February 2006 - Freeradius-Users - lists.freeradius.org

(Cannot assign requested address) bind() failed
by tommy garsia 13 Feb '06

13 Feb '06

Hello all, I'm trying to run chilli with external radius server....e.g....the chilli machine's IP is 172.17.1.200 and then the radius is 172.17.1.222....this is the chilli.conf #radiuslisten 127.0.0.1 radiusserver1 172.17.1.222 radiusserver2 172.17.1.222 but, after i start chilli...it shows error like this:: hotspot: chilli --fg --debug ChilliSpot version 1.0 started. chillispot[3181]: ChilliSpot 1.0. Copyright 2002-2005 Mondru AB. Licensed under GPL. See http://www.chillispot.org for credits. chillispot[3181]: redir.c: 532: 99 (Cannot assign requested address) bind() failed chillispot[3181]: chilli.c: 3558: Failed to create redir is this a chilli error or radius error?? what should i do with my configuration?? regards, --------------------------------- Yahoo! Mail Use Photomail to share photos without annoying attachments.

3 3

freeradius src for mysql
by Radius User 13 Feb '06

13 Feb '06

hi members, can anyone inform me that what is the source file in freeradius-1.1.0, in where the mysql quiries for authentication and accounting is executed. thanks and regards...

2 1

Problem with PPTP and LDAP authentication.
by Joey McDonald 13 Feb '06

13 Feb '06

Hey gang, I'm still struggling getting freeradius and LDAP working to authenticate my PPTP users. I'd really appreciate if one of the guru's could have a look. I've wiped my old install and installed a fresh copy of freeradius and all the config files. Reading the list postings it's clearly best to make as few changes as posible to the config files. So, the bit's I've changed in radiusd.conf are as follows: modules { ldap { server = "ldap.mycompany.net" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "ou=people,dc=mycompany,dc=net" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" password_attribute = userPassword I uncommented the ldap section under authenticate: authenticate { ... Auth-Type LDAP { ldap } Then, I added my client in clients.conf. In users I added: DEFAULT Auth-Type := LDAP Fall-Through = 1 Those are all the changes I've made to the default configurations. I'm now storing my password(s) in the ldap directory in plain text. Using radtest from another machine on the network authenticates from the LDAP server just fine. Authentication from my PPTP server always gives me the following: rad_recv: Access-Request packet from host x.x.x.x:32792, id=112, length=149 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "joey" MS-CHAP-Challenge = 0x0a5f7e5035f0d2306105161cdf7060c4 MS-CHAP2-Response = 0xb600a2aa1bab3836758fcf6e48643de987c900000000000000003e30dd6e4b9c0b1d9bebde2c68fbab2aa625a5246217a002 Calling-Station-Id = "165.236.229.162" NAS-Identifier = "pptp" NAS-Port = 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Login incorrect: [joey/<no User-Password attribute>] (from client vpn-external port 0 cli 165.236.229.162) Sending Access-Reject of id 112 to x.x.x.x:32792 What am I doing wrong? Thanks so much! --joey

4 5

Kerberos 5
by John Metcalfe 13 Feb '06

13 Feb '06

Hello: We are having trouble compiling freeRADIUS version 1.1.0 rlm_krb5 module. Is this required for RADIUS with TLS and PEAP? Thank you John Metcalfe, Jr. IT Specialist - AIS IBM Business Consulting Services, Public Sector Telephone: 240-396-5305 email: metcalfej(a)us.ibm.com

7 11

Source file MySQL
by Radius User 12 Feb '06

12 Feb '06

hi members, can anyone inform me that what is the source file in freeradius-1.1.0, in where the mysql quiries for authentication and accounting is executed. thanks and regards...

1 0

Realm proxy HOW-TO??
by Danai Chudthong 12 Feb '06

12 Feb '06

Dear all I setup freeradius for my EAP-TLS with realm configuration and everything is fine. But I have some problem about database. The realm name is shown in table raddpostauth but it's not shown in table radacct which is more important. I checked in debug mode and found that freeradius send username with out realm to AP during post-auth process then AP send only username to freeradius for accounting. How to set freeradius to send user@realm to AP in post-auth? I'm not sure what I miss.. Any idea please? For more information, please review in sql query below. Thanks Danai mysql> select username, Realm, NASIPAddress, AcctStartTime, AcctStopTime from radacct where AcctStartTime >= 20060212; +----------+-------+--------------+---------------------+---------------------+ | username | Realm | NASIPAddress | AcctStartTime | AcctStopTime | +----------+-------+--------------+---------------------+---------------------+ | danai | | 192.168.1.2 | 2006-02-12 12:29:47 | 2006-02-12 12:44:32 | | danai | | 192.168.1.2 | 2006-02-12 12:44:34 | 2006-02-12 12:52:33 | | danai | | 192.168.1.2 | 2006-02-12 12:52:35 | 2006-02-12 16:23:09 | | danai | | 192.168.1.2 | 2006-02-12 16:23:10 | 2006-02-12 17:27:56 | | danai | | 192.168.1.2 | 2006-02-12 17:28:01 | 2006-02-12 17:30:48 | | danai | | 192.168.1.2 | 2006-02-12 17:30:52 | 2006-02-12 17:32:58 | | danai | | 192.168.1.2 | 2006-02-12 17:35:39 | 2006-02-12 17:35:45 | | danai | | 192.168.1.2 | 2006-02-12 17:35:46 | 2006-02-12 17:36:58 | | danai | | 192.168.1.2 | 2006-02-12 17:37:33 | 2006-02-12 21:56:37 | | danai | | 192.168.1.2 | 2006-02-12 17:53:49 | 2006-02-12 17:54:09 | | danai | | 192.168.1.2 | 2006-02-12 17:54:16 | 2006-02-12 18:03:05 | | danai | | 192.168.1.2 | 2006-02-12 18:03:09 | 0000-00-00 00:00:00 | | danai | | 192.168.1.2 | 2006-02-12 21:54:47 | 2006-02-12 21:55:06 | | danai | | 192.168.1.2 | 2006-02-12 21:55:39 | 2006-02-12 21:56:10 | | danai | | 192.168.1.2 | 2006-02-12 21:56:39 | 2006-02-12 22:25:04 | | danai | | 192.168.1.2 | 2006-02-12 22:12:11 | 2006-02-12 22:18:44 | | danai | | 192.168.1.2 | 2006-02-12 22:19:01 | 2006-02-12 22:19:23 | | danai | | 192.168.1.2 | 2006-02-12 22:20:01 | 0000-00-00 00:00:00 | | danai | | 192.168.1.2 | 2006-02-12 22:26:12 | 2006-02-12 22:26:34 | | danai | | 192.168.1.2 | 2006-02-12 22:26:35 | 0000-00-00 00:00:00 | +----------+-------+--------------+---------------------+---------------------+ 20 rows in set (0.00 sec) mysql> select user, NASIPAddress, date from radpostauth where date >= 20060212; +--------------------+--------------+---------------------+ | user | NASIPAddress | date | +--------------------+--------------+---------------------+ | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:29:47 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:44:33 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:52:34 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 16:23:10 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:28:01 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:30:51 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:35:39 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:35:46 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:37:33 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 17:53:49 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 17:54:15 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 18:03:09 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 21:54:47 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 21:55:39 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 21:56:39 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:12:11 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:19:01 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:20:01 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:26:12 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:26:35 | +--------------------+--------------+---------------------+ 20 rows in set (0.00 sec) __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

problem with checkrad
by Fazal Ahmed Malik 12 Feb '06

12 Feb '06

Hi, I am facing problem with checkrad in icradius. I am sorry for mailing this question on this mailing list because i could not find solution any where.We have recently added ascend MAX TNT in list of NAS, before that simultenous use was working fine, now with Max simultenous use is not working, in checkrad logs i have found that session id is 8 digits long but in NAS session id is 9 digits long so it get the user login. If any body has solution for this please help. Thanks, fam

1 0

RE: multiple huntgroup, same NAS-IP
by Jonathan De Graeve 12 Feb '06

12 Feb '06

> regexps huh!! > > care you post an example please? > > Thanks, =~ ^(huntgroup1|huntgroup2)$ Kind Regards Jonathan

1 0

Problem with freeradius on SuSE 9.2
by Neil Muller 12 Feb '06

12 Feb '06

I'm trying to install run freeradius on SuSE 9.2 Pro but when I try running using /usr/sbin/radiusd -sfxxyz I get the following error message: radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': rlm_exec.a: cannot open shared object file: No such file or directory however ls shows: callisto:/etc # ls -la /usr/lib/freeradius/rlm_exec* lrwxrwxrwx 1 root root 11 Feb 12 08:32 /usr/lib/freeradius/rlm_exec-1.0.0.la -> rlm_exec.la -rw-r--r-- 1 root root 7002 Oct 5 2004 /usr/lib/freeradius/rlm_exec.a -rw-r--r-- 1 root root 701 Oct 5 2004 /usr/lib/freeradius/rlm_exec.la I have the following rpms installed: freeradius-1.0.0-5 radiusclient-0.3.2-142 freeradius-devel-1.0.0-5 pam_radius-1.3.16-67 and radiusd.conf is jsut the SuSE 9.2 default at the moment The full output from radiusd startup is below. Can anyone help me track down where I have gone wrong. Thanks, Neil ***** radiusd -sfxxyg output ***** callisto:/etc # /usr/sbin/radiusd -sfxxyz Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': rlm_exec.a: cannot open shared object file: No such file or directory

1 0

RE: multiple huntgroup, same NAS-IP
by Jonathan De Graeve 11 Feb '06

11 Feb '06

> -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Agent > Smith > Verzonden: zaterdag 11 februari 2006 18:08 > Aan: FreeRadius users mailing list > Onderwerp: Re: multiple huntgroup, same NAS-IP > > > I have 100s of users but here is an example. > goal: > user u1: has access from NAS-IP 192.168.50.5 > user u2: has access from NAS-IP 192.168.5 and 6 > > currently I have huntgroup defination such as, > hu1 NAS-IP-Address 192.168.50.5 > hu2 NAS-IP-Adderss 192.168.50.6 > > Then in the users file, (sorry if the syntax is not > exactly correct here) > u1 Auth-by: Local, huntgroup: hu1 > u2 Auth-by: Local, hungrroup: hu2 > #then also, > u1 Auth-by: Local, huntgroup: hu2 Using regexp you can match both, that's how I do it

2 1