June 2005 - Freeradius-Users - lists.freeradius.org

restricting access for users
by Martial VdB 17 Jun '05

17 Jun '05

Hi there, Im a newby here so forgive if I ask obvious questions. Im trying to setup, wel actually I did setup FreeRADIUS Version 1.0.2 on a Linux Debian machine and it is working fine :) But I need to achieve the following setup: We have # cisco routers and switches who are locally managed by on site engineers. So these local engineers have to be able to log in to their devices and not be allowed to log in to devices on other sites. Next to these different site engineers there is a group called NOC. The NOC engineers need to access all devices on all sites. Ive tried several setups by using the huntgroups and using system as authentication method but I can't get the huntgroup validation to work. It looks like the huntgroups are just ignored. Everyone can just enter any device as soon as their usrname and password is matched on the system. Did someone do a similar setup where users where restricted and with a general group that needs access everywhere or can someone tell me how I should take this on. It should be fairly easy I thought Thanks for your help, it is highly appreciated, Martial _________________________________________________________________ Free blogging with MSN Spaces http://spaces.msn.com/?mkt=nl-be

3 5

Re: Radius attributes necessary for PPP connection into Cisco modem-bank
by Mike Partyka 17 Jun '05

17 Jun '05

On Jun 16, 2005, at 1:29 PM, Alan DeKok wrote: > You are trying to authenticate a modem connection... which means you > can't use it until it's authenticated. Which means you can't use it > to get data from the other end to do the authentication. > > Maybe I'm confused by your description, but what you described is > impossible Let me take another stab at describing it and maybe it'll help. The modem dials out to the Cisco modem bank, the modem bank (i am guessing here, as i am not this far) is configured to authenticate against Radius. Radius is configured to talk to Mysql and uses a query that checks the username/password, based on the exit status it accepts or denies the connection request to the modem. As i said my PPP knowledge is weak, but isn't what i described part of the PAP/CHAP handshake process that Radius is configured to use? Please correct me if i am mistaken. Thanks,

3 3

Freeradius Mysql
by synackrst 16 Jun '05

16 Jun '05

Hello, I have freeradius + mysql plus rlm_sqlcounter. And chillispot for wireless captive portal. The connection to mysql is ok. I create users in mysql databases, but running radius in debug mode, I can see the always "Access-Rejected of id 0 to 127.0.0.1" when I make a test with "radtest". So.. chillispot users don't login in wireless lan. Any suggestions? Thank you Regards, Paulo Leitao

2 2

FW: freeradius accounting
by james 16 Jun '05

16 Jun '05

Hi One question, when A call B at the start record, the calling_station_id is A, called_station_id is B. When the call ends, B hung up first, then at the stop record, the calling_station_id should be B or A? Thanks James

1 0

FW: radwho
by james 16 Jun '05

16 Jun '05

Hi, When run radwho, it only display the last user to log on. Why? Best regards, James

1 0

load balancing
by Lucas Aimaretto 16 Jun '05

16 Jun '05

Hi all, Is it possible to have freeradius as a proxy, but also, doing some load-balancing within N other freeradius-servers ? Has anybody done something like this before ? I've seen at freeradius.org that some used LinuxVirtualServer for doing this. But, I believe that, having a freeradius as proxy+load-balancer, it should have a better connection-handling. Am I wrong ? Any suggestion would be appreciated. Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

2 1

load balancing
by Lucas Aimaretto 16 Jun '05

16 Jun '05

Hi all, Is it possible to have freeradius as a proxy, but also, doing some load-balancing within N other freeradius-servers ? Has anybody done something like this before ? I've seen at freeradius.org that some used LinuxVirtualServer for doing this. But, I believe that, having a freeradius as proxy+load-balancer, it should have a better connection-handling. Am I wrong ? Any suggestion would be appreciated. I'm using freeradius 1.0.2. Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

1 0

Radius attributes necessary for PPP connection into Cisco modem-bank
by Mike Partyka 16 Jun '05

16 Jun '05

I have been asked to setup Radius to authenticate a modem connection by connecting to our Mysql database. I have read the Radius documentation more than once and i attribute my difficulties to a poor understanding of PPP connections on Linux. I just don't understand what are the necessary attributes that Radius has to pass back to the modem in order for the connection to be made. The modem is dialing into a Cisco modem bank here at our office where the Mysql databse is as well. I have been given a query for Radius to do that will get the authentication from Mysql but i am so far from that portion of the setup, i don't know where to look first. >From where i stand it seems like i could keep reading the Radius documentation and still never understand what needs to be done because i am lacking some more fundamental information that is required to put the pieces together. Can anyone point me to some basic documentation that might firm up my understanding of what needs to be done? Thanks, Mike Partyka Jumpnode Systems, LLC Systems Administrator (612)605-5056 Desk (612)605-3510 Fax

2 1

MS-CHAP problems :(
by Alexander Orlov 16 Jun '05

16 Jun '05

Hello! I have this message, when I try to use ms-chap auth: ---------------- Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 ../../sbin/radiusd: error while loading shared libraries: /usr/local/radius/lib/rlm_mschap-1.0.2.so: undefined symbol: md4_calc ------------------ I try to find some in this mail list archive about this bug, and all of I can find was about ver. 0.6-0.8, but I have 1.0.2 free radius. What I can do to resole this porblem? pap, chap auth work fine.

2 1

Undefined symbol with eaptls / freeradius 1.0.3 (debian)
by Antonio-Blasco Bonito 16 Jun '05

16 Jun '05

I compiled and installed freeradius-1.0.3 on debian sarge. It runs. But when using rlm_eap_ttls-1.0.3.so I'm having the same problem described six months ago by Julien (see below). Then I tried the latest freeradius-snapshot-20050615 but I get errors in the install phase: *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** rlm_eap_tls.so is not portable! *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** libeap.so is not portable! gcc -shared .libs/rlm_eap_peap.o .libs/peap.o -Wl,--rpath -Wl,/usr/local/lib -L/usr/local/lib -lradius -lrlm_eap_tls -L/usr/local/src/freeradius-snapshot-20050615/src/modules/rlm_eap/libeap -leap -lssl -lnsl -lresolv -lpthread -lcrypto -Wl,-soname -Wl,rlm_eap_peap-1.1.0-pre0.so -o .libs/rlm_eap_peap-1.1.0-pre0.so /usr/bin/ld: cannot find -lrlm_eap_tls collect2: ld returned 1 exit status libtool: install: error: relink `rlm_eap_peap.la' with the above command before installing it make[11]: *** [install] Error 1 Cna somebody give me any hints how to get out of this problem? On Tue, Dec 07, 2004 at 03:16:47PM +0100, Julien CABESSUT wrote: > I'm trying to set up a freeradius server on a debian box to authenticate > wireless users. The current debian (sid) package for 1.0.1 doesn't > include eap_tls, eap_ttls, nor eap_peap due to licensing issues - yet I > needed them. So I downloaded the source package, removed the three lines > in debian/rules which were preventing the compilation of those modules, > built a brand new package, and installed it. Now I have an error which > makes the server crash when someone tries to authenticate : > freeradius: relocation error: /usr/lib/freeradius/rlm_eap_peap-1.0.1.so: > undefined symbol: eaptls_process > Any suggestion on what could cause this problem ? Yes. The libltdl in Debian includes a patch from the CVS version of libtool, which breaks the linkage used by rlm_eap_ttls and rlm_eap_peap into rlm_eap_tls. Try 1.1.0, which should work with the libltdl in Debian/sarge or Debian/sid. -- Paul "TBBle" Hampson, on an alternate email client. -- Antonio-Blasco Bonito Phone: +39 050 315-2958 E-mail: blasco.bonito(a)isti.cnr.it Istituto di Scienza e Tecnologie dell'Informazione "A. Faedo" CNR Area della Ricerca di Pisa Via G. Moruzzi 1 56124 Pisa Italy

2 1