Re: Freeradius-Users Digest, Vol 128, Issue 64

22 Dec 2015

      Dear friends,

i read message from 
http://lists.freeradius.org/pipermail/freeradius-users/2013-January/064662.h...
so i know many people are experianced with freeradius
please let me know if you are available to write custom config file for me?

i use FreeRadius + MySQL + Radius Manager (DMA-Soft)

ppoe user that created in RM for example test@test.com succesfuly loged in 
to MikroTik nas
with radius offered ip pool or radius offered statik ip

when users service expired

as a user there is no way to know if is fault or service expired

what i need

regexp user  *@test.com

regexp get ip from sql ip pool named  "expired"

ip pool from mysql "expired"
gateway 1.1.1.1 (this will open status page from our server)

update reply {
        DHCP-Domain-Name-Server = 8.8.8.8
        DHCP-Domain-Name-Server += 8.8.4.4
        DHCP-Subnet-Mask = 255.255.255.255
        DHCP-Router-Address = 1.1.1.1
        DHCP-IP-Address-Lease-Time = 7200
        DHCP-DHCP-Server-Identifier = 1.1.1.1
    }

my best regards

oguz

----- Original Message ----- 
From: <freeradius-users-request@lists.freeradius.org>
To: <freeradius-users@lists.freeradius.org>
Sent: Tuesday, December 22, 2015 6:13 PM
Subject: Freeradius-Users Digest, Vol 128, Issue 64
...
Send Freeradius-Users mailing list submissions to
freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-request@lists.freeradius.org
You can reach the person managing the list at
freeradius-users-owner@lists.freeradius.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Freeradius + LDAP - WARNING: No "known good" password was
     found in LDAP (Anirudh Malhotra)
  2. Re: Freeradius + LDAP - WARNING: No "known good" password was
     found in LDAP (Kermes - -)
  3. Proxy server rejects/failed auth request (srithar jeevadurai)
  4. Re: Problem with handshake (Mario Guerri Maglia)
  5. Re: Compilation error (Alan DeKok)
  6. Re: Problem with handshake (Alan DeKok)
  7. Re: Proxy server rejects/failed auth request (srithar jeevadurai)
----------------------------------------------------------------------
Message: 1
Date: Tue, 22 Dec 2015 17:10:31 +0530
From: Anirudh Malhotra <amalhotra.sp-dl@nkn.in>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: Freeradius + LDAP - WARNING: No "known good" password was
found in LDAP
Message-ID: <567936AF.8040003@nkn.in>
Content-Type: text/plain; CHARSET=US-ASCII; format=flowed
Hi,
Your LDAP is returning ok
So the only problem is
unhash
Auth-Type LDAP {
                ldap
        }
from authenticate section and check.
BR,
Anirudh Malhotra
On Monday 21 December 2015 07:30 PM, Alan DeKok wrote:
...
On Dec 21, 2015, at 3:38 AM, Kermes - - <kermes@gmx.es> wrote:
...
I need some help with my freeradius + LDAP configuration, I'm stuck
   with a "WARNING: No "known good" password was found in LDAP" message,
   and I don't know how to continue with the debugging of this problem.
   The user isn't found in LDAP.  The debug output shows that, including 
the LDAP query.
...
First, versions:
   freeradius-ldap-2.2.6-6.el6_7.x86_64
   freeradius-2.2.6-6.el6_7.x86_64
This is the output from "radiusd -X":
   The debug output is from "radiusd -Xx", which adds timestamps... and 
makes the output more difficult to read.  Please use just "radiusd -X".
   Mon Dec 21 08:14:30 2015 : Debug:   [ldap] performing search in
   ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local with 
filter
   (uid=test)
   Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for check items in
   directory...
   Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for reply items in
   directory...
   And nothing was found.
What happens when you use that LDAP search string in an LDAP client 
utility?
Test it with an LDAP client.  Once you get the search string correct, 
fix the FreeRADIUS query to use the correct search string.
...
basedn =
   "ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local"
       filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
One or both of those is wrong for your LDAP system.
I don't know what the *right* query is, because I don't know your how 
LDAP system is set up.
Alan DeKok.
-
List info/subscribe/unsubscribe? See 
http://www.freeradius.org/list/users.html
------------------------------
Message: 2
Date: Tue, 22 Dec 2015 15:03:52 +0100
From: "Kermes - -" <kermes@gmx.es>
To: freeradius-users@lists.freeradius.org
Subject: Re: Freeradius + LDAP - WARNING: No "known good" password was
found in LDAP
Message-ID:
<trinity-c224afb0-39a9-48d3-b0ac-f8cc5577644e-1450793032362@3capp-mailcom-bs05>
Content-Type: text/plain; charset="UTF-8"
Hi Anirudh,
that was exactly my problem, the authenticate section!
Thanks a lot!
  BR
...
On Dec 21, 2015, at 3:38 AM, Kermes - - <kermes@gmx.es> wrote:
...
I need some help with my freeradius + LDAP configuration, I'm stuck
with a "WARNING: No "known good" password was found in LDAP"
  message,
and I don't know how to continue with the debugging of this problem.
The user isn't found in LDAP. The debug output shows that, including
  the LDAP query.
...
First, versions:
freeradius-ldap-2.2.6-6.el6_7.x86_64
freeradius-2.2.6-6.el6_7.x86_64
This is the output from "radiusd -X":
The debug output is from "radiusd -Xx", which adds timestamps... and
  makes the output more difficult to read. Please use just "radiusd -X".
Mon Dec 21 08:14:30 2015 : Debug: [ldap] performing search in
ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local with
  filter
(uid=test)
Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for check items in
directory...
Mon Dec 21 08:14:30 2015 : Info: [ldap] looking for reply items in
directory...
And nothing was found.
What happens when you use that LDAP search string in an LDAP client
  utility?
Test it with an LDAP client. Once you get the search string correct,
  fix the FreeRADIUS query to use the correct search string.
...
basedn =
"ou=users,cn=secdb,cn=data,ou=ALL,ou=infra,dc=infra,dc=local"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
One or both of those is wrong for your LDAP system.
I don't know what the *right* query is, because I don't know your how
  LDAP system is set up.
Alan DeKok.
-
List info/subscribe/unsubscribe? See
  [1]http://www.freeradius.org/list/users.html
Enviar: martes 22 de diciembre de 2015 a las 12:40
  De: "Anirudh Malhotra" <amalhotra.sp-dl@nkn.in>
  Para: "FreeRadius users mailing list"
  <freeradius-users@lists.freeradius.org>
  Asunto: Re: Freeradius + LDAP - WARNING: No "known good" password was
  found in LDAP
  Hi,
  Your LDAP is returning ok
  So the only problem is
  unhash
  Auth-Type LDAP {
  ldap
  }
  from authenticate section and check.
  BR,
  Anirudh Malhotra
  On Monday 21 December 2015 07:30 PM, Alan DeKok wrote:
  -
  List info/subscribe/unsubscribe? See
  [2]http://www.freeradius.org/list/users.html
References
1. http://www.freeradius.org/list/users.html
  2. http://www.freeradius.org/list/users.html
------------------------------
Message: 3
Date: Tue, 22 Dec 2015 19:53:48 +0530
From: srithar jeevadurai <srijeevadurai1@gmail.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Proxy server rejects/failed auth request
Message-ID:
<CAC5rx4xtLWJcytnjhfxeVXzxm2DnvmVLEq6rYs==12nyFA4BAg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Hi Friends,
I have created the proxy setup ready and made configuration changes as per
my knowledge.
While trying to send request from NAS simulator, it is giving below error
message in radius.log
*Tue Dec 22 19:36:46 2015 : Auth: Login incorrect: [asdf@company.com
<asdf@company.com>] (from client 234.224.654.123 port 16679 cli 
355545455)*
config file Users has below difference compare to installation file users.
Can you please help me to fix the same?
< DEFAULT Service-Type == Framed-User, Framed-Protocol == 7
<         Framed-IP-Netmask = 255.255.255.255,
<         MS-Primary-DNS-Server == 195.68.0.1,
<         MS-Secondary-DNS-Server == 195.68.0.2,
<         Service-Type == Framed-User,
<         Framed-Protocol == 7,
<         Fall-Through == no
One more request, I could not find any connection between proxy radius and
home server radius, Is the connection only happen when it is required? 
i.e.
while sending request from proxy to home server.
-- 
Regards,
Srithar Durairaj
Alternate Mail I.D: srijeevadurai1@yahoo.co.in
Mobile: +919886251852
------------------------------
Message: 4
Date: Tue, 22 Dec 2015 12:41:55 -0300
From: Mario Guerri Maglia <mario.guerri@seciu.edu.uy>
To: freeradius-users@lists.freeradius.org
Subject: Re: Problem with handshake
Message-ID: <56796F43.1000901@seciu.edu.uy>
Content-Type: text/plain; charset=utf-8; format=flowed
Hi,
sadly the hints you gave me didn't work.
First of all I must say I'm a new user of FreeRadius, so I'll try to
give a detailed explanation of my problem.
In the begining the radius was functioning ok, the authentication was
ok, it consulted the LDAP and if the user was right, the user could
connect to the Wi-Fi. We had few defined users and for many weeks nobody
connected to it.
After that we tried to connect again and this error message appeared:
Tue Nov 17 11:26:04 2015 : Error: TLS Alert read:fatal:handshake failure
Tue Nov 17 11:26:04 2015 : Error:     TLS_accept: failed in SSLv3 read
client certificate A
Tue Nov 17 11:26:04 2015 : Error: rlm_eap: SSL error error:14094410:SSL
routines:SSL3_READ_BYTES:sslv3 alert handshake failure
Tue Nov 17 11:26:04 2015 : Error: SSL: SSL_read failed inside of TLS
(-1), TLS session fails.
Tue Nov 17 11:26:04 2015 : Auth: Login incorrect (TLS Alert
read:fatal:handshake failure): [mguerri] (from client AP_RAU_red_2 port
8 cli CC-AF-78-2B-9F-65) Usuario Rechazado
So now the users can't connect, more precisely some devices can't
connect. For example some notebooks with Ubuntu 14.04 and newer mobile
phones with android. But on the other hand some older movile phones with
android can connect to the Wi-Fi, the user is validated.
Previously to write to the list I found in the Internet the problem was
related to the size of the certification and the solution was to
generate cerfication of 2048 size. Because ours were of 1024. I changed
it the size to 2048 and after that I did these:
openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out
cacert.pem
openssl req -new -keyout radius.key -out radius.seciu.edu.uy.csr -days 
3650
openssl ca -policy policy_anything -out radius.seciu.edu.uy.crt
-extensions xpserver_ext -extfile xpextensions -infiles
radius.seciu.edu.uy.csr
openssl x509 -inform PEM -outform DER -in cacert.pem -out ca.der
openssl dhparam -check -text -5 512 -out dh
dd if=/dev/urandom of=random count=2
But it didn't function, the message is the same.
I did what you told me to do, I passed cacert.pem, radius.key and
radius.seciu.edu.uy.crt to the client. But I got the same error message.
I don't realize what am I doing wrong...
Hope you can help me, thanks in advance
Mario
------------------------------
Message: 5
Date: Tue, 22 Dec 2015 10:42:47 -0500
From: Alan DeKok <aland@deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: Compilation error
Message-ID: <FD5AC9BB-0D65-46DA-AD54-81EFFEFF918D@deployingradius.com>
Content-Type: text/plain; charset=us-ascii
On Dec 22, 2015, at 4:27 AM, srithar jeevadurai <srijeevadurai1@gmail.com> 
wrote:
...
I am getting below error message while compiling freeRadius.
Use a recent version of OpenSSL.
Alan DeKok.
------------------------------
Message: 6
Date: Tue, 22 Dec 2015 10:46:16 -0500
From: Alan DeKok <aland@deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: Problem with handshake
Message-ID: <B0DDD21F-20B2-4925-8363-D332753993C8@deployingradius.com>
Content-Type: text/plain; charset=us-ascii
On Dec 22, 2015, at 10:41 AM, Mario Guerri Maglia 
<mario.guerri@seciu.edu.uy> wrote:
...
sadly the hints you gave me didn't work.
Did you follow the instructions?
If so, *which step* failed?  Simply saying "it didn't work" is unhelpful.
...
First of all I must say I'm a new user of FreeRadius, so I'll try to give 
a detailed explanation of my problem.
That's good.  But I pointed you to detailed documentation which says how 
to get this to work.  Did you follow it?
...
In the begining the radius was functioning ok, the authentication was ok, 
it consulted the LDAP and if the user was right, the user could connect 
to the Wi-Fi. We had few defined users and for many weeks nobody 
connected to it.
After that we tried to connect again and this error message appeared:
Which you already said.  There's no need to post it again.
...
Previously to write to the list I found in the Internet the problem was 
related to the size of the certification and the solution was to generate 
cerfication of 2048 size. Because ours were of 1024. I changed it the 
size to 2048 and after that I did these:
The directory raddb/certs contains configuration files and scripts which 
create new certificates.  Did you use them?
Apparently not.
...
But it didn't function, the message is the same.
Running server-side OpenSSL scripts doesn't change the client 
configuration.
...
I did what you told me to do, I passed cacert.pem, radius.key and 
radius.seciu.edu.uy.crt to the client. But I got the same error message.
I don't realize what am I doing wrong...
You need to follow the instructions *exactly*.  And if something goes 
wrong, say *which* step is going wrong.
Alan DeKok.
------------------------------
Message: 7
Date: Tue, 22 Dec 2015 21:43:15 +0530
From: srithar jeevadurai <srijeevadurai1@gmail.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: Proxy server rejects/failed auth request
Message-ID:
<CAC5rx4xDxQb7jGC0Gt1pWFtb0HQJZ21O_LmUygV5pcs_Nj8Q3w@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Hi Team,
Do we need to keep listen config as below for proxy server?
File: radiusd.conf
-- auth proxy
listen {
       ipaddr = 234.223.454.556
       port = 1812
       type = proxy
}
--account proxy
listen {
       ipaddr = 234.223.454.556
       port = 1813
       type = proxy
}
On Tue, Dec 22, 2015 at 7:53 PM, srithar jeevadurai <
srijeevadurai1@gmail.com> wrote:
...
Hi Friends,
I have created the proxy setup ready and made configuration changes as 
per
my knowledge.
While trying to send request from NAS simulator, it is giving below error
message in radius.log
*Tue Dec 22 19:36:46 2015 : Auth: Login incorrect: [asdf@company.com
<asdf@company.com>] (from client 234.224.654.123 port 16679 cli 
355545455)*
config file Users has below difference compare to installation file 
users.
Can you please help me to fix the same?
< DEFAULT Service-Type == Framed-User, Framed-Protocol == 7
<         Framed-IP-Netmask = 255.255.255.255,
<         MS-Primary-DNS-Server == 195.68.0.1,
<         MS-Secondary-DNS-Server == 195.68.0.2,
<         Service-Type == Framed-User,
<         Framed-Protocol == 7,
<         Fall-Through == no
One more request, I could not find any connection between proxy radius 
and
home server radius, Is the connection only happen when it is required? 
i.e.
while sending request from proxy to home server.
--
Regards,
Srithar Durairaj
Alternate Mail I.D: srijeevadurai1@yahoo.co.in
Mobile: +919886251852
-- 
Regards,
Srithar Durairaj
Alternate Mail I.D: srijeevadurai1@yahoo.co.in
Mobile: +919886251852
------------------------------
Subject: Digest Footer
-
List info/subscribe/unsubscribe? See 
http://www.freeradius.org/list/users.html
------------------------------
End of Freeradius-Users Digest, Vol 128, Issue 64
*************************************************

dahili.network＠gmail.com

tags

participants (1)