December 2006 - Freeradius-Users - lists.freeradius.org

automated response
by Olaf Becker 27 Dec '06

27 Dec '06

I am currently out of the office and will return January 2.

1 0

problem with NT-Password and LDAP
by Ana Gallardo Gómez 26 Dec '06

26 Dec '06

Hello, my problem is, i have a Freeradius server that retrieves the authentication information from an OpenLDAP server; in this server the NT-Password atributte has 252 characters (32 characters from NT-hash + white spaces), and the NT-Password generated in ms-chap has 32 characters. How can I remove the white spaces from NT-Password in the ldap module?Debug information:...rlm_ldap: performing search in ou=xxx,dc=xxx,dc=xxx, with filter (cn=xxxx) rlm_ldap: Added password xxx in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding ntPassword as NT-Password, value 06B11E3D941021E1A5C51C6868F2F0E6 & op=21...After that "LOGIN INCORRECT".Sorry for my english.Thank you very much. _________________________________________________________________ ¡Ya está aquí Windows Live Spaces! Ahora podrás crear fácilmente tu propio sitio Web. http://spaces.live.com/signup.aspx

2 1

Re: Questions from a totally ignorant n00b
by Gene Mosley 26 Dec '06

26 Dec '06

Alan, I read the FAQ section which you posted (http://wiki.freeradius.org/index.php/FAQ#How_do_I_deny_access_to_a_specific…) It talks about denying access to a specific user, or a group of users - which is not what I need. I need to deny access to specific IP addresses - not specific users. Anyone from any IP address should be able to authenticate (which is the default) - but nobody should be able to authenticate from specific IP addresses. If I have servers: 10.11.12.1 10.11.12.2 10.11.12.3 10.11.12.4 Then Bob should be able to authenticate from all of them - UNLESS for some reason I wanted to block authentication from 10.11.12.4 - then what would I need to do in order to make it so that anyone trying to authenticate from 10.11.12.4 would be rejected (again, based on the IP address, not their user name or group)? ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, December 21, 2006 3:22:12 PM Subject: Re: Questions from a totally ignorant n00b Gene Mosley wrote: > > What I am looking for is to allow a user ("bob") to authenticate > from any system he uses UNLESS that system is blocked from authenticating. Perhaps you could try reading the FAQ entry I pointed to earlier. It tells you how to do exactly that. > It seems that AIX RADIUS cannot do this - can FreeRADIUS? Have you been reading my responses? > Can FreeRADIUS be configured to allow/disallow authentication based > on the source IP address that the user is coming from and NOT the user > account itself (allowing "bob" to authenticate from "server1" which is > not 'banned', but not allowing "bob" to authenticate from "server2" > which is 'banned')? > And, if so - how? Go read my messages, and the FAQ entry I posted? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

proxy authentication
by Dubi Lego 26 Dec '06

26 Dec '06

Hi all, Is it possible to proxy all authentication messages to specific remote server including replies (Access-Reject, Access-Accept)?

2 1

Reset sql counter
by Bishal 24 Dec '06

24 Dec '06

Is it possible to reset the sql counter manually or by any scripts in freeradius?

2 1

radius+mysql weird problem
by Jorge Minassian - Comintec 22 Dec '06

22 Dec '06

Hello all !, After upgrading Fedora from FC2 to FC4, I got what is described below from log (radiusd -X) If I query database manually, I get all info about users (all users are correctly on DB), but radius still says "No matching entry in the database ...". If using "files", it works OK. I tried to downgrade DB (from 4.1 to 3.23), also reinstal freeradius from rpm or compiled by me, but problem persists. Have someone any ad about this ?. I will apreciate any help to troubleshoot this problem !. Thank you very much, Jorge. ---- Ready to process requests. rad_recv: Access-Request packet from host localhost:56607, id=27, length=55 User-Name = "000" User-Password = "1234" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "000", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: '000' rlm_sql (sql): sql_set_user escaped user --> '000' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '000' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '000' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '000' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '000' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): No matching entry in the database for request from user [000] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [000/1234] (from client gabriel port 1) Sending Access-Reject of id 27 to localhost:56607 Finished request 0 Going to the next request

2 2

dialup admin coding - help required
by Cory Robson 22 Dec '06

22 Dec '06

Ok I have tried and tried to get this to work how I want but obviously need more sleep, not being a code genius and trying to learn this mix and mash is confusing enough. Anyway this is my code for my failed login page, my sql query does parse all information into the array ok but I just cannot seem to get it to output on screen. Any way here is what I have so far anyone able to assist in showing me where I'm going wrong. <?php require('../conf/config.php3'); ?> <html> <?php if (is_file("../lib/sql/drivers/$config[sql_type]/functions.php3")) include_once("../lib/sql/drivers/$config[sql_type]/functions.php3"); else{ echo <<<EOM <title>Failed logins</title> <link rel="stylesheet" href="style.css"> </head> <body bgcolor="#80a040" background="images/greenlines1.gif" link="black" alink="black"> <center> <b>Could not include SQL library functions. Aborting</b> </body> </html> EOM; exit(); } $now = time(); $start = $now - ($last*60); $now_str = date($config[sql_full_date_format],$now); $prev_str = date($config[sql_full_date_format],$start); ?> <head> <title>Failed Logins</title> <link rel="stylesheet" href="style.css"> </head> <body bgcolor="#80a040" background="images/greenlines1.gif" link="black" alink="black"> <center> <table border=0 width=550 cellpadding=0 cellspacing=0> <tr valign=top> <td align=center><img src="images/title2.gif"></td> </tr> </table> <table border=0 width=400 cellpadding=0 cellspacing=2> </table> <br> <table border=0 width=840 cellpadding=1 cellspacing=1> <tr valign=top> <td width=65%></td> <td bgcolor="black" width=35%> <table border=0 width=100% cellpadding=2 cellspacing=0> <tr bgcolor="#907030" align=right valign=top><th> <font color="white">Failed Logins</font>  </th></tr> </table> </td></tr> <tr bgcolor="black" valign=top><td colspan=2> <table border=0 width=100% cellpadding=12 cellspacing=0 bgcolor="#ffffd0" valign=top> <tr><td> <?php echo <<<EOM EOM; ?> <p> <table border=1 bordercolordark=#ffffe0 bordercolorlight=#000000 width=100% cellpadding=2 cellspacing=0 bgcolor="#ffffe0" valign=top> <tr bgcolor="#d0ddb0"> <th>#</th><th>login</th><th>Password</th><th>Time</th><th>Terminate cause</th><th>Caller ID</th> </tr> <?php $link = @da_sql_pconnect($config); $search = @da_sql_query($link,$config, "SELECT id, user,pass,reply,date,callingid FROM radpostauth ORDER BY date;"); $num = 0; *// Here is where my array collects the records - This is working *// while( $row = @da_sql_fetch_array($search,$config) ){ $num++; $acct_login = $row[user]; $acct_password = $row[pass]; $acct_terminate_cause = $row[reply]; $acct_time = $row[date]; $acct_callingid = $row[callingid]; } ?> *// Here is my screen output, obviously I need to loop through the array and output the lines but just can't figure it out. *// <tr align=center bgcolor="white"> <td>$num</td> <td>$acct_login</td> <td>$acct_password</td> <td>$acct_time</td> <td>$acct_terminate_cause</td> <td>$acct_callingid</td> </tr> </table> </td></tr><tr><td> </td></tr> </table></td></tr></form> </table> </tr> </table> </body> </html>

3 2

User authentication using Mysql table - radacct
by N S 22 Dec '06

22 Dec '06

I have the radacct table populated with a few users. But the radius is not checking this table for user info. The only users being allowed/authenticated are those that are in the users.conf file.How do I make the radius look for the user info in the mysql database. Thanks. _________________________________________________________________ Type your favorite song. Get a customized station. Try MSN Radio powered by Pandora. http://radio.msn.com/?icid=T002MSN03A07001

5 11

Re: Questions from a totally ignorant n00b
by Gene Mosley 21 Dec '06

21 Dec '06

Alan, Thank you very much for the information. What I am looking for is to allow a user ("bob") to authenticate from any system he uses UNLESS that system is blocked from authenticating. I mean "bob" could authenticate from "server1" but not from "server2" - restricting it (somehow) by the IP address of the source - not by the user account. Nobody could authenticate from "server2" - anyone could authenticate from "server1" (with valid credentials). It seems that AIX RADIUS cannot do this - can FreeRADIUS? Someone else suggested using IPTables to not allow "server2" to talk to the RADIUS server - but I thought that the communication was from the firewall to the RADIUS server, not from the user system (although I will be looking into this). Anyway - to recap/summarize: Can FreeRADIUS be configured to allow/disallow authentication based on the source IP address that the user is coming from and NOT the user account itself (allowing "bob" to authenticate from "server1" which is not 'banned', but not allowing "bob" to authenticate from "server2" which is 'banned')? And, if so - how? ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, December 21, 2006 12:48:50 PM Subject: Re: Questions from a totally ignorant n00b Gene Mosley wrote: > Alan, > Could you perhaps give me a hint about how one would go about > allowing any user from any system (_unless_ that system is listed for > the specific purpose of not allowing anyone to authenticate from it) to > authenticate? You've phrased the problem in a very complicated way. By default, any user is allowed to authenticate from any NAS. You don't have to do anything to enable this behavior. If you want NO ONE to authenticate from a particular NAS, then don't list the NAS IP address in clients.conf. If you want only SOME people to authenticate from a particular NAS, see the FAQ. http://wiki.freeradius.org/index.php/FAQ#How_do_I_deny_access_to_a_specific… Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

no DB handles ,How to solve this ?
by 梁增辉 21 Dec '06

21 Dec '06

hi all I've seen many of these messages in the radius.log (I am using freeradius 1.1.1 mysql version :5.1.11) There are no DB handles to use! skipped 0, tried to connect 0 There are no DB handles to use! skipped 0, tried to connect 0 There are no DB handles to use! skipped 0, tried to connect 0 What does it mean ? How to solve this ? -------------- liangzh 2006-12-21

2 1