- Freeradius-Users - lists.freeradius.org

Howto use rlm_python or how another way to use "rocket codes"
by Jesse Schlüter 10 Jun '15

10 Jun '15

Hello everyone, I am trying to find a simple solution for the following problem. I have a device for which I need authentication in form of a username and pre-generated one-time-pads. The device speaks radius flawlessly, so I though the easiest setup would be a radius server. The authentication system should be as small and rugged as possible, so no fancy stuff around ist wanted. This is supposed to an access of last resort to certain systems. So it should be working even if everything else is breaking down (like active-directory and stuff like that). Finally I found out that it is possible to "program" my own authentication plugin using python for freeradius. There is only one problem: zero documentation. I found the python example "prepaid.py" somewhere on the internet, so I was able to put my own module together. But how do I tell freeradius to use this module? I am not a freeradius expert, and I went through the wiki, but again, documentation seems to be sparse on details. Thanks for any hints, Jesse -- Jesse Schlüter mail: jesse.schlueter(a)helix360.de

2 3

Many exchanges between supplicant and the server - EAP-TLS
by vince technical address 10 Jun '15

10 Jun '15

Hello, On a radius server configured with EAP-TLS, logs contain many exchanges between the station and the server. It seems logical with the handshake TLS but each station response of access challenge causes the execution of the authorize section. Can you tell me if this is normal? Best regards, Vincent

5 6

Freeradius authentication from Postgres?
by Kim Halavakoski 10 Jun '15

10 Jun '15

Hello, Is it possible to get user authentication from an existing database containing fields for username and password and use this info in authenticating Radius users? What kind of configuration would this require, as I would not like to change the existing database structure with new fields and I just need the usernames and passwords from the database, any other required configurations can be done in static configuration files if needed. Effectively just replacing the following user file to be fetched from a database with username and password fields: > testuser Cleartext-Password := "password" Anybody have example configurations for such a setup? Best regards, Kim Halavakoski khalavakoski(a)gmail.com Sent from my mobile device, excuse my clawfingerness!

3 2

acct-session-start attribute ?
by Jeremy Ravel 10 Jun '15

10 Jun '15

Hi guys, I am beginner in FR. I want to be able to delay the activation of the login. For example i can create an user monday, but i just want allow him to connect only from friday to logon on my network. I tried to use the attribute acct-session-start on the user, but when i use it one user, the user can never log. I get this from the log: Thu May 28 16:18:16 2015 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 39465, id=155, length=277 ChilliSpot-Version = "1.3.0" User-Name = "day2" User-Password = "day2" Service-Type = Login-User Acct-Session-Id = "5567077800000003" Framed-IP-Address = 10.10.4.200 NAS-Port-Type = Wireless-802.11 NAS-Port = 3 NAS-Port-Id = "00000003" Calling-Station-Id = "00-1B-77-16-34-1A" Called-Station-Id = "00-50-56-B2-BF-8D" NAS-IP-Address = 10.10.4.254 NAS-Identifier = "vlan4" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Vlan4_ssid" WISPr-Location-Name = "Vlan_4" WISPr-Logoff-URL = " http://10.10.4.254:3990/logoff " Message-Authenticator = 0xee48deacd07a8f3d13df74480fa48198 Thu May 28 16:19:09 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu May 28 16:19:09 2015 : Info: +- entering group authorize {...} Thu May 28 16:19:09 2015 : Info: ++? if (!NAS-IP-Address) Thu May 28 16:19:09 2015 : Info: ? Evaluating !(NAS-IP-Address) -> FALSE Thu May 28 16:19:09 2015 : Info: ++? if (!NAS-IP-Address) -> FALSE Thu May 28 16:19:09 2015 : Info: ++[preprocess] returns ok Thu May 28 16:19:09 2015 : Info: ++[chap] returns noop Thu May 28 16:19:09 2015 : Info: ++[mschap] returns noop Thu May 28 16:19:09 2015 : Info: ++[digest] returns noop Thu May 28 16:19:09 2015 : Info: [suffix] No '@' in User-Name = "day2", looking up realm NULL Thu May 28 16:19:09 2015 : Info: [suffix] No such realm "NULL" Thu May 28 16:19:09 2015 : Info: ++[suffix] returns noop Thu May 28 16:19:09 2015 : Info: [eap] No EAP-Message, not doing EAP Thu May 28 16:19:09 2015 : Info: ++[eap] returns noop Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] sql_set_user escaped user --> 'day2' Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'day2' ORDER BY id Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'day2' ORDER BY priority Thu May 28 16:19:09 2015 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'vlan_4' ORDER BY id Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Released sql socket id: 3 Thu May 28 16:19:09 2015 : Info: [sql] User day2 not found Thu May 28 16:19:09 2015 : Info: ++[sql] returns notfound Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[chillispot_max_bytes] returns noop Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[noresetcounter] returns noop Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Entering module authorize code Thu May 28 16:19:09 2015 : Debug: rlm_sqlcounter: Could not find Check item value pair Thu May 28 16:19:09 2015 : Info: ++[dailycounter] returns noop Thu May 28 16:19:09 2015 : Info: ++[expiration] returns noop Thu May 28 16:19:09 2015 : Info: ++[logintime] returns noop Thu May 28 16:19:09 2015 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Thu May 28 16:19:09 2015 : Info: ++[pap] returns noop Thu May 28 16:19:09 2015 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Thu May 28 16:19:09 2015 : Info: Failed to authenticate the user. Thu May 28 16:19:09 2015 : Info: Using Post-Auth-Type Reject Thu May 28 16:19:09 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu May 28 16:19:09 2015 : Info: +- entering group REJECT {...} Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] sql_set_user escaped user --> 'day2' Thu May 28 16:19:09 2015 : Info: [sql] expand: %{User-Password} -> day2 Thu May 28 16:19:09 2015 : Info: [sql] expand: INSERT INTO radpostauth (user, pass, reply, date) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply acket-Type}', '%S') -> INSERT INTO radpostauth (user, pass, reply, date) VALUES ( 'day2', 'day2', 'Access-Reject', ' 2015-05-28 16 :19:09') Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (user, pass, reply, date) VALUES ( 'day2', 'day2', 'Access-Reject', ' 2015-05-28 16 :19:09') Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Thu May 28 16:19:09 2015 : Debug: rlm_sql (sql): Released sql socket id: 2 Thu May 28 16:19:09 2015 : Info: ++[sql] returns ok Thu May 28 16:19:09 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> day2 Thu May 28 16:19:09 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 But if i dont give him, the attribute he can logon. If somone has any clue ? Thanks

2 15

issues with running freeradius3.0.8 certificate authentication
by syed latheef 10 Jun '15

10 Jun '15

Hi We had installed the freeradius 3.0.8 in our redhat machine but the certificate is not getting authenticated . the logs are in line along with this mail .this machine previously was running freeradius older version which was working fine .please help us resolve this issue . Thanks Latheef.S logs attached =========== n Jun 8 05:57:20 2015 : Debug: (151) EAP-Message = 0x019603ec19c00000093416030100510200004d030155756700e53bdacb99665df630bde73d39d1c5c6fce32ea9d05be3e568648039201e7488ca35449034fe49d15fb01baa51f3c1aa01f3a3c21555b9c302f338fbc20035000005ff0100010016030108d00b0008cc0008c90003de308203da308202c2 Mon Jun 8 05:57:20 2015 : Debug: (151) Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 8 05:57:20 2015 : Debug: (151) State = 0x209817dc210e0ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (151) Finished request Mon Jun 8 05:57:20 2015 : Debug: Waking up in 4.9 seconds. Mon Jun 8 05:57:20 2015 : Debug: (152) Received Access-Request Id 48 from 192.168.3.201:1024 to 192.168.3.48:1812 length 225 Mon Jun 8 05:57:20 2015 : Debug: (152) Framed-MTU = 1480 Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-IP-Address = 192.168.3.201 Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-Identifier = 'HP ProCurve Switch 2824' Mon Jun 8 05:57:20 2015 : Debug: (152) User-Name = 'ctc' Mon Jun 8 05:57:20 2015 : Debug: (152) Service-Type = Framed-User Mon Jun 8 05:57:20 2015 : Debug: (152) Framed-Protocol = PPP Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-Port = 2 Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-Port-Type = Ethernet Mon Jun 8 05:57:20 2015 : Debug: (152) NAS-Port-Id = '2' Mon Jun 8 05:57:20 2015 : Debug: (152) Called-Station-Id = '00-0e-7f-c4-98-60' Mon Jun 8 05:57:20 2015 : Debug: (152) Calling-Station-Id = '50-65-f3-5c-e9-ed' Mon Jun 8 05:57:20 2015 : Debug: (152) Connect-Info = 'CONNECT Ethernet 1000Mbps Full duplex' Mon Jun 8 05:57:20 2015 : Debug: (152) Tunnel-Type:0 = VLAN Mon Jun 8 05:57:20 2015 : Debug: (152) Tunnel-Medium-Type:0 = IEEE-802 Mon Jun 8 05:57:20 2015 : Debug: (152) Tunnel-Private-Group-Id:0 = '1' Mon Jun 8 05:57:20 2015 : Debug: (152) State = 0x209817dc210e0ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (152) EAP-Message = 0x029600061900 Mon Jun 8 05:57:20 2015 : Debug: (152) Message-Authenticator = 0x39b1ce0cd6391f6f3c41fa7b4bb58913 Mon Jun 8 05:57:20 2015 : Debug: (152) session-state: No cached attributes Mon Jun 8 05:57:20 2015 : Debug: (152) # Executing section authorize from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (152) authorize { Mon Jun 8 05:57:20 2015 : Debug: (152) policy filter_username { Mon Jun 8 05:57:20 2015 : Debug: (152) if (!&User-Name) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (!&User-Name) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ / /) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ / /) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /@.*@/ ) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /@.*@/ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /\.\./ ) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /\.\./ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Mon Jun 8 05:57:20 2015 : Debug: (152) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /\.$/) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /\.$/) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /(a)\./) { Mon Jun 8 05:57:20 2015 : Debug: (152) if (&User-Name =~ /(a)\./) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (152) } # policy filter_username = notfound Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [preprocess] = ok Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling chap (rlm_chap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from chap (rlm_chap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [chap] = noop Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling mschap (rlm_mschap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from mschap (rlm_mschap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [mschap] = noop Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling digest (rlm_digest) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from digest (rlm_digest) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [digest] = noop Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling suffix (rlm_realm) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) suffix: Checking for suffix after "@" Mon Jun 8 05:57:20 2015 : Debug: (152) suffix: No '@' in User-Name = "ctc", looking up realm NULL Mon Jun 8 05:57:20 2015 : Debug: (152) suffix: No such realm "NULL" Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from suffix (rlm_realm) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [suffix] = noop Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: calling eap (rlm_eap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Peer sent code Response (2) ID 150 length 6 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Continuing tunnel setup Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authorize]: returned from eap (rlm_eap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [eap] = ok Mon Jun 8 05:57:20 2015 : Debug: (152) } # authorize = ok Mon Jun 8 05:57:20 2015 : Debug: (152) Found Auth-Type = EAP Mon Jun 8 05:57:20 2015 : Debug: (152) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (152) authenticate { Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authenticate]: calling eap (rlm_eap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Expiring EAP session with state 0x209817dc210e0ee7 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Finished EAP session with state 0x209817dc210e0ee7 Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Previous EAP request found for state 0x209817dc210e0ee7, released from the list Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Peer sent method PEAP (25) Mon Jun 8 05:57:20 2015 : Debug: (152) eap: EAP PEAP (25) Mon Jun 8 05:57:20 2015 : Debug: (152) eap: Calling eap_peap to process EAP data Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: processing EAP-TLS Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: Received TLS ACK Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: Received TLS ACK Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: ACK handshake fragment handler Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: eaptls_verify returned 1 Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: eaptls_process returned 13 Mon Jun 8 05:57:20 2015 : Debug: (152) eap_peap: FR_TLS_HANDLED Mon Jun 8 05:57:20 2015 : Debug: (152) eap: EAP session adding &reply:State = 0x209817dc220f0ee7 Mon Jun 8 05:57:20 2015 : Debug: (152) modsingle[authenticate]: returned from eap (rlm_eap) for request 152 Mon Jun 8 05:57:20 2015 : Debug: (152) [eap] = handled Mon Jun 8 05:57:20 2015 : Debug: (152) } # authenticate = handled Mon Jun 8 05:57:20 2015 : Debug: (152) Using Post-Auth-Type Challenge Mon Jun 8 05:57:20 2015 : Debug: (152) Post-Auth-Type sub-section not found. Ignoring. Mon Jun 8 05:57:20 2015 : Debug: (152) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (152) session-state: Nothing to cache Mon Jun 8 05:57:20 2015 : Debug: (152) Sent Access-Challenge Id 48 from 192.168.3.48:1812 to 192.168.3.201:1024 length 0 Mon Jun 8 05:57:20 2015 : Debug: (152) EAP-Message = 0x019703e81940d027670910cd24815ce68c509691a6027d4d32c742fd2152db96203c01477e40e1fb397b2d854dadef536faac0190c02f09dadbd8c92c64b0f874bc4cd223be761823ab9c83910b648daf987435b98be5aca01f12238ff7c9651390663cfd2b91b0004e5308204e1308203c9a003020102 Mon Jun 8 05:57:20 2015 : Debug: (152) Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 8 05:57:20 2015 : Debug: (152) State = 0x209817dc220f0ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (152) Finished request Mon Jun 8 05:57:20 2015 : Debug: Waking up in 4.9 seconds. Mon Jun 8 05:57:20 2015 : Debug: (153) Received Access-Request Id 49 from 192.168.3.201:1024 to 192.168.3.48:1812 length 225 Mon Jun 8 05:57:20 2015 : Debug: (153) Framed-MTU = 1480 Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-IP-Address = 192.168.3.201 Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-Identifier = 'HP ProCurve Switch 2824' Mon Jun 8 05:57:20 2015 : Debug: (153) User-Name = 'ctc' Mon Jun 8 05:57:20 2015 : Debug: (153) Service-Type = Framed-User Mon Jun 8 05:57:20 2015 : Debug: (153) Framed-Protocol = PPP Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-Port = 2 Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-Port-Type = Ethernet Mon Jun 8 05:57:20 2015 : Debug: (153) NAS-Port-Id = '2' Mon Jun 8 05:57:20 2015 : Debug: (153) Called-Station-Id = '00-0e-7f-c4-98-60' Mon Jun 8 05:57:20 2015 : Debug: (153) Calling-Station-Id = '50-65-f3-5c-e9-ed' Mon Jun 8 05:57:20 2015 : Debug: (153) Connect-Info = 'CONNECT Ethernet 1000Mbps Full duplex' Mon Jun 8 05:57:20 2015 : Debug: (153) Tunnel-Type:0 = VLAN Mon Jun 8 05:57:20 2015 : Debug: (153) Tunnel-Medium-Type:0 = IEEE-802 Mon Jun 8 05:57:20 2015 : Debug: (153) Tunnel-Private-Group-Id:0 = '1' Mon Jun 8 05:57:20 2015 : Debug: (153) State = 0x209817dc220f0ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (153) EAP-Message = 0x029700061900 Mon Jun 8 05:57:20 2015 : Debug: (153) Message-Authenticator = 0xdc642a3312c2b7a0bf5c5700b86cc72f Mon Jun 8 05:57:20 2015 : Debug: (153) session-state: No cached attributes Mon Jun 8 05:57:20 2015 : Debug: (153) # Executing section authorize from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (153) authorize { Mon Jun 8 05:57:20 2015 : Debug: (153) policy filter_username { Mon Jun 8 05:57:20 2015 : Debug: (153) if (!&User-Name) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (!&User-Name) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ / /) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ / /) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /@.*@/ ) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /@.*@/ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /\.\./ ) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /\.\./ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Mon Jun 8 05:57:20 2015 : Debug: (153) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /\.$/) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /\.$/) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /(a)\./) { Mon Jun 8 05:57:20 2015 : Debug: (153) if (&User-Name =~ /(a)\./) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (153) } # policy filter_username = notfound Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [preprocess] = ok Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling chap (rlm_chap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from chap (rlm_chap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [chap] = noop Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling mschap (rlm_mschap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from mschap (rlm_mschap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [mschap] = noop Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling digest (rlm_digest) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from digest (rlm_digest) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [digest] = noop Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling suffix (rlm_realm) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) suffix: Checking for suffix after "@" Mon Jun 8 05:57:20 2015 : Debug: (153) suffix: No '@' in User-Name = "ctc", looking up realm NULL Mon Jun 8 05:57:20 2015 : Debug: (153) suffix: No such realm "NULL" Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from suffix (rlm_realm) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [suffix] = noop Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: calling eap (rlm_eap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Peer sent code Response (2) ID 151 length 6 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Continuing tunnel setup Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authorize]: returned from eap (rlm_eap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [eap] = ok Mon Jun 8 05:57:20 2015 : Debug: (153) } # authorize = ok Mon Jun 8 05:57:20 2015 : Debug: (153) Found Auth-Type = EAP Mon Jun 8 05:57:20 2015 : Debug: (153) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (153) authenticate { Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authenticate]: calling eap (rlm_eap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Expiring EAP session with state 0x209817dc220f0ee7 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Finished EAP session with state 0x209817dc220f0ee7 Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Previous EAP request found for state 0x209817dc220f0ee7, released from the list Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Peer sent method PEAP (25) Mon Jun 8 05:57:20 2015 : Debug: (153) eap: EAP PEAP (25) Mon Jun 8 05:57:20 2015 : Debug: (153) eap: Calling eap_peap to process EAP data Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: processing EAP-TLS Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: Received TLS ACK Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: Received TLS ACK Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: ACK handshake fragment handler Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: eaptls_verify returned 1 Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: eaptls_process returned 13 Mon Jun 8 05:57:20 2015 : Debug: (153) eap_peap: FR_TLS_HANDLED Mon Jun 8 05:57:20 2015 : Debug: (153) eap: EAP session adding &reply:State = 0x209817dc23000ee7 Mon Jun 8 05:57:20 2015 : Debug: (153) modsingle[authenticate]: returned from eap (rlm_eap) for request 153 Mon Jun 8 05:57:20 2015 : Debug: (153) [eap] = handled Mon Jun 8 05:57:20 2015 : Debug: (153) } # authenticate = handled Mon Jun 8 05:57:20 2015 : Debug: (153) Using Post-Auth-Type Challenge Mon Jun 8 05:57:20 2015 : Debug: (153) Post-Auth-Type sub-section not found. Ignoring. Mon Jun 8 05:57:20 2015 : Debug: (153) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (153) session-state: Nothing to cache Mon Jun 8 05:57:20 2015 : Debug: (153) Sent Access-Challenge Id 49 from 192.168.3.48:1812 to 192.168.3.201:1024 length 0 Mon Jun 8 05:57:20 2015 : Debug: (153) EAP-Message = 0x0198017619007479820900c7ba6febe19fb88e300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d010105050003820101004aeb0a79893906ef633d Mon Jun 8 05:57:20 2015 : Debug: (153) Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 8 05:57:20 2015 : Debug: (153) State = 0x209817dc23000ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (153) Finished request Mon Jun 8 05:57:20 2015 : Debug: Waking up in 4.9 seconds. Mon Jun 8 05:57:20 2015 : Debug: (154) Received Access-Request Id 50 from 192.168.3.201:1024 to 192.168.3.48:1812 length 225 Mon Jun 8 05:57:20 2015 : Debug: (154) Framed-MTU = 1480 Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-IP-Address = 192.168.3.201 Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-Identifier = 'HP ProCurve Switch 2824' Mon Jun 8 05:57:20 2015 : Debug: (154) User-Name = 'ctc' Mon Jun 8 05:57:20 2015 : Debug: (154) Service-Type = Framed-User Mon Jun 8 05:57:20 2015 : Debug: (154) Framed-Protocol = PPP Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-Port = 2 Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-Port-Type = Ethernet Mon Jun 8 05:57:20 2015 : Debug: (154) NAS-Port-Id = '2' Mon Jun 8 05:57:20 2015 : Debug: (154) Called-Station-Id = '00-0e-7f-c4-98-60' Mon Jun 8 05:57:20 2015 : Debug: (154) Calling-Station-Id = '50-65-f3-5c-e9-ed' Mon Jun 8 05:57:20 2015 : Debug: (154) Connect-Info = 'CONNECT Ethernet 1000Mbps Full duplex' Mon Jun 8 05:57:20 2015 : Debug: (154) Tunnel-Type:0 = VLAN Mon Jun 8 05:57:20 2015 : Debug: (154) Tunnel-Medium-Type:0 = IEEE-802 Mon Jun 8 05:57:20 2015 : Debug: (154) Tunnel-Private-Group-Id:0 = '1' Mon Jun 8 05:57:20 2015 : Debug: (154) State = 0x209817dc23000ee756ad6df1b14e725e Mon Jun 8 05:57:20 2015 : Debug: (154) EAP-Message = 0x029800060319 Mon Jun 8 05:57:20 2015 : Debug: (154) Message-Authenticator = 0xb4daff305fd89d80c104cb751486a1d1 Mon Jun 8 05:57:20 2015 : Debug: (154) session-state: No cached attributes Mon Jun 8 05:57:20 2015 : Debug: (154) # Executing section authorize from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (154) authorize { Mon Jun 8 05:57:20 2015 : Debug: (154) policy filter_username { Mon Jun 8 05:57:20 2015 : Debug: (154) if (!&User-Name) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (!&User-Name) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ / /) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ / /) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /@.*@/ ) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /@.*@/ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /\.\./ ) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /\.\./ ) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Mon Jun 8 05:57:20 2015 : Debug: (154) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /\.$/) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /\.$/) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /(a)\./) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&User-Name =~ /(a)\./) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) } # policy filter_username = notfound Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling preprocess (rlm_preprocess) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [preprocess] = ok Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling chap (rlm_chap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from chap (rlm_chap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [chap] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling mschap (rlm_mschap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from mschap (rlm_mschap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [mschap] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling digest (rlm_digest) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from digest (rlm_digest) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [digest] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling suffix (rlm_realm) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) suffix: Checking for suffix after "@" Mon Jun 8 05:57:20 2015 : Debug: (154) suffix: No '@' in User-Name = "ctc", looking up realm NULL Mon Jun 8 05:57:20 2015 : Debug: (154) suffix: No such realm "NULL" Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from suffix (rlm_realm) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [suffix] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Peer sent code Response (2) ID 152 length 6 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: No EAP Start, assuming it's an on-going EAP conversation Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [eap] = updated Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling files (rlm_files) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) files: users: Matched entry DEFAULT at line 182 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from files (rlm_files) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [files] = ok Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling expiration (rlm_expiration) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from expiration (rlm_expiration) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [expiration] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling logintime (rlm_logintime) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from logintime (rlm_logintime) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [logintime] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: calling pap (rlm_pap) for request 154 Mon Jun 8 05:57:20 2015 : WARNING: (154) pap: No "known good" password found for the user. Not setting Auth-Type Mon Jun 8 05:57:20 2015 : WARNING: (154) pap: Authentication will fail unless a "known good" password is available Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authorize]: returned from pap (rlm_pap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [pap] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) } # authorize = updated Mon Jun 8 05:57:20 2015 : Debug: (154) Found Auth-Type = EAP Mon Jun 8 05:57:20 2015 : Debug: (154) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (154) authenticate { Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authenticate]: calling eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Expiring EAP session with state 0x209817dc23000ee7 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Finished EAP session with state 0x209817dc23000ee7 Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Previous EAP request found for state 0x209817dc23000ee7, released from the list Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Peer sent method NAK (3) Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Peer NAK'd our request for PEAP (25) with a request for PEAP (25), skipping... Mon Jun 8 05:57:20 2015 : ERROR: (154) eap: No mutually acceptable types found Mon Jun 8 05:57:20 2015 : Debug: (154) eap: Failed in EAP select Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[authenticate]: returned from eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [eap] = invalid Mon Jun 8 05:57:20 2015 : Debug: (154) } # authenticate = invalid Mon Jun 8 05:57:20 2015 : Debug: (154) Failed to authenticate the user Mon Jun 8 05:57:20 2015 : Debug: (154) Using Post-Auth-Type Reject Mon Jun 8 05:57:20 2015 : Debug: (154) # Executing group from file /root/etc/raddb/sites-enabled/default Mon Jun 8 05:57:20 2015 : Debug: (154) Post-Auth-Type REJECT { Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 154 Mon Jun 8 05:57:20 2015 : Debug: %{User-Name} Mon Jun 8 05:57:20 2015 : Debug: Parsed xlat tree: Mon Jun 8 05:57:20 2015 : Debug: attribute --> User-Name Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: EXPAND %{User-Name} Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: --> ctc Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Matched entry DEFAULT at line 18 Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Attribute "Framed-Protocol" allowed by 0 rules, disallowed by 0 rules Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Attribute "Framed-Compression" allowed by 0 rules, disallowed by 0 rules Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: EAP-Message = 0x04980004 allowed by EAP-Message =* 0x Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Mon Jun 8 05:57:20 2015 : Debug: (154) attr_filter.access_reject: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [attr_filter.access_reject] = updated Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: calling eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: returned from eap (rlm_eap) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [eap] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) policy remove_reply_message_if_eap { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&reply:EAP-Message && &reply:Reply-Message) { Mon Jun 8 05:57:20 2015 : Debug: (154) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Mon Jun 8 05:57:20 2015 : Debug: (154) else { Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: calling noop (rlm_always) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) modsingle[post-auth]: returned from noop (rlm_always) for request 154 Mon Jun 8 05:57:20 2015 : Debug: (154) [noop] = noop Mon Jun 8 05:57:20 2015 : Debug: (154) } # else = noop Mon Jun 8 05:57:20 2015 : Debug: (154) } # policy remove_reply_message_if_eap = noop Mon Jun 8 05:57:20 2015 : Debug: (154) } # Post-Auth-Type REJECT = updated Mon Jun 8 05:57:20 2015 : Debug: (154) Delaying response for 1.000000 seconds Mon Jun 8 05:57:20 2015 : Debug: Waking up in 0.3 seconds. Mon Jun 8 05:57:20 2015 : Debug: Waking up in 0.6 seconds. Mon Jun 8 05:57:21 2015 : Debug: (154) <delay>: Sending delayed response Mon Jun 8 05:57:21 2015 : Debug: (154) <delay>: Sent Access-Reject Id 50 from 192.168.3.48:1812 to 192.168.3.201:1024 length 44 Mon Jun 8 05:57:21 2015 : Debug: (154) <delay>: EAP-Message = 0x04980004 Mon Jun 8 05:57:21 2015 : Debug: (154) <delay>: Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 8 05:57:21 2015 : Debug: Waking up in 3.9 seconds. Mon Jun 8 05:57:25 2015 : Debug: (151) <done>: Cleaning up request packet ID 47 with timestamp +1844 Mon Jun 8 05:57:25 2015 : Debug: (152) <done>: Cleaning up request packet ID 48 with timestamp +1844 Mon Jun 8 05:57:25 2015 : Debug: (153) <done>: Cleaning up request packet ID 49 with timestamp +1844 Mon Jun 8 05:57:25 2015 : Debug: (154) <delay>: Cleaning up request packet ID 50 with timestamp +1844 Mon Jun 8 05:57:25 2015 : Debug: Waking up in 4.7 seconds. Mon Jun 8 05:57:29 2015 : Debug: (150) <done>: Cleaning up request packet ID 46 with timestamp +1838 Mon Jun 8 05:57:29 2015 : Info: Ready to process requests

3 2

[freeradius-server 3.0.8] errors while compiling
by ICHIBA Sara 10 Jun '15

10 Jun '15

hey, I'm trying to install freeradius-server 3.0.8. I installed successfully talloc 2.1.0 but when I do ./configure in order to install freeradius I have these errors and warnings configure: WARNING: snmpget not found - Simultaneous-Use and checkrad may not work configure: WARNING: snmpwalk not found - Simultaneous-Use and checkrad may not work configure: WARNING: pcap library not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pc ap-lib-dir=<path>. configure: WARNING: collectdclient library not found. Use --with-collectdclient-lib-dir=<path>. configure: WARNING: cap library not found, debugger checks will not be enabled. Use --with-cap-lib-dir=<path>. configure: error: in `/root/freeradius-server-3.0.8': configure: error: failed linking to libcrypto. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds with out OpenSSL) See `config.log' for more details you can find the complete output of the compilation in the file attached. I'm running on centOS 7.

4 9

issues with running freeradius3.0.8 certificate authentication
by syed latheef 10 Jun '15

10 Jun '15

Hi We had installed the freeradius 3.0.8 in our redhat machine but the certificate is not getting authenticated . the logs are attached along with this mail .this machine previously was running freeradius older version which was working fine .please help us resolve this issue . Thanks Latheef.S

1 0

Different LDAPs for different realms
by Šerých Jakub 10 Jun '15

10 Jun '15

Dear freeradius group, I'm sorry for such a newbie question, but I'm little bit lost in the freeradius configuration files structure. I have freeradius 3.0.9 running on Debian 8 in the eduroam network. I need to authenticate users of my organization realms on my server using LDAP (I have 2 realms with sepparate LDAP servers (on MS active directory controllers)). All other realms I need to send to national eduroam radius server by the radsec channel. At the moment my configuration works with the users added to "users" file. But when I tried to configure LDAP authentication using tutorials found on the Internet: - specification of LDAP server access in the modules-enabled/ldap - switching the ldap authentication in the sites-enabled/inner-tunnel authorize { . ldap . } . authenticate { . Auth-Type LDAP { ldap } . } it tries to LDAP authenticate all the users with any realm, not only my internal realms. Could anybody send me some example configuration files for such situation or reference to some tutorial solving it? Thanks in advance for any info Jakub

2 1

implementing network authentication
by Randeep 10 Jun '15

10 Jun '15

Hi Guys, This is Randeep from Bangalore, India. I work in a small company. We are planning to provide ISP services shortly. The plan is as follows. We will have a mpls nation wide vpn network and in each city we will have a city POP where the local cable operators can connect to our network. From the local cable operators we will reach the customers. So we are planning to use FreeRadius for the network authentication. We will have our centralized Radius server in Bangalore and in each city POP we will have a NAS(Network Access Server), most probably a Mikrotik router. The customers will as for authentication to the NAS and nas will forward the request to the radius and radius will validate it. Our plan for customer creation is as follows. >From our website, we will be able to create new customers. From the website we will be creating the broadband plans(includes the bandwidth available to the customer like 10mbps and the data limit etc). The issues are: I couldn't find any apis for the freeradius to create the plans or create the users or specify the plan details. How can I do this? We will be using mysql along with FreeRadius. What I understood from the google is the radius will send the VSA to the NAS for limiting the user access. But from where the FreeRadius will get these values? Can we write this to the mysql tables? And I learned that the NAS will update the Radius about the usage periodically. But to which table in FreeRadius this will be written? And will the freeRadius will compare the total data the user consumed and his limit when the radius validate the next request from the user? Is there any rules we need to write for this? We would like to use PPPoE for auth. We have to run the PPPoE on Mikrotik? also the ip pools we have to allot there? And we would like to do two kind of logins. 1. A browser page redirection when the user tries to start using interent. Which asks for password and username. 2. PPPoE dialer for android Can you guys please clear these or suggest if any other better scenario for implementing this kind of solution? Best Regards, Randeep

2 3

SQL Counter access period reply CoA on Update Interim
by Jose Luis Espinoza 09 Jun '15

09 Jun '15

Hi, I setup up a sql_counter fine… after access period is reached and active connections is reset user cannot login again. The issue is to ‘kill’ that connection just in the moment access period limit is reached. Can anybody explain me how to do that? Kind Regards JL

2 4