September 2005 - Freeradius-Users - lists.freeradius.org

PEAP without credentials
by Sebastian Müller 16 Sep '05

16 Sep '05

Hi, is there a way, to tell the freeradius to accept an incoming peap request, without asking for user credentials, or to accept any credentials? Currently needed to use the credentials guest/guest. It would be simpler to accept any credentials, without loosing the encryption. Thanks Windows XP (SP2) as default it tries to sends the local credentials, but of course they are getting rejected. The Auth-Type := Accept accepts the Login (I also get a "Login OK" msg.) but it doesn't tunnel and Accept them fully. Cheers Sebastian Müller www.sophieneck-berlin.de

2 2

crash in 1.0.5
by Norbert Wegener 16 Sep '05

16 Sep '05

freeradius crashes in 1.0.5 with: in radius.conf: passwd nwfiles { filename = /etc/raddb/gug format = "~User-Category:*User-Name" } /etc/raddb/gug ########################################################## newgroup:*Norbert Wegener TCGID=ZZZZZ1EC ########################################################## and a users file ########################################################## "Norbert Wegener TCGID=ZZZZZ1EC" User-Category=="newgroup" Fall-Through = Yes, DEFAULT User-Category== "newgroup" Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-AVPair += "ip:addr-pool=newgroup", Fall-Through = No, DEFAULT Auth-Type == Reject ########################################################## freeradius crashes in 1.0.5, when starting a connection, the configuration files are read. When a clients start a connection, gdb shows: (gdb) bt #0 rad_mangle (data=0x812afc0, request=<value optimized out>) at rlm_preprocess.c:186 #1 0x403432c4 in preprocess_authorize (instance=0x812afc0, request=0x81320a0) at rlm_preprocess.c:497 #2 0x0805655c in modcall (component=1, c=0x812b6c0, request=0x81320a0) at modcall.c:219 #3 0x0805677f in modcall (component=1, c=0x812c938, request=0x81320a0) at modcall.c:252 #4 0x08054d30 in indexed_modcall (comp=1, idx=1, request=0x81320a0) at modules.c:469 #5 0x0805281e in rad_authenticate (request=0x81320a0) at auth.c:592 #6 0x0804c156 in rad_respond (request=0x81320a0, fun=0x8052790 <rad_authenticate>) at radiusd.c:1642 #7 0x0804db80 in main (argc=4, argv=0xbffff534) at radiusd.c:1427 We use certificates and eap tls. If you need more information, please let me know. Norbert Wegener

2 4

/local/dialup page will not display for dialupadmin
by Miguel Ramirez 15 Sep '05

15 Sep '05

Hey gus I am new to this and usually I follow evey step to make it work, and do try hard (I have had my had on this for a week now). I have read the readme file the 'How to" document and upto the point where I have to get the dialupadmin page displayed on the browser it does not happen :-( well I have tried on SuSe 9.0 server and Fedora Core 3 and 4 I get to make the installer for radius source and Date::Manip PerlModule and they seam to get install ok. I know this type of things is like finding a needle in a histack, but I am running out of patience, please help me!, thanks now can someone please give me some clues

1 0

Tru64 again
by Tim Winders 15 Sep '05

15 Sep '05

I'm back at trying to get freeradius working under Tru64. This time using 1.0.5. I have an older cvs version working, but I can't remember what I did to make it work. :-( The working version I have is marked 1.1.0-pre0 built on Feb 17, 2005. First, in src/main/radiusd.c I have commented out the OSFC2 define. I do this because I'm not running C2, but it is always found and enabled, which kills the make. Then, I run configure with these options: CFLAGS="-I/usr/local/ssl/include -I/usr/local/include" LDFLAGS="-L/usr/local/ssl/lib -L/usr/local/lib" LIBS="-lssl -lcrypto -lsecurity" ./configure \ --disable-shared \ --enable-ltdl-install=no \ --with-openssl-includes=/usr/local/ssl/include \ --with-openssl-libraries=/usr/local/ssl/lib \ --without-mysql --disable-mysql radiusd seems to compile, but with many warnings. However, when I run it, it immediately seg faults and dumps core. Unfortunately, I am not a programmer, so I don't know how to begin troubleshooting this and try to help get freeradius working under Tru64. I remember being told that none of the development team uses Tru64. So, it's possible this will never work "right". But, I'm willing to help out in whatever limited capacity I can, including CPU/shell account. Any useful suggestions are welcome. --- Tim Winders Associate Dean of Information Technology South Plains College Levelland, TX 79336 Problem replying to my email? Click the "Sign" button in the OE toolbar or, better yet, get your own FREE Personal E-Mail Digital ID: http://www.thawte.com/email/index.html

4 5

Two different sources, one with a single value
by Martin.Ward＠uk.neceur.com 15 Sep '05

15 Sep '05

Hi all, I'm just about getting the hang of FreeRadius now, thanks to the various emails and stuff that people have been asking, but I've not been able to find the answer to one particular question. I have a radius server that will process two types of request: 1. A user name and password login. Currently it's a flat file but I will change that the use the rlm_unix module in the near future. 2. A MAC address, which is passed in as two attributes, "User-Name=MAC Address" and "User-Password=MAC Address" For the MAC address I want a flat file with just the MAC addresses in it. I have tried using the passwd module and just ignoring the User-Password attribute like so: passwd mac_address { filename = /var/mac_addresses format = "*User-Name" } but this fails to authenticate even though it gets through the Authorize section OK: rad_recv: Access-Request packet from host 172.29.252.228:1026, id=98, length=160 NAS-IP-Address = 172.29.252.228 NAS-Port-Id = "10:2" Extreme-Attr-208 = 0x556e6b6e6f776e204c6f636174696f6e NAS-Port-Type = Wireless-802.11 User-Name = "000e359ec2ce" User-Password = "000e359ec2ce" Calling-Station-Id = "000e359ec2ce" Called-Station-Id = "0004960e2e00" NAS-Identifier = "Altitude 300" Proxy-State = 0x31303a32040436c236c236c236c236c236c236c236c2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 42 modcall[authorize]: module "preprocess" returns ok for request 42 radius_xlat: '/var/log/freeradius/radacct/172.29.252.228 /auth-detail-20050913' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.29.252.228/auth-detail-20050913 modcall[authorize]: module "auth_log" returns ok for request 42 modcall[authorize]: module "mac_address" returns ok for request 42 modcall: group authorize returns ok for request 42 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [000e359ec2ce/000e359ec2ce] (from client wlan-switch port 0 cli 000e359ec2ce) Am I simply doing the impossible, or am I missing something obvious (again)? |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356

2 3

Questions about freeradius, ntlm_auth and windows groups
by Claudio 15 Sep '05

15 Sep '05

Hi to all, I have a freeradius 1.0.4 (upgrade to 1.0.5 is nearly coming...) with ntlm_auth on a Windows 2000 PDC. With the standard authentication with ntlm calls there is no problem. Now my question is that: is possible to assign some ip pools based on the user-group on the PDC? A quick example... i have a user called user01 with group free. The freeradius must look if the user belongs to group free (group on the PDC, not on unix) and if yes, it assign the ip pool like 10.0.1.0 to 10.0.1.10. If have another group, like only_internet, the radius must assign an ip in the pool of 10.0.1.11 to 10.0.1.20. Something like that is possible? I think yes....but how? I have searched into the previous post of the list, without any good results... someone can help me? Tnx in advance, Claudio Prono.

2 3

Re: SQL Documentation
by Sean 15 Sep '05

15 Sep '05

Sean <sean(a)swarmhotspots.com> wrote: > Can anyone recommend a good source for documentation for FreeRadius. The files that come with it, and the web pages? There really isn't any "secret treasure trove" of documentation that you get told about only if you ask for it. > I'm trying to understand the processes that occur between > Chillispot, FreeRadius and MySql. In particular I need to understand > how the Counter works and how to use the counter in MySQL. "the counter"? Please be specific. rlm_sqlcounter exists in the server source. It has sample configurations and documentation. What part of that do you have questions about? Alan DeKok. In particular I want to use the following in my radiusd.conf. counter daily{ reset =24h } counter weekly{ reset =7d } counter monthly{ reset=30 } What I need to know is do I have to add extra fields to my radius database and if so which tables need to be changed and how to address them from sql.conf. Regards, Sean

2 1

Let's share photos
by Aguirre Fernando 15 Sep '05

15 Sep '05

Hi I'm updating my address book. Please click on the link below and enter your contact info for me: http://www.ringo.com/i.html?i=119599134x886574&homeEmail=freeradius-users%4… I'm using a new, free service where I put in my contact info for you, you put in your contact info for me, and everyone stays up to date automatically. It's surprisingly easy and useful. Thanks for your help. Aguirre Fernando Don't receive any more invitations from Aguirre Fernando: http://www.ringo.com/friends/invite/block.html?memberId=119599134&email=fre… Don't receive any more invitations from anyone: http://www.ringo.com/friends/invite/block.html?email=freeradius-users%40lis…

1 0

RE: custom variable in config files
by Tariq Rashid 15 Sep '05

15 Sep '05

thanks for the suggestion and clarification. trying what you suggested gives me ... Config: including file: /opt/freeradius102/etc/raddb/proxy.conf config: No such entry network_address for string ${network_address}.126:1812 Errors reading radiusd.conf i'll keep trying and report back anything that works. tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 15 September 2005 17:18 To: FreeRadius users mailing list Subject: Re: custom variable in config files "Tariq Rashid" <tariq.rashid(a)uk.easynet.net> wrote: > i'd like to do something like ... > > realm abc.def { > type = radius > authhost = `%{config:network_address}`.126:1812 The expansion of configuration-file variables is not the same as the expansion of run-time variables. See other examples in the configuration. What *could* work is: authhost = ${network_address}.126:1812 Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Receivin a full DN in a radius request
by Jean-Francois Gobin 15 Sep '05

15 Sep '05

Hello there, For some purpose, I'm receiving a full DN in a radius request, which I must authenticate on a LDAP server. FOr now, I got a problem : radiusd strips everything after the first "=", leaving me with a username of "uid" ... Is there something I missed ? I read all the documentation I can find, nothing helped. Regards, Jean-Francois Gobin ---------- Jean-Francois Gobin - Administrateur gobinjf.be http://www.gobinjf.be mailto:gobin@gobinjf.be

4 16