Hi all,<br><br>Thanks for the reply.<br>i was just missing " ". <br><br>Well another problem here.. i have defined a priv level 7 in the switch. ran the following commands.<br><br>privilege configure level 7 snmp-server host
<br>privilege configure level 7 snmp-server enable<br>privilege configure level 7 snmp-server<br>privilege exec level 7 ping<br>!<br><br>But still the user is able to run all the commands.<br><br>here is my user file conf
<br><br>user Auth-Type :=Local, User-Password == "user"<br> Service-Type = NAS-Prompt-User,<br> Login-Service = ssh,<br> Cisco-avpair = "Shell:priv-lvl=7"<br><br><br><br><br><br>
<div><span class="gmail_quote">On 7/19/07, <b class="gmail_sendername"><a href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org</a></b> <<a href="mailto:freeradius-users-request@lists.freeradius.org">
freeradius-users-request@lists.freeradius.org</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Send Freeradius-Users mailing list submissions to
<br> <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br><br>To subscribe or unsubscribe via the World Wide Web, visit<br> <a href="http://lists.freeradius.org/mailman/listinfo/freeradius-users">
http://lists.freeradius.org/mailman/listinfo/freeradius-users</a><br>or, via email, send a message with subject or body 'help' to<br> <a href="mailto:freeradius-users-request@lists.freeradius.org">freeradius-users-request@lists.freeradius.org
</a><br><br>You can reach the person managing the list at<br> <a href="mailto:freeradius-users-owner@lists.freeradius.org">freeradius-users-owner@lists.freeradius.org</a><br><br>When replying, please edit your Subject line so it is more specific
<br>than "Re: Contents of Freeradius-Users digest..."<br><br><br>Today's Topics:<br><br> 1. Problem in EAP-TLS Authentication (Govardhana K N)<br> 2. Re: Quirky question about rewriting usernames (Pshem Kowalczyk)
<br> 3. Support for Cisco (ashish verma)<br> 4. Re: Support for Cisco (<a href="mailto:tnt@kalik.co.yu">tnt@kalik.co.yu</a>)<br> 5. Re: Support for Cisco (Peter Nixon)<br><br><br>----------------------------------------------------------------------
<br><br>Message: 1<br>Date: Thu, 19 Jul 2007 10:36:28 +0530<br>From: "Govardhana K N" <<a href="mailto:govardhan.nagarajaiah@gmail.com">govardhan.nagarajaiah@gmail.com</a>><br>Subject: Problem in EAP-TLS Authentication
<br>To: FreeRadius <<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>Message-ID:<br> <<a href="mailto:5f382300707182206k616c02f6ude7fb5e71976dbe9@mail.gmail.com">
5f382300707182206k616c02f6ude7fb5e71976dbe9@mail.gmail.com</a>><br>Content-Type: text/plain; charset="iso-8859-1"<br><br>Hi,<br><br>I was trying to configure EAP with TLS/TTlS. After enabling TLS/TTLS in "
<br>eap.conf", I tried sending an Radius Access-Request with EAP-Identitye<br>response. The Server is crashing becoz of segmentation fault. The debug lod<br>from the server is given below.<br><br>-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
<br>cheux301:/etc/freeradius# freeradius -X<br>Starting - reading configuration files ...<br>reread_config: reading radiusd.conf<br>Config: including file: /etc/freeradius/proxy.conf<br>Config: including file: /etc/freeradius/clients.conf
<br>Config: including file: /etc/freeradius/snmp.conf<br>Config: including file: /etc/freeradius/eap.conf<br>Config: including file: /etc/freeradius/sql.conf<br> main: prefix = "/usr"<br> main: localstatedir = "/var"
<br> main: logdir = "/var/log/freeradius"<br> main: libdir = "/usr/lib/freeradius:/usr/local/lib"<br> main: radacctdir = "/var/log/freeradius/radacct"<br> main: hostname_lookups = no<br> main: max_request_time = 30
<br> main: cleanup_delay = 5<br> main: max_requests = 1024<br> main: delete_blocked_requests = 0<br> main: port = 0<br> main: allow_core_dumps = no<br> main: log_stripped_names = yes<br> main: log_file = "/var/log/freeradius/radius.log"
<br> main: log_auth = no<br> main: log_auth_badpass = no<br> main: log_auth_goodpass = no<br> main: pidfile = "/var/run/freeradius/freeradius.pid"<br> main: bind_address = <a href="http://127.0.0.1">127.0.0.1</a>
IP address [<a href="http://127.0.0.1">127.0.0.1</a>]<br> main: user = "freerad"<br> main: group = "freerad"<br> main: usercollide = no<br> main: lower_user = "no"<br> main: lower_pass = "no"
<br> main: nospace_user = "no"<br> main: nospace_pass = "no"<br> main: checkrad = "/usr/sbin/checkrad"<br> main: proxy_requests = no<br> proxy: retry_delay = 5<br> proxy: retry_count = 3<br> proxy: synchronous = no
<br> proxy: default_fallback = yes<br> proxy: dead_time = 120<br> proxy: post_proxy_authorize = no<br> proxy: wake_all_if_all_dead = no<br> security: max_attributes = 200<br> security: reject_delay = 1<br> security: status_server = no
<br> main: debug_level = 0<br>read_config_files: reading dictionary<br>read_config_files: reading naslist<br>Using deprecated naslist file. Support for this will go away soon.<br>read_config_files: reading clients<br>
read_config_files: reading realms<br>radiusd: entering modules setup<br>Module: Library search path is /usr/lib/freeradius:/usr/local/lib<br>Module: Loaded exec<br> exec: wait = yes<br> exec: program = "(null)"
<br> exec: input_pairs = "request"<br> exec: output_pairs = "(null)"<br> exec: packet_type = "(null)"<br>rlm_exec: Wait=yes but no output defined. Did you mean output=none?<br>Module: Instantiated exec (exec)
<br>Module: Loaded expr<br>Module: Instantiated expr (expr)<br>Module: Loaded PAP<br> pap: encryption_scheme = "crypt"<br>Module: Instantiated pap (pap)<br>Module: Loaded CHAP<br>Module: Instantiated chap (chap)
<br>Module: Loaded MS-CHAP<br> mschap: use_mppe = yes<br> mschap: require_encryption = yes<br> mschap: require_strong = yes<br> mschap: with_ntdomain_hack = no<br> mschap: passwd = "(null)"<br> mschap: ntlm_auth = "(null)"
<br>Module: Instantiated mschap (mschap)<br>Module: Loaded System<br> unix: cache = no<br> unix: passwd = "/etc/passwd"<br> unix: shadow = "/etc/shadow"<br> unix: group = "/etc/group"<br> unix: radwtmp = "/var/log/freeradius/radwtmp"
<br> unix: usegroup = no<br> unix: cache_reload = 600<br>Module: Instantiated unix (unix)<br>Module: Loaded eap<br> eap: default_eap_type = "md5"<br> eap: timer_expire = 60<br> eap: ignore_unknown_eap_types = no
<br> eap: cisco_accounting_username_bug = no<br>rlm_eap: Loaded and initialized type md5<br>rlm_eap: Loaded and initialized type leap<br> gtc: challenge = "Password: "<br> gtc: auth_type = "PAP"<br>rlm_eap: Loaded and initialized type gtc
<br> tls: rsa_key_exchange = no<br> tls: dh_key_exchange = yes<br> tls: rsa_key_length = 512<br> tls: dh_key_length = 512<br> tls: verify_depth = 0<br> tls: CA_path = "(null)"<br> tls: pem_file_type = yes<br> tls: private_key_file = "/etc/freeradius/certs/cert-
srv.pem"<br> tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem"<br> tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem"<br> tls: private_key_password = "whatever"<br> tls: dh_file = "/etc/freeradius/certs/dh"
<br> tls: random_file = "/etc/freeradius/certs/random"<br> tls: fragment_size = 1024<br> tls: include_length = yes<br> tls: check_crl = yes<br> tls: check_cert_cn = "%{User-Name}"<br> tls: cipher_list = "DEFAULT"
<br> tls: check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd"<br>rlm_eap_tls: Loading the certificate file as a chain<br>rlm_eap: Loaded and initialized type tls<br> ttls: default_eap_type = "md5"
<br> ttls: copy_request_to_tunnel = no<br> ttls: use_tunneled_reply = no<br>rlm_eap: Loaded and initialized type ttls<br> mschapv2: with_ntdomain_hack = no<br>rlm_eap: Loaded and initialized type mschapv2<br>Module: Instantiated eap (eap)
<br>Module: Loaded preprocess<br> preprocess: huntgroups = "/etc/freeradius/huntgroups"<br> preprocess: hints = "/etc/freeradius/hints"<br> preprocess: with_ascend_hack = no<br> preprocess: ascend_channels_per_line = 23
<br> preprocess: with_ntdomain_hack = no<br> preprocess: with_specialix_jetstream_hack = no<br> preprocess: with_cisco_vsa_hack = no<br> preprocess: with_alvarion_vsa_hack = no<br>Module: Instantiated preprocess (preprocess)
<br>Module: Loaded realm<br> realm: format = "suffix"<br> realm: delimiter = "@"<br> realm: ignore_default = no<br> realm: ignore_null = no<br>Module: Instantiated realm (suffix)<br>Module: Loaded files
<br> files: usersfile = "/etc/freeradius/users"<br> files: acctusersfile = "/etc/freeradius/acct_users"<br> files: preproxy_usersfile = "/etc/freeradius/preproxy_users"<br> files: compat = "no"
<br>Module: Instantiated files (files)<br>Module: Loaded Acct-Unique-Session-Id<br> acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address,<br>Client-IP-Address"<br>Module: Instantiated acct_unique (acct_unique)
<br>Module: Loaded detail<br> detail: detailfile =<br>"/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"<br> detail: detailperm = 384<br> detail: dirperm = 493<br> detail: locking = no<br>Module: Instantiated detail (detail)
<br>Module: Loaded radutmp<br> radutmp: filename = "/var/log/freeradius/radutmp"<br> radutmp: username = "%{User-Name}"<br> radutmp: case_sensitive = yes<br> radutmp: check_with_nas = yes<br> radutmp: perm = 384
<br> radutmp: callerid = yes<br>Module: Instantiated radutmp (radutmp)<br>Listening on authentication <a href="http://127.0.0.1:1812">127.0.0.1:1812</a><br>Listening on accounting <a href="http://127.0.0.1:1813">127.0.0.1:1813
</a><br>Ready to process requests.<br>rad_recv: Access-Request packet from host <a href="http://127.0.0.1:32823">127.0.0.1:32823</a>, id=217, length=95<br> User-Name = "jrc"<br> NAS-Identifier = "jrcnas"
<br> NAS-Port-Type = Ethernet<br> CUI = "0"<br> Service-Type = Framed-User<br> Framed-MTU = 1400<br> Calling-Station-Id = "1:1:1:1:1:1"<br> Message-Authenticator = 0x2568987af6f31763f9199f8067fafee1
<br> EAP-Message = 0x02d20008016a7263<br> Processing the authorize section of radiusd.conf<br>modcall: entering group authorize for request 0<br>Segmentation fault<br>cheux301:/etc/freeradius#<br><br><br><br>-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
<br><br><br>--<br>Thanks & Regards,<br>Govardhana K N<br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <a href="https://lists.freeradius.org/pipermail/freeradius-users/attachments/20070719/d5a2969f/attachment-0001.html">
https://lists.freeradius.org/pipermail/freeradius-users/attachments/20070719/d5a2969f/attachment-0001.html</a><br><br>------------------------------<br><br>Message: 2<br>Date: Thu, 19 Jul 2007 17:59:54 +1200<br>From: "Pshem Kowalczyk" <
<a href="mailto:pshem.k@gmail.com">pshem.k@gmail.com</a>><br>Subject: Re: Quirky question about rewriting usernames<br>To: "FreeRadius users mailing list"<br> <<a href="mailto:freeradius-users@lists.freeradius.org">
freeradius-users@lists.freeradius.org</a>><br>Message-ID:<br> <<a href="mailto:20fe625b0707182259p75a26361pbb64b5e732a13886@mail.gmail.com">20fe625b0707182259p75a26361pbb64b5e732a13886@mail.gmail.com</a>><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br><br>Hi<br><br>On 19/07/07, Cliff Cole <<a href="mailto:clifflcole@gmail.com">clifflcole@gmail.com</a>> wrote:<br>> Hello all.<br>><br>> Here is my issue. This is very weird and would only affect one NAS.
<br>> I'm not sure freeradius is capable of this. I want a username that<br>> comes in to check for an @domainname. If the domainname is there I<br>> want it to be stripped and added back later. If the domainname is not
<br>> there I'd like it to continue and have to domainname added later in<br>> the authentication process. I hope this makes sense and any help is<br>> appreciated<br><br>What do you mean by 'later' you can definitely check for the presence
<br>of domain, you can strip it and add it again. you just have to define<br>the flow. rlm_attr will be of help to you (for both stripping and<br>adding).<br><br>kind regards<br>Pshem<br><br><br>------------------------------
<br><br>Message: 3<br>Date: Thu, 19 Jul 2007 14:33:13 +0530<br>From: "ashish verma" <<a href="mailto:ashish.scit@gmail.com">ashish.scit@gmail.com</a>><br>Subject: Support for Cisco<br>To: <a href="mailto:freeradius-users@lists.freeradius.org">
freeradius-users@lists.freeradius.org</a><br>Message-ID:<br> <<a href="mailto:11b554120707190203i158ebc5dx5313c650d3f0830f@mail.gmail.com">11b554120707190203i158ebc5dx5313c650d3f0830f@mail.gmail.com</a>><br>Content-Type: text/plain; charset="iso-8859-1"
<br><br>Hi all,<br><br>I am trying to configure "free radius" for some Cisco devices.<br>till now i am able to authenticate using the radius server and i am getting<br>into user level or privilege level depending on the attribute i am defining.
<br>Now what i am looking for is authorization.<br>There is something called "Cisco-AV priv" attribute through which one can<br>define privilege level from 1 to 15. But i am not able to define it in<br>"users file".
<br>Can anyone tell me how to define this or whether we can define this kind of<br>attribute in freeradius or not?<br><br>Thanks in advance,<br>Ashish<br>-------------- next part --------------<br>An HTML attachment was scrubbed...
<br>URL: <a href="https://lists.freeradius.org/pipermail/freeradius-users/attachments/20070719/17ebaf12/attachment-0001.html">https://lists.freeradius.org/pipermail/freeradius-users/attachments/20070719/17ebaf12/attachment-0001.html
</a><br><br>------------------------------<br><br>Message: 4<br>Date: Thu, 19 Jul 2007 10:14:49 +0100<br>From: <<a href="mailto:tnt@kalik.co.yu">tnt@kalik.co.yu</a>><br>Subject: Re: Support for Cisco<br>To: "FreeRadius users mailing list"
<br> <<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>Message-ID: <<a href="mailto:dGKlB4KJ.1184836489.7100930.tnt@kalik.co.yu">dGKlB4KJ.1184836489.7100930.tnt@kalik.co.yu
</a>><br>Content-Type: text/plain; charset=ISO-8859-2<br><br>Use proper format:<br><br>Cisco-AVPair = "priv-lvl=levelnumber"<br><br>Ivan Kalik<br>Kalik Informatika ISP<br><br><br>Dana 19/7/2007, "ashish verma" <
<a href="mailto:ashish.scit@gmail.com">ashish.scit@gmail.com</a>> pi?e:<br><br>>Hi all,<br>><br>>I am trying to configure "free radius" for some Cisco devices.<br>>till now i am able to authenticate using the radius server and i am getting
<br>>into user level or privilege level depending on the attribute i am defining.<br>>Now what i am looking for is authorization.<br>>There is something called "Cisco-AV priv" attribute through which one can
<br>>define privilege level from 1 to 15. But i am not able to define it in<br>>"users file".<br>>Can anyone tell me how to define this or whether we can define this kind of<br>>attribute in freeradius or not?
<br>><br>>Thanks in advance,<br>>Ashish<br>><br>><br><br><br><br>------------------------------<br><br>Message: 5<br>Date: Thu, 19 Jul 2007 12:20:04 +0300<br>From: Peter Nixon <<a href="mailto:listuser@peternixon.net">
listuser@peternixon.net</a>><br>Subject: Re: Support for Cisco<br>To: FreeRadius users mailing list<br> <<a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>
Message-ID: <<a href="mailto:200707191220.05789.listuser@peternixon.net">200707191220.05789.listuser@peternixon.net</a>><br>Content-Type: text/plain; charset="iso-8859-9"<br><br>On Thu 19 Jul 2007, ashish verma wrote:
<br>> Hi all,<br>><br>> I am trying to configure "free radius" for some Cisco devices.<br>> till now i am able to authenticate using the radius server and i am<br>> getting into user level or privilege level depending on the attribute i am
<br>> defining. Now what i am looking for is authorization.<br>> There is something called "Cisco-AV priv" attribute through which one can<br>> define privilege level from 1 to 15. But i am not able to define it in
<br>> "users file".<br>> Can anyone tell me how to define this or whether we can define this kind<br>> of attribute in freeradius or not?<br><br><a href="http://wiki.freeradius.org/Cisco#Per_User_Privilege_Level">
http://wiki.freeradius.org/Cisco#Per_User_Privilege_Level</a><br><br>--<br><br>Peter Nixon<br><a href="http://peternixon.net/">http://peternixon.net/</a><br><br><br>------------------------------<br><br>-<br>List info/subscribe/unsubscribe? See
<a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br><br><br>End of Freeradius-Users Digest, Vol 27, Issue 116<br>*************************************************<br></blockquote>
</div><br>