February 2006 - Freeradius-Users - lists.freeradius.org

freeRadius Features
by Mohammad Flaifel 21 Feb '06

21 Feb '06

Hi all, I need to install a radius server and i already testes freeradius and seems is really good. i need to know if freeradius supports: - Change of Authorization while the subscriber's PPP session is still connected. - Disconnect users based on download volume limitation regards, Flaifel

1 0

RE: dictionary.cablelabs[168]: dict_addvalue: value name too long
by Ryan Melendez 21 Feb '06

21 Feb '06

Hey Alan, I don't have more than one version of freeradius running. This was my problem. ./configure LDFLAGS=/path/to/openssl/ export LDFLAGS make I needed to set LDFLAGS _before_ ./configure. This works well: LDFLAGS=/path/to/openssl/ export LDFLAGS ./configure make Thanks, Ryan -----Original Message----- From: freeradius-users-bounces+rmelendez=wayport.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+rmelendez=wayport.net@lists.freeradius. org] On Behalf Of Alan DeKok Sent: Thursday, February 16, 2006 4:24 PM To: FreeRadius users mailing list Subject: Re: dictionary.cablelabs[168]: dict_addvalue: value name too long "Ryan Melendez" <rmelendez(a)wayport.net> wrote: > I am using 1.1.0. Sorry I left that out. That message isn't produced when running the stock 1.1.0. What else is going on in your machine? Do you have multiple versions of FreeRADIUS installed? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 3

setting up on shared hosting webhost service
by eric＠gozippy.com 21 Feb '06

21 Feb '06

1st: I'm a newb to freeradius - not to the world... I have successfully installed freeradius with experiemental modules (for using mysql) on a mandrake mandriva 10.2 machine on my local lan... I got my scripts to work flawlessly... I uploaded my modified scripts to my webhost and nothing... I called my webhost (I am a reseller for them, and they are in my home town) and talked them into installing freeradius onto the servers my sites are located on. Shared webhost... I am not sure how they are limiting my virtual host server to just the /home/myuserid/ directory but that is the limnit of where I can see... I do not have root access, I can ssh, but only to the /home/userid and down thru my individual accounts cpanels and such... I have modified clients.conf and sql.conf to appropriate settings - I think... what am I missing? any ideas or tips I can relay to my webhost on setting up freeradius? It is a bit difficult and burdomsome on my webhost to have to physically modify or change the clients.conf each time I add a new client or access point in my network, plus how do I ensure my radius access to my "localhost" mysql databases within my hosting account are talking to eachother? I think there are some issues connecting as the radius server is installed on the webhost server - my personal site, abeit has a private ip, actually runs from the /home/myuserid/public_html/ on the server... further, some of the other domains I own or have sold and set up corresponding dns and webhosting space with cpanels for on the same server do not have private ip's (I can of course add them on to the service I am buying from the webhost for a minimal fee) - but currently they are shared ips... is there anyway to use freeradius on shared ips and still be able to keep individual virtual hosts seperate? if I need dedicated hosting and a box of my own to run this in the real world that would just add several thousand dollars of cost to my overall deplopyment and long term maintenance contracts in a co-lo somewhere... currently my webhost's servers are at a co-lo in dallas... ideas, tips and tricks to make it work are VERY welcomed... thanks in advance - Eric(a)GoZippy.com

1 0

Auth from LDAP, then add reply via SQL
by Robert Myers 20 Feb '06

20 Feb '06

I must be missing this in the documentation. If I authenticate via the users file/LDAP/SQL , is there a way to add replies from the radcheck table in sql? -Bob

1 2

Bug #86?
by Stefan Winter 20 Feb '06

20 Feb '06

Hi, it seems like bug #86 didn't make it into 1.1. Any chance of seeing this somewhen in the 1.1 branch? I'd work on it myself, but the path Alan describes in the bug comment sounds somewhat like spanish to me (and the patch I provided in #203 seems not clean enough, even to myself in retrospective) :-) Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Log file format
by Walter Reynolds 20 Feb '06

20 Feb '06

We have some tools that currently run some statistics on the radius accounting file. Well, we currently use a different radius server. With that in mind the log format is different. Is there a way to modify the format of the accounting log format? -- Walter Reynolds University of Michigan

2 1

cisco pptp+mppe problems on ios 12.3T and later
by jakobp 20 Feb '06

20 Feb '06

hi, maybe one of the cisco users here on the list can help me. I want to run dialin vpdn on a cisco 1712, using pptp tunnels with mppe encryption and authenticate against freeradius 1.1.0 The strange thing is, my setup used to work just fine, until i tried to upgrade IOS from 12.2 to 12.3T or 12.4. in both trains (> 12.2) mppe suddenly fails to work. a normal, unencrypted pptp works. "debug" shows that cisco gets a radius reply with ms-chap mppe attributes, but seems to miss/misunderstand something. "debug mppe" says: MPPE: keying material missing from radius the relevant parts of my cisco config: aaa authentication login vpnauth group radius aaa authentication ppp default group radius local aaa authorization network default if-authenticated aaa authorization network vpnauth group radius vpdn enable vpdn multihop vpdn source-ip 217.196.69.198 vpdn logging vpdn logging user vpdn logging tunnel-drop vpdn session-limit 10 vpdn search-order multihop-hostname vpdn-group pptp ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 lcp renegotiation on-mismatch interface Virtual-Template1 ip unnumbered FastEthernet0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly peer default ip address pool vpnpool compress mppc ppp encrypt mppe auto ppp authentication ms-chap ms-chap-v2 ppp eap refuse callin radius-server host x.x.x.x auth-port 1812 acct-port 1813 key xxx radius-server authorization default Framed-Protocol ppp radius-server vsa send accounting radius-server vsa send authentication ... and from radiusd.conf: mschap { authtype = MS-CHAP use_mppe = yes require_encryption = no require_strong = no } i already tried to find information or to change some of the config settings, but no luck :( thanks in advance, jakob

1 0

Migration. Please Help
by Marta Lajas 20 Feb '06

20 Feb '06

Hy all, Sorry for the stupid question but I dont have any C/Unix knowledge. We have a FreeRadius Server running in a machine. It is using a custom module (in order to authenticate to an ldap server) developed two years ago called rlm_ldap2. Now I am going to install FreeRadius in another machine and I want to use that custom module. Is it neccesary to install OpenLdap before? or is it enough to copy my rlm_ldap2.so in the directory with the other rlm_* libraries compiled during the FreeRadius installation? Thank you very much Regards, Marta --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

1 0

attribute Password in an Access-Reject packet
by Susana Macias 20 Feb '06

20 Feb '06

Hy all, I am trying to include two pairs attribute/value in my Radius Response Packet. This is my code: ... pairadd(&request->reply->vps, pairmake("Password", "***\n", T_OP_EQ)); pairadd (&request->reply->vps, pairmake("Reply-Message", "TID-2002", T_OP_EQ)); ... When I do some tests, I observe this: 1) If my radius Response Packet is an Access-Accept, the FreeRadius server sends: Received response ID 255, code 2, length = 71 User-Password = "***\n" Reply-Message = "TID-2002" 2) If my radius Response Packet is an Access-Reject, the FreeRadius server sends: Received response ID 252, code 3, length = 30 Reply-Message = "TID-2002" ---------------------------- * Why the Password attribute does not appear in the Access-Reject packet? * Why does the Password attribute (in the Access-Accept packet) appear like User-Password? Thank you very much Susana ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

4 6

RE: free realm
by Bart van Daal 20 Feb '06

20 Feb '06

thanks! -----Original Message----- From: freeradius-users-bounces+b.vandaal=edpnet.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+b.vandaal=edpnet.net@lists.freeradius.org] On Behalf Of Dusty Doris Sent: maandag 20 februari 2006 6:27 To: FreeRadius users mailing list Subject: Re: free realm > I'm looking for a solution to add a 'free' realm to my conf. > The object is to always send an access-accept if freeradius receives a > request from a NAS with username e.g. 'free/nonexistinguser/password' > > Is this possible with freeradius? > > thanks and have a nice week-end, > Bart Sure. Read the users manpage (man 5 users) and the comments in the users file. Here are some hints. DEFAULT Realm == "somerealm", Auth-Type := Accept or DEFAULT User-Name =~ "^[^@]@somedomain$", Auth-Type := Accept or someusername Auth-Type := Accept etc... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0