- Freeradius-Users - lists.freeradius.org

Grab request password with ASCII character
by Mehdi Ravanbakhsh 30 Apr '13

30 Apr '13

Hi Alll i need to Grab request password to insert in database if Cleartext-Password is "import" so i write this unlang script in authenticate section : Auth-Type PAP { pap { reject = 1 } if (reject) { if ("%{control:Cleartext-Password}"=="import" ) { ok update control { password-import = "%{sql:SELECT change_impoprt_password ('%{User-Name}'::varchar,'%{User-Password}'::varchar)}" Log-State := "New Password Is Imported" } } else { if (("%{control:Bad-Password-Pool}") && ("%{control:Bad-Password-Pool}" != "" ) ) { ok update control { Auth-Type := "Accept" Pool-Name := "%{control:Bad-Password-Pool}" Log-State := "PAP Password Is Not Correct" } update reply { Reply-Message = "Your Password in not correct in system" } } else { update control { Log-State := "PAP Password Is Not Correct - Reject" Auth-Type := "Reject" } update reply { Reply-Message := "Your Password in not correct in system" } } } ok } } but if user use symbols like ! @#& or any character that is based on ASCII character i can not get real password character for example : import password is : "test!@#" request:user-password is : "test=21@=23" do we have any way to get or convert request:user-password to none ASCII .

3 4

Re: How to fix the proxy source port
by Okis Chuang 30 Apr '13

30 Apr '13

> Chuang Okis wrote: > > I think you misunderstanding my point a bit. Maybe I don't express it clear > enough. > > I only need fixing my *source port* instead of random port, I don't care IP > address at all. > > Ah, OK. > > > Actually, due to some maintenance issue, we want to know that could we fix > our arc port while our freeRADIUS AS A ROAMING CENTER. We are trying > reducing the number of firewall logs. That's why we want to keep src port the > same. > > No there's no way to fix the source port. > > Even if you did, the server would dynamically open *new* source ports > when it gets busy. That's how UDP applications work. > Ok, now I've saved lots of time finding any possible way to do this. Thanks for being so concise about this issue. > It should be OK to have a firewall rule which allows packets FROM the > proxy IP, TO the home server IP and home server port. Adding the source > port is pretty much pointless. > > Alan DeKok. > Hmm. That sounds making sense. I'll discuss with our firewall policy manager about it. However, thank you very much Alan. Okis.

1 0

wireshart shows wrong information
by Juan Pablo L. 29 Apr '13

29 Apr '13

Hi, i m implementing a module in which i m using some TLV for which i modified the dictionary.3gpp2 as very well suggested in a different thread, but i see that the data for those TLV fields are not encoded properly or at least that is what wireshark is showing even thou debugging freeradius it shows that the data being sent is the correct it differs from the data captured using tcpdump ... here is my dictionary entry: ATTRIBUTE 3GPP2-Prepaid-Acct-Quota 90 tlvBEGIN-TLV 3GPP2-Prepaid-Acct-QuotaATTRIBUTE 3GPP2-Prepaid-Acct-Quota-QuotaIDentifier 1 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeQuota 2 integerATTRIBUTE 3GPP2-Prepaid-Acct-Quota-VolumeThreshold 4 integerEND-TLV 3GPP2-Prepaid-Acct-Quota and for that i m writing the following code: pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-QuotaIDentifier","1", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeQuota","1000000", T_OP_EQ));pairadd(&request->reply->vps,pairmake("3GPP2-Prepaid-Acct-Quota-VolumeThreshold","100", T_OP_EQ));

5 12

Re: How to fix the proxy source port
by Chuang Okis 29 Apr '13

29 Apr '13

I think you misunderstanding my point a bit. Maybe I don't express it clear enough. I only need fixing my *source port* instead of random port, I don't care IP address at all. Actually, due to some maintenance issue, we want to know that could we fix our arc port while our freeRADIUS AS A ROAMING CENTER. We are trying reducing the number of firewall logs. That's why we want to keep src port the same. Hope my illustration being clear enough! : p Okis > Re: How to fix the proxy source port

2 1

Question about EAP-TTLS session resumption
by stefan.paetow＠diamond.ac.uk 29 Apr '13

29 Apr '13

Hi, We're trying to put together an EAP-TTLS authentication solution with another open-source authentication server (Jasig CAS). We've found that only the first authentication process succeeds, but everything else after fails. In order for us to pinpoint whether this is a problem in the CAS software or the JRadius implementation of the EAP-TTLS Radius authenticator, I'd just like to confirm with the Radius experts on the list that I have some things right. As far as I understand RFC5281 (the EAP-TTLS RFC) in general and Section 15.3 (session resumption) more in particular, the EAP-TTLS session should only be resumed if the client was successfully authenticated with the server. So am I correct in saying that if an EAP-TTLS session was established and a username and password were passed through the tunnel that were not successfully authenticated (i.e. the password was incorrect), the session cannot be resumed and should start again, i.e. a new tunnel session should be negotiated and the authentication request retried? What we've seen is that the radiusd -X output shows a full EAP-TTLS session negotiation the first time, but then only a resumption (or at least that's what FreeRADIUS assumes, based on the debug output) of the session to continue. FreeRADIUS then sees the EAP handler fail. Should that session (i.e. 'request 7 ID 9') have been renegotiated and restarted because the user-password combination of 'bob' and 'test' is invalid? -- begin of debug output -- Ready to process requests. rad_recv: Access-Request packet from host 172.23.6.33 port 49802, id=2, length=53 User-Name = "bob" EAP-Message = 0x0200000801626f62 Message-Authenticator = 0xeec2f0280b8274f92fc902a15122729c # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 2 to 172.23.6.33 port 49802 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee0ac522ee0bd0bfaaf533badfdea46d Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.6.33 port 49802, id=3, length=135 User-Name = "bob" State = 0xee0ac522ee0bd0bfaaf533badfdea46d EAP-Message = 0x020100481500160301003d010000390301517e66cc1774b02aba3b0067774c719d9a7c24c36fb94a5d97f862a59f866bd30000120039003800330032001600130035002f000a0100 Message-Authenticator = 0x93d337adcf53e180ece72e8e881f3022 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 72 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 003d], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 172.23.6.33 port 49802 EAP-Message = 0x0102040015c000000aad160301002a020000260301517e66cc4dd7399c18c8e95722c093c30c18a2b3549d244021917a9abb3cf70c00003900160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3133303332383130343130335a170d3133303532373130343130335a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c2361ca9a23bfb2d48d6a3c5f76e83350f2a58e42587f9adc4de3612058d892aa23524ebdd297ca35a4f8c0611df6c3c5fefe1960457461c408837e5a510 EAP-Message = 0x34b1ae326dd147568ab1f1bff4fa5d40bcf87b28c9c030344a4cbe39a61ff41fe8cfdc10ef05ccc6aafeff7f0174dddb5eaa3b9c1fd69123d1ea0200dc979466ade9c041914e82e1797ad55d78246505f6afe90216d3ccb0dd528f3af0d3ac20cb3211bd6add5ac2c17aa4162059f955ecbefd1f15f9129b81189d265af1ec0079756a51cfed7d324ba21ef25f76331646759c0803ff0991f67146414b32c22dcc55403641c94e203e4cef260f1becdab151f573deaf0cc24f91fd48d2f5256beef50203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010041663c32fe5eedd682 EAP-Message = 0xddc752319616593b579b11640c49c453da1185607efccb85c520e0b6ff8c5af5ee473eedce1dc2b34511697a799e7714d1a172ff7b28a795f98d318b22a8830949f603ea384648c5b5dc87d29aaf0837b35656dce70a09354480a66724153ab9fad79c4beef5f2e7cb2dbcd5bcecc6a09351cb60e7052d3c8e3d61d2bd731ebe2ffe45b961c1eaebe18d869dcd3a90c3330bcfa11426d5b69a100a67171af5c5f4c9a039a8633facfa708cdd222bdf9b3c5eca0ac2b9d2b2b6cd64c0e36e2a552c2599bd718a439eb451fca5061d049aa0b4da32261b5d42f03bb66414744b5dd5eb409203f382991f8c30ba7a39459570d75007dfeaaf0004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee0ac522ef08d0bfaaf533badfdea46d Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.6.33 port 49802, id=4, length=69 User-Name = "bob" State = 0xee0ac522ef08d0bfaaf533badfdea46d EAP-Message = 0x020200061500 Message-Authenticator = 0x70dbb506dd3e90f77ccd778face63bce # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 172.23.6.33 port 49802 EAP-Message = 0x0103040015c000000aad0084f610431892d8fc300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3133303332383130343130335a170d3133303532373130343130335a308193310b3009060355040613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100bbed8595e784e9c7c0df8907a92d8fbd387b3573c00086b0f36a983ef0f17a98a884b384f3f9b735c2ca53bf7752d09a75c86c4ae311ad013ed00a6f8e5059e49fbbc4d0bb89deff65a02ecb4bfe539b732f40c1f5eec0e948aceff8f4c127db4a0d094802ce5c831d5fdf EAP-Message = 0xc29ab0bdf654698c465becf471fa0e9ff5a4710ac2049b3b1e0c5c28130974a15d3196b2e9ed8045ecd85877bd2c5d5a2611960a7bf231b24a7df880684adcb83672ede7978ed87702fc5dea2481b7e57b2915a6e636095acd7ccf81fb63d9ad11a662e603e608e99ce8f8da2ad5580a4ff9e2fc04e17e48880e88469b2eeec32a799ea415402223b6963f0457fe9e078b7700ac850203010001a381fb3081f8301d0603551d0e041604149fb44e41b351c3814ceb1717bb8635456bb14c373081c80603551d230481c03081bd80149fb44e41b351c3814ceb1717bb8635456bb14c37a18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747982090084f610431892d8fc300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100998e6624f26413f190607c91e2c1980a631e7502118553724829370404c2a76be99df3f8fc002ab9d5058e545a4fba5d5141ee1289e23210e2a68046e2f84f251d8a2aac18bf7d480882dc7bab3b EAP-Message = 0x6e17558a9a641e99eb1dd950 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee0ac522ec09d0bfaaf533badfdea46d Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.6.33 port 49802, id=5, length=69 User-Name = "bob" State = 0xee0ac522ec09d0bfaaf533badfdea46d EAP-Message = 0x020300061500 Message-Authenticator = 0xc5b78f00d90d9000f380c6c4ffbf1e03 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 5 to 172.23.6.33 port 49802 EAP-Message = 0x010402cb158000000aadbf54dd4a547886f0e1b9c2de1016d7e2cffa5639e29b519987f01a974ea9f4808f63b48391965c13a0a7f93dbeb91696b8c1aee94ea74d7a347a3f54d5bf68bb967c97aeec64c7360224f361a18df585547ce3b547cf6d9955dcbc1a514d792259c0b25672a871f18a14a8a25abe32f12e42917dfac450cb0361478cec76ffb33bb2d0cae6b7edc1e1aa81620b64c586e4a1c09bf360c6b72b716122184825d718ac7c120d91160301020d0c0002090080b34ae22174e4eeae3fca75f04f4d925acf03a3263797fdd693c77f43551070859c00a5c1efc1c1ac0c50a3be2a6f3f8020a1642dbe282f5f528c6eab4e563c30609a EAP-Message = 0x63b1526ba290556dbd48c0f94578e2e90209ec08f006b2cee430c8daeb0f8940309fbbecaa2fb31fa3a9e6f0a518acdf08f2b49cdc25668b2753648e28730001020080543bbf88aa79bd53f6160d0d35a072f857b9c2972aab6332705af63a790d6403e9c49ff22b2dc49357404f932d07dd5f356f50278d7bbcf0626306b6ebaf3b31094b6f3969d60275c81928f76c7324e7432e60e507fc82f2047d9fd1116d0cc7492cd19e8af4e0dfad67e34f71c991ac2124e0ec5cc0bfc4d66d1105044afb3301002609ffc594fff901957db2d2aa85722cb988ef50d088331db2bd44fc8b42c435dbb8acfe4b7132f89ad2d6962ce4d15bf2b3f59f6089fd12 EAP-Message = 0xa0a20b93710c7261920e086b869d8830fd2b364478a99aad88e55943423ed0e9685288e1a6296eafc1e6ecbfd23814050ac1be7fb16f7a14e18cf093e42d6ef9c5e76b56f4c8dfbd1190faaf3612164971be6ed9afad7139baee74ad1fd919830e4dd47e5c39323f8c30ad328883d247faf64041a8fc47e6900b1fe4d32fe34bb1570021cd2eb41e84fd085c44c0c4fa850c993265052d2d736bf5b618ddfa80ef1d38a3fc4b7adf22e4cd87dc042e7b6532a38c7f3ff378502cba9ef44e929e31984e44cc10803a16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee0ac522ed0ed0bfaaf533badfdea46d Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.23.6.33 port 49802, id=6, length=283 User-Name = "bob" State = 0xee0ac522ed0ed0bfaaf533badfdea46d EAP-Message = 0x020400dc150016030100861000008200807a3e5b1c5275fc1a5d9703a1869a10c97c0a5d952ef68856282db3247caa800e92f99db7e955628d4b8169744a4041bdeb9283fe6325b96111d66b23fbc6a9d08247e07848ee4b455e093eb0c42ddbb1471c7a7d767d000578d9a72d98f3f10a6867235b586db242befec8b05e9fc7f6290035a891c22ed8dcd63e7c281d0e2714030100010116030100403c4b17cf47865ca8145dadaa0ccaf7e4583434a078dfac613f87a2ab57bab4268a49102b25db060671325f131472762ba222400f2922d8b86a1c41b4929a6d77 Message-Authenticator = 0xab95b02d63cd2fce1e5d84f12d46df51 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 220 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 6 to 172.23.6.33 port 49802 EAP-Message = 0x0105004515800000003b1403010001011603010030bfce3580cef44ecb9c8167c8936362b0e3d27e143628bced69d63ee326962203b07bfdce8c5ff92be9a767135dfa174e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee0ac522ea0fd0bfaaf533badfdea46d Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.23.6.33 port 49802, id=7, length=69 User-Name = "bob" State = 0xee0ac522ea0fd0bfaaf533badfdea46d EAP-Message = 0x020500061500 Message-Authenticator = 0xed6e7eafb52ef1f2d6420942208619b7 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 ++[eap] returns handled Sending Access-Challenge of id 7 to 172.23.6.33 port 49802 EAP-Message = 0x0106000a158000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xee0ac522eb0cd0bfaaf533badfdea46d Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.23.6.33 port 49802, id=8, length=175 User-Name = "bob" State = 0xee0ac522eb0cd0bfaaf533badfdea46d EAP-Message = 0x02060070150017030100204bd552b4e34fa7ad1f304d79a10e0268d458c78c0ab0a4dfa7e5eba562ad977f170301004070b2bbfb2617b0c7e477b6bb36c0d1264019ac58b3994ee3b2a5567d091719ca07f880770713cc8b6813b2d08ab93c50f4a07d3e3a361a7fd95a8dba52d56ade Message-Authenticator = 0xcef7f32703068c422db34b44728943c9 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 112 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "bob" User-Password = "test" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "bob" User-Password = "test" FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 8 to 172.23.6.33 port 49802 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 2 with timestamp +56 Cleaning up request 1 ID 3 with timestamp +56 Cleaning up request 2 ID 4 with timestamp +56 Cleaning up request 3 ID 5 with timestamp +56 Waking up in 0.1 seconds. Cleaning up request 4 ID 6 with timestamp +56 Cleaning up request 5 ID 7 with timestamp +56 Waking up in 1.0 seconds. Cleaning up request 6 ID 8 with timestamp +56 Ready to process requests. rad_recv: Access-Request packet from host 172.23.6.33 port 49808, id=9, length=55 User-Name = "steve" EAP-Message = 0x0200000801626f62 Message-Authenticator = 0xc73f5d44c09c2e24670ad724fb07ec95 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry steve at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> steve attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 9 to 172.23.6.33 port 49808 Waking up in 4.9 seconds. Cleaning up request 7 ID 9 with timestamp +78 Ready to process requests. -- end of debug -- Stefan Paetow -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

3 5

Username with spaces (MySQL)
by Andres Gomez Ruiz 29 Apr '13

29 Apr '13

Hi everybody. I'm using freeradius to log many wireless user, It works great. I have a MySQL table working with freeradius, and I use some SQL_counters to control the "timeup" of my users (based on the raddacct table of the database); everything work great, but I only have a problem: Using a captive portal the user "USER1" can login wirh he freeradius server and it record the event int the raddacct table. If anohter user wants to user the same username "USER1" he can't login (I'm using the simultaneus SQL script). But if an other user use the usrname "USER1 " and he puts some "spaces" after the username, HE CAN LOGIN! So I have many users using the same username putting one, two, three, ...etc., spaces after the username. How can I solve this situation? May be with a SQL query that ignores the spaces in the username? (talking about the sql counters) Thanks a lot!!! regards, Andrés

5 6

Re: How to fix the proxy source port
by Okis Chuang 29 Apr '13

29 Apr '13

<quote author='Alan DeKok-2'> Okis Chuang wrote: > Can I FIX the source port rather than random src port when proxy request > to other RADIUS server? > > I know it is able to fix src IP address in proxy.conf, but seems no > config about fixed src port. > > What if I set " src_ipaddr = 127.0.0.1:3100 " in proxy.conf, could this > work? >>No. >>Read proxy.conf. Look for "src_ipaddr". This is documented. >>Alan DeKok. Yeah.Actually I almost k knew it that I cannot achieve this hope while seeing the document. But.I just want to know is there any other way to get this done? I know this demand is not too much common. But it's really a real demand in our case. Any idea? Okis List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </quote> Quoted from: http://freeradius.1045715.n5.nabble.com/How-to-fix-the-proxy-source-port-tp5 719758p5719762.html

2 1

RADIUS server is dumping core
by ramakrishna 29 Apr '13

29 Apr '13

Hi, I am using FreeRADIUS 2.2.0. Recently I have observed that RADIUS server is generating core frequently. I have tried debugging the core file using gdb. Please find the attached file for the gdb output for one of the core file generated. Please lemme know if you need any more information for tracing the core dump. Thanks, -- Best Regards, M.Rama Krishna Prasad,

3 8

authentification ldap subgroup
by REYNALD chekhina 29 Apr '13

29 Apr '13

Hello all ! I have configured freeradius 2.1.12-4 with ldap group authorization. My problem is it's doesn't work with subgroup. I have a group with subgroup and when ldap verify group of user it doesn't see subgroup of user. my ldap configuration modules : ldap {#Note that this needs to match the name in the LDAP#Server certificate, if you.re usin ldaps.server = "192.168.1.3"identity = "cn=user_ldap,ou=users,dc=toto,dc=local"password = Toto1basedn = "dc=toto,dc=local"#filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))"filter = "(&(objectclass=user)(objectcategory=user)(userPrincipalName=%{%{Stripped-User-Name}:-%{User-Name}}*))" # Group membership checking. Disabled by default. #groupname_attribute = cngroupmembership_filter = "(|(&(objectClass=group)(member=%Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn})))"groupmembership_attribute = memberOf chase_referrals = yesrebind = yes} Anyone can help me ? Thanks in advance !

1 1

question about freeradius
by Tim Reichhart 29 Apr '13

29 Apr '13

Hey Guys I am just wondering if I can use freeradius for hotspot and dial up accounts on same box or does it have to be separate box for hotspot and dial up accounts? Tim

3 2