- Freeradius-Users - lists.freeradius.org

Access reject problem
by Arvind Gupta 16 Aug '12

16 Aug '12

Hi I have configured RADIUS server in windows server 2008 R2 as mentioned in below link. http://docs.openvpn.net/how-to-tutorialsguides/administration/configuring-a… After that running radexample.c as it is available in free-radius client framework, but getting access reject error. I verified that what user I am using to authenticate is available in groups which is configured there. I am not getting any idea that why I am getting access reject (PW_ACCESS_REJECT) error. any help in this issue will be very helpful to me. Thanks Arvind Kumar Gupta

2 1

Problem with crypt passwords matching
by Robert Haskins 16 Aug '12

16 Aug '12

I am running Freeradius 2.1.12 on a Centos box. I am able to authenticate from the server command line, and from a Cisco ASR1k BRAS via the command line. However, when I attempt to authenticate customers from the DSL network, I get a reject, even though the crypt'd passwords match! Here is a sample from a trace: rad_recv: Access-Request packet from host 204.111.5.9 port 1645, id=235, length=89 Framed-Protocol = PPP User-Name = "k143rott" User-Password = "k*****" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/0/304" Service-Type = Framed-User NAS-IP-Address = 204.111.5.9 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "k143rott", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "k143rott" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 169 [files] users: Matched entry DEFAULT at line 172 [files] users: Matched entry DEFAULT at line 186 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "krt444" [pap] Using CRYPT password "*3u.3LS/VKTOVc" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CRYPT password check failed): [k143rott/k*****] (from client va-edbg-bras-1 port 0) Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> k143rott attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 30 for 1 seconds Going to the next request Sending delayed reject for request 21 Sending Access-Reject of id 227 to 204.111.5.9 port 1645 The crypt'd password ("*3u.3LS/VKTOVc") is exactly what is in the /etc/shadow file. So I am confident the shared secret is correct. What am I doing wrong? -- Haskins Family Farm Middletown, VA web: http://www.haskinsfamilyfarm.com FB: http://www.facebook.com/pages/Middletown-VA/Haskins-Family-Farm/114984971161

5 5

Multiple incoming requests from unknown clients
by Diego Matute 14 Aug '12

14 Aug '12

Looked at the docs and am still unclear here. What is the best practice for handling incoming requests which require different policies (i.e. secret keys) whereby the client IP is unknown? Was thinking there may be a to setup virtual servers which listen on different server IPs somehow? Few thoughts: - route based on client configured DNS: SOMEPREFIX.mydomain.com - accept all and pass other RADIUS attributes down (not preferred) Thanks, Diego

4 12

Disable PEAP-TLS but allow PEAP
by Cotton, Jesse 14 Aug '12

14 Aug '12

We need to use a public certificate for PEAP b/c the majority of our clients are not on our domain. However I do not want to allow EAP-TLS with any cert signed by the 3rd party CA. Is it possible to prevent PEAP-TLS with a cert but allow PEAP? If so, what config options do I need to add and where? I've read several posts about this and none have been helpful. Jesse

5 6

Per-realm post-proxy
by Shaun Lowry 14 Aug '12

14 Aug '12

Is it possible to have a per-realm post-proxy section? We need to add a couple of attributes to our Access-Accepts which vary in content depending on which realm we've proxied. Otherwise, is there an easy way to distinguish realm in the global post-proxy section? Shaun.

4 3

rlm_sql Error
by Antonio Modesto 14 Aug '12

14 Aug '12

Hi, Here in the ISP which I work we have a Freeradius 1.X in production, and a 2.X that we're testing to replace the old one. On both Radius we get the following error sometimes, What can be causing this? The SQL Database is in the same server of freeradius 1.X, but the load is low, we have about 2500 subscribers. I was thinking about increasing the number of sql connections, which is set to 4, would it make any difference? Database server load: load averages: 1.10, 1.05, 1.03 Error: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thanks in advance.

6 7

Problem with accounting insert into Oracle
by Aurélien Lafranchise 14 Aug '12

14 Aug '12

Hi Alan, Thanks for the answer. I need all these data so it is not a clean problem. But I will disable sqltrace when everything will be ok. Could you be more precise on where to increase the 2K limit ? Cheers, AL Aurélien Lafranchise wrote: > I have the same error for every request in dialup.conf (STOP, START, UPDATE). > > The database connection is working well but I have: > [sql] Couldn't insert SQL accounting STOP record - ORA-01756: quoted string not properly terminated > > with sqltrace on you can see the mistake at the end. The request seems to be truncated: Yes. You can't put infinie amounts of data into the SQL query. The limit is ~2K or so. > Any idea ? Is there a global option for the maximum number of characters for a request ? It's limited in the SQL module. You've edited the configuration to log tons of data. This generally isn't useful, or necessary. Fix that, or edit the SQL module to allow more than 2K of data in the expansion. Alan DeKok.

3 6

Problem with accounting insert into Oracle
by Aurélien Lafranchise 13 Aug '12

13 Aug '12

Hi, I have the same error for every request in dialup.conf (STOP, START, UPDATE). The database connection is working well but I have: [sql] Couldn't insert SQL accounting STOP record - ORA-01756: quoted string not properly terminated with sqltrace on you can see the mistake at the end. The request seems to be truncated: INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, IMSI_3GPP, ChargingID_3GPP, PDPType_3GPP, ChargingGwAddress_3GPP, GPRSNegotiatedQoSprofile_3GPP, SGSNAddress_3GPP, GGSNAddress_3GPP, IMSIMCCMNC_3GPP, GGSNMCCMNC_3GPP, NSAPI_3GPP, SessionStopIndicator_3GPP, SelectionMode_3GPP, ChargingCharacteristics_3GPP, ChargingGwIPv6Address_3GPP, SGSNIPv6Address_3GPP, GGSNIPv6Address_3GPP, IPv6DNSServers_3GPP, SGSNMCCMNC_3GPP, TeardownIndicator_3GPP, IMEISV_3GPP, RATType_3GPP, MSTimeZone_3GPP, CamelChargingInfo_3GPP, PacketFilter_3GPP, NegotiatedDSCP_3GPP, AllocateIPType_3GPP) VALUES('', 'D4090646343006F3', '64e5c1c4162df0d5', '447937700458', '', '10.100.100.3', '', 'Ethernet', NULL, TO_DATE('2012-08-13 11:35:27','yyyy-mm-dd hh24:mi:ss'), '74', 'RADIUS', '', '', '679' + ('0' * 4294967296), '83' + ('0' * 4294967296), 'internet.mbqt.net', '447937700458', 'User-Request', 'Framed-User', 'GPRS-PDP-Context', '10.73.248.60', '0', '0', '234507089001283', '875562739', '0', '', '98-1B631F', '80.10.0.97', '212.9.6.70', '23450', '', '5', '255', '0', '0800', '', '', '', '', '20801', '', '', '2', '; but in the dialup.conf file it is ok: accounting_stop_query_alt = "INSERT into ${acct_table2} (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, IMSI_3GPP, ChargingID_3GPP, PDPType_3GPP, ChargingGwAddress_3GPP, GPRSNegotiatedQoSprofile_3GPP, SGSNAddress_3GPP, GGSNAddress_3GPP, IMSIMCCMNC_3GPP, GGSNMCCMNC_3GPP, NSAPI_3GPP, SessionStopIndicator_3GPP, SelectionMode_3GPP, ChargingCharacteristics_3GPP, ChargingGwIPv6Address_3GPP, SGSNIPv6Address_3GPP, GGSNIPv6Address_3GPP, IPv6DNSServers_3GPP, SGSNMCCMNC_3GPP, TeardownIndicator_3GPP, IMEISV_3GPP, RATType_3GPP, MSTimeZone_3GPP, CamelChargingInfo_3GPP, PacketFilter_3GPP, NegotiatedDSCP_3GPP, AllocateIPType_3GPP) \ VALUES('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', \ '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', NULL, TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), \ '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', \ '%{Acct-Input-Octets}' + ('%{%{Acct-Input-Gigawords}:-0}' * 4294967296), \ '%{Acct-Output-Octets}' + ('%{%{Acct-Output-Gigawords}:-0}' * 4294967296), \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', \ '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}', '%{3GPP-IMSI}', '%{3GPP-Charging-ID}', '%{3GPP-PDP-Type}', '%{3GPP-Charging-Gateway-Address}', '%{3GPP-GPRS-Negotiated-QoS-profile}', '%{3GPP-SGSN-Address}', '%{3GPP-GGSN-Address}', '%{3GPP-IMSI-MCC-MNC}', '%{3GPP-GGSN-MCC-MNC}', '%{3GPP-NSAPI}', '%{3GPP-Session-Stop-Indicator}', '%{3GPP-Selection-Mode}', '%{3GPP-Charging-Characteristics}', '%{3GPP-Charging-Gateway-IPv6-Address}', '%{3GPP-SGSN-IPv6-Address}', '%{3GPP-GGSN-IPv6-Address}', '%{3GPP-IPv6-DNS-Servers}', '%{3GPP-SGSN-MCC-MNC}', '%{3GPP-Teardown-Indicator}', '%{3GPP-IMEISV}', '%{3GPP-RAT-Type}', '%{3GPP-MS-TimeZone}', '%{3GPP-Camel-Charging-Info}', '%{3GPP-Packet-Filter}', '%{3GPP-Negotiated-DSCP}', '%{3GPP-Allocate-IP-Type}')" Any idea ? Is there a global option for the maximum number of characters for a request ? Cheers Aurélien Lafranchise

2 2

FTP site is now on a new machine
by Alan DeKok 13 Aug '12

13 Aug '12

It's a quad core system with a bit better connectivity. Let me know if there are any issues. Alan DeKok.

1 0

Testing pre-2.2.0
by Alan DeKok 13 Aug '12

13 Aug '12

We're (again) close to releasing 2.2.0. This time for real. In order to make the server more future-proof, I've made some changes to the TTLS parser. This will solve issues in the long term. But it needs more testing now. Please try the git "v2.1.x" branch with various supplicants, and TTLS. Please post here if it works / fails. Thanks. Alan DeKok.

4 9