June 2007 - Freeradius-Users - lists.freeradius.org

freeradius and AD
by Donny Jekels 28 Jun '07

28 Jun '07

Did anyone ever got FreeRadius to work with AD on Windows 2003 R2? I tried the config recommended in the FAQ to get FR to work with AD and I never get nay use to authorize. Any advise or working configs would be greatly appreciated.

2 1

802.1x+EAP+LDAP
by Arjuna Scagnetto 28 Jun '07

28 Jun '07

i have a configuration that works. Using 802.1x Eap-ttls (pap) and a OpenLdap for user authentication. It works. But this lines inside radius.conf make me confused. # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. in my radius.conf the following lines ,in section authorize, are uncommented Auth-Type LDAP { ldap } and in section authentication ldap option is uncommented. if i comment the ldap options in authorize section doesn't work, and the same if i comment the ldap option in authenticate section. No radius schema installed on openldap. Using ldap.attr in radius. Can someone help me understand why it works even if it shouldn't? Thanks for answering Arjuna Scagnetto

2 1

Hints File and Users file and I am lost
by Jeff 28 Jun '07

28 Jun '07

First let me say I have worked on this for a day, read pretty much all i can find, docs etc, and am getting more confused as I go, so its time to step back and ask for some help om what I am doing wrong. I am trying to get a default profile to work I can't put on in the users file cause the billling program auto creates a file, and its the culprit that won't input the ascend-data-filter in the correct format. So I can't create a default profile in the users file I use a users txt file for users to auth thats imported by our billing program This works great, etc and users auth, etc aok all works and is in production The issue came up when the ascend data filter would not work well it turns out the billing program sends the info wrong it just not chageable at the billing software Ascend-Data-Filter = "ip in forward tcp est", ---> note no + as += And of course without the += when its sent out to the nas its only seeing the 1st line and doesn't read the rest of the filters The issue is its importing the ascend data filter attribute incorrectly and theirs no way to change it at the rodopi billing end I won't get into details of that for its just not possible to get that to happen So I need to come up with a way add that info at the radius level I have played with the hints file but i am not sure thats my answer, and for some reason its not even appearing to see it ie the preprocess is uncommented in radiusd.conf authorize section and in accounting section Heres the example Heres whats happening on a user with what i have been trying First I have two realms example realm sakeoftest.net { type = radius authhost = LOCAL accthost = LOCAL nostrip realm sakeoftest2.net { type = radius authhost = LOCAL accthost = LOCAL nostrip --- Heres the hints file entry DEFAULT Suffix == "", Strip-User-Name = No Hint = "test", Framed-Protocol = PPP, Service-Type = Framed-User, Session-Timeout = 14400, Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in forward dstip *.*.*.*/32", Ascend-Data-Filter += "ip in drop tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Port-Limit = 1 --- Heres the entry for the users.txt file joe "test" Hint = "test", Fall-Through = no Any ideas anyone ???? Please!!!!!!!!!

3 6

FreeRadius.Net
by Summer Dance 28 Jun '07

28 Jun '07

Hi all, I have problem with FreeRadius.net - Windows version of FreeRadius and not sure if I am on right place to post question. Now, I will supose that I am on right question and post it, otherwise I suggest someone of administrators to point it out and hoppely point out where to post the question. I cann't start FreeRadius.net in debug mode and I have this reply: Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\FreeRADIUS.net\bin>radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Errors reading /usr/local/FreeRADIUS.net-1.1.5/etc/raddb: No such file or direct ory Errors reading radiusd.conf C:\FreeRADIUS.net\bin> As far as I can see, something wrong with paths. Trying to find where to correct the paths in configuration files on Radius server and I have changed all lines looking like this: /usr/local/FreeRADIUS.net-1.1.5/ to path I have installed in my FreeRadius.net but still have the same output with an Error... as you can see above. Can someone help me with this ? Al.

1 0

Segfault when accessing request attributes
by baki＠enternet.hu 28 Jun '07

28 Jun '07

Hello! I use Debian 4.0 with FreeRadius 1.1.3 and I am developing a custom module for the post-auth section. When I want to access the request attributes (user name and password) I get a segmentation fault with this code: VALUE-PAIR *request_pairs = request->packet->vp; When I used gdb to debug the segfault I noticed that the request attributes are in request->proxy (and the reply attributes are in request->proxy_reply). I don't understand this because the preprocess module runs before my module and it uses request->packet->vps without any errors. Please help me, because if I write my module using request->proxy and request->proxy_reply I get a segfault in an accounting module (running after my module) when it tries to access the request attributes in request->packet. Thanks. Best regards, Baki

2 1

Re: Pam_radius_Auth - Problem
by Geoff Mitchell 28 Jun '07

28 Jun '07

Markus, Did you get any replies to your post from the 18th about pam_radius_auth not working, as I am having exactly the same issue. What I have found out is that the pam_radius_auth module is fine, except when the user is not in the password file. At this point it would seem that something is not getting initialised correctly which results in the call to conv->conv, which should prompt you for the password and then return it in resp->resp, constantly comes back with ^H ^\177INCORRECT. As this translates to the value you saw in your password field, I have to suspect that something is broken within PAM and requires the modules to work around this if the user is not in the password file. The problem I am having is working out how to work around the problem, so I am interested as to if you got a reply to your post. Thanks Geoff

1 0

duplicate requests...
by suganthi velusamy 28 Jun '07

28 Jun '07

--------------------------------- Bollywood, fun, friendship, sports and more... you name it, we have it.

3 3

sqlippool reject authentication if no IP?
by Hugh Messenger 28 Jun '07

28 Jun '07

With my current configuration, if sqlippool cannot assign an IP, the authentication still succeeds. How can I set things up so if no IP is available, the authentication will fail with some informative Reply-Message, like the simultaneous use session control does? -- hugh

3 2

Question about dictionnary
by Thomas LAVIGNE 28 Jun '07

28 Jun '07

Hello all, I'm new to the world of Linux and FreeRadius and of course also new to this list. I need to build up a Radius Server with FreeRadius. It will answere request coming from ADSL users, relayed by a RadisuProxySmartEdge Redback. On my test server, I've successfully installed the OS, FreeRadius the MySQL server, the SSH server, apache and phpmyadmin. Some Radius Client test show that it seems to work with a test-user in MySQl Database. I got Access-Accept. My problem is that the customer ask me to ?change/add? dictionary for supporting "RedBack attributes". I need to add user name and password for each users and and three common value for all users. I'm not sure how to do that. Include an other file, modify the main dictionary file ? Can someone please explain me how to play with dictionary. Everything was installed this WE, so I guess I have all the last version. (some guide I found talk about unexisting folder, or about radiusd which seems little bit different of FreeRadius). I hope I was clear enough. Thank you for reading me. Any help will be greatly appreciate. Good night. Regards, Thomas

6 7

2.0.0 Depracated conditional expansion ":-"
by Hugh Messenger 28 Jun '07

28 Jun '07

The default mysql-dialup.conf queries are generating a lot of these warnings: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: INSERT INTO radpostauth (id, user, pass, reply, date) VALUES ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (id, user, pass, reply, date) VALUES ('', 'radiustest', 'test123', 'Access-Accept', '2007-06-27 13:34:51') I'm assuming the warning is telling me that things like '%{User-Password:-Chap-Password}' should now be '%{%{User-Password}:-%{Chap-Password}}', as per 'man unlang': Conditional Syntax Conditional syntax similar to that used in Unix shells may also be used. %{%{Foo}:-bar} If %{Foo} has a value, returns that value. Otherwise, returns literal string "bar". %{%{Foo}:-%{Bar}} If %{Foo} has a value, returns that value. Otherwise, returns the expansion of %{Bar}. This is the same for every conditional variable in the mysql-dialup.conf file, of which there are quite a few. If they do need changing, I'll be quite happy to do that and send you a fixed file. -- hugh

2 1