- Freeradius-Devel - lists.freeradius.org

Authentication
by Scott Pinhorne 09 Feb '09

09 Feb '09

Good Morning I am receiving authentication requests from clients GPRS devices. The problem I have is the user/pass are not unique only the call-station-id is so I need to have free radius client authenticate on calling-station-id and not take in to account the user/pass. So if the calling-station-id matches the request I would like to then return the appropriate information. I am using MySQL to authenticate. Any pointers would be appreciated. Example Request Access-Request packet from host 192.168.71.1:4358, id=172, length=118 NAS-IP-Address = 192.168.71.1 NAS-Identifier = "GRN-J20" Called-Station-Id = "domain.com" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual User-Name = "void" User-Password = "void" Calling-Station-Id = "4412345678912" 3GPP-IMSI-MCC-MNC = "12345" Best Regards Scott Pinhorne Tel: 0845 862 0371 http://www.voxit.co.uk <http://www.voxit.co.uk> P Please consider the environment before printing this email. PRIVACY AND CONFIDENTIALITY NOTICE The information in this email is for the named addressee only. As this email may contain confidential or privileged information if you are not, or suspect that you are not, the named addressee other person responsible for delivering the message to the named addressee, please contact us immediately. Please note that we cannot guarantee that this message has not been intercepted and amended. The views of the author may not necessarily reflect those of VoxIT Ltd. VIRUS NOTICE The contents of any attachment may contain software viruses, which could damage your own computer. While VoxIT Ltd has taken reasonable precautions to minimise the risk of software viruses, it cannot accept liability for any damage, which you may suffer as a result of such viruses. We recommend that you carry out your own virus checks before opening any attachment. -- This message has been scanned for viruses and dangerous content by VOXIT Limited, and is believed to be clean.

1 0

Re: Authentication
by Scott Pinhorne 09 Feb '09

09 Feb '09

Thank you for contacting VoxIT Limited If your email is with regards to support of any kind please resend your email to: support(a)voxit.co.uk A ticket will be automatically created and the ID sent to you by return However if this is not support related I will reply as soon as possible but if your email is urgent please call us on: 0845 862 0371 Many Thanks

1 0

..::Dictionary::..
by Alfonso Reyes 09 Feb '09

09 Feb '09

Hi list Im trying to setup the connection to our 3com 3012 router to handle the connections, it has the following instructions that I dont fully understand could you please help me? Create a user on the Radius Server "admin" DONE Under "return list attributes" tab select "Ins" WHATS THIS? Scroll the attribute list for "User-Privilege" (this should now be listed if the dictionary file was successfully edited and loaded per Radius Server instructions) AND THIS? Select "User-Privilege" attribute, then "Admin" then select the "add" button WE DONT HAVE THAT BUTTON. The thing here is that I think that the server they are talking about is a Microsoft based or something like that, but Im not sure if I have to do something else with the freeradius right now I have the username and the password, The values of the router are on the dictionary file. Heres all the information about it. Solution ID: 3KB10331 Router 3000/5000 Series - Admin Login with Radius Authentication Problem: How to configure Radius Fix: To login to a 3Com Router using Radius Authentication perform the following: On the Radius server edit the Radius Server Dictionary file and add the lines below (refer to you Radius Server manual for details) ATTRIBUTE User-Privilege 107 integer VALUE User-Privilege Guest 0 VALUE User-Privilege Operator 1 VALUE User-Privilege Admin 2 Create a user on the Radius Server "admin" Under "return list attributes" tab select "Ins" Scroll the attribute list for "User-Privilege" (this should now be listed if the dictionary file was successfully edited and loaded per Radius Server instructions) Select "User-Privilege" attribute, then "Admin" then select the "add" button On the 3Com Router execute the following commands [Router_5231]local-user admin service-type administrator password simple admin local user database entry in the event Radius Servers are unavailable [Router_5231]radius server 10.210.2.250 IP Address of the Radius Server [Router_5231]radius shared-key 1234abcd Radius Server shared secret [Router_5231]aaa-enable Enable AAA Authentication, Authorization and Accounting [Router_5231]aaa authentication-scheme login default radius local Configures the Router to authenticate login via Radius first then the local user database Any Ideas? Thanks for your help

2 1

GIT Log for 2009-02-04 00:33 GMT
by aland＠deployingradius.com 04 Feb '09

04 Feb '09

commit 8ce15abf9d56ce2d535fb0b95d8672d2f3ba8aa8 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 3 15:15:03 2009 +0100 Corrected typo. Noted by Chris Moules Files changed: man/man5/unlang.5 | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit a00afbdb8ac20729fa5826daeb992f0ede0c89da Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 3 14:39:41 2009 +0100 Fixed name Files changed: src/modules/rlm_smsotp/rlm_smsotp.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 7563be4618ae362ebf7ea039bc8f173b7f4f303a Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 3 14:33:53 2009 +0100 Note issue as reported in bug #622 Files changed: src/main/listen.c | 6 +----- 1 files changed, 1 insertions(+), 5 deletions(-) ====================================================================== commit 55f2dea1d9fc8ff709fb3f5f93835fb9fbff42c3 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 3 14:33:29 2009 +0100 Free insthandle if there's no detach function Files changed: src/main/modules.c | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) ====================================================================== commit 7293ef685d6d3495f6eac973b72a0efe13522627 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 3 14:22:03 2009 +0100 Cleaned up source code && updated "configure" Files changed: raddb/modules/smsotp | 50 - src/modules/rlm_smsotp/Makefile.clean | 11 + src/modules/rlm_smsotp/Makefile.in | 26 + src/modules/rlm_smsotp/config.h.in | 9 +- src/modules/rlm_smsotp/configure | 4069 ++++++++++++++++----------------- src/modules/rlm_smsotp/configure.in | 19 +- src/modules/rlm_smsotp/rlm_smsotp.c | 960 ++++---- src/modules/rlm_smsotp/rlm_smsotp.h | 68 +- 8 files changed, 2508 insertions(+), 2704 deletions(-) ====================================================================== commit 8861e30f07aa2360c4a4ddbd6654969b89ea8753 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 3 11:26:34 2009 +0100 New module as supplied by Siemens Files changed: src/modules/rlm_smsotp/Makefile.clean | 11 - src/modules/rlm_smsotp/Makefile.in | 37 - src/modules/rlm_smsotp/config.h.in | 52 - src/modules/rlm_smsotp/configure | 4312 --------------------------------- src/modules/rlm_smsotp/configure.in | 51 - src/modules/rlm_smsotp/rlm_smsotp.c | 480 ---- src/modules/rlm_smsotp/rlm_smsotp.h | 34 - 7 files changed, 0 insertions(+), 4977 deletions(-) ====================================================================== commit 690bfc454caf94b165b17084c6a11c546261613e Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Feb 3 10:54:32 2009 +0100 Revert "Change default hash function to SHA1. MD5 is broken." This reverts commit 340f01028f6f2dc8fa18336c9448f2787fc8de0f. However, many versions of OpenSSL don't include SHA support, so doing this would break the default install. <sigh> Files changed: raddb/certs/ca.cnf | 2 +- raddb/certs/client.cnf | 2 +- raddb/certs/server.cnf | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) ======================================================================

1 0

unlang parsing
by Chris Moules 03 Feb '09

03 Feb '09

I have just come across an oddity in the unlang parsing. I though that I had some form of logic error, but it turned out to be white space. I had some unlang code, like the following: --- if (condition) { update control { Attrib1 := "value1" } } else { update control { Attrib2 := "value2" } } --- Starting FreeRADIUS in debug gave me the error: --- /etc/freeradius/sites-enabled/radius3[91]: Too many closing braces Errors reading /etc/freeradius/radiusd.conf --- Restructuring the code the to following, however, works fine. --- if (condition) { update control { Attrib1 := "value1" } } else { update control { Attrib2 := "value2" } } --- The difference is just the newline after the closing 'if' brace. I had a look for this being mentioned in the man page but did not see anything, except my previous micro-patch. If this known and/or documented? Chris

2 1

Man page fix for unlang
by Chris Moules 03 Feb '09

03 Feb '09

There is a logic error in the unlang man page. I was just reading this: --- Operators The operator used to assign the value of the attribute may be one of the following, with the given meaning. = Add the attribute to the list, if and only if an attribute of the same name is already present in that list. := Add the attribute to the list. If any attribute of the same name is already present in that list, its value is replaced with the value of the current attribute. --- I was fairly sure that the '=' operator only assigned if the value is NOT set. I checked the docs on the wiki (http://wiki.freeradius.org/Operators) which states this. Below a quick patch. Chris --- freeradius-server-2.1.3/man/man5/unlang.5 2008-12-05 16:37:56.000000000 +0000 +++ freeradius-server-2.1.3.fix/man/man5/unlang.5 2009-02-03 13:35:18.157287116 +0000 @@ -530,7 +530,7 @@ .RS .IP = Add the attribute to the list, if and only if an attribute of the same -name is already present in that list. +name is not already present in that list. .IP := Add the attribute to the list. If any attribute of the same name is already present in that list, its value is replaced with the value of

2 1

..::Multiple Devices::..
by Ing. Alfonso Reyes 03 Feb '09

03 Feb '09

Hi List. I'm new to the radius Server, We want to use the radius for all the connections on our network, the thing is that we want to allow a group of users to a group of access points, and use the same radius to control our vpn connections. As far as I understand if we allow anyone on the radius, it will be allowed on all the devices. The question is: Is there a way to limit the users connections to some devices? Thanks for your advice; We look forward to read your answer. Have a great day. Alfonso

2 1

GIT Log for 2009-02-03 00:33 GMT
by aland＠deployingradius.com 03 Feb '09

03 Feb '09

commit 1fba1996886e7cf8188bea59c0f109a763bbc757 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 2 10:47:40 2009 +0100 Expose more functions Based on a patch from Chris Moules Files changed: src/modules/rlm_sql/rlm_sql.c | 3 --- src/modules/rlm_sql/rlm_sql.h | 3 --- src/modules/rlm_sqlippool/rlm_sqlippool.c | 14 +++++++------- 3 files changed, 7 insertions(+), 13 deletions(-) ====================================================================== commit eb3ace511ada30c450c030baa3a511cefb0cf299 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Feb 2 10:31:04 2009 +0100 Load anonymous pools by type, not hard-coded to CoA Files changed: src/main/realms.c | 35 +---------------------------------- 1 files changed, 1 insertions(+), 34 deletions(-) ======================================================================

1 0

Freeradius support RFC4590?
by kevinf 02 Feb '09

02 Feb '09

Hi all now I am using freeradius for SIP-inbound authentication. my SIP proxy support RFC4590 authenticaiton . does Freeradius support RFC4590 ? any config example ? Regards Kevin

2 5

GIT Log for 2009-02-02 00:33 GMT
by aland＠deployingradius.com 02 Feb '09

02 Feb '09

commit 9b99e767c9a8581f3b610e8664dfe5a243853df9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 1 19:13:37 2009 +0100 Updated copyright date Files changed: src/main/version.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 9b38cac1da78da9d7ba2eb655aa359e94c07068d Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 1 19:13:06 2009 +0100 Updates for 2009 Files changed: COPYRIGHT | 27 +++++++++++++++++---------- 1 files changed, 17 insertions(+), 10 deletions(-) ====================================================================== commit 1ae2aef6ef375bfe1200262b8bdb41705919de64 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Feb 1 09:21:59 2009 +0100 Don't dereference request->process until request is set Files changed: src/modules/frs_proxy/frs_proxy.c | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-) ======================================================================

1 0