January 2007 - Freeradius-Users - lists.freeradius.org

which users are connected and when ?
by adreas Polyxronopoulos 11 Jan '07

11 Jan '07

Hello list, I have a wlan using freeradius for authentication. I want to create a user-managment application which will help me in monitoring the wlan. The main information i would like to provide with my application is the following : 1) How many users are connected on my wlan and how many are not connected ? 2) Which users are connected on my wlan and when did the connected ? As i have studied freeradius until now i can get this information from detail-file. But i would like to know if i could export detail-file in a mysql-format or if i could have info like detail-file provide in a mySql format. I am intersting in mySql because my application will be in php and the manipulation of mySql database is much easier. Any ideas would be useful....thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: ldap { fail=1}
by jerrrry＠voila.fr 11 Jan '07

11 Jan '07

> Message du 10/01/07 à 15h38 > De : "Alan DeKok" > A : jerrrry(a)voila.fr, "FreeRadius users mailing list" > Copie à : > Objet : Re: ldap { fail=1} > > jerrrry(a)voila.fr wrote: > > > > i'm using freeradius 1.0.1 from Red Hat entreprise 4. > > You SHOULD upgrade: > > http://freeradius.org/security.html > > > I want the radius server to authenticate users thanks to the "users" > > file even if the ldap directory is not reachable and the radius server > > to start even if the DB is not reachable > > That's probably the way the server should work. Those issues probably > weren't though of when the server was written, as the SQL module works > the same way. > > > I tried with ldap { fail =1} in the authorize section and sql { fail > > = 1 } in the instantiate section without any success. > > > > "fail" doen't seem to be know. > > No, it doesn't work in the "instantiate" section. It could, though. > It's a good idea, and one I hadn't thought of. so there is no solution to backup my nas client list thanks to freeradius with somethng like instantiate{ redundant { sql1 sql2 } } Thomas > > An alternative would be to update the LDAP module to NOT bind at > startup, and do it only when a request came in. That would help, too. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > >

1 0

FreeRadius Project PEAP/MS-CHAP
by Evan Vittitow 11 Jan '07

11 Jan '07

Do you know why my pppd would launch inappropriately in CHAP Mode rather than MS-CHAP.

1 0

FreeRadius Project PEAP/MS-CHAP
by Evan Vittitow 11 Jan '07

11 Jan '07

Do you know why my pppd would launch inappropriately in CHAP Mode rather than pppd.

1 0

Authentication accept/deny based on realm
by Lisa Casey 10 Jan '07

10 Jan '07

Hi, I am using freeradius. I currently have two realms setup in mu users file with fallthrough=yes for both of them since the usernames/passwords are also in the users file and I need to be able to match on those. Currently, if username johndoe logs in as johndoe(a)realm1.com he gets accepted. If he then logs in as johndoe(a)realm2.com he will also get accepted since freeradius looks at the users file (and the realms file) finds the realm is valid, then goes on down the users file, finds the username/password valid, thus accepting the login. I'ld like to have it so that if johndoe logs in as johndoe(a)realm1.com he gets authenticated, but if he logs in as johndoe(a)realm2.com he does not. I'm not sure how to do that. I've googled a bit but didn't come up with anything that looked helpful. If someone could point me in the right direction, I'ld appreciate it. Lisa Casey

2 1

doc/rlm_sql is wrong?
by Phil Mayers 10 Jan '07

10 Jan '07

I've been looking at using rlm_sql to replace a fairly complex set of Autz-Type and rlm_passwd maps. Primarily this is to speed up updates when e.g. blocking systems and not have to HUP the server. The doc/rlm_sql file states that processing is done with pairs of check/reply items at a time - that is, first the user check items are compared and if matches the reply items added; then for each group (in order of priority) the group check items are compared and if match the reply items added. The code in rlm_sql.c definitely does not do that, at least in 1.1.3 as far as I can understand the code? Instead it appears to smoosh the user and all the group check items together, compares them, and if they *all* match adds *all* the reply items. This seems to make groups pretty useless except for using the SQL-Group construct in the users file. Comments?

4 4

Re: ldap { fail=1}
by jerrrry＠voila.fr 10 Jan '07

10 Jan '07

> Message du 10/01/07 à 15h38 > De : "Alan DeKok" > A : jerrrry(a)voila.fr, "FreeRadius users mailing list" > Copie à : > Objet : Re: ldap { fail=1} > > jerrrry(a)voila.fr wrote: > > > > i'm using freeradius 1.0.1 from Red Hat entreprise 4. > > You SHOULD upgrade: > > http://freeradius.org/security.html does not Red Hat supply any security patch with the OS support ? > > > I want the radius server to authenticate users thanks to the "users" > > file even if the ldap directory is not reachable and the radius server > > to start even if the DB is not reachable > > That's probably the way the server should work. Those issues probably > weren't though of when the server was written, as the SQL module works > the same way. > > > I tried with ldap { fail =1} in the authorize section and sql { fail > > = 1 } in the instantiate section without any success. > > > > "fail" doen't seem to be know. > > No, it doesn't work in the "instantiate" section. It could, though. > It's a good idea, and one I hadn't thought of. and "fail = 1" should work for ldap in the authorize section ? > > An alternative would be to update the LDAP module to NOT bind at > startup, and do it only when a request came in. That would help, too. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > >

3 2

Re: Freeradius-Users Digest, Vol 21, Issue 26 (Vacation)
by Michael Castillo 10 Jan '07

10 Jan '07

I will be out of the office from Thursday January 11th thru Monday January 15th, 2007. I will be returning to the office on Tuesday the 16th. Please contact Steve Fouchek at 463.2216 if you have any issues or question that require an immediate response. Michael

1 0

Bogus default attrs file?
by Tomas Hoger 10 Jan '07

10 Jan '07

Hi all! Default attrs file used by rlm_attr_filter contains following DEFAULT section: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, [ ... ] Framed-Protocol == PPP, Framed-Protocol == SLIP, [ ... ] This syntax, accompanied with tisp realm example, suggests that the attribute e.g. Framed-Protocol will be preserved in proxy reply if it's value is either PPP or SLIP. However, it does not seem to be true. Framed-Protocol will not pass this filter at all. Documentation quite clearly states: "an attribute must pass *all* the rules which affect it in order to make it past the filter". Hence using == rule twice with different values for same attribute should be the same as using !*. Or am I missing anything? Proposal for fix: check_pair function after comparison always increments either fail or pass counter for given attribute. It may be modified to not increment fail for '==' operator (and also '=~') when compare fails. This should be consistent with final " fail == 0 && pass > 0 " check and default attrs file should work as expected. Untested patch: For released code: --- rlm_attr_filter.c 2005-08-11 23:06:38.000000000 +0200 +++ rlm_attr_filter.c.new 2007-01-10 13:32:55.000000000 +0100 @@ -68,8 +68,6 @@ case T_OP_CMP_EQ: if (comp == 0) { ++*(pa); - } else { - ++*(fa); } break; @@ -120,8 +118,6 @@ regfree(&reg); if (comp == 0) { ++*(pa); - } else { - ++*(fa); } break; For CVS code (some #ifdef HAVE_REGEX_H should probably appear here): --- rlm_attr_filter.c 2006-11-22 22:44:19.000000000 +0100 +++ rlm_attr_filter.c.new 2007-01-10 13:37:05.000000000 +0100 @@ -68,7 +68,8 @@ compare = paircmp(check_item, reply_item); if (compare == 1) { ++*(pass); - } else { + } else if (check_item->operator != T_OP_CMP_EQ && + check_item->operator != T_OP_REG_EQ) { ++*(fail); } Ideas? th.

2 2

1.1.4 and rlm_sql_mysql.so
by Jeffrey Sewell 10 Jan '07

10 Jan '07

I'm installing freeRADIUS on a CentOS 4.0 system. When I used the RPM on a different box it worked fine, but the RPM is out of date and I want this new box to be more up-to-date than RPMs will allow. 1.1.4 compiles fine and works w/o MySQL (5.0). However, when I run it with the SQL lines in radiusd.conf uncommented, I get this: rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1844] Unknown module "sql". radiusd.conf[1773] Failed to parse authorize section. that library is on my other (RPM-installed) system, but is not anywhere on the file system of the new box (including the source dir--it isn't in the tarball). Where is that file stored for 1.1.4? Are there other libraries that I will need that should be with that one and are also missing? Jeffrey

2 2