<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><div><br></div>Hi Alan,<div>Thank you for your help. I've already run the radtest command as a regular user using debugging mode and I had this issue </div><div><br></div><div>: $radclient: dict_init: Couldn't open dictionary "/usr/local/etc/raddb/dictionary" : Permission denied .</div><div><span style="font-size: 12pt;"><br></span></div><div><span style="font-size: 12pt;">But I couldn't get any solution. That's why I went to run the radtest command as a root user. </span></div><div>I want to known how to solve it as a regular user.</div><div><br></div><div><br></div><div>With regards,</div><div> Christian. </div><br><div><hr id="stopSpelling">From: hangi_chris@hotmail.com<br>To: freeradius-users@lists.freeradius.org<br>Subject: RE: Freeradius-Users Digest, Vol 107, Issue 36<br>Date: Tue, 11 Mar 2014 01:52:00 +0000<br><br>
<div dir="ltr">
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Hi Alan,<div>Thank you for your help. I've already run the radtest command as a regular user using debugging mode and I had this issue : $radclient: dict_init: Couldn't open dictionary "etc/raddb/dictionary" : Permission denied . I want to know how to solve this problem. </div><div><br></div><div>With regards,</div><div> Christian. </div><div> <br><br><div>> From: freeradius-users-request@lists.freeradius.org<br>> Subject: Freeradius-Users Digest, Vol 107, Issue 36<br>> To: freeradius-users@lists.freeradius.org<br>> Date: Mon, 10 Mar 2014 09:56:18 +0100<br>> <br>> Send Freeradius-Users mailing list submissions to<br>> freeradius-users@lists.freeradius.org<br>> <br>> To subscribe or unsubscribe via the World Wide Web, visit<br>> http://lists.freeradius.org/mailman/listinfo/freeradius-users<br>> or, via email, send a message with subject or body 'help' to<br>> freeradius-users-request@lists.freeradius.org<br>> <br>> You can reach the person managing the list at<br>> freeradius-users-owner@lists.freeradius.org<br>> <br>> When replying, please edit your Subject line so it is more specific<br>> than "Re: Contents of Freeradius-Users digest..."<br>> <br>> <br>> Today's Topics:<br>> <br>> 1. Authentication on the basis of circuit id and not mac address<br>> (Mahima Kumar)<br>> 2. Authorise based on Calling Station ID ? (Darren Ward (darrward))<br>> 3. Testing an access-request user without the debugging mode<br>> (Hangi Christian)<br>> 4. Re: Testing an access-request user without the debugging mode<br>> (A.L.M.Buxey@lboro.ac.uk)<br>> <br>> <br>> ----------------------------------------------------------------------<br>> <br>> Message: 1<br>> Date: Sun, 9 Mar 2014 08:51:51 -0600<br>> From: Mahima Kumar <mahima@ualberta.ca><br>> To: freeradius-users@lists.freeradius.org<br>> Subject: Authentication on the basis of circuit id and not mac address<br>> Message-ID:<br>> <CADOyXPg+1pxy90Dur+Pf6MxmJt3TBUHuo5oyuJvwA_y04uappw@mail.gmail.com><br>> Content-Type: text/plain; charset="iso-8859-1"<br>> <br>> Hi ,<br>> <br>> I have used an Alcatel router as relay agent which gives the circuit id and<br>> i can see that in the radius debug output, so the client is getting<br>> authenticated on the basis of mac address and is getting the ip address<br>> from the Dhcp server , now i want to authenticate the client based on the<br>> circuit id provided by the relay agent in between, but the radius server<br>> doesn't accept username as circuit id, it only authenticates based on mac<br>> address of the client(i tried changing the users file), so can anyone<br>> please guide me as to what changes i have to make for this to be possible.<br>> <br>> TIA<br>> <br>> <br>> Regards,<br>> Mahima<br>> -------------- next part --------------<br>> An HTML attachment was scrubbed...<br>> URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20140309/c97c6465/attachment-0001.html><br>> <br>> ------------------------------<br>> <br>> Message: 2<br>> Date: Mon, 10 Mar 2014 01:57:23 +0000<br>> From: "Darren Ward (darrward)" <darrward@cisco.com><br>> To: "freeradius-users@lists.freeradius.org"<br>> <freeradius-users@lists.freeradius.org><br>> Subject: Authorise based on Calling Station ID ?<br>> Message-ID:<br>> <5D5ED6338DFDB54B8E876331223AEE2D1F88B009@xmb-rcd-x10.cisco.com><br>> Content-Type: text/plain; charset="us-ascii"<br>> <br>> Hi All<br>> <br>> I have a two box wifi solution where the controller performs dot1x/EAP authentication of the end user then a policy management box that sits behind that implements appropriate QoS and traffic policies to the users traffic<br>> <br>> Of course the Authen part is easy as it's just the normal username/password in users<br>> <br>> The Author is a little bit trickier and I was interested in some opinions on how to resolve...<br>> <br>> Basically the policy manager uses the mac address to authorise the device<br>> <br>> The mac address was sent by the wifi controller as the calling-station-id but the question is how do I match that field against the user to authorise them?<br>> <br>> Darren<br>> <br>> -------------- next part --------------<br>> An HTML attachment was scrubbed...<br>> URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20140310/78452ee0/attachment-0001.html><br>> <br>> ------------------------------<br>> <br>> Message: 3<br>> Date: Mon, 10 Mar 2014 06:33:12 +0000<br>> From: Hangi Christian <hangi_chris@hotmail.com><br>> To: "freeradius-users@lists.freeradius.org"<br>> <freeradius-users@lists.freeradius.org><br>> Subject: Testing an access-request user without the debugging mode<br>> Message-ID: <DUB118-W18FF7A0914B285CD495FAB9A740@phx.gbl><br>> Content-Type: text/plain; charset="iso-8859-1"<br>> <br>> <br>> <br>> <br>> <br>> <br>> <br>> Hello Guys,<br>> <br>> I am new in Freeradius server and also in linux and I need your help regarding the functionality of the server. I am currently using freeradius version 2.2.3 and my desktop computer is running the CentOS 6.4 linux operating. First of all, I've downloaded the uncompressed freeradius software package (freeradius-server-2.2.3.tar) from the freeradius website: http://www.freeradius.org from source code in the tar format. Then after I had to create a folder using CentOS linux in order to the freeradius server source code package to the folder, uncompressed and installed on the computer. After copied to the folder, I used the tar commands to uncompress the source code package and install it on the computer using #./configure, #make and #make install commands from the INSTALL file of the uncompressed server package. After installed, the configurations files of the RADIUS SERVER were found under /usr/local/etc/raddb directory path.<br>> i tested the server on the debugging mode using radiusd -X and at the end of the output i saw this line " Ready to process requests".<br>> <br>> I have first created a user inside the users file and I did the normal default testing with the debugging mode and the user was accepted. After that i change the clients.conf file putting my shared key and the IP Address of the switch and also configure ssh on the server side <br>> <br>> I have done the AAA , Radius and SSH configurations on the switch, then I used Putty on another computer to access to the server by putting the IP address of the switch . <br>> <br>> Is this the right way to access the server ? <br>> i ran the debugging mode on the server and try to access using putty on another PC .<br>> here is the result i got this :<br>> rad_recv: Accounting-Request packet from host 192.168.9.26 port 5001, id=151, length=122<br>> User-Name = "testing"<br>> NAS-Identifier = "002389550a92"<br>> NAS-Port = 16781313<br>> NAS-Port-Type = Ethernet<br>> Calling-Station-Id = "0000-0000-0000"<br>> Acct-Status-Type = Start<br>> Acct-Authentic = RADIUS<br>> Acct-Session-Id = "1100030205009"<br>> Framed-IP-Address = 192.168.9.25<br>> NAS-IP-Address = 192.168.9.26<br>> Event-Timestamp = "Apr 2 2000 12:00:06 ICT"<br>> Service-Type = Login-User<br>> # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default<br>> +group preacct {<br>> ++[preprocess] = ok<br>> [acct_unique] Hashing 'NAS-Port = 16781313,NAS-Identifier = "002389550a92",NAS-IP-Address = 192.168.9.26,Acct-Session-Id = "1100030205009",User-Name = "testing"'<br>> [acct_unique] Acct-Unique-Session-ID = "6ff6addd9c912e31".<br>> ++[acct_unique] = ok<br>> [suffix] No '@' in User-Name = "testing", looking up realm NULL<br>> [suffix] No such realm "NULL"<br>> ++[suffix] = noop<br>> ++[files] = noop<br>> +} # group preacct = ok<br>> # Executing section accounting from file /usr/local/etc/raddb/sites-enabled/default<br>> +group accounting {<br>> [detail] expand: %{Packet-Src-IP-Address} -> 192.168.9.26<br>> [detail] expand: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/192.168.9.26/detail-20140310<br>> [detail] /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.9.26/detail-20140310<br>> [detail] expand: %t -> Mon Mar 10 13:12:05 2014<br>> ++[detail] = ok<br>> ++[unix] = ok<br>> ++[exec] = noop<br>> [attr_filter.accounting_response] expand: %{User-Name} -> testing<br>> attr_filter: Matched entry DEFAULT at line 12<br>> ++[attr_filter.accounting_response] = updated<br>> +} # group accounting = updated<br>> Sending Accounting-Response of id 151 to 192.168.9.26 port 5001<br>> Finished request 1.<br>> Cleaning up request 1 ID 151 with timestamp +122<br>> Going to the next request<br>> Waking up in 4.9 seconds.<br>> Cleaning up request 0 ID 10 with timestamp +122<br>> Ready to process requests.<br>> <br>> then i stopped the debugging mode. and run the server using this commands<br>> <br>> [root@chris raddb]# service radiusd restart<br>> Stopping radiusd: [ OK ]<br>> Starting radiusd: [ OK ]<br>> <br>> on the user's PC side i got access denied and the server does not report on the radius.log file .<br>> please help me and also correct me where ever i went wrong.<br>> <br>> With Regards,<br>> Chris<br>> <br>> <br>> <br>> <br>> <br>> <br>> -------------- next part --------------<br>> An HTML attachment was scrubbed...<br>> URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20140310/9cc417f8/attachment-0001.html><br>> <br>> ------------------------------<br>> <br>> Message: 4<br>> Date: Mon, 10 Mar 2014 08:55:51 +0000<br>> From: A.L.M.Buxey@lboro.ac.uk<br>> To: FreeRadius users mailing list<br>> <freeradius-users@lists.freeradius.org><br>> Subject: Re: Testing an access-request user without the debugging mode<br>> Message-ID: <20140310085551.GA1959@lboro.ac.uk><br>> Content-Type: text/plain; charset=us-ascii<br>> <br>> Hi,<br>> <br>> > Stopping radiusd: [ OK ]<br>> > Starting radiusd: [ OK ]<br>> > <br>> > on the user's PC side i got access denied and the server does not report<br>> > on the radius.log file .<br>> > please help me and also correct me where ever i went wrong.<br>> <br>> if everything works fine in the full debug mode, then the problem when running<br>> as a service is either a file permissions issue (since when you ran in debug<br>> mode things got written as 'root' user...now its trying to run as a non priv<br>> task - check the files its trying to write/access - AND check what the server says when<br>> run in foreground mod e(not full debug, just not as a background daemon).<br>> <br>> another issue may be eg SELinux - are you running selines ('getenforce' output will<br>> say Enforcing) - it may be that you need to use SELinux policy tools to allow certain<br>> things (wondering why you arent using the FreeRADIUS that comes as part of your distro<br>> in these early days of testing/getting familiar?) - you can validate this by temporarily<br>> turning off SELinux 'setenforce 0' - to see what happens<br>> <br>> alan<br>> <br>> <br>> ------------------------------<br>> <br>> -<br>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<br>> <br>> End of Freeradius-Users Digest, Vol 107, Issue 36<br>> *************************************************<br></div></div></div>
</div></div> </div></body>
</html>