September 2006 - Freeradius-Users - lists.freeradius.org

radclient not able to send salted encrypted VSA's?
by Birchmeier Raphael 06 Sep '06

06 Sep '06

Hi, I'm using freeradius version 1.3. I need to send CoA requests to a Juniper-ERX containing salted VSA "ERX-LI-Action=enable". radclient says it is unable to "salt" this vp's. If someone could help extending radclient or tell me another way how to send salted CoA requests I'd appreciate. Here's what raclient tells: echo "Acct-Session-Id = 0020049806" | radclient -f /sendcoa.txt -x localhost coa test Sending CoA-Request of id 62 to 127.0.0.1 port 1700 ERX-LI-Action = on radclient: Failed to send packet for ID 62: ERROR: No request packet, cannot encrypt ERX-LI-Action attribute in the vp. The input file looks like: ERX-LI-Action=1 ERX-Med-Ip-Address=1.1.1.1 ERX-Med-Dev-Handle=1234 ERX-Med-Port-Number=5061 The dictionary like: ATTRIBUTE ERX-LI-Action 58 integer encrypt=2 ATTRIBUTE ERX-Med-Dev-Handle 59 octets encrypt=2 ATTRIBUTE ERX-Med-Ip-Address 60 ipaddr encrypt=2 ATTRIBUTE ERX-Med-Port-Number 61 integer encrypt=2 Thanks, Raphael __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 3

Enable Syslog
by fvt3 06 Sep '06

06 Sep '06

Can we send radius log to a syslog? If so, how can I accomplish this. I am using the latest freeradius version.. I try changing logdir=syslog but not successful... Thanks in advance.. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Mysql connection with SSL
by Fabio Pedretti 06 Sep '06

06 Sep '06

Hi, I'd like to know if there is a way to securing access to a Mysql server from freeradius. I found this thread with a patch enabling SSL connections: http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-March/04205… Have things progressed since then? Fabio

2 1

How to restrict pppoe users on nas-port-id
by eugene＠snowball.co.za 06 Sep '06

06 Sep '06

I'm using FreeRADIUS Version 1.0.4 with Dialup_admin and mysql and I would like to know if anyone can direct me in the right place to find out how to restrict pppoe users from logging in from multiple NAS port IDs. I would like to restrict them to logging on to only a specific set of port IDs that comes from a database. Any help will be appreciated. -Eugenevdm

2 1

Radius Installation
by Nico Gazzano 05 Sep '06

05 Sep '06

I'm going to start by saying that I'm new to radius. I've gotten as far as installing version 1.1.3. Are there any scripts to add users, and how do I configure the web interface? Nico Gazzano Network & Systems Admin MIS Choice Inc. 1699 Wall ST Suite 602 Mount Prospect, IL 60056 Phone 847-690-1900 ext206 Fax 847-690-1350 nicog(a)mischoice.com

2 3

Free Radius make error with Sol10
by Rafiqul Ahsan 05 Sep '06

05 Sep '06

Hi, Following error I am getting when i try to make the free radius on Solaris 10. I am following direction as stated from link http://wiki.freeradius.org/index.php/Build I installed following packages as suggested in the above link : libgcc-3.3-sol10-sparc-local.gz openssl-0.9.8b-sol10-sparc-local.gz openldap-2.3.21-sol10-sparc-local.gz And trying to build, freradius-1.1.3.tar.bz2 Using make version 3.80 Here is the sequesnce of command : ./configure ./make - and getting following error. # make make: *** No targets specified and no makefile found. Stop. # cd # cd rafi_dir/ # cd free_radius_1.1.3/ # cd freeradius-1.1.3 # make gmake[1]: Entering directory `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3' Making all in libltdl... gmake[2]: Entering directory `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3/libltdl' /usr/sfw/bin//gmake all-am gmake[3]: Entering directory `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3/libltdl' /bin/bash ./libtool --tag=CC --mode=link gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -no-undefined -version-info 4:4:1 -o libltdl.la -rpath /usr/local/lib ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread gcc -shared -Wl,-h -Wl,libltdl.so.3 -o .libs/libltdl.so.3.1.4 .libs/ltdl.o -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lc (cd .libs && rm -f libltdl.so.3 && ln -s libltdl.so.3.1.4 libltdl.so.3) (cd .libs && rm -f libltdl.so && ln -s libltdl.so.3.1.4 libltdl.so) false cru .libs/libltdl.a ltdl.o gmake[3]: *** [libltdl.la] Error 1 gmake[3]: Leaving directory `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3/libltdl' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3/libltdl' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3' make: *** [all] Error 2 Please help me figure out where do i need to look at, or any configuration that I missed ? Thanks Rafi -- Rafiqul Ahsan 630-717-1698(h) 2120 Periwinkle Ln 630-689-1457(h) Naperville, IL 60540 847-812-6176(c)

1 0

RE: monitoring freeradius with snmp
by Andy Ford 05 Sep '06

05 Sep '06

Hi Allan Thanks for you suggestions. After running configure --with-snmp I noticed (following your notes below) that the '#define WITH_SNMP 1' was missing from autoconf.h. So I added the line manually in autoconf.h as ... /* Include SNMP subagent */ /* #undef WITH_SNMP */ #define WITH_SNMP 1 ... and got a stream of error from 'make'. Here is a small snippet of the errors. ------------------ make errors ------------------------ make[4]: Entering directory `/tmp/freeradius-1.1.2/src/main' /tmp/freeradius-1.1.2/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I../include -DHO STINFO=\"\" -DRADIUSD_VERSION=\"1.1.2\" -c radius_snmp.c rm -f .libs/radius_snmp.lo gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I../include -DHOSTINFO=\"\" -DRADIUSD_VERSION=\"1.1.2\" -c radi us_snmp.c -fPIC -DPIC -o .libs/radius_snmp.lo In file included from radius_snmp.c:39: ../include/smux.h:60: error: parse error before "oid" ../include/smux.h:64: error: parse error before "oid" ../include/smux.h:94: error: parse error before "oid" ../include/smux.h:94: warning: no semicolon at end of struct or union ../include/smux.h:101: error: parse error before "oid" ../include/smux.h:101: warning: no semicolon at end of struct or union ../include/smux.h:115: error: parse error before '}' token ../include/smux.h:136: error: parse error before '[' token -------------------------------------------------------------- Obviously I've completely buggered something up. A little advice would be great. I downloaded the latest version i.e. freeradius-1.1.2 I also have NET-SNMP version: 5.2.rc3 installed. I can see from the list you are a very busy person, so thanks for your time. I've attached the complete output from make, along with autoconf.h. Regards Andy -----Original Message----- From: freeradius-users-bounces+andy.ford=telindus.co.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.ford=telindus.co.uk@lists.freeradi us.org] On Behalf Of Alan DeKok Sent: 04 August 2006 18:16 To: FreeRadius users mailing list Subject: Re: monitoring freeradius with snmp Andy Ford <andy.ford(a)telindus.co.uk> wrote: > 1. compiled freeradius with the '--with-snmp' option Did the "configure" process find the SNMP information it needed? Does src/include/autoconf.h have a line like: #define WITH_SNMP 1 ? > 2. modified the radiusd.conf file with > > snmp = yes > $INCLUDE ${confdir}/snmp.conf When the server starts, does it say anything about connecting to SMUX peer? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

4 4

Proxy with TLS
by Gabriele Chervatin 05 Sep '06

05 Sep '06

Hi, I'm very newbie to Freeradius. I'm try to use TLS whit to freeradius server. I've a firewall FW that talk locally (over LAN) with the freeradius A. Then freeradius A proxies the request to a remote (over WAN) freeradius B. The system works great and I'm able to authenticate user on firewall FW by freeradius B (which is the only who have the user accounts). Now to increment the security, I'm trying to use EAP-TLS or EAP-TTLS between the two freeradius server, but with no luck, infact in the logs of the main server i see: rlm_eap: No EAP-Message, not doing EAP (an so it's no doing TLS) I'm use version 1.1.3, and I've generate correctly the certificates, and configured eap.conf to use tls and ttls. What is wrong? Maybe is not possible to use TLS in proxy mode? Thanks -- Gabriele Chervatin

3 3

Question about freeradius and Cisco VoIP router
by Ali Majdzadeh 05 Sep '06

05 Sep '06

Hello All I am writing a C program as an external program for freeradius to handle authentication requests recieved from a Cisco VoIP router. How can I pack attribute-value pairs and send them to the router? I can determine the attribute-value pairs transmitted by the router through environment variables, but I don't know how to send the attribute-value pairs which the router expects to recieve. Best Regards Ali

2 1

Lost values
by Jack Daniels 05 Sep '06

05 Sep '06

Hi there, I've got the next config file: radiusd.conf ----------------- modules { exec my_auth { wait = yes program = "/home/myself/my_auth.sh %{NAS-IP-Address} %{Calling-Station-ID} %{User-Name}" input_pairs = request output_pairs = reply } ... instantiate { exec my_auth } authorize { mschap my_auth eap } ... /home/myself/my_auth.sh ------------------------------------ #!/bin/bash echo "NAS: $1" echo "Caller: $2" echo "User: $3" exit 0 And I'm using a Cisco Aironet 1200 AP. Ok, so the problem is the next: When I connect through the access point, i get the following output (I just put the parts regarding my script) ... radius_xlat: '/tmp/radius_auth/auth.sh 192.168.254.22 0002.2d85.4676 test' Exec-Program: /tmp/radius_auth/auth.sh 192.168.254.22 0002.2d85.4676 test Exec-Program output: NAS: 192.168.254.22 Caller: 0002.2d85.4676 User: test Exec-Program-Wait: plaintext: NAS: 192.168.254.22 Caller: 0002.2d85.4676 User: test Exec-Program: returned: 0 ... I get like 6 of those and then I got 3 of these (Please note that the parameters are gone) Exec-Program: /tmp/radius_auth/auth.sh test Exec-Program output: NAS: test Caller: User: Exec-Program-Wait: plaintext: NAS: test Caller: User: Exec-Program: returned: 0 And finally I get this one (And they are back) radius_xlat: '/tmp/radius_auth/auth.sh 192.168.254.22 0002.2d85.4676 test' Exec-Program: /tmp/radius_auth/auth.sh 192.168.254.22 0002.2d85.4676 test Exec-Program output: NAS: 192.168.254.22 Caller: 0002.2d85.4676 User: test Exec-Program-Wait: plaintext: NAS: 192.168.254.22 Caller: 0002.2d85.4676 User: test Exec-Program: returned: 0 And access is granted. So, my question is, why, at some point, i lose the values of %{NAS-IP-Address} and %{Calling-Station-ID}? I'd like to know also if there is a way to "ignore" a request for my script. In this case, my script gives a 0 back, and this grants access. If I modify it to return 1, access is denied. I'd like to know if there is a value that doesn't cause the whole auth process to fail, like ignore until I get the IP address that was lost. What I want to do in my script, is to check the AP's ip address and depending on it deny access to users of a determined AP and grant access to users of the others AP, but since sometimes I lose the value of those vars, the whole process will fail even for a user who is on an authorized AP. If someone could shed some light, that'd be great. Thanks a lot. Jack _________________________________________________________________ Don't just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/

2 1