May 2006 - Freeradius-Users - lists.freeradius.org

Fwd: Regular expression - Trying to rewrite User-Name
by Damian Porter 11 May '06

11 May '06

the user-name is coming to the radius process without any dashes and i want to add dashes to separate the octets. I have looked an that document and it does not offer a solution for the problem.

3 3

Regular expression - Trying to rewrite User-Name
by Damian Porter 11 May '06

11 May '06

I have bee struggling with problem for a few days now. I use Centos 4.3 and freeradius 1.0.1. I am trying to rewrite a username to include dashes. see my statement below in the rewrite section. searchfor = "([a-z0-9]{2})([a-z0-9]{2})([a-z0-9]{2})([a-z0-9]{2})([a-z0-9]{2})([a-z0-9]{2}) replacewith = "%{1}-%{2}-%{3}-%{4}-%{5}-%{6}" this is the output that i am getting in my radius.log file. Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Thu May 11 14:36:24 2006 : Info: Ready to process requests. Thu May 11 14:36:39 2006 : Auth: Login incorrect: [0e35-353afe-3afe19-fe19/NOPASSWORD] (from client$ Thu May 11 14:38:49 2006 : Auth: Login incorrect: [13ce-ce20f9-20f949-f949/NOPASSWORD] (from client$ Thu May 11 14:38:56 2006 : Auth: Login incorrect: [0e35-353ad7-3ad71b-d71b/NOPASSWORD] (from client$ PS i have even gone as far as downloading regular expression programs to check my code. If anybody has any suggestions or has encounted this problem before let me know.

3 2

Rm: Mysql 5.0 with freeradius 1.1.1
by elimachi＠entelsa.entelnet.bo 11 May '06

11 May '06

Dear list: I´m taking up again my work with freradius since two years ago. Now I´m working over a RHE AS linux distribution box and working with a Mysql 5.0. In this version the password hashing algorithm has changed and differ from Mysql 3.x or 4.x. Then I´d like to know if freeradius engine will work without problems with Mysql 5.0 or later. Refer this article: I´ll be very grateful with your comments. Thank you. Edu.

2 1

Nested groups in ldap
by Kobiske, Rob 11 May '06

11 May '06

I was wounding if there was a way for ldap to look into nested groups. I have enabled ldap groups, and I have a ldap group that contains another group, and I would like ldap to search with in that main group and nested group to see if a user belongs to either group. If anyone know how to do this with freeradius+ldap, please let me know. Thanks, Rob Kobiske

1 0

Freeradius and MySQL
by Jeremy ohara 11 May '06

11 May '06

Hi there i have free radius updated on fedora. got a mysql database. but from what i'm noticing its not being check on the database. got dialupadmin installed and using that to put the accounts into the database. and have setup freeradisu with the db Jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

2 1

Strange error
by Jeremy ohara 11 May '06

11 May '06

Hi there i just setup freeradius with mysql when i try to use a test radius program to test the radius to see if it works i geot error: warning bad radius packet form host x.x.x.x: unknown packet code 100 does anyone know what th is means? jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

5 8

Re: radius filters for ldap searching
by Terry J Fike Jr 11 May '06

11 May '06

The only way i got this to work, was seperate trees in ldap for each group. and then in your default line in your users file put the tree you want it to search for the group and nas definition. > > Message: 2 > Date: Thu, 11 May 2006 12:52:47 +0300 > From: Mircea Harapu <mircea.harapu(a)rcs-rds.ro> > Subject: radius filters for ldap searching > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4463096F.3010605(a)rcs-rds.ro> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hello, > > I'm using freeradius 1.0.4 with openldap 2.2.24 to authenticate users on > cisco switches. > Every switch belongs to a specific group and for every user I'm setting > the groups he can access. I also use cisco avpairs for level privilege. > So far , so good! > The problems occured when I tried to make a user to have different level > privileges on different switches . > This is the profile I'm using : > > # test, radius, isp.ro > dn: uid=test,ou=radius,dc=isp,dc=ro > uid: test > objectClass: radiusprofile > cn: test > userPassword:: xxx > radiusGroupName: bucuresti > radiusGroupName: valcea > radiusServiceType: NAS-Prompt-User > > # bucuresti, test, radius, isp.ro > dn: cn=bucuresti,uid=test,ou=radius,dc=isp,dc=ro > uid: test > objectClass: radiusprofile > userPassword:: xxx > radiusGroupName: bucuresti > radiusServiceType: NAS-Prompt-User > radiusCiscoLevel: "shell:priv-lvl=15" > cn: bucuresti > > # valcea, test, radius, isp.ro > dn: cn=valcea,uid=test,ou=radius,dc=isp,dc=ro > uid: test > objectClass: radiusprofile > userPassword:: xxx > radiusGroupName: valcea > radiusServiceType: NAS-Prompt-User > radiusCiscoLevel: "shell:priv-lvl=7" > cn: valcea > > raddb/users > # Switch 192.168.50.202 > # Descriere test > DEFAULT NAS-IP-Address == 192.168.50.202, Ldap-Group == bucuresti > Fall-Through = no > DEFAULT Auth-Type := Reject > > what I need is to filter the ldap search in authorize section based on > GroupName and I don't know how. -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

1 0

Re: Solaris 8/SPARC - MySQL 5.0 NDB Cluster - Freeradius 1.1.1 with rlm_sqlippool module: 'radiusd' segmentation fault
by Robles Rodriguez,Alejandro 11 May '06

11 May '06

"Alan DeKok" <aland(a)nitros9.org> wrote: >> I have for the past 4 weeks been trying to evaluate if FreeRadius >> can be used as a AAA in an UMTS network with a large amount of >> subscribers for the GPRS Data services. > I believe others are doing this today. > FreeRADIUS scales very well. 10 million subscribers shouldn't be a >problem in a carefully designed system. Well, I'm wondering if this is in a clustered configuration i.e. multiple nodes handling the load and cooperating (sharing data such as IP pools). If this is the case I'd be interested to know a few accounts to find out more about their architecture (behind freeradius such as database servers, etc). Any clues? I'd really like o create some sort of standard architecture for freeradius that can scale and is reliable and have it in a "real" environment for a while for others to have confidence when making this same decision that I'm about to make. >> I'm done for now more details will come later meanwhile I have a >> question: is the rlm_sqlippool module going to be part of a >> freeradius release in the near future and if not, what would it be >> the procedure to follow for it to happen? > An uopdated version of the module is in CVS head. If there's >interest, it could be back-ported to 1.1.x. I have compared my version with that of the CVS root and apart form some small differences that I'll investigate further I noticed that it has the same bug that I found. The problem is that I don't know how to report it. Can you help? Also I think it'd be a good idea to back-port it to 1.1.x. Who decides this and how do I express my interest? Thank you! Cheers, Alejandro Robles.

2 1

FreeRADIUS, MySQL and usergroups again
by Michael Schwartzkopff 11 May '06

11 May '06

Hi, I want to authorize users according to the membership in a group. With Auth-Type=System it is easy: DEFAULT Auth-Type = System, Group == "RASUser" Is there any analogy to this setup in the sql module? Thanks for any help, I am quite desparate already ... -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

2 2

MySQL: Group membership test
by Michael Schwartzkopff 11 May '06

11 May '06

Hi, As a backend database to RADIUS I use MySQL. No I have a special problem: I want to autorize a user for a specific service only if the user is member of a specific group, say "RAS_User". This configuration is nescessary because this database is used also for other authentication/autorization. The documentation says, that the authcheck_table is beeing searched for the user and the reply items in the authrepl_table are returned for the user. I did not find any hint how to configure my freeradius that way, that the user is autorized to use the service only if he is member of a specific group. The groupcheck is only adds further attributes. In the ldap module f.i. I can use the "groupmembership_filter". Is there anything similar in the sql module? How can I configure freeradius or the sql module to test the group membership? Thanks for any help. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

2 2