May 2006 - Freeradius-Users - lists.freeradius.org

Proxy Error
by mad 24 May '06

24 May '06

Hello ! I have change the version of freeradius, before I had the 1.0.4 version and now the last CVS. I have a problem with the proxy configuration ... so I have change some things for have a "result". Like, before in the users file I rejected the request with an other realm, and at the end of the file I reject ... For example, for netA before I had DEFAULT Realm != "NetB", Realm != "NULL", Auth-type := Reject [...] DEFAULT Auth-Type := Reject And now I must comment this line for A proxy request at B. When A proxy request at B, and B try to response at B ... A "Received Unknown packet code 11from client 147.173.3.249 port 1812: Cannot validate signature Dropping packet without response." You know this error ? Thanks for your help Regards, Configuration For A ## In proxy.conf ## realm netB { type = radius authhost = IPRadiusB:1812 accthost = IPRadiusB:1813 secret = secretAB nostrip } ## In clients.conf ## client IPRadiusB { secret = secretAB shortname = cric nastype = other } /\/\/\ For B /\/\/\ ## In proxy.conf ## realm netA { type = radius authhost = IPRadiusA:1812 accthost = IPRadiusA:1813 secret = secretAB nostrip } ## In clients.conf ## client IPRadiusA { secret = secretAB shortname = cric nastype = other } ## And in the radiusd.conf ## proxy_requests = yes $INCLUDE ${confdir}/proxy.conf

2 4

RE: Expirey dates
by Chris Liles 24 May '06

24 May '06

Sure, Here is an example: mysql> select * from radcheck where UserName = 'guestuser35'; +----+-------------+-----------------------+----+----------------------+ | id | UserName | Attribute | op | Value | +----+-------------+-----------------------+----+----------------------+ | 35 | guestuser35 | Password | := | test | | 36 | guestuser35 | MS-CHAP-Use-NTLM-Auth | := | No | | 37 | guestuser35 | Expiration | := | 24 May 2006 23:00:00 | +----+-------------+-----------------------+----+----------------------+ 3 rows in set (0.00 sec) -- Chris Liles -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 24, 2006 11:56 AM To: FreeRadius users mailing list Subject: Expirey dates Importance: High Hi there I'm using Free radius 1.0.5 with mysql. i was wondering is there a way to setup where by if a user accounts expireds on 25/07/2006. when the user tries to get on on the 26th the user wont be let on cos the account has expired? Jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

1 0

RE: Freeradius + Wireless + AD
by Chris Liles 24 May '06

24 May '06

Get samba on the AD first, then install freeradius. Tons of docs about getting samba working with AD are on the net, after you get that working, come back and ask your freeradius questions. The default freeradius config only needs a couple of changes to accomplish what you want to get done. -- Chris Liles -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Kartthik Raghunathan Sent: Wednesday, May 24, 2006 11:21 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius + Wireless + AD I would like to know whether the freeradius can run on rhel v3 smooth. Also am planning to integrate my wireless AP (ie.linksys) with freeradius and for authentication going to use my active directory. So can someone please let me know what are the packages should i install for smooth compilation, really having hard time with this ! Thanks, Kartthik -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as… - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius + Wireless + AD
by Kartthik Raghunathan 24 May '06

24 May '06

I would like to know whether the freeradius can run on rhel v3 smooth. Also am planning to integrate my wireless AP (ie.linksys) with freeradius and for authentication going to use my active directory. So can someone please let me know what are the packages should i install for smooth compilation, really having hard time with this ! Thanks, Kartthik -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

please help me...........................................!!!!!!!!!!!!!!!!!!!!!!!!!!!11
by raviprakash sunkara 24 May '06

24 May '06

Hi Everybody.. Good morning. please help me i? Did anyone tell where " SIP training " held in India or any other place .... please excuse me for asking this , Bye -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com <b>

1 0

change proxy attributes
by André Lemos 24 May '06

24 May '06

isn't there a way to change the attributes my freeradius sends out to a proxy by messing with the users file? thanks DISCLAIMER: This message may contain confidential information or privileged material and is intended only for the individual(s) named. If you are not a named addressee and mistakenly received this message you should not copy or otherwise disseminate it: please delete this e-mail from your system and notify the sender immediately. E-mail transmissions are not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete or contain viruses. Therefore, the sender does not accept liability for any errors or omissions in the contents of this message that arise as a result of e-mail transmissions. Please request a hard copy version if verification is required. Critical Software.

2 4

Freeradius + GoRemote Authentication
by Chris Armstrong 24 May '06

24 May '06

Hello I want to change from Radiator/LDAP to Freeradius/MySQL. My problem is that i don't know how to configure GoRemote in Freeradius. On Google i don't seem to find an example how this has to be setup. Can somebody tell me how i do this in Freeradius? In clients.conf i have added following: client 216.231.206.61 { secret = mysecret shortname = GoRemote } Where do i have to put the realm part and how should it look? Below you see my configuration in radiator. Thanks for you help. Chris The configuration in radiator looks like this: clients.cfg --------------------------------- # Requests from GoRemote <Client 216.231.206.61> Secret mysecret Identifier GoRemote </Client> realms.cfg ----------------------------------------------- # GoRemote redirect <Handler Client-Identifier=tnt,Realm=/..*/> AuthByPolicy ContinueAlways AuthBy GoRemote <AuthBy RADIUS> Host 216.231.206.81 Secret mysecret AuthPort 1645 AcctPort 1646 RetryTimeout 10 RejectEmptyPassword </AuthBy> </Handler>

1 0

Attributes and LDAP
by Marek Gradzki 24 May '06

24 May '06

Hi. I am currently using FreeRadius server 1.0.2 on Solaris 8 with LDAP authentication and MySQL accounting for PPPoE sessions with ADSL technology. Everything works fine, but some problems appeared lately. User profiles are stored in some subtree of LDAP server. Each user has an attribute radiusGroupName set to test (for example). I would like to setup some common attribute values in the group profile, which is also stored in the LDAP server but in the other subtree, and import them to user profile during authentication. Now it does not work. Unfortunately I do not have much space to experiment because it is working configration and I really do not have an idea how to setup this kind of behaviour. Parts of my config files are below: _huntgroups: _cisco NAS-IP-Address == 192.168.0.211 _clients.conf: _client 192.168.0.211 { secret = cisco nastype = cisco shortname = c7200vxr } _radiusd.conf:_ # MODULE CONFIGURATION modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } ldap { server = "ds1i.ostisp.intra ds2i.ostisp.intra" identity = "cn=freeradius,ou=admins,o=radius,dc=ostnet,dc=pl" password = radius basedn = "ou=users,ou=adsl,o=radius,dc=ostnet,dc=pl" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" password_attribute = userPassword # access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap_ext.attrmap groupname_attribute = radiusGroupName groupmembership_filter = "(cn=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile)" groupmembership_attribute = radiusGroupName ldap_connections_number = 40 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp # username = %{User-Name} username = %{Stripped-User-Name:-%{User-Name}} case_sensitive = no check_with_nas = yes perm = 0600 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } $INCLUDE ${confdir}/sql.conf } # Instantiation instantiate { expr detail } authorize { preprocess chap ldap files } # Authentication. authenticate { Auth-Type CHAP { chap } Auth-Type LDAP { ldap } Auth-Type PAP { pap } unix } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique suffix files } # # Accounting. Log the accounting data. # accounting { sql } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } _users: _DEFAULT Ldap-Group == disabled, Auth-Type := Reject Reply-Message = "Blocked account." DEFAULT Huntgroup-Name == cisco, LDAP-Group == ostinternet, User-Profile := "cn=ostinternet,ou=profiles,ou=adsl,o=radius,dc=ostnet,dc=pl" Fall-Through = no DEFAULT Huntgroup-Name == huawei, LDAP-Group == ostinternet, User-Profile := "cn=ostinternet,ou=profiles,ou-adsl,o=radius,dc=ostnet,dc=pl" Fall-Through = no Write if You have any ideas. Thanks in advance.

2 3

returning variable as HEX in Access-Accept
by Michael Kopp 24 May '06

24 May '06

Hi all, I have maybe a strange request OK I receive some Attributes in Access-Request and I have to return the HEX values of the received Attribute back to the NAS within the Access-Accept message. For example I receive for instance "Framed-MTU" = 1500 in Access-Request and now I have to put in the Access-Accept Class = "05DC" (the hex value of the framed-MTU) and sent it back to the NAS. I already tried several things but cannot get it to work. What I tried Class = `%{Framed-MTU}`, but then I only get the integer value in the class attribute If I do something like Class = 0x`%{Framed-MTU}`, I just get an parser error Additionally I have to add a second variable into the Class attribute, is this also possible to tie together the both variables and sent their Hex value back in Class attribute ? or maybe just one variable and a fixed other value ? Like "Class = 0xAAAA`%{Framed-MTU}`, (Also with this I get a parser error ) Hope my explanation is clear, I know strange request ;-) Is the stuff what I try to achive even possible ? and if yes, can somebody show me how ? I cannot find a answer in the archive and in the man pages Thanks Michael -- Bis zu 70% Ihrer Onlinekosten sparen: GMX SmartSurfer! Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer

3 2

FreeRadius 1.1.1 and run-away CPU
by Aaron Burruss 24 May '06

24 May '06

Hi all. I'm running freeraduius 1.1.1 on a FreeBSD 5.4 server. I'm using the mysql module (mysql 4.0.24), and everything seems to be working fine... but at random times, the CPU becomes pegged by the radiusd process, and it will stop accepting requests from my clients. This does not (seem to) occur when I run in debug (-X), but I obviously don't want to run it in that mode for the long term. I've looked around, and can't seem to find anything that might be causing this to happen. last pid: 3745; load averages: 0.51, 0.26, 0.53 up 0+18:46:06 09:29:34 41 processes: 2 running, 39 sleeping CPU states: 46.7% user, 0.0% nice, 52.9% system, 0.4% interrupt, 0.0% idle Mem: 41M Active, 315M Inact, 105M Wired, 12K Cache, 111M Buf, 535M Free Swap: 1024M Total, 1024M Free PID USERNAME PRI NICE SIZE RES STATE TIME WCPU CPU COMMAND 3744 root 115 0 4172K 3240K RUN 0:42 98.62% 86.57% radiusd 536 mysql 20 0 57672K 33996K kserel 1:07 0.00% 0.00% mysqld 414 root 96 0 3476K 2808K select 0:01 0.00% 0.00% sendmail This is a 2.8GHz box with 1GB ram. Restarting the daemon sometimes helps, for a while, then high CPU again. Sometimes it spikes up immediately. Reboot has not helped. Thoughts? -A

3 3