March 2006 - Freeradius-Users - lists.freeradius.org

FC5
by Sam Sein Muan Tie 30 Mar '06

30 Mar '06

hi all Got a bug from freeradius of FC5, i ended up using FC4 and radiusd. dont have the server no more but here's some debug information for those who might be able to help out on Redhat Fedora Core 5 Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. bt rad_recv: Access-Request packet from host 130.95.80.25:1812, id=84, length=149 NAS-IP-Address = 130.95.80.25 NAS-Port = 50002 NAS-Port-Type = Ethernet User-Name = "host/CSSE clients" Called-Station-Id = "00-16-C7-12-AE-C2" Calling-Station-Id = "00-50-BA-7E-22-7C" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001601686f73742f4353534520636c69656e7473 Message-Authenticator = 0x29a5526ff95c708b434eb6beefe28ac5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1208936784 (LWP 3491)] 0x0019acbd in ?? () from /usr/lib/rlm_preprocess.so (gdb) bt #0 0x0019acbd in ?? () from /usr/lib/rlm_preprocess.so #1 0x0019b2b1 in ?? () from /usr/lib/rlm_preprocess.so #2 0x080544eb in modcall () #3 0x08054ab7 in modcall () #4 0x080546bc in modcall () #5 0x08052a4e in read_mainconfig () #6 0x0804ca4c in rad_authenticate () #7 0x08055a75 in rad_respond () #8 0x080570b7 in main () (gdb) bt #0 0x0019acbd in ?? () from /usr/lib/rlm_preprocess.so #1 0x0019b2b1 in ?? () from /usr/lib/rlm_preprocess.so #2 0x080544eb in modcall () #3 0x08054ab7 in modcall () #4 0x080546bc in modcall () #5 0x08052a4e in read_mainconfig () #6 0x0804ca4c in rad_authenticate () #7 0x08055a75 in rad_respond () #8 0x080570b7 in main () (gdb) bt Sam

1 0

need to free string returned by cf_section_value_find ?
by jasonatx0001 30 Mar '06

30 Mar '06

Is the caller responsible for freeing the memory pointed to by the return value from cf_section_value_find ? Or does this just point to the memory owned by the conf_section which free radius will free on its own ? -- View this message in context: http://www.nabble.com/need-to-free-string-returned-by-cf_section_value_find… Sent from the FreeRadius - User forum at Nabble.com.

2 1

Adding 2 or more Framed-Routes
by Brent 29 Mar '06

29 Mar '06

Anyone know the correct way to add more then 1 framed-route? Here is what is setup now and this works. af_user Service-Type = Framed-User, Simultaneous-Use=1 Framed-IP-Address = 206.40.yyy.yyy, Framed-Route = "206.40.xxx.xxx/29 206.40.yyy.yyy 1", Do I just need to add a second Frame-Route like this? af_user Service-Type = Framed-User, Simultaneous-Use=1 Framed-IP-Address = 206.40.yyy.yyy, Framed-Route = "206.40.xxx.xxx/29 206.40.yyy.yyy 1", Framed-Route = "206.40.zzz.zzz/29 206.40.yyy.yyy 1", Thanks, Brent -- Yeah, I've Got Gmail! Yeah!

2 1

Re: Expiration Date using Freeradius 1.1.1 and mysql
by Atkins, Dwane P 29 Mar '06

29 Mar '06

I appreciate the input, I am looking for the README that will tell me how to use the Expiration attribute in the Users file, but how does one correlate it to the mysql database? Is there field in the radius database tables? Can I do a bulk add with dates that will allow me to do this? Thanks Dwane Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

1 0

PsionTeklogix 9150
by LUX Wissenmeyer Daniel 29 Mar '06

29 Mar '06

Hello, i would like to use freeradius authentication for psionteklogix 9150, instead of local authentication. Has sombody an experience with such client? thks, daniel

1 0

Shared secret is wrong, except that it isn't?
by seebs＠plethora.net 29 Mar '06

29 Mar '06

Okay, I'm sorta stumped here. I'm getting the exact behavior described for "shared secret is wrong", but I am pretty confident that it isn't. FreeRadius 1.1.1, installed on NetBSD 3.0/amd64. Synopsis: No matter how cleverly I try to make sure I have the right shared secret, I get garbage passwords. My clients file says: 127.0.0.1 foobar I'm using radtest: radtest user pw localhost 10 foobar I get: auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [beta1]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! There are no unprintable characters in the password I'm sending. So. The one thing I can think of is the 64-bit environment, because an old version of cistron-radiusd I was skimming once had a comment about assumptions about the size of long and the size of (void *). However, even then, I would expect that a radtest and a radiusd built and running on the same server would, even if they were doing it wrong, do it wrong in precisely compatible ways! So, uhm. Where exactly is this encryption happening? It looks like lib/radius.c is the place where shared secrets are used, but the code seems to be substantially different from the cistron code I vaguely remember from way back when. In particular, I don't remember this MD5 stuff... -s

3 3

Expiration Date using Freeradius 1.1.1 and mysql
by Atkins, Dwane P 29 Mar '06

29 Mar '06

Good morning all, I would like to be able to begin and expire accounts on certain dates, but I would like to be able to do it by input information into the radius database that I have created using mysql. Also, I appreciate the help you all have given. If I have one bit of information to share with new freeradius people, it is to slow down and do not get ahead of yourself. Once I took it step by step, all the piece feel into place. I get access-accepts using radtest, sql logins and even NTRadPing. So I have come quite far in a week. Thanks again. Dwane

2 1

RE: Different user attributes based on NAS-IP-Address? AlsoSuffixwildcards available?
by John Mylchreest 29 Mar '06

29 Mar '06

Can you give me an example in SQL please of how I might implement it using this fashion? Is it not just a case of if it passes radcheck, then it will respond with radreply? -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 28 March 2006 18:14 To: FreeRadius users mailing list Subject: Re: Different user attributes based on NAS-IP-Address? AlsoSuffixwildcards available? "John Mylchreest" <John.Mylchreest(a)ioko.com> wrote: > When you mean key off the NAS-IP-Address, do you mean like I > suggested in my previous example, or a cleaner solution? The NAS-IP-Address can be used as a check item, just like anything else. DEFAULT NAS-IP-Address == 1.2.3.4 Reply-Message = "Hello you guy from 1.2.3.4" The same config can be applied to SQL. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

2 1

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 29 Mar '06

29 Mar '06

Hi, > From: "Natalia Escalera" <nescalera(a)gmail.com> > > We tried FR 1.1.1 and we are still having problems with > passwords containing > special characters like '$' for the LDAP authentication. In > FR 1.1.0 the '$' > was replaced by a character such as '%24'. For the new > version, the symbol > '$' is deleted as well as the character that is next to it. Here is an > example of the executed command and its output: > > Command: > /usr/local/bin/radtest username "test$2006" x.x.x.x 1 test123 > Output: > Sending Access-Request of id 215 to x.x.x.x port 1812 > User-Name = "username" > User-Password = "test006" #<----- No dollar sign, no number 2 > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1 > rad_recv: Access-Reject packet from host x.x.x.x:1812, > id=215, length=20 That seems to be a problem with the radtest/radclient. Can you test with some "real" RADIUS client? The server may now work correctly but the special characters in User-Password seem to be "destroyed" by the radtest/radclient so they are never sent to the server. I haven't tested 1.1.1 yet, so unfortunately I cannot give more specific help :( -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

opening sockets in modules
by radhika putty 29 Mar '06

29 Mar '06

Hi.. Are we allowed to open sockets inside a module and communicate with other programs. If not then how else can we communicate with other network programs.. --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.

3 2