January 2007 - Freeradius-Users - lists.freeradius.org

freeradius-1.1.3 + snmp...
by adreas Polyxronopoulos 12 Jan '07

12 Jan '07

Hi list, I have ubuntu 6.10 and i have set-up my freeradius-1.1.3 for peap-eap/mschapv2. I have got this packages for snmp : libsnmp9 , libsnmp9-dev , libsnmp-base , libsnmp-perl , libsnmp-session-perl , php5-snmp , snmp ,snmpd I have configured the radiusd.conf to support snmp and in snmp.conf i have set the community string to public as it is in snmpd.conf. However when i am running freeradius in debugging mode : radiusd -X , i get the following output and the freeradius does not start. Why is that happening ? When i configured the radiusd.conf without snmp everything works perfect. root@apolyxrono2:/usr/local/etc/raddb# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.0.15 IP address [10.0.0.15] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) main: smux_password = "public" main: snmp_write_access = no SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: public SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 root@apolyxrono2:/usr/local/etc/raddb# thanks for help... Adreas Polyxronopoulos ___________________________________________________________ All New Yahoo! Mail – Tired of unwanted email come-ons? Let our SpamGuard protect you. http://uk.docs.yahoo.com/nowyoucan.html

2 1

re:MySql and calling-station-id help please
by Ackbar Joolia 12 Jan '07

12 Jan '07

> I cannot get the above to work at all, can anyone please give me an idea > of how to do the above? See the FAQ about "it doesn't work". Also, try posting pieces of your current config. What you want isn't hard to do, but we have no idea what your configuration is, so it's impossible to say what is going wrong. Alan DeKok Alan, Where is the “it doesn’t work” faq? This is the logic I am following. In my usergroup table, I have got the same username with different groupnames: Usergroup Table --------------------------------------- UserName | GroupName User1 | group1 User1 | group2 User1 | group3 Then in the radcheck table, I have the correct password for that user: Radcheck table -------------------------- UserName | Attribute | op | Value User1 | Password | == | pass1 I am then having the calling-station-id s inside the radgroupcheck table. Bearing in mind that Radius will match all the attributes from the request with the values inside the radgroupcheck table Radgroupcheck -------------------------------- GroupName | Attribute | op | Value Group1 | Calling-Station-Id | := | 123456 Group2 | Calling-Station-Id | := | 345677 In the radgroupreply, I am assigning the different Framed-Ip-Address to the different groups. Radgroupreply ---------------------------------------------------- GroupName | Attribute | op | Value | prio Group1 | Framed-IP-Address | := | xxx | 0 Group2 | Framed-IP-Address | := | yyy | 0 However, every time a request is coming in, the same IP address is being assigned. Radius is not differentiating at all between the different Calling-Station-Id. I know this should be a simple thing to do, but its not working for me. Please help and advise. Al -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

2 1

user/group and permissions CentOS 4.4
by Andrew Long 12 Jan '07

12 Jan '07

In process of building 1.4 on CentOS 4.4. When started (as root) in debug mode, all goes well. When using default user/group nobody I get > Info: Starting - reading configuration files ... > radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied > (rlm_exec: Wait=yes but no output defined. Did you mean output=none?) > radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied > (Failed creating PID file /usr/local/var/run/radiusd/radiusd.pid: Permission denied) Can someone give me a little guidance with the permissions and user/group setup for Cent. --Andrew Long

2 1

IPPool with MySQL
by Umar Draz 12 Jan '07

12 Jan '07

Dear Members!! Is it possible to use ip pool with freeradius + mysql? main_pool works well with unix shadow files but i don't know how i can do with mysql. Any ideas? Regards, Umar Draz _________________________________________________________________ Dave vs. Carl: The Insignificant Championship Series. Who will win? http://clk.atdmt.com/MSN/go/msnnkwsp0070000001msn/direct/01/?href=http://da…

1 0

FreeRadius-package on ubuntu6.10
by adreas Polyxronopoulos 11 Jan '07

11 Jan '07

I have noticed a problem when downloading freeradius package for ubuntu6.10. After downloading freeradius package and configuring freeradius for peap-eap/mschapv2 and running freeradius -X i got the following ouput: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 10.0.0.15 IP address [10.0.0.15] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1939] Unknown module "eap". radiusd.conf[1886] Failed to parse authenticate section. In the same machine i have downloaded the source of freeradius-1.1.3 and compiled it. I have done the same configuration in radiusd.conf , clients.conf , user , eap.conf as in the freeradius-package and everything works fine .Why from the freeradius-package this configuration does not work? Adreas Polyxronopoulos ___________________________________________________________ What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship. http://uk.rd.yahoo.com/evt=44106/*http://mail.yahoo.net/uk

2 1

Re: Freeradius-1.1.3 + Mysql ?
by adreas Polyxronopoulos 11 Jan '07

11 Jan '07

Hi list, I have found the mysql-server package but i haven't found the mysql-dev package could you tell me which one specific because there are many thanks Adreas Polyxronopoulos ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, 11 January, 2007 7:23:53 PM Subject: Re: Freeradius-1.1.3 + Mysql ? Hi, > Hi list, > > I have compiled freeradius-1.1.3 with out any configure option. I don't have mySql server on my pc (ubuntu 6.10) . If i would like to store accounting information in mySql , what i have to do? When i download mySql server package do i have to configure freeradius again or just configure radiusd.conf ? if you built from source you will need to build from source again - this is because when you ran ./configure, the automake script checks your compilation environment to see what libraries and headers you have - thus what feature-sets can be enabled. you will need to install the mysql-devel package to compile in support and install the mysql-server package to have the mysql server and utils to USE mysql alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________ What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship. http://uk.rd.yahoo.com/evt=44106/*http://mail.yahoo.net/uk

1 0

Auth Against AD without CHAP/PEAP
by Tim_Crouch＠uttyler.edu 11 Jan '07

11 Jan '07

Is it possible to use freeradius to authenticate against Active Directory without using CHAP or PEAP? I have found directions to do this with supplicants using peap etc. but I don't want to use supplicants. I am currently using freeradius to auth against LDAP with out a problem (for my wireless network). I have made changes in radiusd.conf (basically replacing my LDAP entries with the corresponding AD entry) to try to auth agains AD, but it does not look as if it can read the password. Is anyone else doing this? And if so, how? Thanks! Tim Crouch Systems Administrator Campus Computing Services University of Texas at Tyler 903-566-7476

2 1

automated response
by Baker 11 Jan '07

11 Jan '07

I will be out on medical leave from January 12th through February 18th. If you have questions please direct them to Isaac Force.

1 0

Freeradius on Sun Fire platforms
by gigrim＠infinito.it 11 Jan '07

11 Jan '07

Could anyone advise whether Freeradius can be run on the below SUN Hardware/Software platform list. Many thanks in advance for the support you can provide, your help is much appreciated. Sun Fire V210 UltraSPARC IIIi / Solaris 10 &Java ES Sun Fire V240 UltraSPARC IIIi / Solaris 10 &Java ES Sun Fire V440 UltraSPARC IIIi / Solaris 10 &Java ES Sun Fire V890 UltraSPARC IIIi / Solaris 10 &Java ES Sun Fire X4100 Linux RedHat Sun Fire X4200 Linux RedHat Best Regards Giuseppe Grimaldi

4 3

RE: Restrict Password from detail file , accounting
by Ellis, Scott 1 (N-Comptel Inc.) 11 Jan '07

11 Jan '07

Thanks....I am running 1.0.1.... Scott ... -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: Thursday, January 11, 2007 1:17 PM To: FreeRadius users mailing list Subject: Re: Restrict Password from detail file , accounting Hi, > Do you know what version was the first to introduce this feature? 1.1.2 Feature improvements * Allow tagged VSA's for Juniper. Closes bugs #367 and #368. * Allow Ascend "abinary" format to be specified as octets, (e.g. Ascend-Data-Filter = 0x010203...) * Added "cipher_list" configuration to the EAP-TLS module. See "eap.conf" and "man 1 cipher" for details. * Added "check_cert_issuer" configuration to the EAP-TLS module. See "eap.conf" for details. (closes: #346) * Added "suppress" configuration entry to rlm_detail, to suppress certain attributes (e.g. User-Password). This closes bug #359. * More dictionary updates * Write SSL errors to log file, rather than stderr. This closes bug #347. * Allow a core dump on uid change on Linux (closes: #361) > Is there any other solution for the older versions? not that i can think of straight off-hand,. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1