February 2006 - Freeradius-Users - lists.freeradius.org

Re: (Cannot assign requested address) bind() failed
by Sean 15 Feb '06

15 Feb '06

On Mon, 2006-02-13 at 12:08 +0100, freeradius-users-request(a)lists.freeradius.org wrote: > Re: (Cannot assign requested address) bind() failed Hi Tommy, If you are using DD-WRT you might be making a common mistake. It won't accept a Web name for re-direction. You have to use an IP address. EG 123.123.123.123/hotspotlogin.cgi/ It is also vital to put a / at the end of the address. I've written a tutorial that might help you at http://swarmhotspots.com/faq.html and I also provide free FreeRadius testing for Chillispot at http://swarmhotspots.com/Chilli-Test-Area Regards, Sean Bracken http://swarmhotspots.com

2 1

Multiple LDAP Search Bases - Per NAS
by Ben Plimpton 15 Feb '06

15 Feb '06

Hello all Is it possible to setup FreeRadius so that requests coming from a certain NAS will use a different search base than the default? For example: We have an ou=radius,dc=test,dc=com and we stick dsl users records in there. These user records have attributes that would be dsl specific like static IP addressing. We would like to be able to provide users with a backup dialup in case anything goes really wrong with our dsl service. Could we configure FreeRadius to look in a different ou, say ou=dialup,ou=radius,dc=test,dc=com, when it received an authentication request from the dialup NASes? Is this possible? We have also considered running two instances of FreeRadius, one on the higher ports and one on the lower, and then pointing the DSL customers to one and the dialup to another, but I would like to avoid this if there is a cleaner solution that I am not aware of. Our FreeRadius server is running Fedora Core 4 and FreeRadius 1.0.4 OpenLDAP is our LDAP backend. Thanks for any replies. -- "Microsoft is not the answer, it's the question. NO is the answer." Ben Plimpton Network Engineer bplimpton(a)sopris.net 970-963-SURF(7873) ext 5174 www.sopris.com

2 1

Cisco aaa authorization network
by Stefan Winter 15 Feb '06

15 Feb '06

Hello, while migrating a NAS (Cisco AS5300) from TACACS+ to RADIUS I stumbled over some peculiarities of the equipment. When configuring with aaa authentication network default group radius aaa authorization network default group radius and having a user logging in with PPP, it seems that the NAS expects some of the Cisco-AVPairs, but I don't exactly know what to send him. Since I send the wrong things, I'm in the situation that authentication succeeds (Access-Accept), but subsequent authorization fails. I know this is slightly off-topic for the list, sorry, but I'm really at the end of my knowledge here, maybe someone has a clue. The old TACACS+ config was group = DialupUser { maxsess = 2 service = ppp protocol = ip {} service = ppp protocol = multilink {} } which I thought I could convert into the following entry in the users file DEFAULT NAS-IP-Address == 158.64.2.6 Framed-Protocol := PPP, Cisco-AVPair += "ppp:protocol=ip", Cisco-AVPair += "ppp:protocol=multilink" but either that was not sufficient and I need more Cisco-AVPairs or it's plain wrong (the attributes get sent alright, it's just not what the NAS likes). Instead of "ppp:" I also tried "lcp:" "ipcp:" and "network:". None of this impresses the AS5300, and turning on debugging didn't reveal what he would expect instead. Can someone help out? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

(no subject)
by Herman Swensson 15 Feb '06

15 Feb '06

Hi, I have installed Radius and get the next eror radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "(null)" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain 20360:error:0200100E:system library:fopen:Bad address:bss_file.c:259:fopen('','r') 20360:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:261: 20360:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:758: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1902] Unknown module "eap". radiusd.conf[1849] Failed to parse authenticate section. What have I to change Greeting Herman -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 267.15.8/260 - Release Date: 14-2-2006

2 2

silently drop packet (access-request)
by Andriy Gapon 15 Feb '06

15 Feb '06

Is there a way to force a silent drop of a packet instead of sending Access-Reject ? I am interested in both doing this through configuration file(s) and doing this from a module (e.g. with some special return code or attribute). On a somewhat related note: is there way to make FreeRADIUS server drop/reject all incoming packets without Message-Authenticator the same way it does this for packets with invalid/incorrect value in that attribute ? Preferably through configuration, without changes in code. -- Andriy Gapon

2 6

PAP credentials against AD?
by Josh Howlett 15 Feb '06

15 Feb '06

Is it possible to authenticate PAP credentials from the NAS against a Windows domain using NTLM? I've tried using the mschap module, but it expects to see a Challenge that the NAS doesn't provide. thanks, josh.

3 3

Tagged VSA
by Klier, Martin 15 Feb '06

15 Feb '06

We are using tagged VSA (i.e. SIP-From). I think, it isn't standard. without the has_tag entry, behind the regarding attribute in the dictionary file, i see in Debug Mode: SIP-From = "\001sip:abcd@xyz:5060" SIP-From = "\002sip:abcd@xyz:5060" With "has_tag" entry SIP-From:1 = "sip:abcd@xyz:5060" SIP-From:2 = "sip:abcd@uvw:5060" Is it possible, to write the the two tagged attributes (with has_tag entry) in a mysql- database at all ? If it is, how the variable ( %{SIP-From} ) in the sql.conf has to look like Used version 1.0.2-5 regards, Martin

2 1

how to disconnect user after quota given to him finishes ?
by Rupesh Amatya 15 Feb '06

15 Feb '06

Dear all, I am using Freeradius(with mysql as database for users ) with Mikrotik as NAS. This for PPPOE users. I used Dialup Admin to manage freeradius. There is default package of 4hours/day but the users do not get disconnect after 4 hours. It just shows " Out of Quota". What needs to be done to automatically disconnect user after the daily quota is finished ? Hope to get help ..... Thanking you Rupesh

2 1

using scripts for sql.conf
by Maqbool Hashim 15 Feb '06

15 Feb '06

Hi, Is it possible to reference a script from within sql.conf? I'd like to do some checks and inserts on the sql database just before the auth_check query in sql.conf. Whats the best way of doing this? Thanks Maqbool

3 4

ascend-data-filters
by squirrel＠isot.com 15 Feb '06

15 Feb '06

I been told that I need to configure "ascend-data-filters" to pass ADF's to make port 25 work for our dialup users. Does he mean something like this? Ascend-Data-Filter = "ip in forward destport = 25" ************************************** Computer problems? ................... ..............http://www.multibyte.net

3 3