February 2007 - Freeradius-Users - lists.freeradius.org

Help, more
by Stephen Baker 02 Feb '07

02 Feb '07

Note was sent to list (freeradius-users(a)lists.freeradius.org) by mistake intended to send to daemon (freeradius-users-request(a)lists.freeradius.org) Thanks to 1. Re: help (Gaddis, Jeremy L.) 3. Re: help (Peter Nixon)

1 0

How to add check item (Pool-Name) from Exec-Program-Wait script?
by Mindaugas 02 Feb '07

02 Feb '07

Hello, I want to use two ippools. That's no problem of course. But which IP pool to assign I can decide only in Exec-Program-Wait script. Now I have the following lines in users file: DEFAULT Auth-Type := Accept Exec-Program-Wait = "/etc/raddb/authclient" authclient script checks text file, connects to MySQL and Oracle and then it can say - use ippool1 or ippool2. But how to set Pool-Name check item? As far as I understand if authclient would write "Pool-Name:=ipool1" to stdout then that would be reply not check item!? So how could I tell from the script which ippool to use? I feel that that somehow should be possible since ippool is post-auth thing. :) Thanks, Mindaugas

2 3

RE: Expert Help Required
by Josh Howlett 02 Feb '07

02 Feb '07

> Hi Guys, > > Currently i am using cistron radius This is the FreeRADIUS list; you might have more luck at the Cistron list :-) Josh.

1 0

Expert Help Required
by Sekhar 02 Feb '07

02 Feb '07

Hi Guys, Currently i am using cistron radius with the following configuration for user test Auth-Type = Local, Password = "test" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 1.2.3.3, Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240" Now i want to configure one more route path for this user using Cisco-AVPair = "ip:route= example as follows test Auth-Type = Local, Password = "test" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 1.2.3.3, Cisco-AVPair = "ip:route= 1.2.3.4 255.255.255.240" Cisco-AVPair = "ip:route=1.2.4.4 255.255.255.252 " When i try to restart cistron radius it will stop the process because it will not accept two ip routes with two different rage one is /30 and other one is /29. Could some one help me how to add two ip routes for one single user. Thanks for your help --------------------------------- Don't pick lemons. See all the new 2007 cars at Yahoo! Autos.

1 0

Switching users into VLAN
by Michal Prochazka 02 Feb '07

02 Feb '07

Hello, I can't get this scenario to work: On one NAS I need to set for all users which are proxied to be switched into particular VLAN except list of my local users who have to have VLAN ID blank. I tried below minimalistic testing configuration but no user have assigned the VLAN id. huntgroup: ap_scb NAS-IP-Address == xxx.xxx.xxx.xxx users: DEFAULT Huntgroup-Name == "ap_scb" Tunnel-Type = VLAN, Tunnel-Private-Group-Id = 133, Tunnel-Medium-Type = IEEE-802 radiusd.conf (relevant part): # Post-Authentication post-auth { reply_log } pre-proxy { pre_proxy_log } post-proxy { post_proxy_log attr_filter } Thanks in advance, Michal P. -- Michal Prochazka // michalp(a)ics.muni.cz Supercomputing Center Brno Institute of Computer Science Masaryk University Botanicka 68a, 60200 Brno, CZ CESNET z.s.p.o. Zikova 4, 16200 Praha 6, CZ

1 0

RE: The EAP Saga continues.
by Josh Howlett 02 Feb '07

02 Feb '07

> If you choose to use EAP-PEAP/MS-CHAPv2 you need 4 items: > > 1. A server certificate, signed by a Cert Authority "serverCA" ...not forgetting the relevant OID extensions peculiar to EAP-PEAP :-) Josh.

1 0

redundant LDAP server with free-radius
by sumi thra 02 Feb '07

02 Feb '07

Hi All, 1. When i configure the free-radius to use redundant ldap, the radius server contacts the secondary ldap server first. My config file options are: authorize { ... .... redundant{ ldap_primary ldap_secondary } .. } authenticate { .. .. Auth-Type LDAP { redundant { ldap_primary ldap_secondary } } } #unix eap } ldap ldap_primary { ;; .. } ldap ldap_secondary { .... ... } 2. My users file has : DEFAULT LDAP-Group := "groupname1" some vendor specific attributes follows.. DEFAULT LDAP-Group := "groupname2" ..... Do i need to specify it as ldap_primary-LDAP-Group := "groupname1" ldap_secondary-LDAP-Group := "groupname1" ?? or the previous define itself will work ?? Its very urgent. Please reply me if you have any idea. Thanks in advance. Regards, Sumi.

4 12

failed login accounting with dialup admin
by kemas 02 Feb '07

02 Feb '07

I have a small accounting problem with freeradius and dialup admin which I can't find a way to solve it. I've set freeradius to authenticate EAP-TLS, I want to log people who failed to authenticate to mysql with rlm_sql, which will show in dialup admin failed login page. I put in radiusd.con post-auth section the sql module: Post-Auth-Type REJECT { #insert-module-name-here sql } the post-auth query in sql.conf: postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap- Password}', '%{reply:Packet-Type}', NOW())" the sql query runs well, it put the failed login to the radpostauth table but the dialup admin failed login page is searching to the radacct table for the failed user which will never find it. am I doing the right way to put the sql module inside the post-auth? or should I put it in other section? I don't want to change the postauth_query but is there any way to add another query to put the data to radacct table? thanks in advance

5 5

error starting freeradius
by Enrique Llanos V. 01 Feb '07

01 Feb '07

Good afternon, I have just migrated a freeradius from a Red Hat Linux release 7.3 to a FreeBSD 6.1 and when executing: '#/usr/local/etc/rc.d/radiusd start' i get the folowing: Starting radiusd. Thu Feb 1 15:32:27 2007 : Info: Starting - reading configuration files ... tailf -f /var/log/radius.log Thu Feb 1 15:32:27 2007 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Feb 1 15:32:27 2007 : Info: Using deprecated clients file. Support for this will go away soon. Thu Feb 1 15:32:27 2007 : Info: HASH: Reinitializing hash structures and lists for caching... Thu Feb 1 15:32:27 2007 : Error: rlm_unix: Username too long in line: # Thu Feb 1 15:32:27 2007 : Info: HASH: Stored 40 entries from (null) Thu Feb 1 15:32:27 2007 : Error: rlm_unix: Can't open file group file (null): Bad address I've googled for the errors presented i couldn't find a solution,,, any suggestion? Thanks in advance. -- Enrique Llanos V. HTU Networks Peru www.htu-networks.com

2 2

Re: Freeradius-Users Digest, Vol 22, Issue 6
by Marilene Lima 01 Feb '07

01 Feb '07

Hi, I am starting the freeradius with my mysql server and I noticed this erro: rlm_sql_mysql: Mysql error 'Host 'mysql1.wireless.intranet' is not allowed to connect to this MySQL server' But I already give the privileges to my user radius and add the server mysql1.wireless.intranet to my list of hosts knowed. I use linux Debian and mysql 5.0.33 and the both are in the same machine, but they have different ip adress. In the freeradius/sql.conf file I configured this: sql { # Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql" # Connect info server = "mysql1.wireless.intranet" # server = localhost login = "radius" password = "radius_password" #login = "root" # password = "mysql_password" # Database table configuration radius_db = "radius" # If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct" Someone can help me? Thanks a lot, Marilene This the result of freeradius: freeradius -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@mysql1.wireless.intranet:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server radius@mysql1.wireless.intranet:radius rlm_sql_mysql: Mysql error 'Host 'mysql1.wireless.intranet' is not allowed to connect to this MySQL server' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests.

2 1