- Freeradius-Users - lists.freeradius.org

Re: empty preacct and accounting section
by Alan Buxey 25 Sep '13

25 Sep '13

As the msg says. Your preacct {} and accounting {} sections in your server are not configured to do anything. Add active modules to them eg a database call and things will be different. alan

3 2

empty preacct and accounting section
by WorkingMan 25 Sep '13

25 Sep '13

I have been seen this weird message for two days now. I setup PPTP and IPSec (ikev1) with freeradius + mysql. In both cases I see Access-Acccept and in Accounting-Request I see these two message: WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. I have no clue where it's wrong. PPTP can connect but IPSec connection would just keep sending Accounting-Request and never connects (it looks like connection depends on this step). The obvious consequence of this is that there is no accounting info in the DB (due to above warning). I did have success when configuring both separately before. When I combine both together it seems to always cause issue. I am sure it's a configuration issue but I just can't see where the problem is. I saw a post related to this before but it had no resolution other than telling OP that his configuration was wrong. One hint I have is the following log but I don't know what's the cause of it. ignoring request with ID <id>, already processing retransmitting RADIUS message ... #goes on for a while for IPSec, only twice for PPTP RADIUS is not responding Thanks

3 3

Help with sqlcounter for data transferred
by Fabrizio Fiore Donati 25 Sep '13

25 Sep '13

Hi, i'm configuring a server with a sql counter to check the total byte in a week for the users. But the server will reply a wrong count. Here's the counter: sqlcounter weeklybytecounter { counter-name = Weekly-Total-Max-Octets check-name = Max-Weekly-Octets reply-name = Mikrotik-Total-Limit sqlmod-inst = sql key = User-Name reset = weekly query = "SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" But the reply doesn't is the operation between (check-name value) - (query value) for example: rlm_sqlcounter: Authorized user fabrizio, check_item=3000000000, counter=38101894 I expect a reply of 3000000000 - 38101894 = 2961898106 but i receive different value also bigger..... Any idea ? -- Fabrizio Fiore Donati Mobile: +39 3289872420 E-mail: fabrizio.fioredonati(a)2bite.net 2bite s.r.l. Via Saragat snc 67100 L'Aquila (AQ) - Italy Tel.: +39 0862441583

1 0

Re: Active Directory authentication question
by Alan Buxey 25 Sep '13

25 Sep '13

Well. There's no such thing as EAP-TLS/MSCHAPv2 . So I'd guess that your Android device is just doing PEAPv0/EAP-MSCHAPv2 or such and your config allows it to. If you ran in full debug mode when connecting with the Android device you'd see exactly what's happening alan

1 0

EAP-AKA, EAP-AKA'
by Arran Cudbard-Bell 25 Sep '13

25 Sep '13

Just out of interest is anyone using EAP-AKA with the EAP2 module in FreeRADIUS 2.x.x? If so what sorts of services are you using for? Have any telcos successfully deployed EAP-SIM/EAP-AKA['] for authenticating handsets to GSM and 802.11 networks to facilitate cross medium roaming? -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

Proxy auth should supersede local auth
by JB 25 Sep '13

25 Sep '13

Hi! Our setup utilizes custom SQL schemas and functions for authentication and authorization. We now want to add a roaming proxy for a certain realm. When a user logs in using this realm, our custom SQL authorization should be skipped because our functions and the roaming proxy are completely different use cases. Our site now looks something like this: authorize { preprocess suffix if (Realm == "NULL") { custom-sql files } } At first glance, this seems to work but I wanted to know if there's a better or more common way to achieve this. Or is this completely stupid after all? (Why?) Thanks! JB

2 2

pap always returns noop for windows dialup authentication
by paul trader 24 Sep '13

24 Sep '13

hi all - i've recently tried upgrading from v1 to v2. on a centos 6.4 box w/ all latest updates, i installed freeradius v2, added one username and password to /etc/raddb/users: test Cleartext-Password := "testing" and the radtest command-line authentication works. i then added one client for our blade server to /etc/raddb/clients.conf: client x.x.x.x { secret = xxxxx shortname = 3coms } substituting the correct ip and secret for the x's. testing from my linux box w/ a modem, authentication works. output from radiusd -X shows all is well, my linux box receives an ip address and dns servers. relavant -X debug output shows: ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok however, when trying to authenticate from a windows box, authentication fails. every time. i've tried it from a windows xp machine and 2 windows 7 machines. the debug output always says: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject i've been over and over everything a dozen times, have tried changing the windows dialup security settings to use pap only, and also have tried adding the following line to the users file: Auth-Type = PAP even though everything i've read said not to do that. still doesn't work. the only changes i've made to the default installation are to the users and clients.conf files. i have spent hours searching the internet for a similar problem/solution and come up empty. windows boxes will not authenticate, pap always returns noop, and the user is rejected. am i doing something glaringly wrong, or just going plain crazy? regards, paul

4 12

Re: Active Directory authentication question
by Alan Buxey 24 Sep '13

24 Sep '13

Or ask your distribution provider why they still provide wpa_supplicant package without eapol_test tool ;) alan

1 0

message freeradius
by María Teresa Mondragón Reyes 24 Sep '13

24 Sep '13

Hi everybody I need some help I'm new in this topic and I'm traying to configure a freeradius serve. I followed the instructions to configure freeradius plus remote mysql server and when put in debug mode freeradius -f -X i get this message. rad_recv: Accounting-Request packet from host 192.168.4.224 port 32769, id=157, length=285 Invalid packet code 4 sent to a proxy port from home server 192.168.4.224 port 32769 - ID 157 : IGNORED Ready to process requests. Im getting the connection, there is no problem, my user is reaching a ip from the private network 192.168.6.xxx and can access to internet. My freeradius server is in the same machine that shorewall, DNS and gateway... my shorewall rules . . . ACCEPT loc $FW:192.168.4.254 udp 1812,1814,18120 . . . Thanks in advanced tere mondragón

3 2

EAP-TLS Authentication
by arvind132 . 24 Sep '13

24 Sep '13

Hi, I am facing some issues with 802.1x EAP-TLS Authentication. Please suggest any document which can help in better understanding on TLS Authentication. Thanks.

2 1