- Freeradius-Users - lists.freeradius.org

radclient coa example
by jobhunts02＠aol.com 23 Oct '12

23 Oct '12

I've read where radclient can be used to send a change-of-authorization message (COA) from the server to a NAS to change the bandwidth limit but I have not been able to find an example of this. Does any have an example of radclient sending a coa message to change the bandwidth limit?

2 1

Debug Directory
by George Innocent 22 Oct '12

22 Oct '12

Hello; I have been running the radius and can only see the radius.log files; what is the directory for debug logs. --

3 2

No Realm in table radacct
by xylakant＠vorsicht-bissig.de 22 Oct '12

22 Oct '12

Hello together, I have setuped a radius system like eduroam with 3 server. I use "daloradius" for user and accounting management. Authentication and accounting works with realm, but the field realm is empty in table radacct. Furthermore, I want to know how I use / configure Hot Spots in "daloradius". I can't find any description about that. It's rly hard to learn freeradius without a good wiki or something else. There are two locations A @sb-dfki.de and B @kl-dfki.de with their radius server. And a global Server only for Radius proxyforwarding. I've got my client and an access point 172.16.18.82 on location A. I think my configuration is ok. If not, pls tell me. You can see my Debuglogs with a Login by markus(a)kl-dfki.de Location A http://pastebin.com/A1HNtSeu Location B http://pastebin.com/Q2DWbTes Thank you! Xylakant

5 14

eap module failed to start
by Prateek Kumar 22 Oct '12

22 Oct '12

Hi, I have freeradius server ( ver. 2.1.10 ) compiled with openssl-0.9.8l. Now by method given in raddb/certs I created the certificates on a machine having OpenSSL 1.0.0e. After loading ca.pem,server.pem & private.pem ( which is copy of server.pem ) certificates under raddb/certs and then starting the radius server I got this error just after eap module. Is this due to different openssl versions? Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/private.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } rlm_eap: SSL error error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm rlm_eap_tls: Error reading private key file /etc/raddb/certs/private.pem rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[236]: Failed to load module "eap". /etc/raddb/sites-enabled/inner-tunnel[189]: Errors parsing authenticate section. Thanks & Regards, Prateek

4 4

EAP-TTLS: Access Reject comes randomly from AAA
by Rathod Subhashchandra 22 Oct '12

22 Oct '12

Dear All, I am using EAP-TTLS authentication mechanism for between WiMAX client and AAA on Linux environment During EAP negotiation phase following steps are successfully completed. 1. Identity exchange 2. Server/Client EAP-TTLS start 3. Client Hello 4. Server Hello-Server Certificate-Server Key Exchange-Server Hello Done EAP_Failure is coming consistently during "Client Key Exchange phase". This issue is coming consistently for multiple clients during Network Entry. Following is the error from AAA. 2012/06/04 15:52:41:686525 : <FREERADIUS LOG> rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca 2012/06/04 15:52:41:686541 : <FREERADIUS LOG> TLS Alert read:fatal:unknown CA 2012/06/04 15:52:41:686559 : <FREERADIUS LOG> TLS_accept:failed in SSLv3 read client certificate A 2012/06/04 15:52:41:686579 : <FREERADIUS LOG> rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca 2012/06/04 15:52:41:686593 : <FREERADIUS LOG> rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. 2012/06/04 15:52:41:686605 : <FREERADIUS LOG> eaptls_process returned 13 2012/06/04 15:52:41:686618 : <FREERADIUS LOG> rlm_eap: Freeing handler 2012/06/04 15:52:41:686650 : <FREERADIUS LOG> ++[eap] returns reject 2012/06/04 15:52:41:686663 : <FREERADIUS LOG> auth: Failed to validate the user. 2012/06/04 15:52:41:686688 : [TX] Access-Reject To resolve this issue, your timely help will be appreciated. Thanks ! Rathod. Notice: The information contained in this e-mail message and/or attachments to it may contain confidential or privileged information. If you are not the intended recipient, any dissemination, use, review, distribution, printing or copying of the information contained in this e-mail message and/or attachments to it are strictly prohibited. If you have received this communication in error, please notify us by reply e-mail or telephone and immediately and permanently delete the message and any attachments. Thank you

4 3

Re: No Realm in table radacct
by Alan Buxey 21 Oct '12

21 Oct '12

Long answers available but the shirt version is local sites want their kit to show the real user not the anonymous one but then forget to do define policy for external requests.. other sites also don't want to receive remote accounting packets so strip the realm out so they won't get them. For proper handling of remote accounting you need to do a lot of extra work. 1 you need to handle all the bad stuff that NAS kit can send....so that's above and beyond all the local work for your own NAS, then , to keep realm you need to create a look up table for nas/csi to keep the original outer realm so that it can be re-applied when stripped accounting username come your way alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Reading an rlm_counter database file
by jobhunts02＠aol.com 21 Oct '12

21 Oct '12

How can an rlm_counter database file be read?

1 0

mysql ip pool guide or documentation
by Sebastien Boucher 19 Oct '12

19 Oct '12

hello, Sorry for asking a question that was probably asked and answered before but i could not find anything. Can anyone direct me to a guide or some sort of documentation on how to configure ip pool for freeradius using a mysql database ? thank you for your help. Sebastien.

2 2

ntlm_auth - No logon workstation trust account
by Bryce Mackintosh 19 Oct '12

19 Oct '12

Hi, I've been trying to get machine auth working for a good while and I'm currently stuck trying to figure out why ntlm_auth is returning "No logon workstation trust account (0xc0000199)". I've double checked AD and the account definitely exists, and the machine has no problem logging into the domain. User auth works fine. Here's an example command: /usr/bin/ntlm_auth --request-nt-key --username=NOLP3003$ --domain=FOO --challenge=4a8904ffb0ba86d2 --nt-response=7ab480ea0a0754603629da316c9911935ff3c92daffcc621 No logon workstation trust account (0xc0000199) ntlm_auth is version 3.6.1-34.3.1-2691-SUSE-SL12.1-x86_64 Does anyone have any suggestions? I realise that this isn't really a Freeradius issue, but I'm hoping someone here has come across this before. Thanks in advance, Bryce

3 3

Tacacs+ Super-User issue.
by Gilmour, Scott 19 Oct '12

19 Oct '12

Hi I am having an issue with my tacacs+ server. I login as my super-user tacacssu and rather than getting super-user access I am getting read-only access. I checked the logs and there wasn't anything useful given to why I was getting logged in through telnet or the console with read-only access. I even kill the freeradius process and still no luck. Anybody have any ideas? Scott # Created by Devrim SERAL(devrim(a)tef.gazi.edu.tr) # It's very simple configuration file # Please read user_guide and tacacs+ FAQ to more information to do more # complex tacacs+ configuration files. # # Put your NAS key below key = tacacs # Use /etc/passwd.loc file to do authentication # it's must be in passwd file format. So you must mix shadow-passwd files to do it default authentication = file /etc/passwd.loc # Where is the accounting records to go accounting file = /var/log/tacacs.log # Permit all authorization request default authorization = permit # End config file #Users & Groups Setup group = NOCadmin { service = exec { priv-lvl = 15 } } user = SSHlan { default service = permit member = NOCadmin login = cleartext SSHlan } user = kiwi { default service = deny member = NOCadmin login = cleartext kiwi #cmd = configure { #deny .* #} cmd = show { permit running-config permit config deny .* } } user = aorellanop { default service = permit member = NOCadmin login = file /etc/passwd } #Default Users and Groups group = "Default Super-User" { service = exec { priv-lvl = 15 } } user = tacacssu { default service = permit member = "Default Super-User" login = cleartext tacacs } group = "Default Read-Write" { service = exec { priv-lvl = 1 } } user = tacacsrw { default service = permit member = "Default Read-Write" login = cleartext tacacs } group = "Default Read-Only" { service = exec { priv-lvl = 0 } } user = tacacsro { default service = permit member = "Default Read-Only" login = cleartext tacacs } # You can use feature like per host key with different enable passwords #host = 127.0.0.1 { # key = tacacs # type = cisco # enable = <des|cleartext> enablepass # prompt = "Welcome XXX ISP Access Router \n\nUsername:" #} # We also can define local users and specify a file where data is stored. # That file may be filled using tac_pwd #user = test1 { # name = "Test User" # member = staff # login = file /etc/tacacs/tacacs_passwords #} # We can also specify rules valid per group of users. #group = group1 { # cmd = conf { # deny # } #} # Another example : forbid configure command for some hosts # for a define range of clients #group = group1 { # login = PAM # service = ppp # protocol = ip { # addr = 10.10.0.0/24 # } # cmd = conf { # deny .* # } #} #user = DEFAULT { # login = PAM # service = ppp protocol = ip {} #} # Much more features are availables, like ACL, more service compatibilities, # commands authorization, scripting authorization. # See the man page for those features. -- Scott Gilmour | SQA Engineer Enterasys Networks | A Siemens Enterprise Communications Company Office: 978.684.1236 Email: sgilmour(a)enterasys.com

2 1