- Freeradius-Users - lists.freeradius.org

Default user authentication
by Matthew Ceroni 12 Mar '13

12 Mar '13

I am using FreeRadius for 802.1x on my wireless LAN (cisco WLC device). This is an older device and as such doesn't allow for guest or restricted VLANs like a physical switch does. One solution I saw online in a Cisco forum is to have a default user that returns the guest VLAN attribute for any failed authentications (so essentially never fail, just always return ACCEPT-ACCEPT for the default user). As I use FreeRadius for my WLAN and LAN I don't want to apply this policy for the wired network. So, using the users file, can I create a default user and attributes that apply only for a certain Calling Station/NAS ID? Thanks

2 2

rlm_yubikey
by Arran Cudbard-Bell 12 Mar '13

12 Mar '13

What is Yubikey? ----------------------- It's another OTP solution. Why use it? ---------------- * smsotp is rediculously insecure * otp clients on mobile phones can be compromised * RSA tokens suck. I'll expand on the RSA stuff a bit. Here's why RSA sucks: * You need to install and maintain a special RSA Appliance just to try out the system. * RSA tokens have a limited lifespan, once the battery runs out the token is useless, you need to get it replaced by RSA. * RSA tokens use pre-generated token seeds. These become cryptographically useless if either your servers or RSA servers are compromised [http://arstechnica.com/security/2011/06/rsa-finally-comes-clean-securid-is-…] * They're not user friendly. Users have to transcribe the numbers and complete authentication before the code changes (something that a suprising number of users seem to find impossible). * The tokens often get out of sync with the RSA server. * The tokens get scratched to the point you can't read the numbers off the screen. The yubikey guys came up with a different solution: * You still have physical token, but its powered by the USB port. * You set the encryption keys (write only), and instead of forcing users to type in a number, it just acts as a HID. When you tap the little button on the face, it enters the OTP string for you. * Instead of using a seed and mutating it synchronously on the token and server, it uses a fixed encryption key to encrypt validation data in the password string. The encrypted data includes replay counters to stop tokens being reused. Although the tokens are kinda expensive $15-$25 if you need a really secure OTP system probably worth giving them a trial. Why am I going on about Yubikey ? ----------------------------------------------- Just finished an rlm_yubikey implementation. I know there were a couple of implementations on the net already, but they were pretty poor. There was a C one: https://code.google.com/p/freeradius-yubikey-module/ But... Well... asside the code... in general... it used its own weird config system for recording keys, values and replay data, so couldn't integrate with any of the dynamic language modules, sql or ldap. There's also a perl one floating around somewhere, but eww, perl. Here's the config for the new one. The yubikey authorize method acts like PAP, but is more diserning and will only set Auth-Type if it finds a User-Password value which is very likely to be yubikey OTP data. For basic testing: authorize { update control { Yubikey-Key := "0x45a9405b05e956c10257c58dd149c6c4" (the secret key that you set on the token) } yubikey } authenticate { Auth-Type yubikey { yubikey } } You need to handle storing counter values, but it's not exactly hard if you understand what's going on, and pretty site specific anyway. The module will look for a Yubikey-Counter value in the control list, and make sure it's less than the current counter value. Anyway, here's the default config. I'll probably add some sqlite stuff at some point to allow basic replay detection (or if anyone else wants to do that, it'd be appreciated). This is available in FreeRADIUS 3.0 only. https://github.com/FreeRADIUS/freeradius-server/blob/master/src/modules/rlm… -Arran # # This module decrypts and validates Yubikey static and dynamic # OTP tokens. # # The module itself does not provide persistent storage as this # would be duplicative of functionality already in the server. # # Yubikey authentication needs two control attributes # retrieved from persistent storage: # * Yubikey-Key - The AES key use to decrypt the OTP data. # The Yubikey-Public-Id and/or User-Name # attrubutes may be used to retrieve the key. # * Yubikey-Counter - This is compared with the counter in the OTP # data and used to prevent replay attacks. # This attribute will also be available in # the request list after successfull # decryption. # # Yubikey-Counter isn't strictly required, but the server will # generate warnings if it's not present when Yubikey.authenticate # is called. # # These attributes are available after authorization: # * Yubikey-Public-ID - The public portion of the OTP string # # These attributes are available after authentication (if successfull): # * Yubikey-Private-ID - The encrypted ID included in OTP data, # must be verified if tokens share keys. # * Yubikey-Counter - The last counter value (should be recorded). # * Yubikey-Timestamp - Token's internal clock (mainly useful for debugging). # * Yubikey-Random - Randomly generated value from the token. # * Yubikey-Trigger - How the Yubikey was triggered # ('keyboard' or 'button'). yubikey { # # The length (number of ascii bytes) of the Public-ID portion # of the OTP string. # # Yubikey defaults to a 6 byte ID (2 * 6 = 12) #id_length = 12 }

1 0

Re: troubles with eap-peap mschapv2
by Bertrand Poulet 12 Mar '13

12 Mar '13

Le 11/03/2013 , freeradius-users-request(a)lists.freeradius.org a écrit : > Date: Mon, 11 Mar 2013 11:50:17 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: troubles with eap-peap mschapv2 > Message-ID: <513DFD39.90108(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Bertrand Poulet wrote: >> i try to migrate from FreeRADIUS 1.1.6 (Mandrake) >> to FreeRADIUS 2.2.0 (from source) on ubuntu12.04. > That should be easy. I thought so (from what i read on documentation). > >> The same supplicant and same AP with old FR is ok, >> but not with new FR 2.2.0. >> >> What i've done : >> >> I've installed with ./configure; make; make install >> root@myhost:/usr/local/etc/raddb/certs# make >> openssl dhparam -out dh 1024 > Well... that's the problem. You didn't copy the old certificates > over. Instead, you created new ones. > > Don't do that. Use the old certs. It will work. I've copied old "certs" directory to the new server. It's still not good. The supplicant can not connect; there is like a loop between ra_recv and sending-access-challenge. the problem is with certs or could it be something else ? Thanks. the ouput is : rad_recv: Access-Request packet from host 172.20.100.53 port 1645, id=247, length=172 User-Name = "bertrand" Framed-MTU = 1400 Called-Station-Id = "0014.1bb6.4be0" Calling-Station-Id = "844b.f5b8.d423" Cisco-AVPair = "ssid=ipl_dsi" Service-Type = Login-User Message-Authenticator = 0x508e5e0ee37be030c0d4c6e4002d5b60 EAP-Message = 0x0202000d016265727472616e64 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "642" NAS-Port = 642 NAS-IP-Address = 172.20.100.53 NAS-Identifier = "net-ap-A1-1-53" Tue Mar 12 15:10:20 2013 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Tue Mar 12 15:10:20 2013 : Info: +- entering group authorize {...} Tue Mar 12 15:10:20 2013 : Info: ++[preprocess] returns ok Tue Mar 12 15:10:20 2013 : Info: ++[chap] returns noop Tue Mar 12 15:10:20 2013 : Info: ++[mschap] returns noop Tue Mar 12 15:10:20 2013 : Info: ++[digest] returns noop Tue Mar 12 15:10:20 2013 : Info: [suffix] No '@' in User-Name = "bertrand", looking up realm NULL Tue Mar 12 15:10:20 2013 : Info: [suffix] No such realm "NULL" Tue Mar 12 15:10:20 2013 : Info: ++[suffix] returns noop Tue Mar 12 15:10:20 2013 : Info: [eap] EAP packet type response id 2 length 13 Tue Mar 12 15:10:20 2013 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Mar 12 15:10:20 2013 : Info: ++[eap] returns updated Tue Mar 12 15:10:20 2013 : Debug: WARNING: Found User-Password == "...". Tue Mar 12 15:10:20 2013 : Debug: WARNING: Are you sure you don't mean Cleartext-Password? Tue Mar 12 15:10:20 2013 : Debug: WARNING: See "man rlm_pap" for more information. Tue Mar 12 15:10:20 2013 : Info: [files] users: Matched entry bertrand at line 207 Tue Mar 12 15:10:20 2013 : Info: ++[files] returns ok Tue Mar 12 15:10:20 2013 : Info: ++[expiration] returns noop Tue Mar 12 15:10:20 2013 : Info: ++[logintime] returns noop Tue Mar 12 15:10:20 2013 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Mar 12 15:10:20 2013 : Info: ++[pap] returns noop Tue Mar 12 15:10:20 2013 : Info: Found Auth-Type = EAP Tue Mar 12 15:10:20 2013 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Tue Mar 12 15:10:20 2013 : Info: +- entering group authenticate {...} Tue Mar 12 15:10:20 2013 : Info: [eap] EAP Identity Tue Mar 12 15:10:20 2013 : Info: [eap] processing type tls Tue Mar 12 15:10:20 2013 : Info: [tls] Initiate Tue Mar 12 15:10:20 2013 : Info: [tls] Start returned 1 Tue Mar 12 15:10:20 2013 : Info: ++[eap] returns handled Sending Access-Challenge of id 247 to 172.20.100.53 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x131466f213177f9f58f8ed5fb507e76c Tue Mar 12 15:10:20 2013 : Info: Finished request 0. Tue Mar 12 15:10:20 2013 : Debug: Going to the next request Tue Mar 12 15:10:20 2013 : Debug: Waking up in 4.9 seconds. Tue Mar 12 15:10:25 2013 : Info: Cleaning up request 0 ID 247 with timestamp +8 Tue Mar 12 15:10:25 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:25 2013 : Debug: WARNING: !! EAP session for state 0x131466f213177f9f did not finish! Tue Mar 12 15:10:25 2013 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Tue Mar 12 15:10:25 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:25 2013 : Info: Ready to process requests. rad_recv: Access-Request packet from host 172.20.100.53 port 1645, id=247, length=172 User-Name = "bertrand" Framed-MTU = 1400 Called-Station-Id = "0014.1bb6.4be0" Calling-Station-Id = "844b.f5b8.d423" Cisco-AVPair = "ssid=ipl_dsi" Service-Type = Login-User Message-Authenticator = 0x508e5e0ee37be030c0d4c6e4002d5b60 EAP-Message = 0x0202000d016265727472616e64 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "642" NAS-Port = 642 NAS-IP-Address = 172.20.100.53 NAS-Identifier = "net-ap-A1-1-53" Tue Mar 12 15:10:25 2013 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Tue Mar 12 15:10:25 2013 : Info: +- entering group authorize {...} Tue Mar 12 15:10:25 2013 : Info: ++[preprocess] returns ok Tue Mar 12 15:10:25 2013 : Info: ++[chap] returns noop Tue Mar 12 15:10:25 2013 : Info: ++[mschap] returns noop Tue Mar 12 15:10:25 2013 : Info: ++[digest] returns noop Tue Mar 12 15:10:25 2013 : Info: [suffix] No '@' in User-Name = "bertrand", looking up realm NULL Tue Mar 12 15:10:25 2013 : Info: [suffix] No such realm "NULL" Tue Mar 12 15:10:25 2013 : Info: ++[suffix] returns noop Tue Mar 12 15:10:25 2013 : Info: [eap] EAP packet type response id 2 length 13 Tue Mar 12 15:10:25 2013 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Mar 12 15:10:25 2013 : Info: ++[eap] returns updated Tue Mar 12 15:10:25 2013 : Debug: WARNING: Found User-Password == "...". Tue Mar 12 15:10:25 2013 : Debug: WARNING: Are you sure you don't mean Cleartext-Password? Tue Mar 12 15:10:25 2013 : Debug: WARNING: See "man rlm_pap" for more information. Tue Mar 12 15:10:25 2013 : Info: [files] users: Matched entry bertrand at line 207 Tue Mar 12 15:10:25 2013 : Info: ++[files] returns ok Tue Mar 12 15:10:25 2013 : Info: ++[expiration] returns noop Tue Mar 12 15:10:25 2013 : Info: ++[logintime] returns noop Tue Mar 12 15:10:25 2013 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Mar 12 15:10:25 2013 : Info: ++[pap] returns noop Tue Mar 12 15:10:25 2013 : Info: Found Auth-Type = EAP Tue Mar 12 15:10:25 2013 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default Tue Mar 12 15:10:25 2013 : Info: +- entering group authenticate {...} Tue Mar 12 15:10:25 2013 : Info: [eap] EAP Identity Tue Mar 12 15:10:25 2013 : Info: [eap] processing type tls Tue Mar 12 15:10:25 2013 : Info: [tls] Initiate Tue Mar 12 15:10:25 2013 : Info: [tls] Start returned 1 Tue Mar 12 15:10:25 2013 : Info: ++[eap] returns handled Sending Access-Challenge of id 247 to 172.20.100.53 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb07a7177b07968b416db63d319887c15 Tue Mar 12 15:10:25 2013 : Info: Finished request 1. Tue Mar 12 15:10:25 2013 : Debug: Going to the next request Tue Mar 12 15:10:25 2013 : Debug: Waking up in 4.9 seconds. Tue Mar 12 15:10:30 2013 : Info: Cleaning up request 1 ID 247 with timestamp +13 Tue Mar 12 15:10:30 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:30 2013 : Debug: WARNING: !! EAP session for state 0xb07a7177b07968b4 did not finish! Tue Mar 12 15:10:30 2013 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Tue Mar 12 15:10:30 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Mar 12 15:10:30 2013 : Info: Ready to process requests. rad_recv: Access-Request packet from host 172.20.100.53 port 1645, id=247, length=172 User-Name = "bertrand" Framed-MTU = 1400 Called-Station-Id = "0014.1bb6.4be0" Calling-Station-Id = "844b.f5b8.d423" Cisco-AVPair = "ssid=ipl_dsi" Service-Type = Login-User Message-Authenticator = 0x508e5e0ee37be030c0d4c6e4002d5b60 EAP-Message = 0x0202000d016265727472616e64 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "642" NAS-Port = 642 NAS-IP-Address = 172.20.100.53 NAS-Identifier = "net-ap-A1-1-53" ....

3 2

FR Login-Time Vs Unix-Time-Based-Login
by Russell Mike 12 Mar '13

12 Mar '13

Hi Freeradius List, Why someone will use "Unix-Time-Based-Login" why not "Login-Time" FR attribute? Does it offer more flexibility or control over each other. Actually, we want to implement login based on time. i am reading mail archives since yesterday to understand basic functionality of the model. And have also come across where people are talking about both techniques. But unable to know what is better way to go with. Thanks for attending to this material Thanks / Regards RM --

1 1

Old message abou LDAP
by Andres Septer 11 Mar '13

11 Mar '13

When one searches google for freeradius and ldap groups there is a LOT of messages that all point to this message. Freeradius and LDAP groups how to make it work: http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-November/ms… Unfortunately this old archive is unavailable. 404 Is there any other good howto about freeradius + LDAP + groups -- ho to make them wor together? Andres

3 4

troubles with eap-peap mschapv2
by Bertrand Poulet 11 Mar '13

11 Mar '13

Hi all , i try to migrate from FreeRADIUS 1.1.6 (Mandrake) to FreeRADIUS 2.2.0 (from source) on ubuntu12.04. The same supplicant and same AP with old FR is ok, but not with new FR 2.2.0. What i've done : I've installed with ./configure; make; make install root@myhost:/usr/local/etc/raddb/certs# make openssl dhparam -out dh 1024 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time .......................+.................+........................................................................+........................................+...............................................................+.................................+...............+.......+...........................++*++*++* openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key ......................................................................+++ ..........................................................+++ writing new private key to 'server.key' ----- openssl req -new -x509 -keyout ca.key -out ca.pem \ -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf Generating a 2048 bit RSA private key .................................+++ .............................................................................................................+++ writing new private key to 'ca.key' ----- openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Mar 11 13:18:05 2013 GMT Not After : Mar 11 13:18:05 2014 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Mar 11 13:18:05 2014 GMT (365 days) Write out database with 1 new entries Data Base Updated openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` MAC verified OK openssl verify -CAfile ca.pem server.pem server.pem: OK openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der root@myhost:/usr/local/etc/raddb/certs# ll -tr total 116 drwxr-xr-x 8 root root 4096 mars 11 14:10 ../ -rwxr-x--- 1 root root 2693 mars 11 14:10 bootstrap* -rw-r----- 1 root root 4287 mars 11 14:10 Makefile -rw-r----- 1 root root 7847 mars 11 14:10 README -rw-r----- 1 root root 578 mars 11 14:10 xpextensions -rw-r----- 1 root root 1289 mars 11 14:10 ca.cnf -rw-r----- 1 root root 1124 mars 11 14:10 server.cnf -rw-r----- 1 root root 1102 mars 11 14:10 client.cnf -rw-r--r-- 1 root root 3 mars 11 14:18 serial.old -rw-r--r-- 1 root root 0 mars 11 14:18 index.txt.old -rw-r--r-- 1 root root 245 mars 11 14:18 dh -rw-r--r-- 1 root root 5120 mars 11 14:18 random -rw-r--r-- 1 root root 1834 mars 11 14:18 server.key -rw-r--r-- 1 root root 1062 mars 11 14:18 server.csr -rw-r--r-- 1 root root 1675 mars 11 14:18 ca.pem -rw-r--r-- 1 root root 1834 mars 11 14:18 ca.key -rw-r--r-- 1 root root 4212 mars 11 14:18 server.crt -rw-r--r-- 1 root root 3 mars 11 14:18 serial -rw-r--r-- 1 root root 21 mars 11 14:18 index.txt.attr -rw-r--r-- 1 root root 120 mars 11 14:18 index.txt -rw-r--r-- 1 root root 4212 mars 11 14:18 01.pem -rw-r--r-- 1 root root 2533 mars 11 14:18 server.p12 -rw-r--r-- 1 root root 3586 mars 11 14:18 server.pem -rw-r--r-- 1 root root 1195 mars 11 14:18 ca.der drwxr-x--- 2 root root 4096 mars 11 14:18 ./ i got this known problem of certificates (default). freeradius -XXX .... Mon Mar 11 16:35:47 2013 : Debug: Module: Instantiating eap-tls Mon Mar 11 16:35:47 2013 : Debug: tls { Mon Mar 11 16:35:47 2013 : Debug: rsa_key_exchange = no Mon Mar 11 16:35:47 2013 : Debug: dh_key_exchange = yes Mon Mar 11 16:35:47 2013 : Debug: rsa_key_length = 512 Mon Mar 11 16:35:47 2013 : Debug: dh_key_length = 512 Mon Mar 11 16:35:47 2013 : Debug: verify_depth = 0 Mon Mar 11 16:35:47 2013 : Debug: CA_path = "/usr/local/etc/raddb/certs" Mon Mar 11 16:35:47 2013 : Debug: pem_file_type = yes Mon Mar 11 16:35:47 2013 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" Mon Mar 11 16:35:47 2013 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" Mon Mar 11 16:35:47 2013 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" Mon Mar 11 16:35:47 2013 : Debug: private_key_password = "whatever" Mon Mar 11 16:35:47 2013 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" Mon Mar 11 16:35:47 2013 : Debug: random_file = "/usr/local/etc/raddb/certs/random" Mon Mar 11 16:35:47 2013 : Debug: fragment_size = 1024 Mon Mar 11 16:35:47 2013 : Debug: include_length = yes Mon Mar 11 16:35:47 2013 : Debug: check_crl = no Mon Mar 11 16:35:47 2013 : Debug: cipher_list = "DEFAULT" Mon Mar 11 16:35:47 2013 : Debug: ecdh_curve = "prime256v1" .... Sending Access-Challenge of id 202 to 172.20.100.53 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9ee5af279ee6b6b6ef02d416f50f62d3 Mon Mar 11 15:59:05 2013 : Info: Finished request 0. Mon Mar 11 15:59:05 2013 : Debug: Going to the next request Mon Mar 11 15:59:05 2013 : Debug: Waking up in 4.9 seconds. Mon Mar 11 15:59:10 2013 : Info: Cleaning up request 0 ID 202 with timestamp +8 Mon Mar 11 15:59:10 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Mar 11 15:59:10 2013 : Debug: WARNING: !! EAP session for state 0x9ee5af279ee6b6b6 did not finish! Mon Mar 11 15:59:10 2013 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Mon Mar 11 15:59:10 2013 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Mon Mar 11 15:59:10 2013 : Info: Ready to process requests. .... The supplicant :Windows 7, with no certifcates validated, with PEAP, EAP-MSCHAPV2 . What's wrong

3 2

Cannot access radius server from remote host
by Iftakhul Anwar 10 Mar '13

10 Mar '13

Hi All, I just try connect radius server remotely. i've try to radtest with command : radtest user1 meruvian localhost 1812 testing123 Sending Access-Request of id 133 to 127.0.0.1 port 1812 User-Name = "user1" User-Password = "meruvian" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=133, length=20 ## i get accept response from radius server. But when i try with command bellow i got error message like a no respon from radius server: radtest user1 meruvian 192.168.2.3 1812 testing123 Sending Access-Request of id 12 to 192.168.2.3 port 1812 User-Name = "user1" User-Password = "meruvian" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 12 to 192.168.2.3 port 1812 User-Name = "user1" User-Password = "meruvian" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 12 to 192.168.2.3 port 1812 User-Name = "user1" User-Password = "meruvian" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 12 socket 3 Note:192.168.2.3 is ip of radius server. How i can try to connect radius server from another host ? i've try to disable my firewall. but still get no respon from server. Help me to solve this. Thanks -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

3 4

Redirecting Reject Request To Webpage
by Russell Mike 10 Mar '13

10 Mar '13

Hi FreeRadius List Members, Thanks for all the support ever. i am having difficulty to understand something, i need help. i am able to configure mac authentication base on the following logic. it Works !! username="<mac address>";attribute="Auth-Type";op=":=";value="Accept" username="<mac address>";attribute="Auth-Type";op=":=";value="Reject" *Question:* Redirecting Reject Request To Webpage For example, a customer would get reject from FR due to non payment. but at this stage customer do not know, what is happening. Why internet in down. We want the request to redirected to a web page that will display the cause of disconnection. Thanks RM --

3 4

Cannot disconnect radius user using radclient
by Iftakhul Anwar 10 Mar '13

10 Mar '13

Hi All, I've successfully install coovachili anda freeradius using mysql database. Now I've just try to disconnect coovachilli user online with radclient command: I try with command bellow to disconect user="alice" * echo "User-Name=alice" | radclient -x localhost:3779 disconnect testing123 * *Sending Disconnect-Request of id 126 to 127.0.0.1 port 3779* * User-Name = "alice"* *rad_recv: Disconnect-ACK packet from host 127.0.0.1 port 3779, id=126, length=20* And then, user alice be disconnect from coova. Then i try to give disconnect command using remote acces using command bellow : *echo "User-Name=alice" | radclient -x 192.168.2.3:3779 disconnect testing123* *Sending Disconnect-Request of id 78 to 192.168.2.3 port 3779* * User-Name = "alice"* *radclient: no response from server for ID 78 socket 3* * * Note: 192.168.2.3 is ip of radius server But no response from radius server. I've add on client.conf ip address which i use to radius client.But still have same problem. I try that command on my local machine using comand : *echo "User-Name=alice" | radclient -x 192.168.2.3:3779 disconnect testing123* * * Radius still no response. How i can execute this command both of on local and on remote machine ? Thanks -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

3 8

free time
by Jed Gainer 10 Mar '13

10 Mar '13

I would like to ignore bandwidth usage between 2 and 5 am. sqlcounter counterChilliSpotMaxTotalOctetsDaily { counter-name = ChilliSpot-Max-Total-Octets-Daily check-name = CS-Total-Octets-Daily counter-type = data reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily query = "SELECT IFNULL((SUM(AcctInputOctets + AcctOutputOctets)),0) FROM radacct WHERE UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > UNIX_TIMESTAMP(CONCAT(CURDATE(),' ', '00:00:00')) AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime NOT BETWEEN UNIX_TIMESTAMP(CONCAT(CURDATE(),' ', '02:00:00')) AND UNIX_TIMESTAMP(CONCAT(CURDATE(),' ', '05:00:00'))" } Should I do it all in the SQL like that? or does someone have a better idea.

3 5