May 2007 - Freeradius-Users - lists.freeradius.org

FreeRadius on openSuse Error
by Siqhamo Sifo 23 May '07

23 May '07

I am currently running freeradius on openSuse 10.2 and when I do a tail -f on my log file I c the ff error messsage : Error: Exec-Program: FAILED to execute /usr/local/bin/mtacnt: No such file or directory What i find strange is that it seems like mtacnt is not installed on my system which I find strange because when I took a look at my other radius box which is running fc5 the cmd mtacnt is available. Can any1 help REgards Sq

2 1

LDAP access configuration
by Manuel Sánchez Cuenca 23 May '07

23 May '07

Hello all, I have a scenario where a first radius server (R1) proxies the authentication request to another radius server (R2). Later, when the user is authenticated, R1 must access to a LDAP server to recover some network parameters, such as session-timeout or framed-ip-address, and enforce them in the Access Point (AP). Currently, R1 is configured to access to the LDAP server using the user name as filter (filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" in radiusd.conf). My question is, it is possible to configure this filter to use a radius attribute received in the response from R2? I mean, R2 returns in the response an attribute called attr1=val1, and then R1 must use this attribute to search in the LDAP server (¿filter="(uid=%{attr1})" or something similar?) Internet / User -------- AP ---------- R1 -------- R2 \ LDAP User AP R1 LDAP R2 (authn req.) ------------------------------>---------------------------------------> (authn response + attr1=val1) <---------------------------------------- (search uid=attr1) ------------------> (network params) <------------------ (params) <---------------- (Success) <------------<---------------- Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

1 0

Re: Freeradius-Users Digest, Vol 25, Issue 106
by anoop_c＠sifycorp.com 23 May '07

23 May '07

Hi all I am doing eap-tls with fr 1.1.6 I am not getting anything in the log file.I am able to authenticate and connect. Wat are the config to be done for getting log Regards Anoop

1 0

NAS ignoring Access-Accept
by Wolfgang Rosenauer 23 May '07

23 May '07

Hi, I'm not sure if I run into a Cisco or Freeradius issue here. I try to migrate from icradius to freeradius and everything worked in the new configuration when I tried with NTRadPing and so I'm switched the Cisco NAS to the new server. Unfortunately the NAS is ignoring the Access-Accept replies and always denies login attempts. That worked correctly with icradius and the NAS config changed only the ip address of the radius server. My first guess was an ip source issue but my server only has one ip address (and IPv6 ones but radiusd is only listening on 0.0.0.0) and freeradius is compiled with --with-udpfromto. Here are parts of my Cisco config: aaa authentication ppp default if-needed radius local aaa authorization network default radius local aaa accounting update newinfo aaa accounting exec default start-stop radius aaa accounting network default start-stop radius aaa accounting connection default start-stop radius radius-server configure-nas radius-server host a.b.c.d auth-port 1812 acct-port 1813 non-standard radius-server timeout 3 radius-server vsa send accounting I ran radiusd -X and saw that freeradius sent an Access-Accept reply to the NAS' ip address and source port. Any ideas? Thanks, Wolfgang

2 6

How to add a prefix to User-Name before proxying to another RADIUS server?
by Clark J. Wang 22 May '07

22 May '07

I have two RADIUS servers rad_1 and rad_2. For some users rad_1 needs to forward the requests to rad_2 and I want to add some prefix like `QA/' to User-Name before forwarding to rad_2. Does FreeRADIUS support that? And how to configure? Thanks.

3 2

Gigaword support
by eugene＠snowball.co.za 22 May '07

22 May '07

I would like to have updated mysql querries for FreeRadius that supports gigawords. Please assist.

2 1

Radius compatibility questions
by Ouahiba MACHANI 22 May '07

22 May '07

Hi, Can anyone give me details about FreeRadius compatibility? My questions are : 1- Dose radius operate easily with Cisco equipments (including firewalls, VPN, … ) and other hardware VPN servers? 2- The same question for software VPN, such as Microsoft Routing and Remote Access Server (RRAS)? 3- the same question for access points? 3- What version or variants of the following standards and methods dose radius support : X802.1X, EAP-X? - Is there available plug-in that allow to interface with ActiveDirectory ? LDAP directories ? Databases (Oracle, MySQL, etc) ? Where can I find the features of the actual version of radius? I want to develop a plug-in for FreeRadius. This plug-in should be able to handle authentication requests send from a VPN server (either hardware, Cisco or a Software (MS RRAS) implementation) or an AccessPoint. The second requirements, is that this plug-in should be able to interface with the different users Data store including ActiveDirectory, LDAP directories and Databases, to accomplish user authentication. How should I proceed to do this? Should I develop multiples modules? Is their any existing code that I can use to develop such a plug-in? Any additional indication are welcome. Thanks in advance.

3 2

Integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication
by xuebin gong 22 May '07

22 May '07

Hi, All, I am user and want to integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication. Our operating system is Fedora 5 Linux. (1)Install freeRadius-1.1.6 After following the instruction of installation in http://wwww.freeradius.org, install freeRadius-1.1.6 on Fedora Linux 5, run radius server in debug mode radiusd -X ...... Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. FreeRadius was installed succeefully. (2)Configure freeRadius-1.1.6 (2.1) Configure radiusd.conf (2.1.1) LDAP module ldap{ server = "10.0.0.118" identity = "cn=Manager,dc=mtcable,dc=net" password = mtncnl1970 basedn = "dc=mtcable,dc=net" filter = "uid=%{Stripped-User-Name:-%{User-Name}}" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } (2.1.2) authorize module uncomment ldap line authorize{ ...... ldap ...... } (2.1.3) authenticate module uncomment block ldap block: authenticate{ ...... Auth-Type LDAP { ldap } ...... } (2.2) edit /usr/local/etc/raddb/users Uncomment the following lines: DEFAULT Auth-Type = LDAP Fall-Through = 1 (3)Install openLDAP (4)Configure openLDAP (5)Add one LDAP entry for testing dn: uid=jjeep, ou=radius, rccd=AAA3140018f, dc=mtcable,dc=net userPassword:: aabbccdd cn: jeep uid: jjeep radiusAuthType: local radiusSimultaneousUse: 1 homeDirectory: // objectClass: top objectClass: posixAccount objectClass: radiusprofile uidNumber: 7012 gidNumber: 100 After add this entry to LDAP, we reset the password to "888888" (5)Test After run test command line radtest jjeep "888888" localhost 1 testing123 The following is information from running Radiusd -X: ...... rad_recv: Access-Request packet from host 127.0.0.1:32771, id=192, length=57 User-Name = "jjeep" User-Password = "888888" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jjeep", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jjeep radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.0.0.118:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1 970 to 10.0.0.118:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mtcable,dc=net, with filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for req uest 0 rlm_pap: WARNING! No "known good" password found for the use r. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "jjeep" with password "888888" radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mtcable,dc=net, with filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [jjeep] (from cl ient localhost port 1) Delaying request 0 for 1 seconds Finished request 0 Going to the next request The following is logfile: ...... May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" method=128 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 RESULT tag=97 err=0 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId radiusCallbackNumber radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SEARCH RESULT tag=101 err=0 nentries=3 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH attr=uid May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SEARCH RESULT tag=101 err=0 nentries=3 text= It looks like LDAP search successfully and found 3 entries, but redius server could not find any objects. What is wrong with my integration? Thanks In Advanced Robin ____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091

3 2

DialupAdmin Question.
by Joseph Sullivan 22 May '07

22 May '07

Hello Group, I am trying to use Dialup Admin on Free Radius 1.1.6. I have the admin.conf file all setup, it will add, remove users from the MySQL db, but it will not do the radius check by clicking on Check Server. It outputs this: Monday, 21 May 2007, 09:10:14 MDT Server: 127.0.0.1:1812 (test user cowpuppy) Then It just hangs there. I have tried everything in the admin.conf file, setting the host to localhost, the hostname, the public ip address, and it still just hangs there, and it never hits the actual radius server or completes the check. Also, I can login with the user cowpuppy just fine but dialup admin never shows this when I look at the stats for cowpuppy. When I run this command: radtest cowpuppy testpass localhost 0 testing123 It accepts me, and it shows that in the radius.log, but dialup admin doesn't recognize that. I think it is a logging issue. It looks like it needs to log to the SQL server... I am still working on that... As always, thanks for any help you can offer. Cheers!! Joseph Sullivan

2 1

Oracle 10g
by Ashraf Al-Basti 22 May '07

22 May '07

Dear All, is it possible to run Freeradius using oracle 10g DB on different servers? i have freeradius 1.0.1-3 under Redhat AS4 (rpm package). please how can compile freeradius to use the oracle DB?

4 4