January 2008 - Freeradius-Users - lists.freeradius.org

radgroupreply do not read (read_grous directive)
by Arlinelson Fernandes dos Santos 18 Jan '08

18 Jan '08

6 16

Freeradius LDAP at RHEL 5.1
by Renato Gregio de Souza Filho 18 Jan '08

18 Jan '08

Hi all, I'm trying to configure freeradius to authenticate at LDAP Database. I have a poor knowledgement about freeradius and need help :) ... What i need to do to configure correctly my freeradius to authenticate at ldap database? how do i can test it? today i have the following structure at my ldap tree, OU, and user example: ####################################################################### dn: dc=peixotoradius,dc=com,dc=br objectClass: top objectClass: dcObject objectClass: organization o: Peixoto dc: peixotoradius dn: ou=usuarios,dc=peixotoradius,dc=com,dc=br objectClass: top objectClass: organizationalUnit ou: usuarios dn: uid=1015,ou=Usuarios,dc=peixotoradius,dc=com,dc=br uid: 1015 cn: 1015 userPassword: {crypt}$1$1gLC/3mY$aEsZ9ckW6FvyNkUrWDtv0. objectClass: radiusObjectProfile ####################################################################### and at my /etc/raddb/radiusd.conf i have the following at ldap: ####################################################################### prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib64 pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf ldap { server = "localhost" identity = "cn=admin,dc=peixotoradius,dc=com,dc=br" password = My_password basedn = "dc=peixotoradius,dc=com,dc=br" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap timeout = 4 timelimit = 3 net_timeout = 1 } #######################################################################

2 1

radius attributes for cisco ip phone
by Stieven.Struyf＠komatsu.eu 17 Jan '08

17 Jan '08

I have hp procurve 3500yl switches for which i use mac based authentication against radius server. The radius server should assign the vlan's. The pc that hangs behind the phone get the correct vlan, but the phone doesn't. The radius userfile contains this for the phone(for the pc i have the same structure, only different vlan): 001c13d6b06f User-Password == "001c13d6b06f" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-id = "20" The phone doesn't seem to receive an ip. Is there an error in my config? Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 "The question of whether a computer can think is no more interesting than the question of whether a submarine can swim." -- E. W. Dijkstra "This e-mail is property of the company and is supposed to contain only professional content. The company can at all times consult the content of this e-mail and the reply to this e-mail. By replying to this e-mail, you confirm your explicit agreement with the preceding." "Deze e-mail is het eigendom van de Vennootschap en wordt verondersteld enkel beroepsmatige informatie te bevatten. De Vennootschap kan ten allen tijden de inhoud van deze e-mail en van het antwoord daarop raadplegen. Door het beantwoorden van deze e-mail bevestigt U uitdrukkelijk uw akkoord met het voorafgaande."

5 4

Upgrading from 1.0.2 to 2.0.0 problems
by William 17 Jan '08

17 Jan '08

Greetings, I have looked at the documentation included with the 2.0 distribution for setting up radius 2.0 and I am either blind, or it doesn't have when I am looking for. What I am trying to do is set up my main realm to handle either no realm or deal with the default realm, The problem I am having is that I do not wish to proxy it back to itself to handle the realm (puts it in my log twice, and debug shows it re-submitting it back to itself). Where do I look to solve this? I tried in proxy.conf adding: realm myrealm.com { } and tried, at a different time: realm myrealm.com { auth_pool = my_auth_failover } Trying to use the configuration provided as a template. The first causes user(a)myrealm.com to fail, and the second causes it to re-submit it to the server for authentication. How do I fix this, or where is there some detailed documentation on how to configure this? Thank you Wm

3 7

how can I change freeradius logs in other format?
by Niki Petrov 17 Jan '08

17 Jan '08

I'd like to save my freeradius log(accounting) format in other (an example: table) format. Can I do that, and if YES, how? (OS FreBSD 7.0RC1, freeradius version 1.1.7) Thanks!

2 1

cisco wlse patch
by Marc Boisis-Delavaud 17 Jan '08

17 Jan '08

Hello, Have you a patch for cisco wlse leap authentication, working for freeradius 2.0 ? Thanks

1 0

Conditional Authorize based on SQL-Groups?
by Etienne Pretorius 17 Jan '08

17 Jan '08

Hello list, Is there anyway that I can selectivly execute modules in the authorize sections based upon the SQL-Group the user belongs to. I also need to know where you are suppose to enable the 'read_groups' directive as I do not see the sql query being performed at all. <cut> radius_xlat: 'bob@testing' rlm_sql (sql): sql_set_user escaped user --> 'bob@testing' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'bob@testing' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'bob@testing' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'bob@testing' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'bob@testing' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: entering group for request 0 rlm_sqlcounter: Entering module authorize code <cut> /etc/freeradius# grep read_groups * sql.conf: read_groups = yes -- Kind Regards Etienne Pretorius

1 0

XP User/machine accounts
by Ian Begg 16 Jan '08

16 Jan '08

Hi Dont know if this is the correct place to ask but I have a problem. I have got freeradius working with eap/tls and can load the certs to XP laptops and connect. The problem I have is that if I log onto the laptop using a different user, no log on, I think the certs are for user and not machine. Anyone know of a fix. Ian ps I have used http://wiki.freeradius.org/WPA_HOWTO for the setup.

3 2

SQL query length
by Spam Eater 16 Jan '08

16 Jan '08

Hello everyone, I am trying to do a more complicated query for a custom session time counter, but I am running into problems. Can someone please answer the following questions? Problem: When I have the attribute Session-Timeout in the radcheck table, I get a Segmentation Fault after the query as run, no matter if it returns results or not. a) I've noticed that freeradius performs Accounting-Request when this attribute is set, is this normal? b) Is there a limit to the sql query length? c) Is there a limit to the field name, i.e., should I use "SELECT This_is_a_very_long_field_name_having_ifs_nulls_etc AS ShortFieldName" or is it irrelevant? d) The particular query performs a join to another table, may this be the source of the problem? e) Is it mandatory that a query returns results? f) Can I use multiple 'query' in radius.conf, using the values from a first query to feed the next one? Thank you !!

5 8

Failed MAKE on SLES10
by David W Bell 16 Jan '08

16 Jan '08

Anyone else seen this, and if so is there an easy fix, or do I need to find an alternative libgdbm.so ? /home/belld/freeradius-1.0.4/libtool --mode=link gcc -release 1.0.4 \ -module -export-dynamic -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../../include \ -o rlm_counter.la -rpath /usr/local/lib rlm_counter.lo -lgdbm -lnsl -lresolv -lpthread -lcrypto -lssl rm -fr .libs/rlm_counter.la .libs/rlm_counter.* .libs/rlm_counter-1.0.4.* gcc -shared rlm_counter.lo /usr/lib/libgdbm.so -lnsl -lresolv -lpthread -lcrypto -lssl -Wl,-soname -Wl,rlm_counter-1.0.4.so -o .libs/rlm_counter-1.0.4.so /usr/lib/libgdbm.so: could not read symbols: File in wrong format

8 12