July 2007 - Freeradius-Users - lists.freeradius.org

Dusty Doris
by Fabio Silva 26 Jul '07

26 Jul '07

Dusty doris are you here? i need talk to you. and your mail dusty(a)doris.cc doesnt work... Sorry for all, Regards

1 0

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

Hi, We are using freeradius 1.1.6, now, to provide access for our wireless network only. The accounting is very detailed and comprehensive: IP addresses, usernames, packets, roles, APs, SSIDs, etc. Now, we are starting to use the same radius to give 802.1x access to our wired network. The key is that the accounting records for a wired switch are VERY different. Now, AP and SSID, are nonsense items, for example. But we need another records. Can freeradius use different accounting sql inserts depending on NAS? Is there any document showing something like this? I have read many documents but I can not find a clear answer. This was the main question. A related tiny question is as follows. The most comfortable configuration will be to use different accounting inserts depending on huntgroups. Then we could select sql inserts for one huntgroup (all our wired NASes) and different sql insert for another huntgroup (all our wireless NASes). The addition, remove or change of the different NASes could be made modifying only the lists contained in the huntgroups file. It could be very clean and useful. But, when I read the huntgroups documentation I have the strong suspect I can´t do this. Thank you very much in advance, Nicolas Velazquez

2 1

Op values for Attributes
by liran tal 26 Jul '07

26 Jul '07

Hey everyone, I was wondering... are the Op values for certain RADIUS attributes will always be the same or it is completely dynamic to assign any Op value to any attribute. For example, the Max-All-Session attribute, is it always assigned the := op or may it be assigned += , =* , != etc... some other Ops. Thanks, Lir.

2 2

FreeRADIUS 1.1.7 has been released
by Alan DeKok 25 Jul '07

25 Jul '07

Feature improvements * Updated LDAP documentation * Added note on DH parameters in eap.conf, and debugging messages which complain if DH is used, but not configured properly. * Updated the Mikrotik dictionary. Added a note that the sample dictionary they supply is broken. * Output more information on blocked threads, which should help narrow down which modules is causing the problem. * Added more eDirectory support. * rlm_ldap now prints out attributes in the standard format * Enabled server-side handling of procedures in MySQL Bug fixes * Added NT-Hash support for mschap_xlat * Corrected documentation to point to correct location of files * Checks for more recent FreeBSD versions * use -DLDAP_DEPRECATED to avoid OpenLDAP crashes * Use correct value for authentication name in rlm_mschap * Fix over-ride for usernames when use_tunneled_reply = yes Alan DeKok.

1 0

RE:Invalid Operator
by Chris Bell 25 Jul '07

25 Jul '07

They are using the '=' operator. Whether they are correct or not is what I'm trying to determine :). Maybe I should say that I'm very new to both Linux and Radius. I've searched the web for references to these errors but have found nothing that clearly states what should be used. '==' or '='. Thanks for your patience. -----Original Message----- From: freeradius-users-bounces+cbell=thig.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+cbell=thig.com@lists.freeradius.org]On Behalf Of Alan DeKok Sent: Tuesday, July 24, 2007 7:02 PM To: FreeRadius users mailing list Subject: Re: rlm_sql bug in 64-bit architecture ? Chris Bell wrote: > Invalid operator for item User-name: reverting to '==' > > All three of my server logs are filled with them and I've been unable to > find the reason why. All the username's listed in the huntgroup can > successfully authenticate. Have you looked at all of your references to User-Name in the configurations? What operator are they using? Is the operator correct? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

3 2

rml_perl question
by FreeRadius-ML 25 Jul '07

25 Jul '07

Hi All, I've been tinkering with rlm_perl for a few days now, and found it to be fairly simple and straight forward. However, there is something that I'm a little unsure about it's possibility, so I would like to address the list about it. My aim is to have my rlm_perl script connect to a platform of mine, via a proprietary socket protocol. I've noticed that the rlm_perl example is just made of functions, without a main program. My question is this, if I include a main program loop, will that be executed upon the loading of the rlm_perl module, and the execution of the functions by FreeRadius will be performed in accordance to the main program loop? For example, I will open a socket in the main loop, make sure it stays open, and the various functions will utilize the socket that was opened in the main loop - is that possible, or am I misunderstanding something here? Regards, Z2L

6 25

Help: Adding WiMAX VSA support
by Govardhana K N 25 Jul '07

25 Jul '07

Hi, I am using WiMAX supported client, so the attribute format for WiMAX is like Attribute-Type, Length, CONTINUATION, and Value. How can I modify the server to send the attributes in this format? Thanks & Regards, Govardhana K N -- With Regards, Govardhana K N

2 3

Support for WiMAX VSA
by Nitin Naveen 25 Jul '07

25 Jul '07

Hello All, Hi I am Nitin Naveen working with HUGHES SYSTIQUE. We have been working to enhance freeradius to support WiMAX VSA (as per WiMAX NWG forum). WiMAX VSA are not the typical type-length-value rather they have type-length-controlinfo-value. We have enhanced the dictionary but we were not able to generate the attributes as per the WiMAX NWG format. For now we have developed our own rlm_hsc_wimax module. We like to contribute to freeradius so that the WiMAX VSA are supported as part of the standard distribution. To this end we can share our code. But before that we would like to follow the correct procedure for releasing the code. Your inputs and suggestion are awaited. Regards Nitin Naveen Principal Engineer HUGHES SYSTIQUE D-8, Infocity-11 Sector-33, Gugaon Haryana, India tel: +91-124-3045400 fax: +91-124-4039301 nitin.naveen(a)hsc.com www.hsc.com *****************************************************DISCLAIMER***************************************************** This message and/or attachment(s) contained here are confidential, proprietary to HUGHES SYSTIQUE and its customers. Contents may be privileged or otherwise protected by law. The information is solely intended for the entity it is addressed to. If you are not the intended recipient of this message, it is strictly prohibited to read, forward, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately and delete the message. ********************************************************************************************************************

4 4

mschap:User-Name and DOM\user versus user@DOM.EXAMPLE.COM
by Phil Mayers 25 Jul '07

25 Jul '07

All, A few facts first; Windows seems to "know" about both DOM\user and user(a)DOM.EXAMPLE.ORG formats for usernames; when generating an mschap response, it only ever user the "user" portion. ntlm_auth seems to take *exactly* what you put into the command line; that is, it does NO stripping of DOM\user or user(a)DOM.EXAMPLE.ORG rlm_mschap registers several expansions, including mschap:User-Name - this particular expansion performs the following transforms: host/name.dom.example.org -> name$ DOM\user -> user I'm wondering if it would be sensible to add the following transform to the above list: user(a)DOM.EXAMPLE.ORG -> user The rationale being thus: if you want to support both prefix and suffix forms of the realm *and* machine based auth, you have to use the slightly non-intuitive syntax: ntlm_auth --username=%{Stripped-User-Name:-%{mschap:User-Name}} and have : modules { realm suffix { format = suffix delimiter = "@" ignore_null = yes } realm ntdomain { format = prefix delimiter = "\" ignore_null = yes } } authorize { preprocess prefix suffix mschap } If the @suffix transform were in mschap, it would be possible to dispense with the realm modules entirely, and just use: ntlm_auth --username=%{mschap:User-Name} Comments?

1 0

RE: How to capture wireless EAP packets on Windows XP?
by Josh Howlett 25 Jul '07

25 Jul '07

I usually find it simplest to use tcpdump on the RADIUS server, although I've used Wireshark in the past on Windows supplicants. josh. > -----Original Message----- > From: > freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. > org > [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre eradius.org] On Behalf Of Clark J. Wang > Sent: 25 July 2007 03:48 > To: freeRadius Mailing List - users > Subject: How to capture wireless EAP packets on Windows XP? > > I'm testing FreeRADIUS's PEAP-EAP-MSCHAPv2 functionality with > a wireless USB adapter (D-Link AirPlus G DWL-G122) on Windows > XP (SP2). I tried to capture the EAP packets using Wireshark > 0.99.6a but I failed. > > Anyone can help? Thanks. > >

2 1