September 2006 - Freeradius-Users - lists.freeradius.org

AP point support 802.1x but only with WPA
by luigi natalino 04 Sep '06

04 Sep '06

Hello, I would like to know whether someone uses Freeradius with the Access Point Dlink DWL-3200. I must exclusively use the Radius server (802.1x) for the authentication without any type of WPA-*. The last firmware versions of this Access Point allow to use the Radius server only in combination of several kinds of Wpa,but this is not what serves to me. Someone would know to tell me what Firmware use to be able exclusively to use 802.1x without using for WPA (and from where I can download it)? Many Thanks Best Regards, Luigi _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

3 2

Interface binding problem
by Marcel.De_Boer＠alcatel.be 04 Sep '06

04 Sep '06

Hello, I'm trying to setup FreeRADIUS in a testing setup where the IP address to which it binds needs to be set. The RADIUS server is loaded on-demand on a number of machines, where almost all configuration is the same, except for the IP address to which it needs to listen. Normally this would be setup in the configuration file, but this means that either I can't have a centralized configuration file (which makes things very complicated, as I'm trying to provide a standard service in an experimental environment), or the configuration file needs to be changed before every FreeRADIUS startup, which also is very inconvenient. I'd like to set it up with the commandline switch (-i <ip-addr>), but this does not seem to work (tested on versions 0.2, 1.0.1 and 1.2): the server only takes the address from the configuration file and completely ignores the commandline switch. I do realise that the commandline switch is deprecated, but is it possible to get this to work somehow? Kind regards, Marcel de Boer

5 6

huntgroups, sql, and users
by jfr＠e4x.net 03 Sep '06

03 Sep '06

Greetings, we're migrating over from xtradius (yet another cistron derivative) to FreeRadius, and so far, basic authentication seem to work, but onto the huntgroups we're running into a big of a snag. We're using FreeRadius 1.1.2 on Debian w/2.6.12 Kernel, and MySQL 5.0.22 installed FreeRadius stuff via training wheels (apt-get install freeradius freeradius-mysql freeradius-dialupadmin) What we're trying to do is send spacific attributes based on the NAS sending the request... for example: huntgroups file: tc1 NAS-IP-Address = 1.2.3.4 GP NAS-IP-Address = 1.2.3.5 for tc1, which only has 48 lines, we used to assign an IP based on port: users file: DEFAULT Service-Type = Framed-User, Huntgroup-Name = "tc1" Framed-IP-Address = 1.2.3.100+, Framed-IP-Netmask = 255.255.255.255, Fall-Through = Yes #(and for the GP, which is actually globalpop): DEFAULT Service-Type = Framed-User, Huntgroup-Name = "GP" Ascend-Data-Filter = "ip in forward tcp est", Ascend-Data-Filter = "ip in forward dstip 1.2.3.25/32 0", Ascend-Data-Filter = "ip in drop tcp dstport = 25", Ascend-Data-Filter = "ip in forward 0", Fall-Through = Yes so, in theory, a request coming in via a GP nas, should get all those silly Ascend-Data-Filter attributes, and the tc1 box should not, but instead have an IP based on 1.2.3.100 plus the port number. in the authorize section in radiusd.conf, there is an entry for "files" which does indeed point to the users file in the files section. Also turned on "compat=yes" but no luck there. huntgroups is in the preprocess area, and preprocess is in authorize. Am I missing something somewhere? This whole chain of events gets rather confusing. Before (with xtradius) everything was done in the users file, which just fired off an external app which I wrote, that manually checks the database to see if username/password exists.. but freeradius is a little more detailed. - - - Jon

2 2

Proxy IP Address
by Doug Hardie 02 Sep '06

02 Sep '06

I have a situation where all my authentication requests are proxied to me. I have 4 different groups of users that require unique local polieies and have been using a fairly complicated parsing of the Called ID phone number and a couple other fields to figure out which group a request is in. However, I just found out that each of the 4 groups is being proxied through different proxy servers. It would be real easy to distinguish the group from the IP address that the proxy request is being sent from. However, I have not been able to find a variable that contains that information. Have I missed it?

2 2

Regarding handling of threads
by Ravi S M 02 Sep '06

02 Sep '06

Hi I have some doubts regarding free radius server. 1) When we run server parent exits by spawning a child to handle client's requests, so during this time purify also exits but shows 95 leaks. (leak report shows from "src/main/modules.c" from line num "207") * My doubt is whether these leaks which are shown with purify are freed in child or how these leaks get rid off?? * Or when parents calls exit(0), do all memory are freed ?? 2) For handling multiple requests, is threads implemented? If so how? 3) If threads are not implemented how multiple requests are handled? Please I am grateful if you can provide some information. Thanks & Regards Ravi.S.M ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

Re: Is it possible to log connection details in MySQL?
by Sean 01 Sep '06

01 Sep '06

Hi, Saving your log files in mySQL would seem to be a huge waste of disk space. Why not access your log files from an application that can parse them and present them in whatever format you want. I can send you some PHP examples that I've scripted if you like. Regards, Sean http://swarmhotspots.com

1 0

certificate issue
by Kartthik 01 Sep '06

01 Sep '06

1 0

Is it possible to log connection details in MySQL?
by ZaiPower 01 Sep '06

01 Sep '06

Hello: I'd like to know if it is possible to save all the info under the log directory "radacct" (connections' details by client's IP) in MySQL instead of files in hard disk. Are all the variables accessible?. I mean, are they valid for an SQL sentence in 'postauth_query' variables %{Packet-Type}, %{User-Name}, %{User-Password}, %{NAS-IP-Address}, %{NAS-Port} and %{Client-IP-Address}? Am I missing any other info? After reading the answer (http://wiki.freeradius.org/index.php/FAQ#How_do_I_log_failed_login_attempts…) to the question "How do I log failed login attempts in a SQL database?" in the FreeRadius wiki it seems it is possible with adequate SQL sentences. I see three problems: - I don't see clearly how to separate successfully authentication of unsuccessfull. Maybe like this? How could I tell FreeRadius different queries depending on type of request? post-auth { # Login successful: get an address from the IP pool. ippool Post-Auth-Type ACCEPT { sql } Post-Auth-Type REJECT { # Login failed: log to SQL database. sql } } - Where I can find documentation about the different packet types and their data? - Is it possible to tell FreeRadius that I want to send more than one query to MySQL? I really want this functionality (keep the connection logs in MySQL, not in the filesystem). I make this question to know if I am in the right path or ideally if anybody has already make something like this. -- View this message in context: http://www.nabble.com/Is-it-possible-to-log-connection-details-in-MySQL--tf… Sent from the FreeRadius - User forum at Nabble.com.

2 1

openssl certificate, need help
by Collen Blijenberg 01 Sep '06

01 Sep '06

Could someone help me out pleas... we're trying to make our wpa-wlan work, but currently i'm stuck with the certificates part of tls. i'd tried running CA.all, but the script gives me error's. (freeradius 1.1.3) ----------------- + openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:whatever -passout pass:whatever Error opening input file demoCA/cacert.pem demoCA/cacert.pem: No such file or directory + openssl pkcs12 -in root.p12 -out root.pem -passin pass:whatever -passout pass:whatever Error opening input file root.p12 root.p12: No such file or directory + openssl x509 -inform PEM -outform DER -in root.pem -out root.der Error opening Certificate root.pem 20898:error:02001002:system library:fopen:No such file or directory:bss_file.c:278:fopen('root.pem','r') 20898:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:280: unable to load certificate -------------------- in the script dir there is no demoCA en no cacert.pam?! also, the CA.all script has a rm -rf demoCA. so if i comment the 'rm' out, copied the default demoCA and cacert.pam from my working installation (version 1.0.2 that was shipped with fedora, and has certificates for localhost) and gues what, another error: ------------------------------- + openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:whatever -passout pass:whatever No certificate matches private key + openssl pkcs12 -in root.p12 -out root.pem -passin pass:whatever -passout pass:whatever 21004:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:140: + openssl x509 -inform PEM -outform DER -in root.pem -out root.der unable to load certificate 21005:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:642:Expecting: TRUSTED CERTIFICATE + echo -e '' --------------------------------- dunno where to go now!? is there some help on how to make the certificate thing work for tls, and windowsxpsp2 clients ?? Thx Collen

1 0

URGENT! Dialupadmin "Could not connect to SQL database"
by Guilherme Franco 01 Sep '06

01 Sep '06

URGENT! Hi, I'm getting this error *Could not connect to SQL database. *in dialupadmin. (using OCI8 with ORACLE) * *Radiusd connects to Oracle without any problems, dialupadmin don't. Please help. Thank you.* *

3 7