January 2007 - Freeradius-Users - lists.freeradius.org

3ComSwitch Login
by Alexandre Soares 22 Jan '07

22 Jan '07

Hi All, Sorry team, but I still problem to authenticate a valid Administrator User in 3Com Swithc, my question is anyone implemented this feature ? I really don't know where to start the solution in freeradius

4 5

Freeradius(.net) and Oracle
by Brian Atkins 22 Jan '07

22 Jan '07

I am working on setting up a wireless hotspot using Chillispot on DD-WRT. I have installed Freeradius on a W2K server that runs an Oracle database. After reading the documentation and various howtos, I wanted to see if someone could offer some pointers on authenticating to Oracle using a pre-existing database and not the db/tables built from the sql file in the example docs. For example: I have a list of users listed in the database as 'barcode' (20 Char) and the password is stored in plain text as 'pin' (4 Char). I don't care about updating or creating users through Freeradius nor do I care about accounting (simultaneous connections). The defaults in the oraclesql.conf are: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM \ ${authcheck_table} WHERE Username = '%{SQL-User-Name}' ORDER \ BY id" authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM \ ${authreply_table} WHERE Username = '%{SQL-User-Name}' ORDER \ BY id" Which I assumed might be able to be trimmed down to: authorize_check_query = "SELECT barcode,pin FROM ${authcheck_table} \ WHERE barcode = '%{SQL-User-Name}'" Am I incorrect in this assumption? Thanks, Brian

3 2

Access-Accept ONLY on every second try
by Miguel Reategui 22 Jan '07

22 Jan '07

Greetings Listers, On testing a development FreeRadius Server we found out that everything is working, except that the Access-Accept comes only on every second attempt (!) As we can safely discard all network and database problems, I wonder if there is a flag that is being set on the first attempt that allows the second one to work. But how about the third attempt? It will fail and then the fourth will go in. Has anyone experienced something similar? Any tips? Configuration specs: - FreeRADIUS Version 1.1.2, for host - Oracle DB - All settings are kept as default - Running modes tried * radiusd -X * radiusd -xxyz -l stdout * radiusd - Only problem seems to be this one rlm_sql (sql): Couldn't insert SQL accounting STOP record - ORA-00001: unique constraint (FREE_RADIUS.IDX_RADACCT_SESSIONID_UNIQUEID) violated Thanks in advance - Mig

2 1

Read root certificates....
by Polyxronopoulos Adreas 22 Jan '07

22 Jan '07

Hi list , Is it possible for a client-user when he/she tries to connect to the network over freeradius to read the root certificates of freeradius? Does the root-certificates stored somewhere on the users machine? thanks ___________________________________________________________ Yahoo! Messenger - with free PC-PC calling and photo sharing. http://uk.messenger.yahoo.com

2 3

Cisco-AVpair rate-limit attributes
by satish patel 22 Jan '07

22 Jan '07

Dear all i have cisco VPDN with freeradius ( 1.1.4 ) on Suse 10.2 my users connect throgh the xp client useig vpn connection and useing Internet Services but now thing is that i wann restrict user base bandwidth means i want to set bandwidth 64kbps for user1 and 128 kbps for user2 so is it possible through the Cisco-Avpair attributes. i have find lots of document regarding cisco-AVpair attributes then i test it on my network but i dont know it will working or not my test exmple #cat /etc/raddb/users DEFAULT Service-Type := Framed-User Framed-Protocol = PPP, Cisco-Avpair = "lcp:interface-config#1=rate-limit output 512000 10000 10000 conform-action continue exceed-action drop" This rate-limt use for output what about input what rate-limit direction i use for it and how to verifying is it ok or not Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

4 8

authorize and authenticate in proxy
by Ana Gallardo Gómez 22 Jan '07

22 Jan '07

Hello!I want to use Freeradius as a proxy Radius server, and I think that my Freeradius don´t have to do authorize and authenticate: my Freeradius have to proccess request with realm "@unex.es", the others request have to be proxyed. My configuration is:radiusd.conf: authorize { preprocess suffix files Autz-Type LDAP_UNEX_ES{ ldap_unex_es } mschap eap } authenticate { ldap_unex_es Auth-Type MS-CHAP { mschap } eap } users: DEFAULT Autz-Type = "LDAP_UNEX_ES" proxy.conf: realm unex.es { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = other_server_1 accthost = LOCAL secret = ****** nostrip } realm DEFAULT { type = radius authhost = other_server_2 accthost = LOCAL secret = ****** nostrip }- I want to define two instances of "realm DEFAULT", in case one of then fails. It is posible?- Have my freeradius to do authorize and autheticate when request have to be proxyed?- I think that in users file I have to distinguish between request with realm "@unex.es" to set Autz-Type = "LDAP_UNEX_ES" and the others...I´m lost with proxy... I need help. Thank you.Sorry for my english. _________________________________________________________________ Prueba algunos de los nuevos servicios en línea que te ofrece Windows Live Ideas: tan nuevos que ni siquiera se han publicado oficialmente todavía. http://ideas.live.com

2 1

mschap and ldap auth-type together no more working
by LALOT Dominique 22 Jan '07

22 Jan '07

Hello, I had a problem with ippool, but it is a NAS problem. I wanted to do further checks so I upgrade to newer versions: freeradius 1.0.2-4sarge3 stable (I come from this one) freeradius 1.1.3-3 testing freeradius 1.1.2-1bpo1 sarge-backports Before, I was able to do LDAP or MSCHAP automatically. I had and entry in users lalot Auth-Type := ldap Framed-IP-Address = XXX, Framed-IP-Netmask = 255.255.255.0, Fall-Through = Yes If I put mschap in users, it's working for mschap.. The two new ones have the same problem. That's may ne due to an incomplete update.. I don't put all the logs: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=xxx,dc=fr, with filter (uid=lalot) rlm_ldap: looking for check items in directory... rlm_ldap: Adding supannaffectation as Pool-Name, value Pharo & op=21 rlm_ldap: Adding ntPassword as NT-Password, value XXX & op=21 rlm_ldap: Adding lmPassword as LM-Password, value XXX & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user lalot authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 11 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 11 modcall: leaving group authorize (returns ok) for request 11 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 11 and before: rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' modcall[authorize]: module "mschap" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 2 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password You can notice the diff rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' and then rad_check_password: seems confused.. Any ideas?. Config: authorize { preprocess files ldap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap } authenticate { Auth-Type LDAP { ldap } Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } } -- Dominique LALOT Ingenieur Systeme et Reseaux http://annuaire.univmed.fr/showuser.php?uid=lalot

2 3

freeradius + mysql + Cisco-AVpair
by satish patel 22 Jan '07

22 Jan '07

Dear all I have freeradius setup with cisco vpdn with mysql. i am useing cisco-avpair attributes for rate-limit to my user traffic it is working fine with /etc/raddb/user file but when i put this attribites in mysql databases it is not working so now i need help to implement this attributes in mysql so what is op code or what is special configuration for this task Otherwise it is possible to put Group attributes in user file and user information in mysql ???? u get it my query user group create on /etc/raddb/user and users in mysql then my porpse will be solve but it is possible or not and how do it possibel ??? Satish Patel Tulip IT Services Delhi --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

RE: help
by John Wan 22 Jan '07

22 Jan '07

Hi Alan, Many thanks for your help. I have followed all the instructions from http://deployingradius.com. I do not know why I have had the CHAP authentication. I would like to use MS-CHAP authentication instead of CHAP, and do you have any tipps for me for this kind of setup (MS-CHAP)? Any hint would be great - thank you! Many thanks again. Regards John -----Original Message----- From: freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, 18 January 2007 6:16 PM To: FreeRadius users mailing list Subject: Re: help John Wan wrote: > Hi Alan, > > Now everything works but the Active Directory authentication,Please > see the following output from "$ Radiusd -X" when a wireless client > uses "administrator" logon into the chillispot web logon page: > > > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, > length=223 > User-Name = "administrator" > CHAP-Challenge = 0xa784482e8ac92fd573e87bbbad9ca58f > CHAP-Password = 0x00f54cc04e288eec67feff0b13e9448bd2 See my web page. You CANNOT do CHAP authentication to AD. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

encrypted password - radius over WAN
by Agent Smith 22 Jan '07

22 Jan '07

I'd like to implement pam_radius module on some of our Linux boxes but I am worried about password (pam_radius can only do PAP) being captured and misused since the radius server is at central office and clients are all over the place. I read (http://www.cisco.com/warp/public/480/10.html#comp_packet_encry) that radius encrypts passwords using the secret key between radius server and client, is this true with FR? I suppose I can build some stun or openvpn tunnels between linux clients and FR but before I go down that road, I'd like to know if its necessary. ____________________________________________________________________________________ Don't get soaked. Take a quick peak at the forecast with the Yahoo! Search weather shortcut. http://tools.search.yahoo.com/shortcuts/#loc_weather

2 1