October 2005 - Freeradius-Users - lists.freeradius.org

client configuration via postgres in version 1.0.1
by Joel Bjerk 14 Oct '05

14 Oct '05

Is it possible to use the nas table for client information instead of clients.conf? I tried uncommenting readclients=yes in sql.conf but the server read the clients from clients.conf. Thanks, Joel

3 4

rlm_perl & %RAD_REPLY issue
by Max Lock 14 Oct '05

14 Oct '05

Hi Folks, trying to run version 1.0.4 on Debian sarge.. export LD_PRELOAD=/usr/lib/libperl.so.5.8; freeradius -X (to account for known debian weirdness) using rlm_perl like so... sub authorize { $RAD_REPLY{'Max-Total-Octets'} = "xxx6000000"; &log_request_attributes; &log_reply_attributes; &log_check_attributes; return RLM_MODULE_UPDATED; } and getting the following error on STDOUT... rlm_perl: ERROR: Failed to create pair Max-Total-Octets = 6000000 googled around, but can't see anything? other attribs in sql radgroupcheck table are working fine (also using rlm_sql). I took a look at the source code, but I'm not really a coder, and couldn't follow it too easily. However, all I can see is that the following is failing in rlm_perl.c vpp = pairmake(key, val, T_OP_EQ); if (vpp != NULL) { pairadd(vp, vpp); radlog(L_DBG, "rlm_perl: Added pair %s = %s", key, val); return 1; } else { radlog(L_DBG, "rlm_perl: ERROR: Failed to create pair %s = % s", key, val); } can anyone point me in the right direction? just going to try version 1.0.5 in the meantime :) -Thanks Max.

3 9

testing freeradius ports
by jean 14 Oct '05

14 Oct '05

Hi All, I am running freeradius 1.0.5, it seems to start with no errors and listens on the default ports 1812 1813, should I be able to telnet to these ports to check if it accepts connections on them?

3 2

Logging question
by Curt LeCaptain 14 Oct '05

14 Oct '05

Currently I'm using the mysql logging functions of FreeRADIUS and I'm logging two different things: Dial-up customers that log in with just their username (username) DSL Customers that log in with user at domain (username(a)domain.com) I'm wondering, how would I get it so that both log the same way, that is, just username, not the suffix @itol.com. Any advice would be great! Thanks, Curt LeCaptain

3 2

RE: IP address assignment
by Infusino, Michael - ADP Dataphile 14 Oct '05

14 Oct '05

Very nice. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:jmaimon@ttec.com] Sent: Thursday, October 13, 2005 11:41 PM To: FreeRadius users mailing list Subject: Re: IP address assignment Infusino, Michael - ADP Dataphile wrote: > I am using radius to authenticate access from VPN. > > > > Would anyone now how to record the IP address the user is assigned after > they log in. > > > > Michael How does a little dynamic dns strike you? Make sure to actualy read below and attached scripts and setup a DNS key. --------------radiusd.conf------------- ----modules section-------- exec ddns_update { wait = no program = "/usr/local/sbin/radius-dns-update.sh" input_pairs = request packet_type = Accounting-Request shell_escape = yes } ------------end modules---- ----instantiate section------- ddns_update -----------end section-------- _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

3 2

IP address assignment
by Infusino, Michael - ADP Dataphile 14 Oct '05

14 Oct '05

I am using radius to authenticate access from VPN. Would anyone now how to record the IP address the user is assigned after they log in. Michael _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

3 2

Using PAM to authenticate Radius auth requests with PEAP
by Joseph Silverman 14 Oct '05

14 Oct '05

A co-worker of mine here has been asking questions of the list today but I have some of my own. Namely, I don't know much about how Radius does it's magic, but unless I am completely off the bat here, it appears to me that some sort of channel is created between the Radius client and the server over which requests are sent. These requests include a user and a password and other information. The radius server will then compare the user and password to the ones in it's configured database and either authenticate or not. Unix passwords are encrypted through a one-way function and stored in a password file. These passwords can no longer be reversed back to their "clear text" format but it is possible to take a "clear text" user and password (from the radius client) and convert it to this format and compare the two thus matching, or not. I can imagine that PEAP, specifically, does the password encryption on the client and passes that on, using a similar but obviously not the same, one way encryption algorithm, thus requiring the radius server to have access to a clear text password which it would encrypt with the same key and algorithm in order to match to the one from the client. If this is the case, than I can readily see how it can never (never being a long time) be possible to use these sorts of passwords along with UNIX encrypted passwords. This is a darn shame, but if it is indeed the case, so be it. I am asking the list if this is the case or if the reason authentication isn't possible is a simple programming effort that hasn't been done. Also, given our setup: Client: Cisco Wireless AP (1200) Server: Linux running Freeradius What is the optimal means to provide maximum security and still be able to authenticate against the unix shadow password file? Thank you for your time - Yossie

2 1

Re: Microsoft SQL 2000 interface
by Duane Cox 13 Oct '05

13 Oct '05

http://www.freeradius.org/development.html#cvs ----- Original Message ----- From: "Cliff Hayes" <chayes(a)afo.net> To: "Duane Cox" <duanec(a)mail.illicom.net> Sent: Thursday, October 13, 2005 1:56 PM Subject: RE: Microsoft SQL 2000 interface > All, > > Please help with instructions on how to "download the CVS ver of freeradius" > mentioned below. I'm new to Linux. I know how to tar, configure, and make. > Don't know how to CVS. > > Cliff > > -----Original Message----- > From: Duane Cox [mailto:duanec@mail.illicom.net] > Sent: Wednesday, October 12, 2005 11:12 AM > To: Cliff Hayes > Subject: Re: Microsoft SQL 2000 interface > > > I've posted this a few times, so you can search the archives for my previous > email, or download the CVS ver of freeradius. > There is a file in the doc folder called mssql and in there is detailed info > for setting up MSSQL and FR. > I assume this file will be released into FR 1.0.6 > > I would read both my post in the email archives and read the doc in CVS. > > You will have to adjust your views to pull the correct data from platypus. > > But it is possible to do, yes. > > Duane Cox > > > ----- Original Message ----- > From: "Cliff Hayes" <chayes(a)afo.net> > To: "Duane Cox" <duanec(a)mail.illicom.net>; "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Wednesday, October 12, 2005 10:19 AM > Subject: RE: Microsoft SQL 2000 interface > > > > Duane, > > > > No, I don't know where to start in that department. I'm in the inquiry > > stage now. Just trying to find out if it can be done. Is there a HOW-TO > > file somewhere? I just loaded a box with a fresh copy of Fedora 4 and > > freeRadius. I've been tasked with replacing Radiator, and freeRadius is > the > > preferred path. This is my first stumbling block. > > > > Cliff > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Duane > > Cox > > Sent: Wednesday, October 12, 2005 9:15 AM > > To: FreeRadius users mailing list > > Subject: Re: Microsoft SQL 2000 interface > > > > > > Yes it can be done. > > > > Do you have freeradius talking to the MSSQL db yet? > > > > Duane Cox > > > > ----- Original Message ----- > > From: "Cliff Hayes" <chayes(a)afo.net> > > To: <freeradius-users(a)lists.freeradius.org> > > Sent: Wednesday, October 12, 2005 8:56 AM > > Subject: Microsoft SQL 2000 interface > > > > > > > All, > > > > > > Sorry to have to bring up the "M" word, but that's what we have - > > Microsoft > > > SQL 2000 interfacing with Platypus and Radiator. I searched the FAQ and > > > archives and found no reference to a Microsoft SQL interface. > > > > > > Can I populate my Microsoft SQL DB with freeRadius? If so, how? > > > > > > Thanks, > > > > > > Cliff > > > > > > - > > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > >

4 5

Packet of Disconnect
by Ashwin Gobind 13 Oct '05

13 Oct '05

Can freeradius handle a Disconnect Request (Attribute 40). If so how ? �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

3 3

Patch for Statistics page
by Matt Vollmar 13 Oct '05

13 Oct '05

I was having problems with the statistics page only displaying the from date and the to date, rather than all of the dates in between. Come to find out, the reason is that the wrong "date config" variable is used in stats.php3. You basically just change sql_date_format to sql_full_date_format. Here is what to change: Lines 35 and 36 should be: $before = date($config[sql_full_date_format], $now + 86400); $after = ($after != '') ? "$after" : date($config[sql_full_date_format], $now - 604800 ); If you don't want to change the code, change the variable "sql_date_format" to look like "sql_full_date_format" in the admin.conf. Hope this helps someone. Matt

1 0