linux7 pppd[14192]: Couldn't load plugin radius.so Jun 8 13:30:51 linux7 pptpd[14191]: GRE: read(fd=4,buffer=804e6e0,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Jun 8 13:30:51 linux7 pptpd[14191]: CTRL: PTY read or GRE write failed (pty,gre)=(4,5) Jun 8 13:30:51 linux7 kernel: application bug: pptpctrl(14191) has SIGCHLD set to SIG_IGN but calls wait(). Jun 8 13:30:51 linux7 kernel: (see the NOTES section of 'man 2 wait'). Workaround activated. Jun 8 13:30:51 linux7 pptpd[14191]: CTRL: Client 213.16.179.235 control connection finished Why is that ? Couldn't load plugin radius.so ????? -- *Marios Maravelias Web Server Administrator - Support *TopHost - Usable Web Company - Hosting Services* *+ 46 Karaiskaki Str. - Crete - Nea Alikarnassos GR 71601* *( Tel: +30 2810 229 000 , Fax: +30 2810 229 010* ** M.Maravelias(a)tophost.gr <mailto:M.Maravelias@TopHost.gr> web: http://www.tophost.gr/ <http://www.tophost.gr> ------------------------------------------------------------------------ **Disclaimer** This email may contain confidential and privileged material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient please contact the sender and delete all copies.

5 5

RE: Copyright and GPL infringement in tinyPEAP
by Nico.Baggus＠mail.ing.nl 08 Jun '05

08 Jun '05

Alan, are you aware of the site http://gpl-violations.org/ from Harald Welte? Kind Regards, Nico Baggus ----------------------------------------------------------------- ATTENTION: The information in this electronic mail message is private and confidential, and only intended for the addressee. Should you receive this message by mistake, you are hereby notified that any disclosure, reproduction, distribution or use of this message is strictly prohibited. Please inform the sender by reply transmission and delete the message without copying or opening it. Messages and attachments are scanned for all viruses known. If this message contains password-protected attachments, the files have NOT been scanned for viruses by the ING mail domain. Always scan attachments before opening them. -----------------------------------------------------------------

2 1

Error: Discarding new request from client!!!
by Andres 08 Jun '05

08 Jun '05

itprola FirmaI have FCI and freeradius-0.9.3-1.1 This is a problem in my log file!!! Wed Jun 8 09:55:08 2005 : Error: Discarding new request from client 10.10.0.10:1812 - ID: 239 due to live request 3056 Wed Jun 8 09:55:10 2005 : Error: Discarding new request from client 10.10.0.10:1812 - ID: 239 due to live request 3056 Wed Jun 8 09:55:12 2005 : Error: Discarding new request from client 10.10.0.10:1812 - ID: 239 due to live request 3056 Wed Jun 8 09:55:14 2005 : Error: Discarding new request from client 10.10.0.10:1812 - ID: 239 due to live request 3056 every minute or seconds is repeated to. What is the problem? Regards, Andrés de Barros Ingeniería en Data Canelones 2271 11200 Montevideo - Uruguay Tel: (598 2) 408 3506* http://www.itprola.com

1 0

RADIUS: IP-Pooling and connection management
by "Ferreira, André" 08 Jun '05

08 Jun '05

I understand that the radius keeps track of all open connections and their assigned IP addresses. If one of these connections closes, the radius can pass on an access-stop message to a CENTRAL CONTROLLER to indicate the end of this one connection. What about the case that the CENTRAL CONTROLLER realizes that another entity of the system is down. Does the CENTRAL CONTROLLER need to send an access-stop to the radius for each of the current open/active connections, or can it send one message to the radius? Will the radius send the required access-stop message to the other entities (IE:NAS) upon reception of this? Thanx. André Ferreira

1 0

Error: Trying to look up name of unknown client 127.0.0.1.
by kolargol＠kolargol.com 08 Jun '05

08 Jun '05

Hello, I'am keep getting �hose errors in logs: Wed Jun 8 10:15:50 2005 : Error: Trying to look up name of unknown client 127.0.0.1. Wed Jun 8 10:15:50 2005 : Auth: Login OK: [autocom/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 0) Wed Jun 8 10:15:50 2005 : Auth: Login OK: [autocom/<no User-Password attribute>] (from client CMTS-KROW-DOCSIS port 0 cli 000ce5475611) and in RADACCT: Packet-Type = Access-Request Wed Jun 8 08:20:52 2005 EAP-Message = 0x0205000c016175746f636f6d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "autocom" NAS-IP-Address = 127.0.0.1 Client-IP-Address = 127.0.0.1 ...but i have DISABLED proxy and don't want to use it. How can i fix that? --i use PEAP auth configuration to authorize wireless networks gretz Zbigniew Zolkiewski

1 0