March 2006 - Freeradius-Users - lists.freeradius.org

Sending Access-Accept for everyone.
by Robert Myers 03 Mar '06

03 Mar '06

Is there a way to send access-accept all of the time? I've tried to do the DEFAULT in username, but that didn't seem to work for me. -Bob

1 0

virus through freeradius-user-request mail??
by Seferovic Edvin 03 Mar '06

03 Mar '06

I've got 2 mail containing viruses sent through freeradius-user-request.. was this email spoofed ( my antivirus software deleted the email so I had no chance to look at the headers etc ) or were email really sent through mailman? Regards, Edvin

2 1

type of lvalue in VALUE_PAIR
by Seferovic Edvin 03 Mar '06

03 Mar '06

Hi, I know this question is probably for the developer list, but I think someone can answer me without any further complications ;) As I "promised", I am patching freeradius ( sqlcounter actually ) so it can do traffic accounting. I have patched it but since I want to have the ability to set the limit by entering the amount of bytes ( in my backend ), I am limited by lvalue of value_pair struct. So values above a (ca) 4 GB are above the limit of uint32 right? What can I do to increase the limit without crashing the freeradius functions. Can I simply change it to uint64_t ( 2 ^64 should be enough ;) ) ??? Regards, Edvin PS: the patched freeradius is working and is able to account traffic, but I think it would not be RFC compliant because I haven't found the needed attributes in the dictionaries

2 4

Dual Server free radius
by Vasco Santos 03 Mar '06

03 Mar '06

Hi, I have question, its possible to put two radius servers runnig in same server with diferents ports?

3 2

RE: EAP module Problem
by King, Michael 03 Mar '06

03 Mar '06

> -----Original Message----- > > > yes ssl, is fun :-) > > now i have another problem, it seems that the the peap module > isnt loading... because when i will compile ./configure > rlm_eap_tls or other ssl modules he says me that iv not > installed openssl but i have installed it. > whats the problem??? > /usr/local/openssl i compiled it by myself... its > openssl-0.9.8a, and later ive installed with apt-get but the > same error... > > >alan I think you just said the magic words. (apt-get) Your using Debian. Are you using th Debian FreeRADIUS package? If so, OpenSSL support is not in the Debian Binary. (It's against the OpenSSL license to distribute it, there is a fun conversation on this in the Debian bug reports) I"ve got a doc on how to create your own local Debian package that includes OpenSSL and all the steps nesscary to install it. Email me directly, and I'll send it to you. I want to go over it a bit, it's still very rough in the later phases. (Joining to an Active Directory Domain) but it's pretty close to done in the building package statge. When I'm finished with it, I'm going to put it up on the Wiki.

1 0

Adding attributes to the reply of a proxied request
by Kristofer Sigurdsson 03 Mar '06

03 Mar '06

Hi list, I have a Linux box running FreeRADIUS 1.0.4. What I'd like to do is receive authentication requests for many groups of users from the same NAS boxes. The identifier for the different types of users would be the @domain part of their username. I'd like to proxy requests to different RADIUS servers based on their domain, which is fairly easy, but what I'd also like to do, is that when the reply from the other RADIUS server comes, add an attribute to the reply. For example: 1. A request comes in, it's user@dadada 2. FreeRADIUS sends a request to RADIUS server 192.168.2.1, because of the @dadada part. 3. RADIUS 192.168.2.1 replies with, "OK, accepted, Framed-IP-Address is this, Framed-Route is that..." 4. FreeRADIUS adds "cisco-avpair: lcp:ip vrf dadada-vrf" and sends the reply back to the NAS. Also, if at all possible, I'd like to be able to strip out attributes sent by the other RADIUS server, eg. if that server includes any cisco-avpair stuff (other than name servers), I'd like to strip that from the reply before it gets to the NAS. Any pointers would be appreciated. I've been looking through the archives, but I can't seem to find a way to modify the replies from the other RADIUS server. Thanks in advance, Kristo

2 2

Ldap-Group and EAP
by Benoît Bianchi 03 Mar '06

03 Mar '06

I have trouble to set up some authorization upon ldap attribute of the user: I have different SSID for my wireless LAN, using WPA or WPA2 with EAP/TTLS and ldap auth which work fine right now with Freeradius How can I prevent user without some ldap special attribute to get authenticated on a special SSID (which is send with the access request as: Called-Station-Id = "00-12-34-56-78-90:SSID" ) ???

1 0

realms in DB
by Santiago Balaguer García 03 Mar '06

03 Mar '06

1 0

EAP module Problem
by Konne 03 Mar '06

03 Mar '06

hi i ve a problem with the eap module, i think its a problem with the certificate... but i used the CA.all script from freeradius... freeradius:~# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/lbs-certs/priv-srv.pem" tls: certificate_file = "/etc/lbs-certs/cert-srv.pem" tls: CA_file = "/usr/src/802/radius/freeradius-snapshot-20060227/scripts/demoCA/cacert.pem" tls: private_key_password = "lbsbz23kliu87nfgqeq3" tls: dh_file = "/etc/lbs-certs/dh" tls: random_file = "/dev/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" 17062:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:454: 17062:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:425: 17062:error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib:ssl_rsa.c:669: rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap: Module instantiation failed.

2 3

SQL Accounting and Null Attribute Values
by trs 02 Mar '06

02 Mar '06

Accounting queries fail if an attribute is null when supplied as a value for certain column types. Partial line from debug output: radius_xlat: 'UPDATE radacct SET AcctStartTime = '2006-03-02 01:18:04', AcctStartDelay = '', It fails with: rlm_sql (sql): Couldn't update SQL accounting START record - ERROR: invalid input syntax for type bigint: "" Can freeradius substitute a zero if an integer attribute is missing from an accounting packet, instead of just a null value?

2 3