Nabble - Cistron - Radius

Re: Can we see the passwords?

2009-11-16T14:10:33Z

On Monday 16 November 2009, Frank DeChellis wrote:
> We are using Cistron 1.6.7.
>
> Is there a way top get the radius.log file to display all passwords,
> not just incorrect passwords?

I haven't tried it myself, but according to the docs, the "-z" option
does this.

--
Aaron Malone (aaron@...)
System Administrator, Poplar Bluff Internet, Inc.
PO Box 190 | Poplar Bluff, MO 63902 | 877.686.9114
-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Can we see the passwords?

2009-11-16T13:58:46Z

Can we see the passwords? Hi there,

We are using Cistron 1.6.7.

Is there a way top get the radius.log file to display all passwords, not just incorrect passwords?

Thanks
Frank

Frank DeChellis
President, Internet Access Worldwide
Welland, Ontario, Canada
www.iaw.com

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

ippool.conf

2009-08-26T01:45:30Z

Hi Guys,

I altered /usr/local/etc/raddb/sql/mysql/ippool.conf to choose an ippool
based on both the {nas-identifier} and the {calledstationid} as below :-

## The ORDER BY clause of this query tries to allocate the same
IP-address
## which user had last session...
allocate-find = "SELECT framedipaddress FROM ${ippool_table} \
WHERE nasid = '%{NAS-Identifier}' \
AND {calledstationid = '%{Called-Station-Id}}' \
AND (expiry_time < NOW() OR expiry_time IS NULL) \
ORDER BY (username <> '%{User-Name}'), \
(callingstationid <> '%{Calling-Station-Id}'), \
expiry_time \
LIMIT 1 \
FOR UPDATE"

i created a 'nasid' column within the 'nas' table and populated
accordingly, howwever, upon trying to start freeradius i get this :-

FreeRADIUS Version 2.1.6, for host i386-pc-solaris2.10, built on May 22
2009 at 14:22:28
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /usr/local/etc/raddb/radiusd.conf
including files in directory /usr/local/etc/raddb/modules/
including configuration file /usr/local/etc/raddb/modules/acct_unique
including configuration file /usr/local/etc/raddb/modules/always
including configuration file /usr/local/etc/raddb/modules/attr_filter
including configuration file /usr/local/etc/raddb/modules/attr_rewrite
including configuration file /usr/local/etc/raddb/modules/chap
including configuration file /usr/local/etc/raddb/modules/checkval
including configuration file /usr/local/etc/raddb/modules/counter
including configuration file /usr/local/etc/raddb/modules/detail
including configuration file
/usr/local/etc/raddb/modules/detail.example.com
including configuration file /usr/local/etc/raddb/modules/detail.log
including configuration file /usr/local/etc/raddb/modules/digest
including configuration file /usr/local/etc/raddb/modules/echo
including configuration file /usr/local/etc/raddb/modules/etc_group
including configuration file /usr/local/etc/raddb/modules/exec
including configuration file /usr/local/etc/raddb/modules/expiration
including configuration file /usr/local/etc/raddb/modules/expr
including configuration file /usr/local/etc/raddb/modules/files
including configuration file /usr/local/etc/raddb/modules/inner-eap
including configuration file /usr/local/etc/raddb/modules/ippool
including configuration file /usr/local/etc/raddb/modules/krb5
including configuration file /usr/local/etc/raddb/modules/ldap
including configuration file /usr/local/etc/raddb/modules/linelog
including configuration file /usr/local/etc/raddb/modules/logintime
including configuration file /usr/local/etc/raddb/modules/mac2ip
including configuration file /usr/local/etc/raddb/modules/mac2vlan
including configuration file /usr/local/etc/raddb/modules/otp
including configuration file /usr/local/etc/raddb/modules/mschap
including configuration file /usr/local/etc/raddb/modules/pam
including configuration file /usr/local/etc/raddb/modules/pap
including configuration file /usr/local/etc/raddb/modules/passwd
including configuration file /usr/local/etc/raddb/modules/perl
including configuration file /usr/local/etc/raddb/modules/policy
including configuration file /usr/local/etc/raddb/modules/preprocess
including configuration file /usr/local/etc/raddb/modules/radutmp
including configuration file /usr/local/etc/raddb/modules/realm
including configuration file /usr/local/etc/raddb/modules/smbpasswd
including configuration file /usr/local/etc/raddb/modules/smsotp
including configuration file /usr/local/etc/raddb/modules/sql_log
including configuration file
/usr/local/etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /usr/local/etc/raddb/modules/sradutmp
including configuration file /usr/local/etc/raddb/modules/unix
including configuration file /usr/local/etc/raddb/modules/wimax
including configuration file /usr/local/etc/raddb/eap.conf
including configuration file /usr/local/etc/raddb/sql.conf
including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf
including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf
including configuration file /usr/local/etc/raddb/sqlippool.conf
including configuration file /usr/local/etc/raddb/sql/mysql/ippool.conf
WARNING: No such configuration item ippool_table
/usr/local/etc/raddb/sql/mysql/ippool.conf[64]: Reference "UPDATE
${ippool_table} SET nasipaddress = '%{NAS-IP-Address}', pool_key =
'${pool-key}', callingstationid = '%{Calling-Station-Id}', username =
'%{User-Name}', expiry_time = NOW() + INTERVAL ${lease-duration} SECOND
WHERE framedipaddress = '%{Framed-IP-Address}' AND expiry_time IS NULL"
not found
Errors reading /usr/local/etc/raddb/radiusd.conf

any ideas please?

kind regards

james

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: Reg Realm attribute

2009-07-14T10:44:10Z

Bala,

Try using NTRADPing. Recently used, and needed to send the Attribute ERX-Pppoe-Description and get through it. The application creates a dictionary file in which you include the attribute before using it in application.

I have a doubt in adding the realm attribute. How to add realm attribute externally. I have added the realm attribute using jradius client. When these attributes are sent to another proxy radius server, the realm attribute is missing.

Regards

Bala

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Reg Realm attribute

2009-07-14T03:17:39Z

Regards

Bala

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Second entry for every user

2009-04-23T08:02:02Z

Second entry for every user Hi there,

We are using 1.6.7 on NetBSD and it is receiving AAA info from a Cisco 7401 router.

This radius server serves 3 devices but the users coming in off the cisco router each geenrate 2 lines in our radwtmp file. See below...

Does anybody know what the second line means? And how we can stop it?

kathi     604RTEgD 69.49.36.105     Wed Apr 22 05:10 - 05:15 (00:05)
kathi     2740beEB                  Wed Apr 22 05:10 - 05:15 (00:05)
cosmo     1985RTEg 69.49.35.240     Wed Apr 22 05:09 - 05:14 (00:04)
cosmo     38080beE                  Wed Apr 22 05:09 - 05:14 (00:04)
kathi     1908RTEg 69.49.36.105     Wed Apr 22 05:09 - 05:10 (00:00)
kathi     39190beE                  Wed Apr 22 05:09 - 05:10 (00:00)
kathi     44140beE                  Wed Apr 22 05:09 - 05:10 (00:00)
borgatti 1084RTEg 69.49.36.82      Wed Apr 22 05:09 - 05:10 (00:01)
borgatti 8910beEB                  Wed Apr 22 05:09 - 05:10 (00:01)
kathi     970RTEgD 69.49.36.105     Wed Apr 22 05:09 - 05:09 (00:00)
kathi     29150beE                  Wed Apr 22 05:09 - 05:09 (00:00)
kathi     18190beE                  Wed Apr 22 05:09 - 05:09 (00:00)
city2     305RTEgD 69.49.36.107     Wed Apr 22 05:09 - 05:14 (00:05)
city2     10410beE                  Wed Apr 22 05:09 - 05:14 (00:05)

Thanks
Frank

Frank DeChellis
President, Internet Access Worldwide
Welland, Ontario, Canada
www.iaw.com

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

RE: Error in test FreeRadius

2009-01-10T20:07:20Z

Error in test FreeRadius

Paulo,

This is the Cistron mailing list .. not the FreeRadius.

-John

From: cistron-radius-bounces+john=dncsi.com@... [mailto:cistron-radius-bounces+john=dncsi.com@...] On Behalf Of Paulo Cesar Naves Mota
Sent: Saturday, January 10, 2009 10:35 PM
To: cistron-radius@...
Subject: Error in test FreeRadius

Hello people,

        I`d like to know how to resolve this problem in configuration:

[root@serverRH5 raddb]# radtest pc1 123456 localhost 0 mysecret
Sending Access-Request of id 169 to 127.0.0.1 port 1812
        User-Name = "pc1"
        User-Password = "123456"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 0
rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=169, length=20

       My clients.conf

       client localhost {
        ipaddr = 127.0.0.1
       secret = mysecret
        require_message_authenticator = no
       shortname       = localhost
       nastype = other
       }

      Thanks for all

Best Regards

Paulo Cesar

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Error in test FreeRadius

2009-01-10T19:34:35Z

Error in test FreeRadius

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Help with instalation Radius in RHES 5.2 x86_64

2009-01-08T03:06:42Z

Hello everybody,

I'd like to know if someone can help me, because I am using Red Hat
Enterprise 5.2 64bits and I am receiving error messages when try install
(using make) . I am using radiusd-cistron-1.6.8 .

In below the error message:

[root@server src]# make
gcc -Wall -g -c radiusd.c
radiusd.c:77: error: static declaration of ‘radius_pid’ follows
non-static declaration
radiusd.h:207: error: previous declaration of ‘radius_pid’ was here
radiusd.c: In function ‘main’:
radiusd.c:523: warning: pointer targets in passing argument 6 of
‘recvfrom’ differ in signedness
radiusd.c:529: warning: pointer targets in passing argument 3 of
‘radrecv’ differ in signedness
radiusd.c:540: warning: pointer targets in passing argument 6 of
‘recvfrom’ differ in signedness
radiusd.c:546: warning: pointer targets in passing argument 3 of
‘radrecv’ differ in signedness
radiusd.c: In function ‘radrespond’:
radiusd.c:620: warning: pointer targets in passing argument 1 of
‘strNcpy’ differ in signedness
radiusd.c:620: warning: pointer targets in passing argument 2 of
‘strNcpy’ differ in signedness
make: ** [radiusd.o] Erro 1

Thanks

Best Regards

--

Paulo César Naves Mota
Administrador de Redes
°v°
/(_)\
^ ^
LinuxUser: 412359

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

DAS Feature in Cistron RADIUS Server

2008-07-07T00:14:18Z

Hello All,

Does the Cistron RADIUS server supports dynamic authorization feature as
per RFC 5176?

Thanks in advance.
--Jayaprakash S

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

PoPToP + Radius not working

2008-06-03T20:43:16Z

Hello,

I have PoPToP and Radius both working fine separately. Unfortunately, when I try to combine them, this is not the case. I'll give you the debug mode output.

(I edited the "service" script to run with the "debug" parameter)
[root@vpnserver1 ~]# service radiusd debug
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config:   including file: /etc/raddb/proxy.conf
Config:   including file: /etc/raddb/clients.conf
Config:   including file: /etc/raddb/snmp.conf
Config:   including file: /etc/raddb/eap.conf
main: prefix = "/usr"
main: localstatedir = "/var"
main: logdir = "/var/log/radius"
main: libdir = "/usr/lib"
main: radacctdir = "/var/log/radius/radacct"
main: hostname_lookups = no
main: snmp = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/var/log/radius/radius.log"
main: log_auth = yes
main: log_auth_badpass = yes
main: log_auth_goodpass = yes
main: pidfile = "/var/run/radiusd/radiusd.pid"
main: bind_address = SERVER_IP IP address [SERVER_IP]
main: user = "radiusd"
main: group = "radiusd"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded PAP
pap: encryption_scheme = "crypt"
Module: Instantiated pap (pap)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = yes
mschap: require_strong = yes
mschap: with_ntdomain_hack = no
mschap: passwd = "(null)"
mschap: ntlm_auth = "(null)"
Module: Instantiated mschap (mschap)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "/etc/shadow"
unix: group = "(null)"
unix: radwtmp = "/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded eap
eap: default_eap_type = "mschapv2"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
rlm_eap: Loaded and initialized type md5
rlm_eap: Loaded and initialized type leap
gtc: challenge = "Password: "
gtc: auth_type = "PAP"
rlm_eap: Loaded and initialized type gtc
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/etc/raddb/huntgroups"
preprocess: hints = "/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/etc/raddb/users"
files: acctusersfile = "/etc/raddb/acct_users"
files: preproxy_usersfile = "/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication SERVER_IP:1812
Listening on accounting SERVER_IP:1813
Ready to process requests.
rad_recv: Access-Request packet from host SERVER_IP:32801, id=186, length=147
        Service-Type = Framed-User
        Framed-Protocol = PPP
        User-Name = "Dennis"
        MS-CHAP-Challenge = 0x1f669550992b56424e239114891e5cdd
        MS-CHAP2-Response = 0x5d00aa14c7072301e8c304fe51bfa9ee5a65000000000000000075ca6a2426c70c3ec4d14ed01b4509a6108468c1fbf25dd4
        Calling-Station-Id = "MY_IP"
        NAS-IP-Address = 127.0.0.1
        NAS-Port = 0
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
modcall[authorize]: module "mschap" returns ok for request 0
    rlm_realm: No '@' in User-Name = "Dennis", looking up realm NULL
    rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 0
rlm_eap: No EAP-Message, not doing EAP
modcall[authorize]: module "eap" returns noop for request 0
    users: Matched entry DEFAULT at line 153
    users: Matched entry DEFAULT at line 172
    users: Matched entry DEFAULT at line 184
modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns ok) for request 0
rad_check_password: Found Auth-Type MS-CHAP
auth: type "MS-CHAP"
Processing the authenticate section of radiusd.conf
modcall: entering group MS-CHAP for request 0
rlm_mschap: No User-Password configured. Cannot create LM-Password.
rlm_mschap: No User-Password configured. Cannot create NT-Password.
rlm_mschap: Told to do MS-CHAPv2 for Dennis with NT-Password
rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication.
rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
modcall[authenticate]: module "mschap" returns reject for request 0
modcall: leaving group MS-CHAP (returns reject) for request 0
auth: Failed to validate the user.
Login incorrect: [Dennis/<no User-Password attribute>] (from client VPN port 0 cli MY_IP)
Delaying request 0 for 1 seconds
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 1 seconds...
--- Walking the entire request list ---
Sending Access-Reject of id 186 to SERVER_IP port 32801
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 186 with timestamp 48458194
Nothing to do. Sleeping until we see a request.

So that's where I stand in the debug when trying to connect with the built-in WinXP client to PoPToP with Radius. Like I said, without PoPToP running through Radius, I receive no errors and running radtest no errors. So any ideas? I don't mean to be incompetent but I'm a little new to the RADIUS scene but, normally pick things up pretty quickly.

Thanks for all your help!
Dennis

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

VPOP configuration

2007-11-14T09:41:52Z

VPOP configuration Hi there,

New to the list. We have Cistron 1.6.7nb2.

Where do I find info on configuring a VPOP? I have to filter through 5 DIDs on a dial-up server. I think if I knew the correct term as Cistron refers to it I could find the info.

Thanks
Frank

Frank DeChellis
President, Internet Access Worldwide
Welland, Ontario, Canada
www.iaw.com

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: Freeradius server can not see any request from clients.

2007-06-01T00:08:33Z

hi
i have the same problem. did u get any reply? is your problem solved?
regards
sara

richard Bai wrote:

Hi, everyone,

I face a very strange problem right now when I configure a freeradius server
with PEAP + LDAP.

I can start the radius in debug mode properly. I get following lines:
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.

Then I did test by using " *radtest username password localhost 0
sharedsecret*"
And the radius server replied with Access-Accept message. So, I think the
serve works just fine.

But when I tested by using "*radtest username password IP of server 0
sharedsecret*" from a client conneted to the server through a hub, I can not
get anything back.
I even did not see any Access-Request information in debug mode on the
radius server. It looks like the radius doesn't receive anything.
However, I sniffered the interface via Ethereal and used " tcpdump -v port
1812 " in the server, I do see the Access-Request packet received by the
interface on the server,
I confirmed that the 1812 port is open.

Please give me some idea. Any advices or solution is welcome.

Thank you very much!

Best Regards
Richard

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

epagunsan@hotmail.com wants to talk to you!

2007-02-25T23:47:35Z

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

ts.gif (124 bytes) Download Attachment

Re: Getting error in radius server with dot1X and supplicant on windows XP...

2007-02-15T07:29:49Z

This is the cistron radius mailing list

raghavendra.sadaramachandra@... wrote:

> Hi All,
>
> I am using free radius server with dot1X. and supplicant is on
> windows XP. Here when I use user name <= 3 letters I am getting
> following error...
>
> * 1.* *Received packet from 192.168.112.90 with invalid
> Message-Authenticator! (Shared secret is incorrect.)*
> **
> and for user name <=3 my client is getting following error.
>
> *2. **Malformed RADIUS packet from host 192.168.0.1: too short
> (length 17 < minimum 20).*
>
> where as radius RFC say... user name length can be >= 3.
>
> since user name goes as part of attributes in radius packet... but
> errors we are getting are totally different.
>
> I mean first we are getting related to message-authenticator where as
> we are passing username with length <=3. and second error my client
> getting is related to packet length...another interesting thing is we
> get these *errors only for PEAP *configuration.... this will work for
> MD5 and others.
>
> can any one help me in this.
>
> whether we are getting different errors because both of us may be
> using different versions of RADIUS server? just a guess.
>
> This error may be because of RADIUS client or server?
>
> Thanx in Advance...
>
> ---Raghu.
>
> **
>
>

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Getting error in radius server with dot1X and supplicant on windows XP...

2007-02-15T06:44:50Z

Hi All,

I am using free radius server with dot1X. and supplicant is on windows XP. Here when I use user name <= 3 letters I am getting following error...

1. Received packet from 192.168.112.90 with invalid Message-Authenticator! (Shared secret is incorrect.)

and for user name <=3 my client is getting following error.

2. Malformed RADIUS packet from host 192.168.0.1: too short (length 17 < minimum 20).

where as radius RFC say... user name length can be >= 3.

since user name goes as part of attributes in radius packet... but errors we are getting are totally different.

I mean first we are getting related to message-authenticator where as we are passing username with length <=3. and second error my client getting is related to packet length...another interesting thing is we get these errors only for PEAP configuration.... this will work for MD5 and others.

can any one help me in this.

whether we are getting different errors because both of us may be using different versions of RADIUS server? just a guess.

This error may be because of RADIUS client or server?

Thanx in Advance...

---Raghu.

The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments.

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

www.wipro.com

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Doubt about RADIUS server errors.

2007-02-15T05:18:59Z

Hi,

I am using free radius server with dot1X. and supplicant is on windows XP. Here when I use user name <= 3 letters I am getting following error...

1. Received packet from 192.168.112.90 with invalid Message-Authenticator! (Shared secret is incorrect.)

and for user name <=3 my client is getting following error.

2. Malformed RADIUS packet from host 192.168.0.1: too short (length 17 < minimum 20).

where as radius RFC say... user name length can be >= 3.

since user name goes as part of attributes in radius packet... but errors we are getting are totally different.

can any one help me in this.

Thanx in Advance...

---Raghu.

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: modifying a user name

2007-02-11T15:59:38Z

In article <6.2.5.6.2.20070206232017.02b949f0@...>,
Jean M. Vandette <vandj@...> wrote:
>Greetings all...
>
>I have a client that requires that when he sends users with
>a prefix ie: bla/ that I rewrite or add a realm of @blah.com so it will
>proxy correctly to his radius server. Problem is his dialer program
>will not allow a @ symbol until updated. Anyone with a way to
>make this work?
>I can strip the prefix but am at a loss on how to add the suffix for these
>users.

If you use 1.6.8 you can do:

# Realms file
bla/* radius.blah.com wildcard

# Users file
bla/* Auth-Type = Accept

Mike.
-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

modifying a user name

2007-02-06T20:52:31Z

Greetings all...

I have a client that requires that when he sends users with
a prefix ie: bla/ that I rewrite or add a realm of @blah.com so it will
proxy correctly to his radius server. Problem is his dialer program
will not allow a @ symbol until updated. Anyone with a way to
make this work?
I can strip the prefix but am at a loss on how to add the suffix for these
users.

Please advise

Jean M. Vandette

*************************************************************************************
*SecureNet Information Services Inc. 100 Alexis Nihon Blvd., Suite 283*
*(514) 744-4242 Vox (514) 744-1552 Fax St. Laurent, Quebec H4M 2N7*
********** Providing Quality Public Internet access since 1994***************

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

RE: Expert Help Required

2007-02-02T13:41:17Z

> test Auth-Type = Local, Password = "test"
> Service-Type = Framed-User,
> Framed-Protocol = PPP,
> Framed-IP-Address = 1.2.3.3,
> Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240"
> Cisco-AVPair = "ip:route=1.2.4.4 255.255.255.252 "

If the example above is exactly what you tried, then you need to add a
',' (comma) at the end of the first AVPair line.

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: Expert Help Required

2007-02-02T06:18:49Z

no luck and it is not working

Pete Conkin wrote:

>
> test Auth-Type = Local, Password = "test"
> Service-Type = Framed-User,
> Framed-Protocol = PPP,
> Framed-IP-Address = 1.2.3.3,
> Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240"
> Cisco-AVPair = "ip:route=1.2.4.4 255.255.255.252 "
>
> When i try to restart cistron radius it will stop the process because it
> will not accept two ip routes with two different rage one is /30 and other
> one is /29.
>
> Could some one help me how to add two ip routes for one single user.

This is just a guess ... please test:

Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240"
Cisco-AVPair += "ip:route=1.2.4.4 255.255.255.252"

or pehaps:

Cisco-AVPair = "ip:route#1= 1.2.3.4 255.255.255.240"
Cisco-AVPair += "ip:route#2=1.2.4.4 255.255.255.252"

Pete

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: Expert Help Required

2007-02-02T06:15:26Z

> Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240"
> Cisco-AVPair += "ip:route=1.2.4.4 255.255.255.252"

Oh, ya ... I forgot the comma at the end of the first Cisco-AVPair line.

>
> or pehaps:
>
> Cisco-AVPair = "ip:route#1= 1.2.3.4 255.255.255.240"
> Cisco-AVPair += "ip:route#2=1.2.4.4 255.255.255.252"
>

Here too :p

Pete

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: Expert Help Required

2007-02-02T06:07:28Z

>
> test Auth-Type = Local, Password = "test"
> Service-Type = Framed-User,
> Framed-Protocol = PPP,
> Framed-IP-Address = 1.2.3.3,
> Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240"
> Cisco-AVPair = "ip:route=1.2.4.4 255.255.255.252 "
>
> When i try to restart cistron radius it will stop the process because it
> will not accept two ip routes with two different rage one is /30 and other
> one is /29.
>
> Could some one help me how to add two ip routes for one single user.

This is just a guess ... please test:

Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240"
Cisco-AVPair += "ip:route=1.2.4.4 255.255.255.252"

or pehaps:

Cisco-AVPair = "ip:route#1= 1.2.3.4 255.255.255.240"
Cisco-AVPair += "ip:route#2=1.2.4.4 255.255.255.252"

Pete

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Expert Help Required

2007-02-02T04:04:36Z

Hi Guys,

Currently i am using cistron radius with the following configuration for user

test Auth-Type = Local, Password = "test"
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-IP-Address = 1.2.3.3,
Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240"

Now i want to configure one more route path for this user using Cisco-AVPair = "ip:route=

example as follows

test Auth-Type = Local, Password = "test"
Service-Type = Framed-User,
Framed-Protocol = PPP,
Framed-IP-Address = 1.2.3.3,
Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240"
Cisco-AVPair = "ip:route=1.2.4.4 255.255.255.252 "

When i try to restart cistron radius it will stop the process because it will not accept two ip routes with two different rage one is /30 and other one is /29.

Could some one help me how to add two ip routes for one single user.

Thanks for your help

radiusd-cistron fails on x86_64, Help!

2007-01-31T11:47:20Z

Hello

I am radiusd-cistron user under NetBSD from 4 (or more) years
working without problems. But now, I must migrate to new
hardware (xeon 64 bits, NetBSD-3.1) but radiusd-cistron fails.

I sent a message to pkgsrc-users mailing list last night and
I hope somebody help me. This is the message with the description
of the problem:
http://mail-index.netbsd.org/pkgsrc-users/2007/01/30/0013.html

Also I found (in this list) some messages from another user
with the same problem but under Linux.
http://lists.cistron.nl/pipermail/cistron-radius/2006-September/006252.html
http://lists.cistron.nl/pipermail/cistron-radius/2006-September/006253.html
http://lists.cistron.nl/pipermail/cistron-radius/2006-September/006254.html

But I didnt found a solution (or some tip) for this problem.
Does somebody can help me?

Thanks in advance

Heron Gallegos
Saltillo Coahuila Mexico
-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

RE: RADIUS keeps crashing

2007-01-23T05:22:12Z

Actually this seems to be an accounting-request packet. And every time it receives an accounting-request, it seems to die.

Toshi

> -----Original Message-----
> From: Toshi Esumi
> Sent: Tuesday, January 23, 2007 2:58 AM
> To: cistron-radius@...
> Subject: RADIUS keeps crashing
>
> Does someone know what's wrong with this request? It suddenly started crashing from these requests from Level3's proxy server.
>
> Thanks,
>
> Toshi
>
> [root@ns1-sea log]# /usr/local/sbin/radiusd -y -Z -xx
> Starting - reading configuration files ...
> Ready to process requests.
> radrecv: Packet from host 209.244.127.136 code=4, id=173, length=532
> User-Name = "46995-69594@ctx46995"
> Ascend-Pre-Output-Packets = 0
> NAS-IP-Address = 209.244.42.90
> NAS-Port = 755
> Service-Type = Framed-User
> Ascend-Data-Rate = 28800
> Attr-529-66 = "\000\000\000"
> Attr-529-67 = "\000\000\000"
> Ascend-Xmit-Rate = 26400
> Called-Station-Id = "7147054308"
> Calling-Station-Id = "7143733029"
> NAS-Identifier = "nas26.lax1.Level3.net"
> Acct-Status-Type = Stop
> Acct-Delay-Time = 0
> Acct-Input-Octets = 1886
> Acct-Output-Octets = 637
> Acct-Session-Id = "337093469"
> Acct-Authentic = RADIUS
> Acct-Session-Time = 63
> Acct-Input-Packets = 39
> Acct-Output-Packets = 19
> Ascend-Modem-PortNo = 84
> Event-Timestamp (Unknown Type 3)
> NAS-Port-Type = Async
> Ascend-Modem-ShelfNo = 1
> Ascend-Pre-Output-Octets = 0
> Tunnel-Server-Endpoint:0 = "209.247.111.228"
> Ascend-Modem-SlotNo = 3
> Attr-529-86 = "\000\000\000"
> Attr-529-13 = "\000\000\000\002"
> Ascend-Disconnect-Cause = 770
> Ascend-PreSession-Time = 32
> Attr-529-20 = "00000000-0000-0000-0000-000000000000"
> Attr-529-28 = "\000\000\000\276"
> Tunnel-Client-Auth-Id:0 = "nas26.lax1.Level3.net"
> Tunnel-Server-Auth-Id:0 = "ac1-hou"
> Tunnel-Type:0 = L2TP
> Ascend-Pre-Input-Packets = 0
> Acct-Tunnel-Connection-Id:0 = "209.244.42.90-8A35-0624-209.247.111.228-1259-
> 0D52"
> Ascend-Connect-Progress = 244
> Ascend-Pre-Input-Octets = 0
> MASTER: accounting process died - exit.
> [root@ns1-sea log]#
>
>

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

RADIUS keeps crashing

2007-01-23T02:57:45Z

Does someone know what's wrong with this request? It suddenly started crashing from these requests from Level3's proxy server.

Thanks,

Toshi

[root@ns1-sea log]# /usr/local/sbin/radiusd -y -Z -xx
Starting - reading configuration files ...
Ready to process requests.
radrecv: Packet from host 209.244.127.136 code=4, id=173, length=532
User-Name = "46995-69594@ctx46995"
Ascend-Pre-Output-Packets = 0
NAS-IP-Address = 209.244.42.90
NAS-Port = 755
Service-Type = Framed-User
Ascend-Data-Rate = 28800
Attr-529-66 = "\000\000\000"
Attr-529-67 = "\000\000\000"
Ascend-Xmit-Rate = 26400
Called-Station-Id = "7147054308"
Calling-Station-Id = "7143733029"
NAS-Identifier = "nas26.lax1.Level3.net"
Acct-Status-Type = Stop
Acct-Delay-Time = 0
Acct-Input-Octets = 1886
Acct-Output-Octets = 637
Acct-Session-Id = "337093469"
Acct-Authentic = RADIUS
Acct-Session-Time = 63
Acct-Input-Packets = 39
Acct-Output-Packets = 19
Ascend-Modem-PortNo = 84
Event-Timestamp (Unknown Type 3)
NAS-Port-Type = Async
Ascend-Modem-ShelfNo = 1
Ascend-Pre-Output-Octets = 0
Tunnel-Server-Endpoint:0 = "209.247.111.228"
Ascend-Modem-SlotNo = 3
Attr-529-86 = "\000\000\000"
Attr-529-13 = "\000\000\000\002"
Ascend-Disconnect-Cause = 770
Ascend-PreSession-Time = 32
Attr-529-20 = "00000000-0000-0000-0000-000000000000"
Attr-529-28 = "\000\000\000\276"
Tunnel-Client-Auth-Id:0 = "nas26.lax1.Level3.net"
Tunnel-Server-Auth-Id:0 = "ac1-hou"
Tunnel-Type:0 = L2TP
Ascend-Pre-Input-Packets = 0
Acct-Tunnel-Connection-Id:0 = "209.244.42.90-8A35-0624-209.247.111.228-1259-
0D52"
Ascend-Connect-Progress = 244
Ascend-Pre-Input-Octets = 0
MASTER: accounting process died - exit.
[root@ns1-sea log]#

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

unable to make radiusd-cistron: make: *** [radiusd.o] Error 1

2006-12-03T03:28:23Z

While i make radiusd-cistron-1.6.8 in fedora core 6., i am getting the
following errors. I tried a lot but i couldnot solve it. the platofrm
please do help me.

gcc -Wall -g -c radiusd.c
radiusd.c:77: error: static declaration of radius_pid follows non-static
declaration
radiusd.h:207: error: previous declaration of radius_pid was here
radiusd.c: In function main:
radiusd.c:523: warning: pointer targets in passing argument 6 of
recvfrom differ in signedness
radiusd.c:529: warning: pointer targets in passing argument 3 of radrecv
differ in signedness
radiusd.c:540: warning: pointer targets in passing argument 6 of
recvfrom differ in signedness
radiusd.c:546: warning: pointer targets in passing argument 3 of radrecv
differ in signedness
radiusd.c: In function radrespond:
radiusd.c:620: warning: pointer targets in passing argument 1 of strNcpy
differ in signedness
radiusd.c:620: warning: pointer targets in passing argument 2 of strNcpy
differ in signedness
make: *** [radiusd.o] Error 1

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

help

2006-12-03T02:00:30Z

Freeradius server can not see any request from clients.

2006-10-25T07:32:00Z

Hi, everyone,

I face a very strange problem right now when I configure a freeradius server with PEAP + LDAP.

I can start the radius in debug mode properly. I get following lines:

Listening on authentication *:1812

Listening on accounting *:1813

Ready to process requests.

Then I did test by using " radtest username password localhost 0 sharedsecret"

And the radius server replied with Access-Accept message. So, I think the serve works just fine.

But when I tested by using "radtest username password IP of server 0 sharedsecret" from a client conneted to the server through a hub, I can not get anything back.

I even did not see any Access-Request information in debug mode on the radius server. It looks like the radius doesn't receive anything.

However, I sniffered the interface via Ethereal and used " tcpdump -v port 1812 " in the server, I do see the Access-Request packet received by the interface on the server,

I confirmed that the 1812 port is open.

Please give me some idea. Any advices or solution is welcome.

Thank you very much!

Best Regards

Richard

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

problem in radius

2006-10-16T21:17:47Z

hi! sorry if this already been ask.. i am not good in radius thingy..

could you help on this.. i am having problems with our radius server.

1. the radius accounting suddenly expire all clients even though it
was just recently activated.

2. users who normally disconnect are still in the database as 'Active'
which is supposedly 'Idle' already.

2. i have a lot of stuckusers which can be seen thru radwho. i tried
to used radkill but it doesn't go away. how can i remove those users
that are not login anymore.

am using radiusd-cistron-pg-1.6.6-2 in Red Hat Linux release 7.3 (Valhalla)

hope you could help on this.. logfiles of /var/log/radius.log
==

Tue Oct 17 11:10:53 2006: Auth: Database check duplicate record for
[prd0029702] start.
Tue Oct 17 11:10:56 2006: Error: Ignore duplicated record for
[prd0029702] id [44EE5BF0015E].
Tue Oct 17 11:10:56 2006: Auth: Database check duplicate record for
[prd0028953] start.
Tue Oct 17 11:11:02 2006: Error: Ignore duplicated record for
[prd0028953] id [44EE4CA17B14].
Tue Oct 17 11:11:02 2006: Error: Accounting: logout: entry for NAS
bly-dialup.westlink.com.ph port 4 has wrong ID
Tue Oct 17 11:11:02 2006: Auth: Database check duplicate record for
[prd0028052] start.
Tue Oct 17 11:11:09 2006: Error: Ignore duplicated record for
[prd0028052] id [44EE4E597C16].
Tue Oct 17 11:11:09 2006: Auth: Database check duplicate record for
[prd0028740] start.
Tue Oct 17 11:11:12 2006: Error: Ignore duplicated record for
[prd0028740] id [44EE4E587BFF].
Tue Oct 17 11:11:12 2006: Error: Accounting: logout: entry for NAS
bly-dialup.westlink.com.ph port 8 has wrong ID
Tue Oct 17 11:11:12 2006: Auth: Database login update for [prd0029126] start.
Tue Oct 17 11:11:12 2006: Auth: Account [prd0029126] found in SQL Database.
Tue Oct 17 11:11:12 2006: Auth: Account [prd0029126] state idle - set active.
Tue Oct 17 11:11:12 2006: Auth: Database login update for [prd0029126] ok.
Tue Oct 17 11:11:12 2006: Auth: Database check duplicate record for
[prd0029254] start.
Tue Oct 17 11:11:15 2006: Error: Ignore duplicated record for
[prd0029254] id [44EE428F78C7].
Tue Oct 17 11:11:15 2006: Auth: Database login update for [prd0028404] start.
Tue Oct 17 11:11:16 2006: Auth: Account [prd0028404] found in SQL Database.
Tue Oct 17 11:11:16 2006: Auth: Account [prd0028404] state already active.
Tue Oct 17 11:11:16 2006: Auth: Database login update for [prd0028404] ok.
-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: Using Calling-Station-Id for access control

2006-10-16T04:43:42Z

I believe you can.

using the Exec-Program or Exec-Program-Wait attribute you cam call a script
to read the first six (or whatever) number of the calling number and return
the Session-Timeout = 21600 attribute / value pair

Benn
----- Original Message -----
From: "Miquel van Smoorenburg" <miquels@...>
To: <cistron-radius@...>
Sent: Sunday, October 15, 2006 9:59 AM
Subject: Re: Using Calling-Station-Id for access control

In article <452FFF7F.3080808@...>,
Kirk Ismay <captain@...> wrote:

>I'm using cistron radius with our dial-up network.
>
>I'd like to be able to set up different session time limits from
>customers coming in from certain area codes and phone exchanges. Can
>Cistron use regular expressions or wildcard matches in check values?
>For instance is the following or something similar possible?
>
>DEFAULT Auth-Type = System, Calling-Station-Id = "807234*"
> Session-Timeout = 21600,
> Fall-Through = Yes

No. But FreeRadius can do what you want. http://www.freeradius.org/

Mike.

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: Using Calling-Station-Id for access control

2006-10-15T07:59:46Z

In article <452FFF7F.3080808@...>,
Kirk Ismay <captain@...> wrote:

No. But FreeRadius can do what you want. http://www.freeradius.org/

Mike.

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Using Calling-Station-Id for access control

2006-10-13T15:05:03Z

I'm using cistron radius with our dial-up network.

I'd like to be able to set up different session time limits from
customers coming in from certain area codes and phone exchanges. Can
Cistron use regular expressions or wildcard matches in check values?
For instance is the following or something similar possible?

DEFAULT Auth-Type = System, Calling-Station-Id = "807234*"
Session-Timeout = 21600,
Fall-Through = Yes

Thanks.

Sincerely,
Kirk Ismay

System Administrator

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/

Re: Pls help: authentication fail on x86_64 Linux

2006-09-19T20:08:47Z

Hi,

I tried both Auth-Type=Local and Auth-Type=Pam. Same result obtained in
both cases. I'm trying to test by compiling Radius 1.6.8 on x86_64 into
32bit executable. Fyi also.

Thanks a lot.
/ST

> In article <3035.137.189.29.184.1158637571.squirrel@...>,
> S.T. Wong <st@...> wrote:
>>Hi all,
>>
>>I was running Cistron Radius 1.6.6 on RedHat 8.0 (i386) for years
>>without problem. Recently I try to migrate the server to new hardware
>>running CentOS 4.4 (x86_64) with Cistron Radius 1.6.8. Authentication
>>from all radius clients except local host failed. After some debugging,
>>found that the user password sent from remote radius clients (I used
>>radclient and Perl module Authen::Radius) can't be decrypted correctly
>>on the new machine.
>>However, authentication works if I use executable compiled on the RedHat
>>8 i386 machine and run it on the new x86_64 hardware with the same
>>configuration files. I wonder if the case relates to the md5 code.
>>
>>I searched the faq and doc but have no idea about the cause of problem.
>>Would anyone advice if I've anything missed?
>
> I think you're the first person to run it on a 64-bit machine..
> the code may have some 32/64 bit problems, or some library may have.
>
> Does Auth-Type = Local, Password = "bla" work ? Is PAP broken,
> or CHAP, or both ? That should give you some clues as to where
> to look for the breakage.
>
> Mike.
>
> -
> List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/
>

-
List info/subscribe/unsubscribe? See http://www.radius.cistron.nl/list/