June 2007 - Freeradius-Users - lists.freeradius.org

MAC-auth only to AP needs a little guidance.
by Giobbi Piero 08 Jun '07

08 Jun '07

Hi all. Im just got radius with user/password to work with my firewall and i just love it! Now i would like to make it rock with our airport basestations to. I only want MAC-authentication, isearched everywhere but i cant find a single example for this , without EAP/TLS. I tried: <MAC-ADDR> "shared secret" as more or less a panic try but of course it didnt work. If anyone could just give me an example or hint where to find some nice info about it would make me happy. Thx p

3 2

rlm_eap:SSL error
by Apangshu Saha 08 Jun '07

08 Jun '07

Dear All, Please let me know the detailed reason why the RADIUS server log is showing the error in SSLV3 read client certificate A please let me know the necessary steps to solve this. With regards , Apangshu

2 1

RE: How to connect to backend DB
by Nitin Naveen 08 Jun '07

08 Jun '07

Hi Peter, I did bother to look at rlm_sql. However my need is a bit different. I do not want to fetch values from a DB and added them as values to certain radisu attributes. I want to fetch, do some operation on the feteched value and then add the result of the operation to the radius attributes. Any ideas or suggested steps would be helpful. Regards Nitin Date: Thu, 7 Jun 2007 11:12:47 +0300 From: Peter Nixon <listuser(a)peternixon.net> Subject: Re: How to connect to backend DB To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200706071112.48377.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-9" On Thu 07 Jun 2007, Nitin Naveen wrote: > Hi, > > I am writing a new RLM called rlm_prop_protocol. It basically adds some > attributes. The value for > these attributes are pulled from a backend database (MYSQL). I wanted to > know whether there > is a provision in freeradius or some standard method that may be used to > connect and fetch > data from the MYSQL database. As of now I have added MYSQL specific code > in my module. Did you bother to look at the FreeRADIUS code before you started writing?? The modules rlm_sql and rlm_sql_mysql would seem to be pretty self explanatory :-) It is quite likely that you can do what you need without writing a new module... Cheers -- *****************************************************DISCLAIMER***************************************************** This message and/or attachment(s) contained here are confidential, proprietary to HUGHES SYSTIQUE and its customers. Contents may be privileged or otherwise protected by law. The information is solely intended for the entity it is addressed to. If you are not the intended recipient of this message, it is strictly prohibited to read, forward, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately and delete the message. ********************************************************************************************************************

2 1

Re: Freeradius-Users Digest, Vol 26, Issue 20
by t.drollinger＠i-motion.de 07 Jun '07

07 Jun '07

Ich bin am Freitag den 8. Juni nicht im Haus und kann Ihre Nachricht erst am Montag den 11. Juni bearbeiten. In dringenden Fällen wenden Sie sich bitte an Herrn René Böhm (E-Mail: r.boehm(a)i-motion.de) Mit freundlichen Grüßen Tobias Drollinger

1 0

Ldap group troubles
by Dourty, Brian R. (IATS) 07 Jun '07

07 Jun '07

I'm having some trouble with the ldap group configuration against AD and need a little help. Freeradius 1.1.4 MS 2003 Active Directory radiusd.conf groupname_attribute = "cn" groupmembership_filter = "(member=%{Ldap-UserDn})" groupmembership_attribute = memberOf users file DEFAULT Ldap-Group == "CN= CSG Group,OU=CSG,OU=ACE,OU=IATS,OU=MU,DC=col,DC=missouri,DC=edu", Auth-Type := LDAP Using ldapsearch as follows I get a match. ldapsearch -x -W -b"CN=Some GROUP,OU=" "(member= CN=Last\\\, First \(Department\),CN=Users,DC=col,DC=missouri,DC=edu)" The userDN actually looks like "CN=Last\, First (Department),CN=Users,DC=col,DC=missouri,DC=edu" but we have escape the \ and the () for bash. Freeradius isn't getting the same results. It looks like it has to do with the fact that the UserDN has a \, and (...) in it. Has anyone else ran into this before? Thanks, Brian Dourty System Administrator - Team Lead Division of IT (formerly IAT Services) University of Missouri - Columbia 573-882-1035

4 11

Re: rlm_sql_mysql Problem with Freeradius on Centos 5
by Andy Hughes 07 Jun '07

07 Jun '07

Hi all, After much head scratching I worked it out. The problem was that SELinux was enabled and stopping radiusd from connecting to the socket. Thanks for your help. Andy > > Message: 2 > Date: Thu, 7 Jun 2007 10:12:38 +0300 > From: "liran tal" <liransgarage(a)gmail.com> > Subject: Re: rlm_sql_mysql Problem with Freeradius on Centos 5 > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <3ed55890706070012r1a1891b2xce125f51f45c2664(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Could it be an authentication problem? Maybe you didn't spell the user to > connect to mysql correct? > I would also suggest that you enable extensive logging on the mysql side > to > see if there are any > requests. This is done usually in /etc/mysql/my.cnf > > > Liran. > > On 6/7/07, Andy Hughes <andy(a)conet.co.nz> wrote: >> >> Hi Freeradius Users, >> >> I am having an issue with the rlm_sql_mysql driver on Centos 5. >> >> When I run radius from the init.d/radiusd the server presents the >> following error in the radius logs. >> >> --snip-- >> >> Fri Jun 8 02:58:42 2007 : Info: rlm_sql (sql): Driver rlm_sql_mysql >> (module rlm_sql_mysql) loaded and linked >> Fri Jun 8 02:58:42 2007 : Info: rlm_sql (sql): Attempting to connect to >> radius@localhost:3306/radius >> Fri Jun 8 02:58:42 2007 : Info: rlm_sql_mysql: Starting connect to > MySQL >> server for #0 >> Fri Jun 8 02:58:42 2007 : Error: rlm_sql_mysql: Couldn't connect socket >> to MySQL server radius@localhost:radius >> Fri Jun 8 02:58:42 2007 : Error: rlm_sql_mysql: Mysql error 'Can't >> connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' >> (13)' >> Fri Jun 8 02:58:42 2007 : Error: rlm_sql (sql): Failed to connect DB >> handle #0 >> >> -- snip -- >> >> -- snip -- >> netstat -a >> >> unix 3 [ ] STREAM CONNECTED 120857 >> /var/lib/mysql/mysql.sock >> tcp 0 0 *:mysql *:* >> LISTEN >> >> -- snip -- >> >> I have tried running the server as root and I still receive the same >> error. >> >> However, >> >> When I run the server in extended debug mode (as root) the server starts >> fine and will serve authentication from the MySQL database quite > happily. >> >> --snip-- >> >> rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and >> linked >> rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius >> rlm_sql (sql): starting 0 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 >> rlm_sql_mysql: Starting connect to MySQL server for #0 >> rlm_sql (sql): Connected new DB handle, #0 >> rlm_sql (sql): starting 1 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 >> rlm_sql_mysql: Starting connect to MySQL server for #1 >> rlm_sql (sql): Connected new DB handle, #1 >> rlm_sql (sql): starting 2 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 >> rlm_sql_mysql: Starting connect to MySQL server for #2 >> rlm_sql (sql): Connected new DB handle, #2 >> rlm_sql (sql): starting 3 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 >> rlm_sql_mysql: Starting connect to MySQL server for #3 >> rlm_sql (sql): Connected new DB handle, #3 >> rlm_sql (sql): starting 4 >> rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 >> rlm_sql_mysql: Starting connect to MySQL server for #4 >> rlm_sql (sql): Connected new DB handle, #4 >> Module: Instantiated sql (sql) >> >> --snip-- >> >> I have also tried various variations of commands in sql.conf to > configure >> the sql port. Can anyone tell me what the appropriate configuration > command >> is? >> >> Can anyone shine any light on what might be the problem here? >> >> Regards, >> >> Andy Hughes >> >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

1 0

From users file to SQL
by David Majorel 07 Jun '07

07 Jun '07

Hi, I need to convert my users/group file to rlm_sql, but after reading the wiki, I can't figure out how to reproduce the flow. I want to authorize all connections, except if the user exists and the password is wrong. If the users doesn't exist or is disabled, I set an unrouteable address to the user. The point is to prevent DSL routers to keep on trying to connect when they are misconfigured, or customer is suspended. I use rlm_sql and rlm_sqlippool with a MySQL backend. The users file I try to convert looks like this : ------ # Default profile for everyone DEFAULT Pool-Name = "default" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Netmask = 255.255.255.254, Framed-MTU = 1492, Framed-Compression = Van-Jacobson-TCP-IP, Qos-Policy-Metering = DL128, Qos-Policy-Policing = UL64, Fall-Through = Yes # Set group attributes DEFAULT Group-Name == "SUSPENDED", Auth-Type := Accept, \ Pool-Name := "disabled" DEFAULT Group-Name == "DSL500", Pool-Name := "dsl500" Qos-Policy-Metering := DL512, Qos-Policy-Policing := UL128, Fall-Through = Yes [... more groups ...] # Set user attributes testuser ClearText-Password := 'test' Framed-IP-Address := [...], Framed-Route := [...], Framed-IP-Netmask := [...], [... more users ...] DEFAULT Auth-Type := Accept ------ According to the wiki, rlm_sql process users first, then groups. With this order, a user could have his IP/routes set even if he is disabled (because he is not rejected). As I have about 10000 users, using big users/group files is not really an option :-) Maybe I did something wrong, any help would be appreciated. Thanks, -- David Majorel Offratel/Lagoon ISP

5 8

check-config option
by Giovanni Lovato 07 Jun '07

07 Jun '07

On http://wiki.freeradius.org/index.php/FAQ, question 6.10 I read: <quote> With FreeRADIUS you can simply use: radiusd -C to check the configuration. [...] </quote> But when I try to do that: <code> # radiusd -C radiusd: invalid option -- C Usage: radiusd [-a acct_dir] [-d db_dir] [-l log_dir] [-i address] [-p port] [-AcfnsSvXxyz] </code> I'm using FreeRADIUS 1.1.6. G.L. -- www.aldu.net/~heruan giovanni.lovato(a)aldu.net

3 3

Markus Wintruff istaußer Haus.
by markus.wintruff＠linde.com 07 Jun '07

07 Jun '07

Ich werde ab 07.06.2007 nicht im Büro sein. Ich kehre zurück am 10.06.2007. Bitte wenden sie sich an Michael Cochu michael.cochu(a)linde.com +49-40-7339-1432. I am not in the office. Please contact Michael Cochu michael.cochu(a)linde.com +49-40-7339-1432.

1 0

Re: Freeradius-Users Digest, Vol 26, Issue 18
by Nitin Naveen 07 Jun '07

07 Jun '07

Hi Peter, I did bother to look at rlm_sql. However my need is a bit different. I do not want to fetch values from a DB and added them as values to certain radisu attributes. I want to fetch, do some operation on the feteched value and then add the result of the operation to the radius attributes. Any ideas or suggested steps would be helpful. Regards Nitin Date: Thu, 7 Jun 2007 11:12:47 +0300 From: Peter Nixon <listuser(a)peternixon.net> Subject: Re: How to connect to backend DB To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200706071112.48377.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-9" On Thu 07 Jun 2007, Nitin Naveen wrote: > Hi, > > I am writing a new RLM called rlm_prop_protocol. It basically adds some > attributes. The value for > these attributes are pulled from a backend database (MYSQL). I wanted to > know whether there > is a provision in freeradius or some standard method that may be used to > connect and fetch > data from the MYSQL database. As of now I have added MYSQL specific code > in my module. Did you bother to look at the FreeRADIUS code before you started writing?? The modules rlm_sql and rlm_sql_mysql would seem to be pretty self explanatory :-) It is quite likely that you can do what you need without writing a new module... Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc *****************************************************DISCLAIMER***************************************************** This message and/or attachment(s) contained here are confidential, proprietary to HUGHES SYSTIQUE and its customers. Contents may be privileged or otherwise protected by law. The information is solely intended for the entity it is addressed to. If you are not the intended recipient of this message, it is strictly prohibited to read, forward, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately and delete the message. ********************************************************************************************************************

1 0