July 2006 - Freeradius-Users - lists.freeradius.org

Radius CDR'S
by ravi reddy 06 Jul '06

06 Jul '06

Hi FreeRadius users, Presently Iam using FreeRadius-1.1.1 with SER iam getting all account start & account stop details in to the Radius database This is a Raw data what I mean is iam gettting two or three messages for one call . So , in order to get them like a CDR per customer what is the way to do it ? Do we have to rely on other softwares? if yes please tell me i will go through that process . Thanks To FreeRadius , Regards, Ravi.

1 0

Re: problem in configuring PEAP on freeRADIUS1.1.2
by Pradeep Sengar 06 Jul '06

06 Jul '06

Thanx Zoltan Ori for ur comments. before getting ur reply i was able to run freeradius server for peap after making following changes in eap.conf file in tls module xxxxxxxxxx eap.conf xxxxxxxxxx tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } xxxxxxxxxxxxxxxx eap.conf ends herexxxxxxxxxxxxxxxxxxxxxxxx problem persisted till i added last line( random_file = ${raddbdir}/certs/random) and started working fine after this addition without creating any certificate(i didn't create any). but after this although i m able to start server but its not accepting any requests. What can be the reason? One more query: in clients.conf file we mention the IP range for APs or for end client(supplicant). Regards Pradeep Singh Date: Wed, 5 Jul 2006 09:33:14 -0400 From: Zoltan Ori <z.ori(a)morehead-st.edu> Subject: Re: problem in configuring PEAP on freeRADIUS1.1.2 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200607050933.14945.z.ori(a)morehead-st.edu> Content-Type: text/plain; charset="iso-8859-1" On Wednesday 05 July 2006 08:48, Pradeep Sengar wrote: > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: SSL error error:0200100E:system library:fopen:Bad address > rlm_eap_tls: Error reading certificate file > rlm_eap: Failed to initialize type tls Did you create any certificates? Are they stored where you indicate in eap.conf? Do they have the proper permissions? Zoltan Ori --

1 0

Radius + Dhcp Server
by Emerson 05 Jul '06

05 Jul '06

Hi, First freeradius user's i need to thank's a everyone, for help's. My freeradius is now working....and authing with eap-tls/ttls/peap...everithing ok. Now i need to deliver IP to my clients after auth. Anyone say to explain, if it work ? And how work...... Thank's..... Emerson

2 1

Radtest failes on new installation. System: FreeBSD6.0-RELEASE
by Göran Nilsson 05 Jul '06

05 Jul '06

Godday. I have installed the latest Freeradius on a FreeBSD6.0 box. The installations goes fine and I'm for the initial tests. I start up the server with "radiusd -X" to get the initial debugging information. The server starts up just fine and doesn't produce any warnings or errors. Eventually it says "ready for prosessing" In another window i do the "radtest test test localhost 0 testing123" This is were the strage part comes in. In the "debug" window i don't see anything. In the command windows i get the response "radclient: Xfailed to get value" So, i dig a little deeper and fire up another window where fire up tcpdump. When doing the ocmmand i will get the "radclient: ....." but no output from tcpdump nor from the debug window. This is where I'm stuck. Is this something related to FreeBSD 6.0? Since the most people recommend doing small changes to configs and then test connectivity in order to not break anything I haven't made any changes whatsoever to my configs. Well, that's about it. Thanks in advance for any ideas,tips or pointers /Goran

2 3

ntlm_auth and clear-text passwords
by robiwan＠arcor.de 05 Jul '06

05 Jul '06

Dear all, For AAA-Authenticating on a Cisco Catalyst Switch 3750, i try to use use the ntlm_auth to authenticate users against our Active Directory (domain-name: SOUTH). Users telnet the switch, therefore a clear-text password will be sent. according to an earlier posting http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-July/045377… i did this: > What you need to do is to configure a *different* ntlm_auth, only > for clear-text passwords. The simplest way to do this is to use the > "exec" module: > > modules { > ... > exec win_domain { > wait = yes > input_pairs = request > output_pairs = reply > program = "ntlm_auth --username=\"%{User-Name}\" --password=\"%{User-Password}\" --domain=usmisgne" > } > ... > } > > Now list "win_domain" in the "authenticate" section, and add the > following entry to the "users" file: > > DEFAULT Auth-Type = win_domain > But the authentication still fails. My ntlm_auth shell-command works: ~# /usr/bin/ntlm_auth --username="john.smith" --password='smith1000' --domain=SOUTH NT_STATUS_OK: Success (0x0) ....but authentication via freeradius fails. Here are my config files and the complete freeradius -X output: my radiusd.conf file: ----------------------------- prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = no require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } ldap { server = "10.187.64.3" identity = "CN=Hans Dampf,CN=Computers,DC=winlab,DC=rsnhm,DC=t-com,DC=de" password = Gerti1000 basedn = "DC=winlab,DC=rsnhm,DC=t-com,DC=de" filter = "sAMAccountname=%{User-Name}" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } exec win_domain { wait = yes input_pairs = request output_pairs = reply program = "/usr/bin/ntlm_auth --username=\"%{User-Name}\" --password=\'%{User-Password}\' --domain=SOUTH" } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap Auth-Type win_domain{ win_domain } } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } here is my users file ---------------------------- hugo User-Password == "hugo01" Service-Type = Login, Cisco-AVPair = "shell:priv-lvl=1" DEFAULT Auth-Type = win_domain freeradius -X --------------------- freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "10.187.64.3" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "CN=Hans Dampf,CN=Computers,DC=winlab,DC=rsnhm,DC=t-com,DC=de" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "Gerti1000" ldap: basedn = "DC=winlab,DC=rsnhm,DC=t-com,DC=de" ldap: filter = "sAMAccountname=%{User-Name}" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP uid mapped to RADIUS $GENERIC$ conns: 0x81215a8 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = yes peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) exec: wait = yes exec: program = "/usr/bin/ntlm_auth --username="%{User-Name}" --password='%{User-Password}' --domain=SOUTH" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "(null)" Module: Instantiated exec (win_domain) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:35261, id=176, length=64 User-Name = "john.smith" User-Password = "smith1000" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "john.smith", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 99 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for john.smith radius_xlat: 'sAMAccountname=john.smith' radius_xlat: 'DC=winlab,DC=rsnhm,DC=t-com,DC=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.187.64.3:389, authentication 0 rlm_ldap: bind as CN=Hans Dampf,CN=Computers,DC=winlab,DC=rsnhm,DC=t-com,DC=de/Gerti1000 to 10.187.64.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in DC=winlab,DC=rsnhm,DC=t-com,DC=de, with filter sAMAccountname=john.smith rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user john.smith authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type win_domain auth: type "win_domain" Processing the authenticate section of radiusd.conf modcall: entering group win_domain for request 0 radius_xlat: '/usr/bin/ntlm_auth --username="john.smith" --password='smith1000' --domain=SOUTH' Exec-Program: /usr/bin/ntlm_auth --username="john.smith" --password='smith1000' --domain=SOUTH Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program: returned: 1 rlm_exec (win_domain): External script failed modcall[authenticate]: module "win_domain" returns fail for request 0 modcall: leaving group win_domain (returns fail) for request 0 auth: Failed to validate the user. Login incorrect: [john.smith/smith1000] (from client localhost port 1645) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 176 to 127.0.0.1 port 35261 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 176 with timestamp 44a4e1a4 Nothing to do. Sleeping until we see a request. Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

3 3

LDAP schema
by Axel Seguin 05 Jul '06

05 Jul '06

Hi everyone, I tried to modify the ldap schema with the RADIUS-LDAPv3.schema file. I do not get an error when restarting ldap but I cannot add the objectclass radiusProfile to any user and therefore I cannot add any radius attribute either. Has anyone ever had this problem? Could the RADIUS-LDAPv3.schema file be the problem? I never read anywhere that it might be a problem. Thank you Axel

1 0

Re: Problem of proxying Vendor Specific Attributes (VSA)!
by Stefan Winter 05 Jul '06

05 Jul '06

> >What do you mean by "keeping"? Logging it? In that case, enable > >post_proxy_detail and pre_proxy_detail logging, they log everything that > > goes > > >through. > > In fact , i would like to know if there is an option to specify the proxy > not deleting the VSA located in the access-reject response of the server > when the proxy send the access-reject to the client?(keep the VSA) > > Clearer, currently, my Radius server send to the proxy an access-reject > with VSA and when the proxy receive these packet, it send the same packet > to the client so an access-reject packet but with no VSA (it seem to delete > them). > > So currently, i have: > *Server Radius*>>>*packet access-reject with VSA*>>>>*Proxy > Radius*>>>*packet access-reject without VSA>>>>>>**Client Radius* > > > > So what i would like is: > > *Server Radius*>>>*packet access-reject with VSA*>>>>*Proxy > Radius*>>>*packet access-reject with VSA>>>>>>**Client Radius* > > ** you've asked that question before. My answer was: this is not supposed to work because it probably violates the RFC. What you could try is to add your VSAs to the FreeRADIUS dictionaries, and specify in "attrs" the exact VSA you want to, not the generic VSA identifier for your vendor id. Maybe you can convince the server then. I wouldn't bet on it though. Further messages via private mail will be ignored, ask the _mailing list_. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

Re: Problem of proxying Vendor Specific Attributes (VSA)!
by Stefan Winter 05 Jul '06

05 Jul '06

Hi, > How can i indicate to the proxy to keep the VSA it receive from the Radius > Server? there is no option in the configuration files to force him to keep > the VSA? What do you mean by "keeping"? Logging it? In that case, enable post_proxy_detail and pre_proxy_detail logging, they log everything that goes through. BTW: please ask via the mailing list. Others may have the same question. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

Can't build rpm for freeradius-1.1.2 on fedora core 5
by DonKiShoot 05 Jul '06

05 Jul '06

Hello all and sorry for my poor english, I'm trying to build the rpm of freeradius-1.1.2 on my fedora core 5 as explain in the wiki because i couldn't find it on the web and i have got actually a bug with freeradius-1.0.5-1.2 that i hope this release correct. If someone could help me, maybe it's not necessary for me to upgrade and make this rpm : With freeradius-1.0.5-1.2 and ActiveDirectory, if i don't use an unique OU with all my users, there is a bug. Freeradius says something like DSID-0C090627 ... not all the time but 90% of the time and it is very rageous. On the web i saw something about referral, about large scope, etc ... and i don't understand anything. As my users are separated in different OU, i must use a large scope. For exemple, with this, it's ok at 100% of time : ldap { basedn = 'OU=Users,OU=Paris,DC=worldcompany,DC=loc' filter = '(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})' base_filter = '(&(objectClass=user)(c=FR))' } But with this, it's ok at 10% of time : ldap { basedn = 'DC=worldcompany,DC=loc' filter = '(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})' base_filter = '(&(objectClass=user)(c=FR))' } If it is really a bug then help me building my rpm, please ;-) When building it with rpmbuild -bb freeradius.spec, all seems good but at the end. It says that there is an error with install files non packed What can i do ? Is there an error in the .spec file ? ########################################################## Vérification des fichiers non empaquetés: /usr/lib/rpm/check-files /var/tmp/freeradius-root erreur: Fichier(s) installé(s) (mais non empaquetés): /usr/share/doc/freeradius/Acct-Type /usr/share/doc/freeradius/Autz-Type /usr/share/doc/freeradius/CYGWIN /usr/share/doc/freeradius/ChangeLog /usr/share/doc/freeradius/DIFFS /usr/share/doc/freeradius/MACOSX /usr/share/doc/freeradius/OS2 /usr/share/doc/freeradius/Post-Auth-Type /usr/share/doc/freeradius/RADIUS-LDAP-eDirectory /usr/share/doc/freeradius/RADIUS-SQL.schema /usr/share/doc/freeradius/README /usr/share/doc/freeradius/Session-Type /usr/share/doc/freeradius/Simultaneous-Use /usr/share/doc/freeradius/aaa.txt /usr/share/doc/freeradius/ascend /usr/share/doc/freeradius/bay /usr/share/doc/freeradius/bugs /usr/share/doc/freeradius/cisco /usr/share/doc/freeradius/coding-methods.txt /usr/share/doc/freeradius/configurable_failover /usr/share/doc/freeradius/duplicate-users /usr/share/doc/freeradius/examples/iplanet.ldif /usr/share/doc/freeradius/examples/iplanet.schema /usr/share/doc/freeradius/examples/mssql.sql /usr/share/doc/freeradius/examples/mysql.sql /usr/share/doc/freeradius/examples/openldap.schema /usr/share/doc/freeradius/examples/oracle.sql /usr/share/doc/freeradius/examples/postgresql.sql /usr/share/doc/freeradius/ldap_howto.txt /usr/share/doc/freeradius/load-balance.txt /usr/share/doc/freeradius/misc-nas /usr/share/doc/freeradius/module_interface /usr/share/doc/freeradius/mssql /usr/share/doc/freeradius/performance-testing /usr/share/doc/freeradius/processing_users_file /usr/share/doc/freeradius/proxy /usr/share/doc/freeradius/radrelay /usr/share/doc/freeradius/release-method.txt /usr/share/doc/freeradius/rfc/attributes.html /usr/share/doc/freeradius/rfc/draft-kamath-pppext-eap-mschapv2-00.txt /usr/share/doc/freeradius/rfc/draft-sterman-aaa-sip-00.txt /usr/share/doc/freeradius/rfc/leap.txt /usr/share/doc/freeradius/rfc/pppext-eap-sim-12.txt /usr/share/doc/freeradius/rfc/rfc1157.txt /usr/share/doc/freeradius/rfc/rfc1227.txt /usr/share/doc/freeradius/rfc/rfc1448.txt /usr/share/doc/freeradius/rfc/rfc1901.txt /usr/share/doc/freeradius/rfc/rfc1905.txt /usr/share/doc/freeradius/rfc/rfc2058.txt /usr/share/doc/freeradius/rfc/rfc2059.txt /usr/share/doc/freeradius/rfc/rfc2138.txt /usr/share/doc/freeradius/rfc/rfc2139.txt /usr/share/doc/freeradius/rfc/rfc2243.txt /usr/share/doc/freeradius/rfc/rfc2289.txt /usr/share/doc/freeradius/rfc/rfc2433.txt /usr/share/doc/freeradius/rfc/rfc2548.txt /usr/share/doc/freeradius/rfc/rfc2618.txt /usr/share/doc/freeradius/rfc/rfc2619.txt /usr/share/doc/freeradius/rfc/rfc2620.txt /usr/share/doc/freeradius/rfc/rfc2621.txt /usr/share/doc/freeradius/rfc/rfc2716.txt /usr/share/doc/freeradius/rfc/rfc2759.txt /usr/share/doc/freeradius/rfc/rfc2809.txt /usr/share/doc/freeradius/rfc/rfc2865.txt /usr/share/doc/freeradius/rfc/rfc2866.txt /usr/share/doc/freeradius/rfc/rfc2867.txt /usr/share/doc/freeradius/rfc/rfc2868.txt /usr/share/doc/freeradius/rfc/rfc2869.txt /usr/share/doc/freeradius/rfc/rfc2882.txt /usr/share/doc/freeradius/rfc/rfc2924.txt /usr/share/doc/freeradius/rfc/rfc3162.txt /usr/share/doc/freeradius/rfc/rfc3575.txt /usr/share/doc/freeradius/rfc/rfc3576.txt /usr/share/doc/freeradius/rfc/rfc3579.txt /usr/share/doc/freeradius/rfc/rfc3580.txt /usr/share/doc/freeradius/rlm_attr_filter /usr/share/doc/freeradius/rlm_dbm /usr/share/doc/freeradius/rlm_digest /usr/share/doc/freeradius/rlm_eap /usr/share/doc/freeradius/rlm_fastusers /usr/share/doc/freeradius/rlm_krb5 /usr/share/doc/freeradius/rlm_ldap /usr/share/doc/freeradius/rlm_otp /usr/share/doc/freeradius/rlm_pam /usr/share/doc/freeradius/rlm_passwd /usr/share/doc/freeradius/rlm_python /usr/share/doc/freeradius/rlm_sim_triplets /usr/share/doc/freeradius/rlm_sql /usr/share/doc/freeradius/rlm_sqlcounter /usr/share/doc/freeradius/supervise-radiusd.txt /usr/share/doc/freeradius/tuning_guide /usr/share/doc/freeradius/variables.txt Erreur de construction de RPM: Fichier(s) installé(s) (mais non empaquetés): /usr/share/doc/freeradius/Acct-Type /usr/share/doc/freeradius/Autz-Type /usr/share/doc/freeradius/CYGWIN /usr/share/doc/freeradius/ChangeLog /usr/share/doc/freeradius/DIFFS /usr/share/doc/freeradius/MACOSX /usr/share/doc/freeradius/OS2 /usr/share/doc/freeradius/Post-Auth-Type /usr/share/doc/freeradius/RADIUS-LDAP-eDirectory /usr/share/doc/freeradius/RADIUS-SQL.schema /usr/share/doc/freeradius/README /usr/share/doc/freeradius/Session-Type /usr/share/doc/freeradius/Simultaneous-Use /usr/share/doc/freeradius/aaa.txt /usr/share/doc/freeradius/ascend /usr/share/doc/freeradius/bay /usr/share/doc/freeradius/bugs /usr/share/doc/freeradius/cisco /usr/share/doc/freeradius/coding-methods.txt /usr/share/doc/freeradius/configurable_failover /usr/share/doc/freeradius/duplicate-users /usr/share/doc/freeradius/examples/iplanet.ldif /usr/share/doc/freeradius/examples/iplanet.schema /usr/share/doc/freeradius/examples/mssql.sql /usr/share/doc/freeradius/examples/mysql.sql /usr/share/doc/freeradius/examples/openldap.schema /usr/share/doc/freeradius/examples/oracle.sql /usr/share/doc/freeradius/examples/postgresql.sql /usr/share/doc/freeradius/ldap_howto.txt /usr/share/doc/freeradius/load-balance.txt /usr/share/doc/freeradius/misc-nas /usr/share/doc/freeradius/module_interface /usr/share/doc/freeradius/mssql /usr/share/doc/freeradius/performance-testing /usr/share/doc/freeradius/processing_users_file /usr/share/doc/freeradius/proxy /usr/share/doc/freeradius/radrelay /usr/share/doc/freeradius/release-method.txt /usr/share/doc/freeradius/rfc/attributes.html /usr/share/doc/freeradius/rfc/draft-kamath-pppext-eap-mschapv2-00.txt /usr/share/doc/freeradius/rfc/draft-sterman-aaa-sip-00.txt /usr/share/doc/freeradius/rfc/leap.txt /usr/share/doc/freeradius/rfc/pppext-eap-sim-12.txt /usr/share/doc/freeradius/rfc/rfc1157.txt /usr/share/doc/freeradius/rfc/rfc1227.txt /usr/share/doc/freeradius/rfc/rfc1448.txt /usr/share/doc/freeradius/rfc/rfc1901.txt /usr/share/doc/freeradius/rfc/rfc1905.txt /usr/share/doc/freeradius/rfc/rfc2058.txt /usr/share/doc/freeradius/rfc/rfc2059.txt /usr/share/doc/freeradius/rfc/rfc2138.txt /usr/share/doc/freeradius/rfc/rfc2139.txt /usr/share/doc/freeradius/rfc/rfc2243.txt /usr/share/doc/freeradius/rfc/rfc2289.txt /usr/share/doc/freeradius/rfc/rfc2433.txt /usr/share/doc/freeradius/rfc/rfc2548.txt /usr/share/doc/freeradius/rfc/rfc2618.txt /usr/share/doc/freeradius/rfc/rfc2619.txt /usr/share/doc/freeradius/rfc/rfc2620.txt /usr/share/doc/freeradius/rfc/rfc2621.txt /usr/share/doc/freeradius/rfc/rfc2716.txt /usr/share/doc/freeradius/rfc/rfc2759.txt /usr/share/doc/freeradius/rfc/rfc2809.txt /usr/share/doc/freeradius/rfc/rfc2865.txt /usr/share/doc/freeradius/rfc/rfc2866.txt /usr/share/doc/freeradius/rfc/rfc2867.txt /usr/share/doc/freeradius/rfc/rfc2868.txt /usr/share/doc/freeradius/rfc/rfc2869.txt /usr/share/doc/freeradius/rfc/rfc2882.txt /usr/share/doc/freeradius/rfc/rfc2924.txt /usr/share/doc/freeradius/rfc/rfc3162.txt /usr/share/doc/freeradius/rfc/rfc3575.txt /usr/share/doc/freeradius/rfc/rfc3576.txt /usr/share/doc/freeradius/rfc/rfc3579.txt /usr/share/doc/freeradius/rfc/rfc3580.txt /usr/share/doc/freeradius/rlm_attr_filter /usr/share/doc/freeradius/rlm_dbm /usr/share/doc/freeradius/rlm_digest /usr/share/doc/freeradius/rlm_eap /usr/share/doc/freeradius/rlm_fastusers /usr/share/doc/freeradius/rlm_krb5 /usr/share/doc/freeradius/rlm_ldap /usr/share/doc/freeradius/rlm_otp /usr/share/doc/freeradius/rlm_pam /usr/share/doc/freeradius/rlm_passwd /usr/share/doc/freeradius/rlm_python /usr/share/doc/freeradius/rlm_sim_triplets /usr/share/doc/freeradius/rlm_sql /usr/share/doc/freeradius/rlm_sqlcounter /usr/share/doc/freeradius/supervise-radiusd.txt /usr/share/doc/freeradius/tuning_guide /usr/share/doc/freeradius/variables.txt #################################################### # cat freeradius.spec ##################################################### ##################################################### Summary: High-performance and highly configurable RADIUS server URL: http://www.freeradius.org/ Name: freeradius Version: 1.1.2 Release: 0 License: GPL Group: Networking/Daemons Packager: FreeRADIUS.org Source0: %{name}-%{version}.tar.gz Prereq: /sbin/chkconfig BuildPreReq: libtool # FIXME: snmpwalk, snmpget and rusers POSSIBLY needed by checkrad Provides: radiusd Conflicts: cistron-radius BuildRoot: %{_tmppath}/%{name}-root %description The FreeRADIUS Server Project is a high-performance and highly configurable GPL'd RADIUS server. It is somewhat similar to the Livingston 2.0 RADIUS server, but has many more features, and is much more configurable. %prep %setup %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ --localstatedir=%{_localstatedir} \ --sysconfdir=%{_sysconfdir} \ --mandir=%{_mandir} \ --disable-ltdl-install \ --with-ltdl-lib=/usr/lib \ --with-ltdl-include=/usr/include \ --with-large-files --with-udpfromto --with-edir \ --with-rlm-sql_postgresql-include-dir=/usr/include/pgsql \ --with-rlm-krb5-include-dir=/usr/kerberos/include \ --with-rlm-krb5-lib-dir=/usr/kerberos/lib make %install [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT mkdir -p $RPM_BUILD_ROOT/etc/{logrotate.d,pam.d,rc.d/init.d} make install R=$RPM_BUILD_ROOT RADDB=$RPM_BUILD_ROOT/etc/raddb # set radiusd as default user/group perl -i -pe 's/^#user =.*$/user = radiusd/' $RADDB/radiusd.conf perl -i -pe 's/^#group =.*$/group = radiusd/' $RADDB/radiusd.conf # shadow password file MUST be defined on Linux perl -i -pe 's/# shadow =/shadow =/' $RADDB/radiusd.conf # remove unneeded stuff rm -f $RPM_BUILD_ROOT%{_mandir}/man8/builddbm.8 rm -f $RPM_BUILD_ROOT%{_prefix}/sbin/rc.radiusd cd redhat install -m 755 rc.radiusd-redhat $RPM_BUILD_ROOT/etc/rc.d/init.d/radiusd install -m 644 radiusd-logrotate $RPM_BUILD_ROOT/etc/logrotate.d/radiusd install -m 644 radiusd-pam $RPM_BUILD_ROOT/etc/pam.d/radius cd .. %pre /usr/sbin/useradd -c "radiusd user" -r -s /bin/false -u 95 -d / radiusd 2>/dev/null || : %preun if [ "$1" = "0" ]; then /sbin/service radiusd stop > /dev/null 2>&1 /sbin/chkconfig --del radiusd fi %post /sbin/ldconfig /sbin/chkconfig --add radiusd # Done here to avoid messing up existing installations for i in radius/radutmp radius/radwtmp radius/radius.log # radius/radwatch.log radius/checkrad.log do touch /var/log/$i chown radiusd:radiusd /var/log/$i chmod 600 /var/log/$i done %postun if [ "$1" -ge "1" ]; then /sbin/service radiusd condrestart >/dev/null 2>&1 fi if [ $1 = 0 ]; then /usr/sbin/userdel radiusd > /dev/null 2>&1 || : fi /sbin/ldconfig %clean [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT %files %defattr(-,root,root) %doc doc/ChangeLog doc/README* todo/ COPYRIGHT INSTALL %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd %config (noreplace) /etc/raddb/* %{_bindir}/* %{_datadir}/%{name} %{_libdir}/* %{_mandir}/*/* %{_sbindir}/* %attr(0700,radiusd,radiusd) %dir /var/log/radius %attr(0700,radiusd,radiusd) %dir /var/log/radius/radacct %attr(0700,radiusd,radiusd) %dir /var/run/radiusd %changelog * Thu Dec 15 2004 Alan DeKok - update for 1.1.0 * Mon May 31 2004 Paul Hampson - update for 1.0.0 release * Fri May 23 2003 Marko Myllynen - update for 0.9 * Wed Sep 4 2002 Marko Myllynen - fix libtool issues for good * Thu Aug 22 2002 Marko Myllynen - update for 0.7/0.8 * Tue Jun 18 2002 Marko Myllynen - run as radiusd user instead of root - added some options for configure * Thu Jun 6 2002 Marko Myllynen - set noreplace for non-dictionary files in /etc/raddb * Sun May 26 2002 Frank Cusack <frank(a)google.com> - move /var dirs from %%post to %%files * Thu Feb 14 2002 Marko Myllynen - use dir name macros in all configure options - libtool is required only when building the package - misc clean ups * Wed Feb 13 2002 Marko Myllynen - use %%{_mandir} instead of /usr/man - rename %%postin as %%post - clean up name/version * Fri Jan 18 2002 Frank Cusack <frank(a)google.com> - remove (noreplace) for /etc/raddb/* (due to rpm bugs) * Fri Sep 07 2001 Ivan F. Martinez <ivanfm(a)ecodigit.com.br> - changes to make compatible with default config file shipped - adjusts log files are on /var/log/radius instead of /var/log - /etc/raddb changed to config(noreplace) to don't override - user configs * Fri Sep 22 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - spec file clear accordling to the libltdl fix and minor updates * Wed Sep 12 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - Updated to snapshot-12-Sep-00 * Fri Jun 16 2000 Bruno Lopes F. Cabral <bruno(a)openline.com.br> - Initial release ############################################################ ############################################################

1 0

X-Ascend-PW-Warntime
by Giuseppe Parlato 05 Jul '06

05 Jul '06

Hi all, starting freeradius in debugging mode I get the following .. X-Ascend-PW-Warntime can you explain me why ? Giuseppe

1 0