March 2006 - Freeradius-Users - lists.freeradius.org

radiusd and PEAP
by Riccardo.Veraldi 02 Mar '06

02 Mar '06

PEAP authentication will no work with kerberos is it irght ? I can use EAP-TTLS with kerberos and it works fine but not EAP-PEAP. is this because PEAP users mschapv2 which si a challenge ? thanks Rick

2 1

multiple User-Passwords
by Stefan Winter 02 Mar '06

02 Mar '06

Hi list, again something from the legacy-auth-backend to radius freak cabinet: I need to have more than one password for a small group of users (which had a seperate one for dial-up vs. other services). All of these pw are available in clear text, so I thought I could mis-use the mySQL tables to allow both with the following trick: Attribute: User-Password op: =~ Value: (pass1|pass2) This doesn't work; even though in my understanding it should. I found a different way: using the same syntax in the "users" file works beautifully: name User-Password =~ (pass1|pass2), Auth-Type := Accept That did it. However, I'd like to stick with pure SQL as a backend. Is there some reason why this doesn't work, or is it just a bug/inflexibility of the rlm_sql(_mysql) module? Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Radius Features
by mohammad flaifel 02 Mar '06

02 Mar '06

Hi all, I need to install a radius server and i already testes freeradius and seems is really good. i need to know if freeradius supports: - Change of Authorization while the subscriber's PPP session is still connected. - Disconnect users based on download volume limitation regards, Flaifel Regards, ------------------------------------------------------------------- Mohammad Flaifel Senior System Engineer Jordan Telecom Network Operation Center Tel: (+962) 6 5805-214 Mob: (+962) 777 374-933

2 1

Replace Cisco Secure ACS 3 with FreeRadius
by Michael Castillo 02 Mar '06

02 Mar '06

For our dial in users and some vpn clients we are using Cisco Secure ACS3 which is authenticating with Novell NDS. Would that configuration be possible using FreeRadius? Thanks

3 2

RE: Problem with ntlm_auth
by King, Michael 02 Mar '06

02 Mar '06

> -----Original Message----- > On Behalf Of Phil Mayers > > It is supposed to be like that. It's been like that forever > as far as I know. I don't know why it was working for you - > is your samba from an OS package and it's possible they > changed the perms? > > (It's even worse on RHEL4 systems - there's a buggy SELinux > policy that labels that directory so ntlm_auth can't access it!) Ack, it's even worse than I thought. I was running my previous FreeRADIUS server as root! So, that's why it didn't bite me before, it had root access. When I setup my new server, I had it running as it's own user account. Thanks for the answer. It always seems to be the simple things.

1 0

freeradius, user log in, simul use, and radius shut down
by Przemysław Backiel 02 Mar '06

02 Mar '06

Hello What I have to do, when: user connect (simultaneous use 1) and while he is conncected to the network I shut down the radius. After that, when he reconnect he is not able to login to the network, so my question how I can clean sth in sql or what i have to run, to clear that dead sesions after what, the user will be able to connect to the network -- Z powazaniem Przemyslaw Backiel

1 0

Long mysql queries in sqlcounter get truncated.
by Luis Zarrabeitia 02 Mar '06

02 Mar '06

Hi. I'm trying to configure a freeradius 1.1.0 [Debian testing] server with mysql backend, and I'm having trouble with the "sql counter" module. When trying to customize the query to obtain the remaining time (the default query does not reflect my enviroment), I find mysql syntax errors. Apparently, it is not processing the full query. Output of "freeradius -X". Note that I changed the actual query for brevity, as anything [valid] that I put in there seem to get me the same result. ------- rlm_sql_mysql: query: SELECT <pretty big and boring query> AND UNIX_TIMESTAMP(AcctStartT rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): database query error, SELECT <pretty big and boring query> AND UNIX_TIMESTAMP(AcctStartT: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 rlm_sql (sql): Released sql socket id: 2 radius_xlat: 'ime)+AcctSessionTime>'1138766400'' --------- (the original query on my radiusd.conf file is: SELECT <pretty big and boring query> AND UNIX_TIMESTAMP(AcctStartTime)+AcctSessionTime>'%b') Notice how the first line in the log is truncated to the "T" of "AcctStartT", that is, the first 251 characters of the query after applying the parameter expansion (%b, %k). (the length is always 251, regardless of the query - if I strip spaces from it I can fit more, but it is still not enough). Also notice how the end of the query is continued on the next "radius_xlat:" line. The query works perfectly with the command line mysql client (after %b and %k expansions). Glancing at the source I see a line "#define MAX_QUERY_LEN 1024" in rlm_sqlcounter.c, far greater than 251, wich makes me doubt that the problem lies in that size, and seems to confirm my suspicion that it might be a configuration parameter that I'm missing somewhere. Can you suggest either a solution or a workaround? (other than storing the query in a mysql5.0 'stored procedure', because I do not wish to add Debian Unstable to my production servers) Regards, Zarrabeitia

2 2

freradius and krb5 interaction
by Riccardo.Veraldi 02 Mar '06

02 Mar '06

Hello, I am using freeradius with EAP-TTLS + kereros authentication + ldap authorization. Everyhtign works but I have this error: rlm_krb5: verify_krb_v5_tgt: host key not found : key table erntry not found I checked and the permissions on /etc/krb5.keytab are correct... anyone has a hint for me ? thanks Rick

2 1

2 X Calling-Station-Id
by Przemysław Backiel 02 Mar '06

02 Mar '06

Hello, I have to limit posibility of loging to the network for one user, just to only 2 Calling-Station-Id how Can I do that? If I put 2 Calling-Station-Id into Radcheck table I am not able to log on to the network so.. my question is how can I limit user, that he can log only from 2 Calling-Station-Id ? -- Z powazaniem Przemyslaw Backiel

1 0

Problem with ntlm_auth
by King, Michael 02 Mar '06

02 Mar '06

So I'm setting up my freeRADIUS server to use Active Directory. I am closely mirror my existing installation. However, I receive this error message while running /usr/sbin/freeradius -X -A . (Which is one I did not encounter last time) (I have trimmed it to what I hope is the pertinent section) Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/run/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/run/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 Doing some reading (always a good thing) http://nixdoc.net/files/forum/about23951.html&highlight= (from a squid mailing list) I found that the windbindd_privileged directory was drwxr-x--- 2 root root 4096 2006-02-28 18:10 winbindd_privileged But it was also strong cautioned that you shouldn't change this, but to add the freeRADIUS to the group ownership of this directory. (I made the group of the directory freerad) Is this a recent change of Samba? I didn't have to do this a few months ago. More importantly, did I do something wrong? Or is this normal, and I just did notate that I did this before. Thanks Mike

2 1