July 2005 - Freeradius-Users - lists.freeradius.org

Re: DICTIONNARY PERMISSION - Please Help
by Stefan.Neis＠t-online.de 16 Jul '05

16 Jul '05

Hi, > What can cause dictionry permissions even if > /etc/freeradius/dictionnary has rwxrwxrwx as > permissions setting > > I am getting the following: > > radclient: dict_init: Couldn't open dictionary > "/etc/freeradius/dictionary": Permission denied Check the permissions of /etc and /etc/freeradius. If you can't read or "execute" one of those directories that'll give that same error message. HTH, Stefan

1 0

Logging question
by Michel Bélanger 15 Jul '05

15 Jul '05

1 0

Re: FreeRadius Chillispot
by sean 15 Jul '05

15 Jul '05

On Fri, 2005-07-15 at 18:10 +0200, freeradius-users- request(a)lists.freeradius.org wrote: > > DSL Modem has pinholes set up directing traffic coming to the static > ip > > out to the same ports on 192.168.1.2 IE 82.141.232.132:1812 sent to > > 192.168.1.2:1812 > > This works fine for Kannel, Apache etc. > > Are the pinholes set up for TCP or UDP? I have setup pinholes for both tcp and udp on ports 1812, 1813 and 1814. They all point to the Radius server on 192.168.1.2. The Chillispot on 192.168.1.6 can direct traffic to the CGI login but sends nothing to Radius. What I'm trying to understand is the sequence of events. When the hospotlogin.cgi script gets a request from a Chillispot user from the AP, does the cgi script initiate the Radius request? If this is the case then the script is not sending a request to Radius. I really hope that this is where the problem is. The alternative is that Chilli is sending users to hotspologin on one port and sending something else on another port. This would explain why hotspot clients can get to the login page but Radius sees no requests. Once again thanks for your help. Regards Sean P.S Sorry that I forgot to change the subject line in the original post.

3 2

Re: Freeradius-Users Digest, Vol 3, Issue 15
by sean 15 Jul '05

15 Jul '05

Hi, I can now get Chillispot to reach the CGI login on my server. The application loads and runs, but times out while trying to process the login. FreeRadius isn't getting any requests from Chilli but does process local requests from radtest. This is the way my network is structured. DSL modem with static ip 82.141.232.132 running firewall and DHCP File server IP 192.168.1.2 from DHCP Running Apache, Kannel, Jabber, MySQL, PHP and FreeRadius DSL Modem has pinholes set up directing traffic coming to the static ip out to the same ports on 192.168.1.2 IE 82.141.232.132:1812 sent to 192.168.1.2:1812 This works fine for Kannel, Apache etc. Radius listens on 1812, 1813 and 1814 Chilli is running on WRT54G with DD-WRT on port 192.168.1.6 from DHCP with internal address 192.169.10.1 DHCP is switched off in DD-WRT and Chilli is assigning IP to wireless clients and directing them to the CGI login script on the file server. This loads fine but times out after entering user and password. Radius can't see any requests coming from Chilli, but processes requests from radtest on the fileserver. I suspect that the DSL modem firewall needs to have some other ports opened but I can't add any software to it so I can't run Ethereal. I hope I've explained clearly. Thanks for any advice you can give. Regards Sean http://topup.ie

3 2

AVPair question
by Andrey 15 Jul '05

15 Jul '05

Hey List, Quick question about AVPair. I have a Colubris Access Point which wants me to use the Colubris-AVPair attribute. The attribute is defined in a dictionary file, which is included in the main dictionary. This is what it looks like: # Colubris dictionary - dictionary.colubris # # Enable by putting the line "$INCLUDE dictionary.colubris" into # the main dictionary file. # # VENDOR Colubris 8744 # # Vendor-specific attributes # ATTRIBUTE Colubris-AVPair 0 string Colubris ATTRIBUTE Colubris-Intercept 1 integer Colubris When I try to authenticate, I get "unknown-vendor 8744, size 30 = '' " for my attributes dump. What am I missing? Is there a separate file for defining vendors? Any help appreciated. - Andrey

2 1

RE: AVPair question
by Guy Davies 15 Jul '05

15 Jul '05

You should not edit the main dictionary file. You should create this as a separate file (called dictionary.colubris) with all the other dictionary.foo files (normally in /usr/local/share/freeradius/). Then look in the file called dictionary in the same directory and make sure (as it says in the comments at the top of the file you've sent) to put the line $INCLUDE dictionary.colubris NOTE: There is already a dictionary.colubris file in my installation of FreeRADIUS 1.0.4. However, it doesn't have the second attribute. If you also have that file, you could simply edit it and insert the second line beginning with "ATTRIBUTE". Once you've done all that, you'll need to restart the server to get it to reread the config files. Guy > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Andrey > Sent: 15 July 2005 16:52 > To: freeradius-users(a)lists.freeradius.org > Subject: AVPair question > > > Hey List, > > Quick question about AVPair. I have a Colubris Access Point > which wants me to use the Colubris-AVPair attribute. The > attribute is defined in a dictionary file, which is included > in the main dictionary. This is what it looks like: > > # Colubris dictionary - dictionary.colubris > # > # Enable by putting the line "$INCLUDE dictionary.colubris" into > # the main dictionary file. > # > # > > VENDOR Colubris 8744 > > # > # Vendor-specific attributes > # > ATTRIBUTE Colubris-AVPair 0 string > Colubris > ATTRIBUTE Colubris-Intercept 1 integer > Colubris > > When I try to authenticate, I get "unknown-vendor 8744, size > 30 = '' " for my attributes dump. What am I missing? Is there > a separate file for defining vendors? > > Any help appreciated. > > - Andrey > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

RE: Server Suggestion
by King, Michael 15 Jul '05

15 Jul '05

> > If the AP's are wireless, then CPU is more important, as > EAP uses SSL, which has a large CPU impact. > Would FreeRADIUS take advantage of a Dual CPU system?

2 1

Allowing any NAS to connect to my radiusd.
by Marcin Jessa 15 Jul '05

15 Jul '05

Hi. I would like to allow any NAS IP to connect to my radius server restricting connections from NAS only with shared secret - username and password. Is it possible to use 0.0.0.0 or ANY in clients.conf/SQL nas table ? What are the security issues having an open setup like that ? Cheers Marcin Jessa.

3 3

ippool problem
by abernabe＠mutua-mad.es 15 Jul '05

15 Jul '05

Hello, I´m trying to configure a FreeRadius 1.0.4 in Red Hat 8.0. Everything works OK until I add the ippool in the "post-auth" and "accounting" section. When I start the server I get always the error "Segmentation Fault" after loading radutmp, just when it tries to load the ippool in the "accounting" section I have the following configuration in the ippool module: ippool 2 { range-start = 172.20.1.1 range-stop = 172.20.1.254 netmask = 255.255.255.0 cache-size = 254 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = yes maximum-timeout = 0 } Do you know if I´m doing something wrong? Thanks

4 5

Access-Challenge
by Srinivasa Rao Chigurupati 15 Jul '05

15 Jul '05

Hi When will Radius Server will challenge with Access-Challenge packet during authentication? Is it depends on any configuration? -- Thanks & Regards Srinivasa Rao Chigurupati

2 3