November 2007 - Freeradius-Users - lists.freeradius.org

variables in 1.1.7
by Norbert Wegener 16 Nov '07

16 Nov '07

With version 1.1.7 I want to achieve the following, which is probably easy in 2.0: In the authorize section I have an ldap module and an sql module sp1. group { ldap1 sp1 } I want to get an attribute from AD and use the value of that attribute in a later call to a database radiusd -AX shows: rlm_ldap: looking for check items in directory... rlm_ldap: Adding mobile as Huntgroup-Name == "VL-SBS-AD02-0001" rlm_ldap: looking for reply items in directory... rlm_ldap: user host/28tef003.ww006.company.net authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 1 radius_xlat: 'host/28tef003.ww006.company.net' rlm_sql (sp1): sql_set_user escaped user --> 'host/28tef003.ww006.company.net' radius_xlat: 'call firstif ('0','host/28tef003.ww006.company.net','', '1.2.3.4','=','2')' Retrieving an attribute from AD obviously works. In sql.conf I have changed authorize_check_query to use a stored procedure: sql.conf: authorize_check_query = "call firstif ('0','%{SQL-User-Name}','%{Huntgroup-Name}', '%{NAS-IP-Address}','=','2')" I would have expected the %{Huntgroup-Name} to be "VL-SBS-AD02-0001", but this is not true. Is the desired assignment possible at all in 1.1.7 ? Norbert Wegener

2 1

Any ideas on this compile error ??
by Willem Gerber 16 Nov '07

16 Nov '07

Hey Guys I cant get radius to compile :/ Linux vaughan 2.6.20-1.2307.fc5 #1 Sun Mar 18 20:44:48 EDT 2007 i686 i686 i386 GNU/Linux /home/willem/freeradius-1.1.7/src/include/modpriv.h:7:18: error: ltdl.h: No such file or directory In file included from rlm_sqlippool.c:37: /home/willem/freeradius-1.1.7/src/include/modpriv.h:16: error: expected specifier-qualifier-list before 'lt_dlhandle' In file included from rlm_sqlippool.c:39: /home/willem/freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.h:15:18: error: ltdl.h: No such file or directory In file included from rlm_sqlippool.c:39: /home/willem/freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.h:68: error: expected specifier-qualifier-list before 'lt_dlhandle' rlm_sqlippool.c: In function 'sqlippool_command': rlm_sqlippool.c:311: error: 'SQL_INST' has no member named 'module' rlm_sqlippool.c: In function 'sqlippool_query1': rlm_sqlippool.c:358: error: 'SQL_INST' has no member named 'module' rlm_sqlippool.c: In function 'sqlippool_postauth': rlm_sqlippool.c:539: warning: pointer targets in passing argument 2 of 'strNcpy' differ in signedness rlm_sqlippool.c:526: warning: unused variable 'self' gmake[6]: *** [rlm_sqlippool.lo] Error 1 gmake[6]: Leaving directory `/home/willem/freeradius-1.1.7/src/modules/rlm_sqlippool' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/home/willem/freeradius-1.1.7/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/home/willem/freeradius-1.1.7/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/willem/freeradius-1.1.7/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/willem/freeradius-1.1.7/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/willem/freeradius-1.1.7' make: *** [all] Error 2 -- "The casing said 'Windows XP or better'... so I installed Linux" -- Anonymous

3 2

Re: freeradius auto-vlan 3com switch 4500G
by pbreton 16 Nov '07

16 Nov '07

Hi Krzysztof, Thanks for sharing your experience. >Please add here: > vlan-assignment-mode string > accounting optional An 3Com product engineer gave me the same instruction, unfortunqtly the 4500G does not support the vlan-assignment-mode and accounting does not take optional as argument. Maybe it shoud. The 4500G is new, and like many new product it must go thru a real world user trial phase to uncover birth defects. This said 3com is going to replace my 4500G with a 5500G at no cost. And this is a solution to my problem -which is not a freeradius one anymore. Thanks again, enjoy the day, Philippe. ----- Original Message ----- From: Krzysztof Olędzki <krzysztof.oledzki(a)axelspringer.pl> To: pbreton(a)wustl.edu Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: freeradius auto-vlan 3com switch 4500G Date: Fri, 16 Nov 2007 00:10:23 +0100 >On 2007-11-11 18:27, Philippe Breton wrote: >> On Sun, 2007-11-11 at 17:37 +0100, Krzysztof Olędzki >>> wrote: On 2007-11-10 17:30, Philippe Breton wrote: >>>>> Did you setup your switch properly: >>>>> >>>>> domain (...) >>>>> vlan-assignment-mode string >>>> Hard to give a 100% answer on this question. I believe >>>> I did with the help of 3com support. >>> This is the most important part. Please make sure it is >>> set up (display current-configuration). >> >> ... I agree with you. The 4500G is new to me. I believe I >> got it right. One important fact to keep in mind is the >> semantic is a litle different between the 5500g and 4500G >> , i.e. what's in this doc does not apply in the 4500G >> >http://www.3com.hu/download/switch_radius_setup.doc/switch_radius_setup.doc >> >> This is my current config: > >Please excuse me for the long delay. A day should be longer >than 24h. ;) > >> description VLAN181 >> # >> radius scheme system >> server-type extended >> primary authentication 127.0.0.1 1645 >> primary accounting 127.0.0.1 1646 >> user-name-format without-domain > >> radius scheme radius1 >> server-type standard >> primary authentication 192.168.181.18 >> key authentication sdfsdfsfsf >> user-name-format without-domain >> # >> domain system >> access-limit disable >> state active >> idle-cut disable >> self-service-url disable > > >> domain wustl.edu >> authentication default radius-scheme radius1 >> access-limit disable >> state active >> idle-cut disable >> self-service-url disable > >Please add here: > vlan-assignment-mode string > accounting optional > >It is required for 3c5500G, so it should also solve the >problem on 3c4500G. If not, please enable >radius/mac-authentication/port-security debugging on the >switch. > >Best regards, > > Krzysztof Olędzki >-- >Krzysztof Olędzki >Axel Springer Polska Sp. z o.o. >tel: +48-22-2320969 >fax: +48-22-2325530

1 0

Problems With Radwho
by Willem Gerber 16 Nov '07

16 Nov '07

Hi Guys/Gals I have problem where radwho only shows users logged in for two nas'es. Aswell as only their accounting info goes into the radacct table. I can see the other users authenticating and i can log into them. So they must be dailing up.... No idea why its happening. Im using radiusd: FreeRADIUS Version 1.1.7, for host i686-pc-linux-gnu, built on Oct 10 2007 at 08:13:06 Regards Willem Gerber -- "The casing said 'Windows XP or better'... so I installed Linux" -- Anonymous

2 4

running freeradius with xinetd....?
by obi-wan 16 Nov '07

16 Nov '07

i have taken delivery of a RHEL server with FreeRadius installed and running from XINETD. _the radius sever is not performing as expected and spews the following ERROR to the log file; " There appears to be another RADIUS server running on the authentication port 1645 " when i attempt to dial and log in. the /etc/xinetd.d/radius file # default: off # description: radius server service radius { protocol = udp wait = yes user = root server = /usr/local/sbin/radiusd server_args = -y -z log_on_success += USERID log_on_failure += USERID disable = yes } when i run the "radiusd" daemon in stand alone mode from the command line the Radius server performs as advertised. _i'm i missing some settings or maybe "radiusd" can't be run from xinetd.? hardware: HP proliant DL320 FreeRadius version 1.1.6 for host i686-pc-linux-gnu RHEL 4u2 any and all suggestions will be appreciated.........thanks to the opensource community. obi-wan

2 1

freeradius auto-vlan 3com switch 4500G
by Philippe Breton 15 Nov '07

15 Nov '07

HI, Has anyone successfully implemented auto-vlan with 3Com switch 4500G? I am using the following tunneling attributes: ATTRIBUTE Tunnel-Type 64 integer has_tag ATTRIBUTE Tunnel-Medium-Type 65 integer has_tag ATTRIBUTE Tunnel-Private-Group-Id 81 string has_tag VALUE Tunnel-Type VLAN 13 VALUE Tunnel-Medium-Type TMT802 6 The node is declared as followed: ##IT Dell Inspiron 4000 laptop -- DHCP 00-09-5b-61-52-0d Auth-Type := Local, User-Password == "00-09-5b-61-52-0d" Tunnel-Medium-Type = TMT802, Tunnel-Private-Group-id = 2, Tunnel-Type = VLAN, Although my radius access request shows that the access has been granted and the VLAN 2 assigned, the switch 4500G does not open its port on VLAN 2. I changed the tunnel-medium-type between TMT802 and 802, but that did not change anything. I am currently doing auto-vlan with 3com 4400 with the same configuration and it is working like a charm. Any idea why the switch does automatically adjust? Any beginning of information is welcome. Thanks, Philippe _RADIUS ACCESS_REQUEST LOG_ rad_recv: Access-Request packet from host 172.20.181.201:1024, id=41, length=126 User-Name = "00-09-5b-61-52-0d" User-Password = "00-09-5b-61-52-0d" NAS-IP-Address = 172.20.181.201 NAS-Identifier = "4500G" NAS-Port = 16809985 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0009-5b61-520d" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00-09-5b-61-52-0d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00-09-5b-61-52-0d at line 2 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [00-09-5b-61-52-0d] (from client switch201 port 16809985 cli 0009-5b61-520d) Sending Access-Accept of id 41 to 172.20.181.201 port 1024 Tunnel-Medium-Type:0 = TMT802 Tunnel-Private-Group-Id:0 = "2u" Tunnel-Type:0 = VLAN Finished request 0

4 9

Users outside /etc/raddb/users
by Rui Meireles 15 Nov '07

15 Nov '07

Hi. I have a simple question. I want to create more than 400 freeradius users, all of them like this: user@realm Auth-Type := Local, User-Password == . . I want to know if there is some way to have this information OUTSIDE the /etc/raddb/users file, because it would massivly increase the size of this file. If someone knows a way to have several user files, please help me. Thanks in advance, Rui Meireles

3 4

Re: Change pam_auth NAS-IP Address in radius reuest. (Alan DeKok)
by Bryan 15 Nov '07

15 Nov '07

> Bryan wrote: > > I'm using the latest freeradius on Centos 4.5. I have several Centos 4.5 > > clients all using pam_auth_radius and LDAP. Everything is working but I > > wanted to know if there is a way to change the NAS-IP-Address that is > > sent by the clients. They all send back 127.0.0.1. I want to them to > > send the real IP addess of the machine as the NAS-IP-Address. > > They should do that. The module obtains the IP address by doing a DNS > lookup on the hostname. So if the hostname maps to 127.0.0.1... that > should be fixed. > > Alan DeKok. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 31, Issue 56 > ************************************************ Thank you. I didn't realize that it did a dns lookup. Centos automatically adds the hostname to the 127.0.0.1 line of the hosts file during install. I removed the hostname from that line and pam_auth now sends the correct IP. BE

1 0

Post-Auth REJECT - conditional sql
by Rachel Primrose 15 Nov '07

15 Nov '07

Hi, I'm having trouble configuring a new freeradius install and need some help please! Version: FreeRADIUS Version 1.1.3 Problem: The LNS that will be sending requests to this server first sends an access request with just the realm with Service-Type=Outbound-User/Dialout-Framed-User (5). We either accept the request and give the LNS some interesting reply items that tell it to authenticate the user at another radius server, OR we reject the access request and the LNS will then send us through an access request for user@realm with Service-Type=Framed-User. When the first realm access request comes through, we do not want to use the sql module to log it, regardless of what our reply will be. The problem is, that Post-Auth-Type is overwritten no matter what I set it to in the users file! Configuration (just the important bits): users realm1.com Password=="blah", Service-Type=="Dialout-Framed-User", Auth-Type=Accept Cisco-AVpair = "vpdn:ip-addresses=192.168.0.0", Cisco-AVpair += "vpdn:tunnel-type=l2tp", Cisco-AVpair += "vpdn:l2tp-tunnel-password=blah", Cisco-AVpair += "vpdn:tunnel-id=blah" DEFAULT Service-Type=="Dialout-Framed-User", Auth-Type=Reject DEFAULT Auth-Type = LDAP, Autz-Type = ldap_user, Post-Auth-Type = ldap_user Service-Type = "Framed-User", Framed-Protocol = "PPP", Framed-Routing = "None", Framed-IP-Netmask = "255.255.255.255" raidusd.conf post-auth { Post-Auth-Type ldap{ sql } Post-Auth-Type REJECT { sql } } In the post-auth section Post-Auth-Type REJECT I want to conditionally run the sql module, based on the Service-Type attribute. Any suggest would be greatly appreciated. Thanks in advance. Kind regards, Rachel Primrose

3 6

Dialup Admin
by Scott 15 Nov '07

15 Nov '07

When I run these commands I get. mysql -uradius -pxxxx radius < badusers.sql ERROR 1067 (42000) at line 4: Invalid default value for 'id' mysql -uradius -pxxxx radius < userinfo.sql ERROR 1067 (42000) at line 4: Invalid default value for 'id' -- Scott Rodgers

1 0