September 2005 - Freeradius-Users - lists.freeradius.org

Proxy of Accounting Requests
by Ashwin Gobind 29 Sep '05

29 Sep '05

Good day. I am using freeradius 1.05 I want to proxy accounting requests originating from certain hosts to another server, how can I do this. Also I am using Jradius to handle accounting request. But this certain request I don't want JRadius to handle, but freeradius just to proxy it. Here is an example of the request Thanks Acct-Session-Id = C42EA2A31F96530 Framed-Protocol = GPRS-PDP-Context Called-Station-Id = vlive Calling-Station-Id = 27829800529 Framed-IP-Address = 10.19.128.6 3GPP-IMSI = 655019800002252 3GPP-Charging-ID = 33121584 3GPP-PDP-Type = 0 3GPP-GGSN-Address = 196.46.162.163 3GPP-IMSI-MCC-MNC = 65501 3GPP-GGSN-MCC-MNC = 65501 3GPP-NSAPI = 5 3GPP-Selection-Mode = 0 3GPP-Charging-Gateway-Address = 10.25.0.10 3GPP-GPRS-Negotiated-QoS-profile = 99-23931F9396979774FB0808 3GPP-SGSN-Address = 196.6.254.49 User-Name = 27829800529 Cisco-AVPair = connect-progress=Call Up Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Virtual Cisco-NAS-Port = GGSN NAS-Port = 60000 Class = [Binary Data] Service-Type = Framed-User NAS-IP-Address = 10.31.1.122 NAS-Identifier = GMC-GGSN0-12-2 Acct-Delay-Time = 0 Client-IP-Address = 10.113.60.6 Acct-Unique-Session-Id = b30a3d4d494c8a87 �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

RE: rlm_perl
by Abdul Lateef 29 Sep '05

29 Sep '05

hi friends, I am really sorry to post it again. Because still i did not find any reply to solve my problems. --- Abdul Lateef <abdul_zu(a)yahoo.com> wrote: > Hi, > > Thanks for your reply. i am going here to post the > debug logs. from the log it seems rlm_per is loaded > successfully but when i am trying to call authorize > and authenticate function from example.pl, the > functions are not calling well. > > Here is full configuration what i did to work with > perl module. > > radreply table: > ------------------- > 123456 Auth-Type := perl > ------------------- > > radiusd.conf > --------------------- > modules area: > > perl { > > module = /usr/local/etc/example.pl > func_accounting = accounting > func_authenticate = authenticate > func_authorize = authorize > func_preacct = preacct > func_checksimul = checksimul > func_xlat = xlat > } > > > > authorize { > > preprocess > chap > suffix > perl > } > > > authenticate { > > Auth-Type Perl { > perl > } > } > --------------------- > > example.pl > -------------------- > > sub authorize { > return RLM_MODULE_OK; > } > > > sub authenticate { > if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { > $RAD_REPLY{'Reply-Message'} = "Denied access"; > return RLM_MODULE_REJECT; > } else { > $RAD_REPLY{'h323-credit-time'} = > \"h323-credit-time=200\"; > return RLM_MODULE_OK; > > } > } > > > -------------------- > > Here is the Log: > =========================== > Wed Sep 28 07:50:45 2005 : Info: Detach perl > 0x93af7a0 > Wed Sep 28 07:50:45 2005 : rlm_perl: > rlm_perl::Detaching. Reloading. Done. > Wed Sep 28 07:50:45 2005 : Info: detach at 0x93af7a0 > returned status 0 > Wed Sep 28 07:50:45 2005 : Info: Detach perl > 0x94b0ec8 > Wed Sep 28 07:50:45 2005 : rlm_perl: > rlm_perl::Detaching. Reloading. Done. > Wed Sep 28 07:50:45 2005 : Info: detach at 0x94b0ec8 > returned status 0 > Wed Sep 28 07:50:45 2005 : Info: Detach perl > 0x950b550 > Wed Sep 28 07:50:45 2005 : rlm_perl: > rlm_perl::Detaching. Reloading. Done. > Wed Sep 28 07:50:45 2005 : Info: detach at 0x950b550 > returned status 0 > Wed Sep 28 07:50:45 2005 : Info: Detach perl > 0x9565480 > Wed Sep 28 07:50:45 2005 : rlm_perl: > rlm_perl::Detaching. Reloading. Done. > Wed Sep 28 07:50:45 2005 : Info: detach at 0x9565480 > returned status 0 > Wed Sep 28 07:50:45 2005 : Info: Detach perl > 0x95bf180 > Wed Sep 28 07:50:45 2005 : rlm_perl: > rlm_perl::Detaching. Reloading. Done. > Wed Sep 28 07:50:45 2005 : Info: detach at 0x95bf180 > returned status 0 > Wed Sep 28 07:50:45 2005 : rlm_perl: > rlm_perl::Detaching. Reloading. Done. > Wed Sep 28 07:50:48 2005 : Info: rlm_sql (sql): > Driver > rlm_sql_mysql (module rlm_sql_mysql) loaded and > linked > Wed Sep 28 07:50:48 2005 : Info: rlm_sql (sql): > Attempting to connect to Radius@10.0.0.65:/radius > Wed Sep 28 07:50:48 2005 : Info: rlm_sql_mysql: > Starting connect to MySQL server for #0 > Wed Sep 28 07:50:48 2005 : Info: rlm_sql_mysql: > Starting connect to MySQL server for #1 > ================================================= > > > I AM REALLY SORRY FOR BIG THREAD. > > > -------- > Yours, > Abdul Lateef > Computer Programmer > HATIF COM > Mob: +974 - 5405022 > Tel: +974 - 4883068 > ICQ: 276994704 > YM!: abdul_zu > Fax: +974 - 4883063 > Doha Qatar > http://www.hatif.com > > > > __________________________________ > Yahoo! Mail - PC Magazine Editors' Choice 2005 > http://mail.yahoo.com > -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

3 2

Need of Help Regarding FreeRadius Server
by manoranjan pandey 29 Sep '05

29 Sep '05

Hi all please help me as i am new user of RADIUS. As i got stuck at this point and i m unable to proceed for further development. so i am desperately waiting for ur response. It's al about freeRadius-1.0.5 .After configuration and instalation i put a command as below n getting below problems---- [root@localhost ~]# radiusd Thu Sep 29 10:54:56 2005 : Info: Starting - reading configuration files ... [root@localhost ~]# radiusd -x Starting - reading configuration files ... Errors reading dictionary: dict_init: /usr/local/etc/raddb/dictionary[14]: Could n't open dictionary " /usr/local/share/freeradius/dictionary": No such file o r directory Errors reading radiusd.conf [root@localhost ~]# radius -y bash: radius: command not found [root@localhost ~]# radiusd -y Thu Sep 29 11:03:19 2005 : Info: Starting - reading configuration files ... [root@localhost ~]# radiusd -z Thu Sep 29 11:03:26 2005 : Info: Starting - reading configuration files ... [root@localhost ~]# radiusd -xyz Starting - reading configuration files ... Errors reading dictionary: dict_init: /usr/local/etc/raddb/dictionary[14]: Couldn't open dictionary " /usr/local/share/freeradius/dictionary": No such file or directory Errors reading radiusd.conf AGAIN AFTER----WHEN I AM TRYING WITH radpwtst...se the below message.,.. [root@localhost ~]# radpwtst Bad format in dictionary '/usr/local/etc/raddb/dictionary' at line 14: $INCLUDE /usr/local/share/freeradius/dictionary Attribute number 1 is not defined in your dictionary Attribute number 6 is not defined in your dictionary Attribute number 4 is not defined in your dictionary Attribute number 5 is not defined in your dictionary Attribute number 30 is not defined in your dictionary Attribute number 31 is not defined in your dictionary Attribute number 61 is not defined in your dictionary Attribute number 2 is not defined in your dictionary No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown sending Access-Request... No reply Attribute number 1 is not defined in your dictionary Attribute number 6 is not defined in your dictionary Attribute number 4 is not defined in your dictionary Attribute number 5 is not defined in your dictionary Attribute number 61 is not defined in your dictionary Attribute number 44 is not defined in your dictionary Attribute number 40 is not defined in your dictionary Attribute number 30 is not defined in your dictionary Attribute number 31 is not defined in your dictionary Attribute number 41 is not defined in your dictionary No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown sending Accounting-Request Start... No reply Attribute number 1 is not defined in your dictionary Attribute number 6 is not defined in your dictionary Attribute number 4 is not defined in your dictionary Attribute number 5 is not defined in your dictionary Attribute number 61 is not defined in your dictionary Attribute number 44 is not defined in your dictionary Attribute number 40 is not defined in your dictionary Attribute number 30 is not defined in your dictionary Attribute number 31 is not defined in your dictionary Attribute number 41 is not defined in your dictionary Attribute number 46 is not defined in your dictionary Attribute number 42 is not defined in your dictionary Attribute number 43 is not defined in your dictionary No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown sending Accounting-Request Stop... No reply bye. -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

2 1

RE: Need of Help Regarding FreeRadius Server
by Guy Davies 29 Sep '05

29 Sep '05

Well, did you look at /usr/local/etc/dictionary? It generally points to /usr/local/share/freeradius/dictionary. If so (and it certainly appears to be so) then go look in /usr/local/share/freeradius/dictionary. It would appear that there is an error (or it did not get installed when you installed FR1.0.5). If so, the dictionary files are in the source tree and can be manually copied over. They are in $SOURCEDIR/share. > cp -R $SOURCEDIR/share/* /usr/local/share/freeradius Should do the trick (replace $SOURCEDIR with the directory in which your freeradius-1.0.5 source is located). Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of manoranjan pandey Sent: 29 September 2005 08:54 To: freeradius-users(a)lists.freeradius.org Subject: Need of Help Regarding FreeRadius Server Hi all please help me as i am new user of RADIUS. As i got stuck at this point and i m unable to proceed for further development. so i am desperately waiting for ur response. It's al about freeRadius-1.0.5 .After configuration and instalation i put a command as below n getting below problems---- [root@localhost ~]# radiusd Thu Sep 29 10:54:56 2005 : Info: Starting - reading configuration files ... [root@localhost ~]# radiusd -x Starting - reading configuration files ... Errors reading dictionary: dict_init: /usr/local/etc/raddb/dictionary[14]: Could n't open dictionary " /usr/local/share/freeradius/dictionary": No such file o r directory Errors reading radiusd.conf [root@localhost ~]# radius -y bash: radius: command not found [root@localhost ~]# radiusd -y Thu Sep 29 11:03:19 2005 : Info: Starting - reading configuration files ... [root@localhost ~]# radiusd -z Thu Sep 29 11:03:26 2005 : Info: Starting - reading configuration files ... [root@localhost ~]# radiusd -xyz Starting - reading configuration files ... Errors reading dictionary: dict_init: /usr/local/etc/raddb/dictionary[14]: Couldn't open dictionary " /usr/local/share/freeradius/dictionary": No such file or directory Errors reading radiusd.conf AGAIN AFTER----WHEN I AM TRYING WITH radpwtst...se the below message.,.. [root@localhost ~]# radpwtst Bad format in dictionary '/usr/local/etc/raddb/dictionary' at line 14: $INCLUDE /usr/local/share/freeradius/dictionary Attribute number 1 is not defined in your dictionary Attribute number 6 is not defined in your dictionary Attribute number 4 is not defined in your dictionary Attribute number 5 is not defined in your dictionary Attribute number 30 is not defined in your dictionary Attribute number 31 is not defined in your dictionary Attribute number 61 is not defined in your dictionary Attribute number 2 is not defined in your dictionary No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown sending Access-Request... No reply Attribute number 1 is not defined in your dictionary Attribute number 6 is not defined in your dictionary Attribute number 4 is not defined in your dictionary Attribute number 5 is not defined in your dictionary Attribute number 61 is not defined in your dictionary Attribute number 44 is not defined in your dictionary Attribute number 40 is not defined in your dictionary Attribute number 30 is not defined in your dictionary Attribute number 31 is not defined in your dictionary Attribute number 41 is not defined in your dictionary No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown sending Accounting-Request Start... No reply Attribute number 1 is not defined in your dictionary Attribute number 6 is not defined in your dictionary Attribute number 4 is not defined in your dictionary Attribute number 5 is not defined in your dictionary Attribute number 61 is not defined in your dictionary Attribute number 44 is not defined in your dictionary Attribute number 40 is not defined in your dictionary Attribute number 30 is not defined in your dictionary Attribute number 31 is not defined in your dictionary Attribute number 41 is not defined in your dictionary Attribute number 46 is not defined in your dictionary Attribute number 42 is not defined in your dictionary Attribute number 43 is not defined in your dictionary No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown No such attribute Unknown sending Accounting-Request Stop... No reply bye. -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Problem with PEAP and MS-CHAPv2 and AD
by Graham, Robert 28 Sep '05

28 Sep '05

I am having a strange problem, and was hoping for some expertise in this matter and I need to get this working very quickly since I am running out of time. I have freeradius configured to authenticate our users for a wired 802.1x environment. Authentication works succesfully if the supplicant (odyssey client) sends only the username and not domain\username. The problem is when I install the odyssey gina module to configure the supplicant to authenticate prior to windows login it passes the credentials as domain\username, whichs fails authentication. I did some searches and made the following changes: proxy.conf added: realm domain { type = radius authhost = LOCAL accthost = LOCAL } and uncommented the ntdomain section in radiusd.conf This did not work, so I tried another suggestion and changed the ntlm_auth string from: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MEM --username=%{User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" to: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Now when I login I get the following error: This also occurs at the desktop level rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=RGraham --domain=MEM --challenge=71c3373eb458a75e --nt-response=c410b4f18e8527df26495cad16d20a09679b03969efa3d3e' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=RGraham --domain=MEM --challenge=71c3373eb458a75e --nt-response=c410b4f18e8527df26495cad16d20a09679b03969efa3d3e Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xf8716a50 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE If I change the ntlm_auth back to the original string and authenticate at the desktop (not gina) it authenticates. So my question is: What do I need to do to configure Freeradius to strip the domain portion where EAP-PEAP is successful at both gina (login) and desktop? Any help would be greatly appreciated. Thanks Robert Graham

4 10

Question about oracle
by chabral - 28 Sep '05

28 Sep '05

Hi, Is it possible to install and run freeradius on an Oracle App Server?. The database server is another server located at another local network. Is it possible to achieve this configuration? Which are the requirements of freeradius for compiling with oracle support? Can I download the code and compile it in the app server? I'll really appreciate your advice. Best regards, -- chabral

1 0

question on challenge message
by Nagaraj Venkatapuram 28 Sep '05

28 Sep '05

what is the configuration required on radius server(freeradius ver1.0.5) to send challenge messages to the radius client ? How does Radius server determine when to send challenge messages to the client ? Thanks, N

2 1

FreeRADIUS 1.0.5 has been released
by Alan DeKok 28 Sep '05

28 Sep '05

See www.freeradius.org for download information. This version has a LOT of fixes over 1.0.4, including security fixes. We suggest everyone upgrade to 1.0.4. Alan DeKok.

9 26

Questions about upgrading Freeradius
by Linda Pagillo 28 Sep '05

28 Sep '05

Hi everyone: I have been using Freeradius v.0.9.3 for over a year and i wish to upgrade to the latest version. Can anyone give me detailed instructions on how to do this? I use Freeradius in a prodcution enviroment and i can't afford to mess it up. I'm running Linux RedHat 9. Do i just do a ./configure, make and make install like i did the first time? If yes, won't that overwrite all of my current config files? Thanks! Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

5 12

RE: Freeradius-Users Digest, Vol 5, Issue 91
by Ashwin Gobind 28 Sep '05

28 Sep '05

If the message authenticator is all zeros, then I can send a request from one freeradius server to another with out any problems. The problem is when I user Radiator with freeradius sending accounting messages to it, it complains about Authentication failure. So I assumed that Radiator does not like a blank MA. Hence I tried to produce one and add it to the accounting packet before sending it to Radiator. However it still fails. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 28 September 2005 07:06 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 5, Issue 91 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: AccountingReq message authenticator (Michael Lecuyer) 2. Re: Questions about upgrading Freeradius (Linda Pagillo) 3. Re: Expose RADIUS packet's identifier (Alan DeKok) 4. Re: Questions about upgrading Freeradius (Alan DeKok) 5. Re: Chap,LDAP and Passwords :) (Alan DeKok) 6. Re: Crashes with 1.0.4/1.0.5, perhaps connected with slow LDAP backend? (Alan DeKok) 7. Re: EAP-TLS reject if CN not in MySQL (Alan DeKok) 8. Re: Questions about upgrading Freeradius (Dusty Doris) 9. Re: Questions about upgrading Freeradius (Linda Pagillo) ---------------------------------------------------------------------- Message: 1 Date: Wed, 28 Sep 2005 10:48:42 -0400 From: Michael Lecuyer <mjl(a)theorem.com> Subject: Re: AccountingReq message authenticator To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <433AAD4A.305(a)theorem.com> Content-Type: text/plain; charset=windows-1252; format=flowed There is no way to generate a message authenticator in an Accounting-Request packet the usual way it's generated for an Access-Request. The accounting packet is signed by the client therefore there cannot be two signatures created for the entire the packet. By the very nature of creating signature the second signature will alter the packet's contents invalidating the first signature. The Message-Authenticator can be only one of two things. Either it's calculated as a hash of the attributes or it's a random number (like the Access-Request authenticator). From your information I suspect it's the former. You might try using the traditional MA calculation for the MA on just the attributes with an empty (zeroed) MA present and back patch the MA. If this works please let me know. Or, if someone has accounting packets generated with proper MA's please send them to me and I'll try some standard hashes. The MA is traditionally created as an MD5-HMAC of the shared secret and the entire packet's contents with an empty (16 byte) Message-Authenticator. For an accounting packet MA use just the attribute block instead of the entire packet try just the attributes with the empty MA. Ashwin Gobind wrote: > Hi. > > > > Is there anyway to generate a message authenticator for an accounting > request packet. At the moment I am using JRadius, I need to send an > accounting request message to another radius server. However after I > add the message authenticator and send to to another server, the other > server complains about "Invalid message authenticator" (Shared secret > is incorrect). > > > > Here is some code : > > //Proxy request to the wap gateway > > > DatagramSocket socket = new DatagramSocket(); > > > socket.setSoTimeout(5000); > > //Generate > authenticator > > > MessageDigest md5 = MessageDigest.getInstance("MD5"); > > > md5.reset(); > > md5.update((byte)req.getCode()); > > > md5.update((byte)req.getIdentifier()); > > int length = > req.getBytes().length; > > byte [] authenticator = > req.getAuthenticator(); > > byte [] attributeBytes = > req.getAttributeBytes(req.getAttributes(),0); > > for (int z=0; z > <authenticator.length ; z++ ) > > > RadiusLog.debug("Autenticator["+z+"] Before = " + authenticator[z]); > > > > > RadiusLog.debug("Autenticator Length: " + authenticator.length); > > RadiusLog.debug("Attributes > Length: " + attributeBytes.length); > > RadiusLog.debug("Paket > Length: " + length); > > > > String sharedSecret = > "testing123"; > > md5.update((byte)(length >> 8)); > > md5.update((byte)(length & > 0xff)); > > md5.update(authenticator, 0, > authenticator.length); > > md5.update(attributeBytes, > 0, attributeBytes.length); > > > md5.update(sharedSecret.getBytes()); > > > req.overwriteAttribute(AttributeFactory.newAttribute(AttributeDictionary .MESSAGE_AUTHENTICATOR, > authenticator)); > > > > > System.arraycopy(md5.digest(), 0, authenticator, 0, 16); > > "This e-mail is sent on the Terms and Conditions that can be accessed by > Clicking on this link http://www.vodacom.net/legal/email.aspx > <http://www.vodacom.net/legal/email.asp> " > > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 2 Date: Wed, 28 Sep 2005 10:17:59 -0500 From: "Linda Pagillo" <linda(a)n2thenet.com> Subject: Re: Questions about upgrading Freeradius To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <009301c5c43f$cffd60c0$2902a8c0(a)com.tnaccess.com> Content-Type: text/plain; charset="iso-8859-1" Thanks for your reply. Is it really this much work to do a simple upgrade? Is there a shortcut? ----- Original Message ----- From: "Dusty Doris" <freeradius(a)mail.doris.cc> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, September 28, 2005 9:58 AM Subject: Re: Questions about upgrading Freeradius > On Wed, 28 Sep 2005, Linda Pagillo wrote: > > > Hi everyone: > > > > I have been using Freeradius v.0.9.3 for over a year and i wish to > > upgrade to the latest version. Can anyone give me detailed instructions > > on how to do this? I use Freeradius in a prodcution enviroment and i > > can't afford to mess it up. I'm running Linux RedHat 9. Do i just do a > > ./configure, make and make install like i did the first time? If yes, > > won't that overwrite all of my current config files? Thanks! > > > > First, I would recommend setting up a lab machine (you can do it on your > workstation if you need to) to test that your configs work correctly with > the new version. Its probably backward compatible, but I wouldn't just > blindly upgrade on production and hope for the best. > > Then you could compile freeradius with --prefix. This will put all > configurations, binaries, etc.. into a certain directory. For example: > > ./configure --prefix=/usr/local/freeradius1.0.5 > make > make install > > When that's done, cd to /usr/local/freeradius1.0.5/etc/raddb and change > your files to make it work like it did in testing. Shutdown the current > radius version and start up the new one with > /usr/local/freeradius1.0.5/sbin/radiusd -X and see if its working. If so, > modify your startup scripts to point to the new version instead of the > old. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ Message: 3 Date: Wed, 28 Sep 2005 11:23:31 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Expose RADIUS packet's identifier To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928152332.0133B16CC1(a)mail.nitros9.org> Josh Howlett <josh.howlett(a)bristol.ac.uk> wrote: > Does anyone know if the server can expose a RADIUS packet's identifier, > for example through mod_exec? Or, is this limited to RADIUS attributes only? ATTRIBUTE Packet-Authentication-Vector 1088 octets It *could* have been somewhere in the documentation, but... Alan DeKok. ------------------------------ Message: 4 Date: Wed, 28 Sep 2005 12:08:13 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Questions about upgrading Freeradius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928160813.115C916CC1(a)mail.nitros9.org> "Linda Pagillo" <linda(a)n2thenet.com> wrote: > Thanks for your reply. Is it really this much work to do a simple upgrade? > Is there a shortcut? Not really. Doing the upgrade slowly is less work than doing it quickly, and then having your RADIUS server down because you missed something. Alan DeKok. ------------------------------ Message: 5 Date: Wed, 28 Sep 2005 12:09:11 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Chap,LDAP and Passwords :) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928160911.41F2616CC1(a)mail.nitros9.org> liz <liz(a)unixgrrl.net> wrote: > However, if I turn on CHAP based authentication I get a message from > the radius server that USER-PASSWORD is a required attribute. You set Auth-Type := LDAP. Don't do that. LDAP doesn't understand CHAP. > I am going to try another radius plugin I found today on > sourcegforge to try and narrow it down. That's not necessary. Alan DeKok. ------------------------------ Message: 6 Date: Wed, 28 Sep 2005 12:12:56 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Crashes with 1.0.4/1.0.5, perhaps connected with slow LDAP backend? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928161256.3095E16CC1(a)mail.nitros9.org> Martin Pauly <pauly(a)hrz.uni-marburg.de> wrote: > We do have perfomance problems with our LDAP backend, > so this sound reasonable, but could this cause the server to crash? Yes. If all of the threads are blocked forever, waiting for the DB to return data, then the queue of requests grows without bounds. At some point, the server says "I'm not making progress, and I can't recover from this", and kills itself. Since the server is *already* effectively dead at that point, it makes no difference to your network. The solution is to fix the database so that it doesn't kill the server. Alan DeKok. ------------------------------ Message: 7 Date: Wed, 28 Sep 2005 12:14:05 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: EAP-TLS reject if CN not in MySQL To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928161405.5BBA516E0B(a)mail.nitros9.org> "Jonathan De Graeve" <Jonathan.De.Graeve(a)imelda.be> wrote: > imply a group that changes the default ACTIONs to something like > > fail = 1 > everythingelse = return > > Tried in config: > > everythingelse = return > > radiusd.conf[1637] Unknown module rcode 'everythingelse'. It was NOT meant to be taken literally. > Any ideas? Read doc/configurable_failover, and type in all the other return codes by hand. Alan DeKok. ------------------------------ Message: 8 Date: Wed, 28 Sep 2005 12:48:09 -0400 (EDT) From: Dusty Doris <freeradius(a)mail.doris.cc> Subject: Re: Questions about upgrading Freeradius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050928124746.N93079(a)mail.doris.name> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed You consider that much work? I wish I had your job! :) On Wed, 28 Sep 2005, Linda Pagillo wrote: > Thanks for your reply. Is it really this much work to do a simple upgrade? > Is there a shortcut? > ----- Original Message ----- > From: "Dusty Doris" <freeradius(a)mail.doris.cc> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Sent: Wednesday, September 28, 2005 9:58 AM > Subject: Re: Questions about upgrading Freeradius > > >> On Wed, 28 Sep 2005, Linda Pagillo wrote: >> >>> Hi everyone: >>> >>> I have been using Freeradius v.0.9.3 for over a year and i wish to >>> upgrade to the latest version. Can anyone give me detailed instructions >>> on how to do this? I use Freeradius in a prodcution enviroment and i >>> can't afford to mess it up. I'm running Linux RedHat 9. Do i just do a >>> ./configure, make and make install like i did the first time? If yes, >>> won't that overwrite all of my current config files? Thanks! >>> >> >> First, I would recommend setting up a lab machine (you can do it on your >> workstation if you need to) to test that your configs work correctly with >> the new version. Its probably backward compatible, but I wouldn't just >> blindly upgrade on production and hope for the best. >> >> Then you could compile freeradius with --prefix. This will put all >> configurations, binaries, etc.. into a certain directory. For example: >> >> ./configure --prefix=/usr/local/freeradius1.0.5 >> make >> make install >> >> When that's done, cd to /usr/local/freeradius1.0.5/etc/raddb and change >> your files to make it work like it did in testing. Shutdown the current >> radius version and start up the new one with >> /usr/local/freeradius1.0.5/sbin/radiusd -X and see if its working. If so, >> modify your startup scripts to point to the new version instead of the >> old. >> >> >> - >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >> > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ Message: 9 Date: Wed, 28 Sep 2005 11:58:04 -0500 From: "Linda Pagillo" <linda(a)n2thenet.com> Subject: Re: Questions about upgrading Freeradius To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <00b901c5c44d$cb1f9e20$2902a8c0(a)com.tnaccess.com> Content-Type: text/plain; charset="iso-8859-1" I wish you had my job too because i'm about fed up with this crap.. Anyway, thanks for the reply, i'll do it. ----- Original Message ----- From: "Dusty Doris" <freeradius(a)mail.doris.cc> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, September 28, 2005 11:48 AM Subject: Re: Questions about upgrading Freeradius > You consider that much work? I wish I had your job! > > :) > > On Wed, 28 Sep 2005, Linda Pagillo wrote: > > > Thanks for your reply. Is it really this much work to do a simple upgrade? > > Is there a shortcut? > > ----- Original Message ----- > > From: "Dusty Doris" <freeradius(a)mail.doris.cc> > > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > Sent: Wednesday, September 28, 2005 9:58 AM > > Subject: Re: Questions about upgrading Freeradius > > > > > >> On Wed, 28 Sep 2005, Linda Pagillo wrote: > >> > >>> Hi everyone: > >>> > >>> I have been using Freeradius v.0.9.3 for over a year and i wish to > >>> upgrade to the latest version. Can anyone give me detailed instructions > >>> on how to do this? I use Freeradius in a prodcution enviroment and i > >>> can't afford to mess it up. I'm running Linux RedHat 9. Do i just do a > >>> ./configure, make and make install like i did the first time? If yes, > >>> won't that overwrite all of my current config files? Thanks! > >>> > >> > >> First, I would recommend setting up a lab machine (you can do it on your > >> workstation if you need to) to test that your configs work correctly with > >> the new version. Its probably backward compatible, but I wouldn't just > >> blindly upgrade on production and hope for the best. > >> > >> Then you could compile freeradius with --prefix. This will put all > >> configurations, binaries, etc.. into a certain directory. For example: > >> > >> ./configure --prefix=/usr/local/freeradius1.0.5 > >> make > >> make install > >> > >> When that's done, cd to /usr/local/freeradius1.0.5/etc/raddb and change > >> your files to make it work like it did in testing. Shutdown the current > >> radius version and start up the new one with > >> /usr/local/freeradius1.0.5/sbin/radiusd -X and see if its working. If so, > >> modify your startup scripts to point to the new version instead of the > >> old. > >> > >> > >> - > >> List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > >> > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 5, Issue 91 *********************************************** �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

1 0