- Freeradius-Users - lists.freeradius.org

Fwd: (0) No reply from server for ID 168 socket 3
by jose luis sanchez ortiz 20 Jun '15

20 Jun '15

---------- Forwarded message ---------- From: jose luis sanchez ortiz <docentesanortiz(a)gmail.com> Date: 2015-06-20 9:12 GMT-05:00 Subject: (0) No reply from server for ID 168 socket 3 To: Freeradius-Devel(a)lists.freeradius.org Hi friend I need help, I finish my graduation project I run radtest and show 3 time Sent Access-Request Id 168 from 0.0.0.0:48323 to 127.0.0.1:1812 length 78 User-Name = 'proyecto' User-Password = '123' NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = '123' (0) No reply from server for ID 168 socket 3 thanks in advance

1 0

Sql counter
by Randeep 20 Jun '15

20 Jun '15

Hi, I'm trying to set maximum data limit for a user. In the /etc/raddb/sql/mysql/counter.conf I have created this. sqlcounter testcounter { counter-name = Max-Data-Used check-name = Max-Data sqlmod-inst = sql key = User-Name reset = daily reply-message = “You have reached your bandwidth limit” sqlmod-inst = sql query = “SELECT SUM(acctinputoctets) + SUM(acctoutputoctets) FROM radacct WHERE username=’%{%k}'” } } When I checked the accounting flow, the flow is as follows, New acct request -> Preacct ->accounting -> Send response So I tried to put the testcounter in /etc/raddb/sites-enabled/default In preacct and accounting blocks. But it gave me errors Sat Jun 20 13:12:54 2015 : Error: /etc/raddb/sites-enabled/default[389]: "SQL Counter" modules aren't allowed in 'accounting' sections -- they have no such method. Sat Jun 20 13:12:54 2015 : Error: /etc/raddb/sites-enabled/default[382]: Errors parsing accounting section. Also I'm confused about the parameters in the testcounter. We have to declare these two variables anywhere? counter-name = Max-Data-Used check-name = Max-Data Where we can specify the max data limit to the user. Please advice. Also please give some links if you which I can refer. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr

1 1

using ippol
by Randeep 20 Jun '15

20 Jun '15

Hi all, I'm trying to configure freeradius to send the ip for the user. In the radiusd.conf i have uncommented $INCLUDE sqlippool.conf in the sqlippool.conf, I have enabled mysql ippool.conf in the file /etc/raddb/modules/ippool, I have defined ippool main_pool. And specified the range, netmask etc in the block. Key I have specified as key = "%{NAS-IP-Address} %{NAS-Port}" But my radippool table is empty. Do I have to specify anything there? I'm testing with radtest. I hope this can be tested with it. In the respose i'm getting like this [root@localhost ~]# radtest randeep randeep123 192.168.1.182 0 lukup124 Sent Access-Request Id 110 from 0.0.0.0:49548 to 192.168.1.182:1812 length 77 User-Name = 'randeep' User-Password = 'randeep123' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = 'randeep123' Received Access-Accept Id 110 from 192.168.1.182:1812 to 0.0.0.0:0 length 56 Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.0 Framed-MTU = 1500 Framed-Routing = Broadcast-Listen Framed-Compression = Van-Jacobson-TCP-IP Service-Type = Framed-User [root@localhost ~]# Do I have to give sqlippool or mainpool in authenticate/authorize/account/preauth in sites-enabled/default? Please advice. Regards, Randeep

2 7

Populating radacct
by Randeep 19 Jun '15

19 Jun '15

Hi, I would like to test limiting the max usable size for a user. But I dont have a real NAS and client. Is there anyway I can send fake usage updates and when next Access-Request comes I can check the total used data and maximum limit and reject the request? Please advice. -- Randeep Mob: +919447831699[kerala] Mob: +919880050349[B'lore] http://twitter.com/Randeeppr http://in.linkedin.com/in/randeeppr [image: --] Randeep Raman [image: http://]about.me/Randeeppr <http://about.me/Randeeppr>

2 1

post-proxy section ( 3.0.9 bump )
by Peter Balsianok 19 Jun '15

19 Jun '15

Hi, I want to log proxy request in the case of Access-Reject from proxy server In the conf file (site-enables/default): post-proxy { log_proxy_reply Post-Proxy-Type Fail-Authentication { log_proxy_request log_control } } I've tested it with Fail or Fail-Authentication. The same result, proxy request wasn't printed out. Debug ouput: .... post-proxy { log_proxy_reply Post-Proxy-Type Fail-AuthenticationOpening new proxy socket 'proxy address * port 0' Listening on proxy address * port 43154 (0) Proxying request to home server 127.0.0.1 port 10812 timeout 14.000000 (0) Sent Access-Request Id 129 from 0.0.0.0:43154 to 127.0.0.1:10812 length 182 (0) NAS-Port-Type = Virtual (0) CHAP-Password = 0x0103d8b4385d31b89f746a2838b87fa049 (0) Service-Type = Framed-User (0) Called-Station-Id = 'proxy.corp' (0) Calling-Station-Id = '421905725408' (0) Framed-Protocol = PPP (0) CHAP-Challenge = 0xe3c6f04f3c08c6067deb9c79c060e966 (0) User-Name = '421905725408' (0) Connect-Info = '8640000' (0) NAS-IP-Address = 85.237.227.1 (0) NAS-Port = 385 (0) Qos-Policy-Policing = 'Uniq-Sess-ID385' (0) Event-Timestamp = 'Jun 18 2015 11:48:41 CEST' (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x313131 Waking up in 0.3 seconds. (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 129 from 127.0.0.1:10812 to 127.0.0.1:43154 length 25 (0) Proxy-State = 0x313131 (0) # Executing section post-proxy from file ./sites-enabled/default (0) post-proxy { (0) log_proxy_reply: EXPAND /app_log/radius/auth/radius.log (0) log_proxy_reply: --> /app_log/radius/auth/radius.log (0) log_proxy_reply: EXPAND %t : Info PROXY-REPLY(%{User-Name}): %{pairs:proxy-reply:} (0) log_proxy_reply: --> Thu Jun 18 11:48:41 2015 : Info PROXY-REPLY(421905725408(a)proxy.corp): Proxy-State = 0x313131 (0) [log_proxy_reply] = ok (0) } # post-proxy = ok (0) Login incorrect (Home Server says so): [421905725408(a)proxy.corp/<via Auth-Type = CHAP>] (from client localhost port 385 cli 421905725408) (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file ./sites-enabled/default (0) Sent Access-Reject Id 111 from 127.0.0.1:1812 to 127.0.0.1:33136 length 0 (0) Finished request What i am doing wrong ? Thx.

2 3

processing in case of proxied authentification
by Peter Balsianok 19 Jun '15

19 Jun '15

Hi, In the documentation ( http://networkradius.com/doc/FreeRADIUS%20Technical%20Guide.pdf) on the page 42 is Figure 4.3 Packet Processing Section Usage. In case of Proxied authentification following sections will be processed: Authorize, Pre-proxy and Post-proxy. As i can see in the debug output also post-auth section is processed. Is it correct ? .. (2) # Executing section post-proxy from file ./sites-enabled/default (2) post-proxy { ... (2) } # post-proxy = ok (2) Found Auth-Type = Accept (2) Auth-Type = Accept, accepting the user (2) # Executing section post-auth from file ./sites-enabled/default (2) post-auth { .... (2) } # post-auth = reject (2) Using Post-Auth-Type Reject (2) Post-Auth-Type sub-section not found. Ignoring. ... Thx.

2 1

LDAP Operations Error
by Syed Rais Ahmad NON DRI 18 Jun '15

18 Jun '15

In my FreeRadius configuration, ntlm_auth gives me successful search output: [root@rscradiuspr01 samba]# ntlm_auth --request-nt-key --domain=DRI_NT1 --username=SYEDRA password: NT_STATUS_OK: Success (0x0) However, RADIUS rejects the user: Thu Jun 18 16:02:46 2015 : Debug: [ldap] waiting for bind result ... Thu Jun 18 16:02:46 2015 : Debug: [ldap] Bind was successful Thu Jun 18 16:02:46 2015 : Debug: [ldap] performing search in ou=users,dc=darden,dc=com, with filter (uid=SYEDRA) Thu Jun 18 16:02:46 2015 : Error: [ldap] ldap_search() failed: Operations error Thu Jun 18 16:02:46 2015 : Info: [ldap] search failed Thu Jun 18 16:02:46 2015 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Jun 18 16:02:46 2015 : Info: ++[ldap] returns fail Thu Jun 18 16:02:46 2015 : Info: Using Post-Auth-Type Reject Thu Jun 18 16:02:46 2015 : Info: # Executing group from file /etc/raddb/sites-enabled/default Thu Jun 18 16:02:46 2015 : Info: +- entering group REJECT {...} Thu Jun 18 16:02:46 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> SYEDRA Thu Jun 18 16:02:46 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jun 18 16:02:46 2015 : Info: ++[attr_filter.access_reject] returns updated Thu Jun 18 16:02:46 2015 : Info: Delaying reject of request 1 for 1 seconds Thu Jun 18 16:02:46 2015 : Debug: Going to the next request What could be the cause of this reject? Thanks. This e-mail message is for the sole use of the intended recipient and may contain information that is confidential, proprietary or privileged. Any unauthorized review, use, distribution, copying or disclosure is strictly prohibited. If you are not the intended recipient, or the employee or agent responsible for delivering it to the intended recipient, please notify sender of the delivery error by replying to this message and then delete it from your system. Receipt by anyone other than the intended recipient is not a waiver of confidentiality or privilege.

3 2

Using AD and SQL to authenticate Wi-Fi users
by Bruno de Paula Larini 18 Jun '15

18 Jun '15

Hi guys, I've been using FR (3.0.4) to authenticate Wi-Fi users against Active Directory and it is working fine. But now I need to check users in SQL database too, like this: SSID1 -> check for users in AD SSID2 -> check for users in SQL database I've managed to get it working, but only if the other authentication method is disabled. Only one would work at a time. To get SQL working, I've either commented the ntlm_auth from mods-enabled/mschap or added the following to the authorize section in sites-enabled/inner-tunnel: ... update control { MS-CHAP-Use-NTLM-Auth := No } mschap ... Removing the above and/or uncommenting the ntlm_auth line, users from AD are authenticated successfully but SQL users are not. I wanted to use unlang to check if the request came from a specific Called-Station-Id, but the inner-tunnel doesn't bring this information and always return false. Is there some check I can use to know where the request came from? Thank you!

3 2

Valid SSL certificate deployment process
by Sunil Kulkarni -X (sunikulk - PERSISTENT SYSTEMS INC at Cisco) 18 Jun '15

18 Jun '15

Hello All, I am using FR 3.0.8 version. I have done setup EAP-TTLS with PAP. For local setup and testing, I have used self-signed certificates. Now my setup and configuration is done and I want to do setup on production side. I have following certificates from CA, however, I am not getting how do I deploy certificates in FreeRadius because /etc/raddb/certs folder contains lots of certificate and its related to file. Root-ca.cer Ca.cer Server.cer Kindly help me on this? --- Thanks, Sunil Kulkarni

2 1

radtest (0) Error parsing "stdin": Failed to get value
by Victor Beliaiev 17 Jun '15

17 Jun '15

Dear Mr. Herwin Weststrate I just have followed your instructions and radiusd and radclient with -x options done everything fine! If need I could send the logs but they look as typical without any warnings or errors. Just both work fine. :-) I hope I can to go forward with freeradius 3.0.8 and freebsd and tune them with mysql. I will try radtest once again... May be something wrong with FreeBSD 10.... Thank you a lot for the fast feedback best wishes with radius and linux Victor ps Sorry for the repetition Среда, 17 июня 2015, 17:03 +02:00 от Herwin Weststrate <herwin(a)quarantainenet.nl>: >On 17-06-15 16:52, Victor Beliaiev wrote: >> 2/ Concole #2 >> radtest -x -4 bob hello 127.0.0.1 0 testing123 >> (0) Error parsing "stdin": Failed to get value > >radtest is a wrapper for radclient. There are two possibilities here: >either the output of radtest is invalid, or there is something wrong >with radclient. > >Could you put the following text in a file and feed that to radclient > > User-Name = 'bob' > User-Password = 'hello' > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > Message-Authenticator = 0x00 > Cleartext-Password = 'hello' > >To feed it to radclient: > > radclient -4 -x 127.0.0.1 auth testing123 < $filename > >All my 3.0.8 installs here work fine, but they're all on linux. > >-- >Herwin Weststrate -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru ---------------------------------------------------------------------- -- Victor Beliaiev +38 050 412-2003 belve(a)mail.ru

1 0