December 2005 - Freeradius-Users - lists.freeradius.org

Help me configure freeradius
by thgjerde 14 Dec '05

14 Dec '05

This is what i whant to do: I have a wireless AP and and a linux server connected with a cat5 cable. I then have a number of diffrenet wireless users that should be able to talk to the linux server But they should not be able to listen in on each other. they should not need a password or certificates So what i was thinking about was to get freeradius to just allow all users to connect without checking for passwords and such. Any tips on how to do this?

1 0

Re: Freeradius-Users Digest, Vol 8, Issue 57
by Sean 14 Dec '05

14 Dec '05

Hi, I have written written a howto that explains how to setup FreeRadius and Chillispot here http://swarmhotspots.com/faq.html. If you need any help you will find contact details on the site. Regards, Sean Bracken

1 0

Proxying based on substring in username
by markcapelle＠pcmc.com 14 Dec '05

14 Dec '05

I am currently knee deep in an Active Directory domain collapse and need to figure out how to get FreeRADIUS to authenticate users as they are moved between domains. During the AD migration process users accounts are disabled in the source domain(where FreeRADIUS currently points) and enabled in the target domain. What I need to do is figure out a way to determine if a user has been moved and if they have, proxy the requests to the new domain. I see two possible ways to do this - 1 - If the user is in AD group "X" proxy the request 2 - If the username has string "m_", then remove the "m_" string and proxy the request My questions are these: which is the easiest to implement and how do I implement each? I have looked at rlm_attr_rewrite a bit and think this may be the module for the second situation. I have googled and searched the lists, unable to find anything of much help. CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of this message in whole or in part is strictly prohibited. Please inform the sender immediately and destroy the original transmittal. Thank you for your cooperation.

1 0

Authenticate users for a hotel through webpage?
by mfred 14 Dec '05

14 Dec '05

Hi, maybe someone can point me to the right direction as it seems I use wrong keywords for my search in the list and on google. I am trying to use freeradius with wlan to authenticate hotel guests that need i-net access. They would prefer that the customer could visit a webpage entering the username / password combination they got at hotel-reception. Would this be a authentication methode which freeradius can handle or do I have to use other authentication modules for such a purpose? The most important thing is: Easy to use for the hotel staff at registering / deleting guests and easy to use for the guests at login. TIA and br, mfred

6 6

rlm_ldap.so not found, Freeradius 1.0.5
by Christophe Gravier 14 Dec '05

14 Dec '05

First, Hello to the mailing ! ;-) I installed freeradius on a fresh debian etch (testing) machine. ( FreeRADIUS Version 1.0.5 as it is package in debian etch tree ). I want my radius being able to authenticate users against an external LDAP source. So I think I've made the right changes (in particular, I modified the /etc/freeradius/radiusd.conf), but when I launch the freeradius server, I received: Wed Dec 14 14:23:36 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Dec 14 14:23:36 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Dec 14 14:23:36 2005 : Error: radiusd.conf[724] Failed to link to module 'rlm_ldap': rlm_ldap.so: cannot open shared object file: No such file or directory Hummm, I don't think it'll work as it is :) I have search for rlm_ldap.so, I have no such library in my /usr/lib/freeradius/ directory (there I've got stuff for mysql and so on). I have try the achieve mailing list and googling, but there's just questions and so few answers .... Does anyone could enventually point me a clue please ? Or a link to the howto he followed for freeradius using ldap ? Best regards, -- Christophe Gravier Laboratoire DIOM, groupe SATIn - Doctorant ISTASE - Ingénieur d'études Perso: http://perso.univ-st-etienne.fr/gravchri/ SATIn: http://www.istase.com/satin Tel : 04 7748 5034 A mediter: http://www.fsffrance.org/news/article2005-11-25.fr.html

2 2

rlm_ldap.so not found, Freeradius 1.0.5
by Christophe Gravier 14 Dec '05

14 Dec '05

First, Hello to the mailing ! ;-) I installed freeradius on a fresh debian etch (testing) machine. ( FreeRADIUS Version 1.0.5 as it is package in debian etch tree ). I want my radius being able to authenticate users against an external LDAP source. So I think I've made the right changes (in particular, I modified the /etc/freeradius/radiusd.conf), but when I launch the freeradius server, I received: Wed Dec 14 14:23:36 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Dec 14 14:23:36 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Dec 14 14:23:36 2005 : Error: radiusd.conf[724] Failed to link to module 'rlm_ldap': rlm_ldap.so: cannot open shared object file: No such file or directory Hummm, I don't think it'll work as it is :) I have search for rlm_ldap.so, I have no such library in my /usr/lib/freeradius/ directory (there I've got stuff for mysql and so on). I have try the achieve mailing list and googling, but there's just questions and so few answers .... Does anyone could enventually point me a clue please ? Or a link to the howto he followed for freeradius using ldap ? Best regards, -- Christophe Gravier Laboratoire DIOM, groupe SATIn - Doctorant ISTASE - Ingénieur d'études Perso: http://perso.univ-st-etienne.fr/gravchri/ SATIn: http://www.istase.com/satin Tel : 04 7748 5034 A mediter: http://www.fsffrance.org/news/article2005-11-25.fr.html

1 0

RE: Two routers using the same Radius server?
by Jonathan De Graeve 14 Dec '05

14 Dec '05

Client ip adres in combination with huntgroups if you work with a mysql db and usergroups -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Mark Tunnell Verzonden: woensdag 14 december 2005 1:59 Aan: FreeRadius users mailing list Onderwerp: Re: Two routers using the same Radius server? Nice! That gets me almost all the way there. I'm able to authenticate using Auth-Type := Local. Now I just need to figure out how to authenticate that type of user name (user@realm) using Auth-Type := System. Any ideas how to go about that? Thanks, Mark Lewis Bergman wrote: > Mark Tunnell wrote: > >> Suppose I have two Cisco routers both configured to authenticate to >> the same radius server. How do I allow a particular user access to >> one router but not the other? Is there a place in the clients.conf or >> users file to configure this? >> > Oh yea, Alan gave me a trick with the hints file that adds a realm to a > client if one is not present that could also help. > DEFAULT User-Name !~ ".*@", NAS-IP-Address == "ip of client" > User-Name := "%{User-name}(a)realmtoadd.com" > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

anybody installed freeradius-1.0.5 on Solaris 8 successfully?
by Qin Zhen 14 Dec '05

14 Dec '05

Hello All, seems solaris 8 and freeradius-1.0.5 dont like each other.. after i installed it, it gave segmentation fault when i tried to run it. anybody has installed and run it successfully on solaris 8? cheers, QZ

2 1

Memory big problem
by Dmitry V. Pleganoff 13 Dec '05

13 Dec '05

And to you thanks. Can i offer small patch for realization of comparison (!~) in rlm_checkval? --- rlm_checkval.c 2005-12-14 03:38:08.000000000 +1000 +++ rlm_checkval.c.patched 2005-12-14 10:15:59.000000000 +1000 @@ -208,6 +208,7 @@ VALUE_PAIR *chk_vp, *item_vp; VALUE_PAIR *tmp; char found = 0; + int opflag = T_OP_REG_EQ; /* quiet the compiler */ instance = instance; @@ -244,6 +245,9 @@ * Check if item != check */ found = 1; + + opflag = chk_vp->operator; + if (data->dat_type == PW_TYPE_STRING || data->dat_type == PW_TYPE_OCTETS) { if (item_vp->length != chk_vp->length) @@ -266,12 +270,18 @@ } #ifdef HAVE_REGEX_H if (ret == RLM_MODULE_REJECT && - chk_vp->operator == T_OP_REG_EQ) { + (chk_vp->operator == T_OP_REG_EQ || + chk_vp->operator == T_OP_REG_NE)) { regex_t reg; int err; char err_msg[MAX_STRING_LEN]; - DEBUG("rlm_checkval: Doing regex"); + if (opflag == T_OP_REG_EQ) { + DEBUG("rlm_checkval: Doing regex (=~)"); + } else { + DEBUG("rlm_checkval: Doing regex (!~)"); + } + err = regcomp(&reg, (char *)chk_vp->vp_strvalue, REG_EXTENDED|REG_NOSUB); if (err){ regerror(err, &reg,err_msg, MAX_STRING_LEN); @@ -289,6 +299,14 @@ } while (ret == RLM_MODULE_REJECT && tmp != NULL); + if (opflag == T_OP_REG_NE) { + if (ret == RLM_MODULE_OK) + ret = RLM_MODULE_REJECT; + else + if (ret == RLM_MODULE_REJECT) + ret = RLM_MODULE_OK; + } + if (ret == RLM_MODULE_REJECT) { if (!item_vp && data->notfound_reject){ char module_fmsg[MAX_STRING_LEN];

1 0

Two routers using the same Radius server?
by Mark Tunnell 13 Dec '05

13 Dec '05

Suppose I have two Cisco routers both configured to authenticate to the same radius server. How do I allow a particular user access to one router but not the other? Is there a place in the clients.conf or users file to configure this? Thanks, Mark

3 7