June 2006 - Freeradius-Users - lists.freeradius.org

Checking SSID via A/D Group
by Garber, Neal 23 Jun '06

23 Jun '06

We use Cisco 1232 AP's with EAP-PEAP-MSCHAPv2 to a Cisco ACS (RADIUS server). We would like to restrict access to SSIDs based upon Windows group membership. The ACS server is not capable of doing this. I currently have FreeRadius (1.1.2) installed under FreeBSD with OpenSSL 0.9.7d-p1 17 and Samba 3.0.20b. If the server is joined to an Active Directory domain, would it be possible to not just authenticate user/pwd through Samba, but also to check for Windows group membership based upon the SSID to which the user is trying to authenticate? If this is possible, can you suggest the general approach to implementing this? For instance, if we have SSID's: ssid1, ssid2 and ssid3 and we want to map ssid1 -> Windows group "ssid1 users" ssid2 -> Windows group "ssid2 users" ssid3 -> Windows group "ssid3 users" such that if the user is a member of the group and their credentials are valid, FreeRadius would return Access-Accept. If they aren't a member of the group or their credentials are invalid, it would return Access-Reject. I've seen some threads talking about putting a SSID attribute in LDAP. But, user's could be authorized for more than one SSID so it doesn't seem like that approach would work. Also, administratively, it's easier to identify/manage who is authorized for which SSIDs if it is done via group membership as opposed to a user attribute. Also, does FreeRadius support changing of passwords via MSCHAP to Active Directory when the password is expired? Thank you in advance for any help/guidance you can provide. Neal

2 1

Compiling Problem concerning `crypt' !!!
by Ravi pandey 23 Jun '06

23 Jun '06

Hi all, Attached the codes of error when I am compiling freeradius-1.1.2 When I finish ./configure, then MAKE, the error happens. I am not able to figure out where is the problem Please give any comment on the problem. Log created while creating MAKE is as follows : make[1]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2' Making all in libltdl... make[2]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/libltdl' /bin/sh ./libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c mkdir .libs gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c -fPIC -DPIC -o .libs/ltdl.lo ltdl.c: In function `lt_dlopenext': ltdl.c:2926: warning: unused variable `file_found' gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c -o ltdl.o >/dev/null 2>&1 mv -f .libs/ltdl.lo ltdl.lo /bin/sh ./libtool --mode=link gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -o libltdl.la -rpath /usr/local/lib -no-undefined -version-info 4:0:1 ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread rm -fr .libs/libltdl.la .libs/libltdl.* .libs/libltdl.* /usr/ccs/bin/ld -G -z defs -h libltdl.so.3 -o .libs/libltdl.so.3.1.0 ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lc (cd .libs && rm -f libltdl.so.3 && ln -s libltdl.so.3.1.0 libltdl.so.3) (cd .libs && rm -f libltdl.so && ln -s libltdl.so.3.1.0 libltdl.so) ar cru .libs/libltdl.a ltdl.o ranlib .libs/libltdl.a creating libltdl.la (cd .libs && rm -f libltdl.la && ln -s ../libltdl.la libltdl.la) make[2]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/libltdl' Making all in src... make[2]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/src' make[3]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/src' Making all in include... make[4]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/src/include' make[4]: Nothing to be done for `all'. make[4]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/src/include' Making all in lib... make[4]: Entering directory `/Home/ochome/rpathak/freeradius-1.1.2/src/lib' /Home/ochome/rpathak/freeradius-1.1.2/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I../include -c crypt.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I../include -c crypt.c -fPIC -DPIC -o .libs/crypt.lo In file included from crypt.c:31: /usr/include/pthread.h:299: error: parse error before '*' token /usr/include/pthread.h:300: error: parse error before '*' token /usr/include/pthread.h:301: error: parse error before '*' token /usr/include/pthread.h:302: error: parse error before '*' token /usr/include/pthread.h:303: error: parse error before '*' token /usr/include/pthread.h:304: error: parse error before '*' token /usr/include/pthread.h:305: error: parse error before '*' token /usr/include/pthread.h:306: error: parse error before '*' token /usr/include/pthread.h:308: error: parse error before '*' token /usr/include/pthread.h:309: error: parse error before '*' token /usr/include/pthread.h:311: error: parse error before '*' token /usr/include/pthread.h:312: error: parse error before '*' token make[4]: *** [crypt.lo] Error 1 make[4]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/src/lib' make[3]: *** [common] Error 2 make[3]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/Home/ochome/rpathak/freeradius-1.1.2' make: *** [all] Error 2 Ravi Kant Pandey --------------------------------- Do you Yahoo!? Next-gen email? Have it all with the all-new Yahoo! Mail Beta.

2 1

Re: Freeradius-Users Digest, Vol 14, Issue 95
by Walter Reynolds 23 Jun '06

23 Jun '06

Great, this worked. Now the question is what example config file had the suppress stanza under the detail auth_log section as well? Mine just listed it under the detail section so I did not know I needed to put it in both places. On Thu, 22 Jun 2006, freeradius-users-request(a)lists.freeradius.org wrote: > Date: Thu, 22 Jun 2006 20:15:54 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: So how do you suppress > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060622191554.GC23362(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > >> So how do I actually suppress the user password from the detail log based >> on this? Looking at the rlm_detail file and I might as well be looking at >> a foreign language. > > you can, for example, do somthing like this in radiusd.conf > > # Write a detailed log of all accounting records received. > # > detail { > # Note that we do NOT use NAS-IP-Address here, as > # that attribute MAY BE from the originating NAS, and > # blah blah blah > detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d > > detailperm = 0600 > suppress { > User-Password > } > > } > > > detail auth_log { > detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y% > m%d > > detailperm = 0600 > suppress { > User-Password > } > > } > > its SO much easier if you read the example config files that come with the > new release as they often contain HOW to use a feature/option/argument :-) > > alan > > -- Walter Reynolds University of Michigan

2 1

Radius Logs
by Grant Wright 23 Jun '06

23 Jun '06

Hi there Freeradius 1.1.2, Fedora Core 4, MySQL 4.1.16 I use the RADIUS logs to calculate usage for a client. What I want to do is separate the internal FTP traffic (which is classified as free traffic) from the rest of the traffic so that I can charge the client accordingly. Any Help would be appreciated, I am fairly new to this. Thanks

2 1

huntgroups and rlm_ldap
by adincov＠noos.fr 23 Jun '06

23 Jun '06

Hello, I need to store in a OpenLDAP backend some access control information based on NAS IP address. Normally this can be done via huntgoups and clients local configuration files. Does anyone know a simple method to put access control based on NAS IP in the LDAP backend? Thanks Alex

1 0

freeradius and certs
by unforgiver 23 Jun '06

23 Jun '06

Hi if i understand well i need 9 cert files: root.pem, root.p12, root.der cert-clt.pem, cert-clt.p12, cert-clt.der cert-srv.pem, cert-srv.p12, cert-srv.der i have demo certs but they expired. How can i create these 9 certs? i try with CA.all and i had multiple errors. is there another way? -- View this message in context: http://www.nabble.com/freeradius-and-certs-t1834817.html#a5007516 Sent from the FreeRadius - User forum at Nabble.com.

2 1

Re: error: Installed (but unpackaged) files(s) found: on REDHAT Enterprise 4.0 (RHEL4) and FreeRadius 1.1.2
by tadej.bregar＠guest.arnes.si 23 Jun '06

23 Jun '06

Hello, I'm struggling to build a RPM package on RHEL 4 also (based on freeradius.spec file), I have tried adding sed line as suggested in on of the previous posts and also suggested %doc lines, but with no success. How do i have to modify freeradius.spec file to build it successfully? Has anyone (besides Alberto Cruz) also managed to build RPM on RHEL 4? Thanky for any info, Tadej Bregar UPDATE: Yesterday I forgot to attach contents of freeradius.spec: ################################ Summary: High-performance and highly configurable RADIUS server URL: http://www.freeradius.org/ Name: freeradius Version: 1.1.2 Release: 0 License: GPL Group: Networking/Daemons Packager: FreeRADIUS.org Source0: %{name}-%{version}.tar.gz Prereq: /sbin/chkconfig BuildPreReq: libtool # FIXME: snmpwalk, snmpget and rusers POSSIBLY needed by checkrad Provides: radiusd Conflicts: cistron-radius BuildRoot: %{_tmppath}/%{name}-root %description The FreeRADIUS Server Project is a high-performance and highly configurable GPL'd RADIUS server. It is somewhat similar to the Livingston 2.0 RADIUS server, but has many more features, and is much more configurable. %prep %setup %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ --localstatedir=%{_localstatedir} \ --sysconfdir=%{_sysconfdir} \ --mandir=%{_mandir} \ --disable-ltdl-install \ --with-ltdl-lib=/usr/lib \ --with-ltdl-include=/usr/include \ --with-large-files --with-udpfromto --with-edir \ --with-rlm-sql_postgresql-include-dir=/usr/include/pgsql \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ --with-rlm-krb5-lib-dir=/usr/kerberos/lib make %install [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,rc.d/init.d} make install R=$RPM_BUILD_ROOT RADDB=$RPM_BUILD_ROOT/etc/raddb # set radiusd as default user/group perl -i -pe 's/^#user =.*$/user = radiusd/' $RADDB/radiusd.conf perl -i -pe 's/^#group =.*$/group = radiusd/' $RADDB/radiusd.conf # shadow password file MUST be defined on Linux perl -i -pe 's/# shadow =/shadow =/' $RADDB/radiusd.conf # remove unneeded stuff rm -f $RPM_BUILD_ROOT%{_mandir}/man8/builddbm.8 rm -f $RPM_BUILD_ROOT%{_prefix}/sbin/rc.radiusd cd redhat install -m 755 rc.radiusd-redhat $RPM_BUILD_ROOT/etc/rc.d/init.d/radiusd install -m 644 radiusd-logrotate $RPM_BUILD_ROOT/etc/logrotate.d/radiusd install -m 644 radiusd-pam $RPM_BUILD_ROOT/etc/pam.d/radius cd .. %pre /usr/sbin/useradd -c "radiusd user" -r -s /bin/false -u 95 -d / radiusd 2>/dev/null || : %preun if [ "$1" = "0" ]; then /sbin/service radiusd stop > /dev/null 2>&1 /sbin/chkconfig --del radiusd fi %post /sbin/ldconfig /sbin/chkconfig --add radiusd # Done here to avoid messing up existing installations for i in radius/radutmp radius/radwtmp radius/radius.log # radius/radwatch.log radius/checkrad.log do touch /var/log/$i chown radiusd:radiusd /var/log/$i chmod 600 /var/log/$i done %postun if [ "$1" -ge "1" ]; then /sbin/service radiusd condrestart >/dev/null 2>&1 fi if [ $1 = 0 ]; then /usr/sbin/userdel radiusd > /dev/null 2>&1 || : fi /sbin/ldconfig %clean [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root) # start of modification Tadej Bregar sed -i "s at doc/freeradius at doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile %doc doc/ChangeLog doc/README* todo/ COPYRIGHT INSTALL %doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX %doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema %doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend %doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover %doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas %doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file %doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ %doc doc/rlm* doc/supervise-radiusd.txt %doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALLa %doc doc/* # end of modification Tadej Bregar %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd %config (noreplace) /etc/raddb/* %{_bindir}/* %{_datadir}/%{name} %{_libdir}/* %{_mandir}/*/* %{_sbindir}/* %attr(0700,radiusd,radiusd) %dir /var/log/radius %attr(0700,radiusd,radiusd) %dir /var/log/radius/radacct %attr(0700,radiusd,radiusd) %dir /var/run/radiusd %changelog * Thu Dec 15 2004 Alan DeKok - update for 1.1.0 * Mon May 31 2004 Paul Hampson - update for 1.0.0 release * Fri May 23 2003 Marko Myllynen - update for 0.9 * Wed Sep 4 2002 Marko Myllynen - fix libtool issues for good * Thu Aug 22 2002 Marko Myllynen - update for 0.7/0.8 * Tue Jun 18 2002 Marko Myllynen - run as radiusd user instead of root - added some options for configure * Thu Jun 6 2002 Marko Myllynen - set noreplace for non-dictionary files in /etc/raddb * Sun May 26 2002 Frank Cusack <frank(a)google.com> - move /var dirs from %%post to %%files * Thu Feb 14 2002 Marko Myllynen - use dir name macros in all configure options - libtool is required only when building the package - misc clean ups * Wed Feb 13 2002 Marko Myllynen - use %%{_mandir} instead of /usr/man - rename %%postin as %%post - clean up name/version * Fri Jan 18 2002 Frank Cusack <frank(a)google.com> - remove (noreplace) for /etc/raddb/* (due to rpm bugs) * Fri Sep 07 2001 Ivan F. Martinez <ivanfm(a)ecodigit.com.br> - changes to make compatible with default config file shipped - adjusts log files are on /var/log/radius instead of /var/log - /etc/raddb changed to config(noreplace) to don't override - user configs * Fri Sep 22 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - spec file clear accordling to the libltdl fix and minor updates * Wed Sep 12 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - Updated to snapshot-12-Sep-00 * Fri Jun 16 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - Initial release ################################

2 1

Re: freeradius and certs
by Walter Reynolds 23 Jun '06

23 Jun '06

Knowing the errors might help, but here is a good web page with instructions: http://www.linuxjournal.com/article/8095 --------------------------- Date: Fri, 23 Jun 2006 00:40:20 -0700 (PDT) From: unforgiver <blood.pl(a)gmail.com> Subject: freeradius and certs To: freeradius-users(a)lists.freeradius.org Message-ID: <5007516.post(a)talk.nabble.com> Content-Type: text/plain; charset=us-ascii Hi if i understand well i need 9 cert files: root.pem, root.p12, root.der cert-clt.pem, cert-clt.p12, cert-clt.der cert-srv.pem, cert-srv.p12, cert-srv.der i have demo certs but they expired. How can i create these 9 certs? i try with CA.all and i had multiple errors. is there another way? -- View this message in context: http://www.nabble.com/freeradius-and-certs-t1834817.html#a5007516 Sent from the FreeRadius - User forum at Nabble.com. -- Walter Reynolds University of Michigan

1 0

ldap client side credential caching in freeradius-1.1.1
by bright spark 23 Jun '06

23 Jun '06

Hello Everybody, I would like to know whether freeradius supports ldap credential caching mechanism? According to the release notes, this support was added in dec'2000 and was removed in march'2003 because openldap latest version didnt support that. What happens if we use some other ldap servers or microsoft ADS? Is it possible to add this support in the latest release? Please reply me if you have any idea. Thanks, Jenni.

1 0

WIKI down
by Francois-Xavier GAILLARD 23 Jun '06

23 Jun '06

Hi list, when going on the wiki (http://wiki.freeradius.org,) identified as a registered user, there's a PHP error: Fatal error: Call to undefined function: getuser() in /srv/www/vhosts/wiki-freeradius/includes/Skin.php on line 546 Could anyone repair please ? :) Regards, Fox.

1 0