October 2008 - Freeradius-Users - lists.freeradius.org

Authentication ok but not login on a Netopia
by Gamaliel Bedolla 13 Oct '08

13 Oct '08

Hi all, I have problems with the autentication of a Netopia R910 router with firmware 4.11. The configuration of the Freeradius is ok but Netopia is not accepting the Acces-Accept form the freeradius. The questions are: Is there an atrribute the Freeradius must reply to the Netopia ? Is there any misconfiguration on the Netopia? Freeradius ver. is 2.0.4. (part of the reply of the Freeradius) rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "****" rlm_pap: Using clear text password "****" rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [gbf/****] (from client ezeronet port 0) +- entering group post-auth ++[exec] returns noop Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 24 with timestamp +98 Ready to process requests. This is the configuration of the Netopia router: Advanced Security Options Security Databases... RADIUS then Local RADIUS Server Addr/Name: (Ip-of-the-Freeradius) RADIUS Server Secret: ******************** Alt RADIUS Server Addr/Name: Alt RADIUS Server Secret: RADIUS Identifer: RADIUS Server Authentication Port: 1812 RADIUS Access Privileges... All Telnet Server Port: 23 LAN (EN Hub) IP Filter Set... Remove Filter Set Thanks to all.

2 1

FR2.1.1 Solaris 5.10 x86 32-bit race condition
by Chris Howley 13 Oct '08

13 Oct '08

Alan, FR 2.1.1, Solaris 5.10 x86 32-bit We're using the latest code from git.freeradius.org. We're using PEAP/MSCAHPv2 and authenticating against Microsoft AD. We've encountered a race condition affecting the server when the supplicant on a windows XP station attempts to reauthenticates 30 minutes after the initial user logon. Here's the URL for the gdb and radiusd -X output: http://129.11.59.52/RADIUSD/ Any help in fixing this problem would be appreciated. Thanks, Chris Howley

2 1

NAS-Identifier
by Stefan Eck (gmail) 13 Oct '08

13 Oct '08

Hi, running successfull freeradius in 1.x version, i'm looking for some free radius documentation to the NAS-Identifier. Couldn't find anything in the doc or wiki. Anyone who can point me to some docs? I do have now an additional NAS which sends an different NAS-Identifier, but I do currently not know how to take advantage of them. Thanks

3 4

One user - Different Service Type depending on NAS
by Mats Blomgren B 13 Oct '08

13 Oct '08

Hi, I have about 6 people working with Network Administration. 3 of the users should have full access (read/write) to the network (94 Extreme Switches). This is straight forward. The other 3 should have read/write to about 80 switches and read only to the last 14. I understand that I can group devices in huntgroups and users in groups and then control the access. The problem I have is that I don't know how to give a certain user a specific "Service-Type" depending on the NAS he/she tries to connect to. I want the Service Type do differ for certain users depending on the NAS. Admin should always have read/write access to all switches and the others should have "read" on some switches and "read/write" on some. The Service type for Extreme Switches are as follows: Service-Type = Login-User (Read Only) Service-Type = Administrative-User (Read/Write) Best Regards Mats Blomgren

3 2

access rights for some users ou users groups with freeradius and mysql
by BADAOUI Nasr-Eddine (P) 13 Oct '08

13 Oct '08

Hi, I'd like to know how to authorize some users or users's group created in mysql tables can logged only on some mysql's clients, with freeradius. Mysql's tables are : nas table for clients radcheck table for users radgropucheck table usergroup table many thanks

2 1

problem installing freeradius
by Tomas D 13 Oct '08

13 Oct '08

Hi, I'm trying to fetch radius from git and install it on my ubuntu server. I'm having some issues compiling radius... Here's what I'm doing; get root@DEV1:~# git clone git://git.freeradius.org/freeradius-server.git radiusd Initialized empty Git repository in /root/radiusd/.git/ remote: Counting objects: 59514, done. remote: Compressing objects: 100% (14414/14414), done. remote: Total 59514 (delta 46293), reused 57698 (delta 44971) Receiving objects: 100% (59514/59514), 11.36 MiB | 2308 KiB/s, done. Resolving deltas: 100% (46293/46293), done. update root@DEV1:~# cd radiusd/ root@DEV1:~/radiusd# git pull origin master:master Already up-to-date. configure ... configure: creating ./config.status config.status: creating Makefile config.status: creating config.h make make[6]: Leaving directory `/root/radiusd/src/modules/frs_detail' Making all in frs_dhcp... make[6]: Entering directory `/root/radiusd/src/modules/frs_dhcp' /bin/sh /root/radiusd/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/radiusd/src -I/root/radiusd/libltdl -c frs_dhcp.c libtool: compile: gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/radiusd/src -I/root/radiusd/libltdl -c frs_dhcp.c -fPIC -DPIC -o .libs/frs_dhcp.o frs_dhcp.c:183: error: 'RAD_LISTEN_DHCP' undeclared here (not in a function) make[6]: *** [frs_dhcp.lo] Error 1 make[6]: Leaving directory `/root/radiusd/src/modules/frs_dhcp' make[5]: *** [common] Error 2 make[5]: Leaving directory `/root/radiusd/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/radiusd/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/root/radiusd/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/radiusd/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/root/radiusd' make: *** [all] Error 2 I tried configuring without dhcp (even though it is not enabled by default anyway...) ./configure --without-dhcp but still get same error Can somebody advise please? Companies Act 2006 : http://www.londonmet.ac.uk/companyinfo

2 2

Multiple Radius Instances on the same machine
by HRZ Konten 13 Oct '08

13 Oct '08

Hello all, I am interested in running more than one configuration including different authentification methods and different clients on one machine. I have Freeradius 1.1.7 in production, but I installed and tested Freeradius 2.0.5 because of the virtual servers. I want to run three separated radius instances on one radius server, for example: 1. instance with pam auth for internal clients (means clients list x) 2. instance with eap auth for external clients (means clients list y) 3. instance with pam auth for other external clients (means clients list z) The issue ist that the configurations of the virtual servers are separated but if one error occures in one instance configuration, the whole radius server can't be started. For example when I have a typing error in the config of the virtual server under sites-available like writing "ks pam" instead of "pam" then I can't start the whole server and none of the instances goes up. The problem is that I have many internal and external clients and the configs will be changed often from different people. I don't want that an error in the config for the external clients bothers the instance for internal clients. Furthermore I want to assign some resources to the different instances like max 5 server processes for instance "2" and max 15 server process for instance "1" and "3". But so far I understood it, this section is not in the config of the virtual servers but for the whole server. Therefore I have a few questions - can I run virtual servers without an error in one instance messing the whole server and the rest instances - is there a possibility to assign unequal resources to the separated instances like server processes, threads or number of requests. The goal is to limit the resources for external requests and give more resources to internal requests. - is possible to run several radius processes on one machine (not virtual servers) with different logs and configs. And how should I tell radiusd1 to use the configuration radusd1.conf and radiusd2 to use radiusd2.conf? Best regards, Irina

2 1

freeradius attributes
by Michael 12 Oct '08

12 Oct '08

How do I set freeradius attributes to establish a hotspot prepaid billing system. I'm using freeradius 1.1.7 with daloradius and chillispot. I am completely a newbie with very little knowledge in these things. Any help would be deeply appreciated. Thanks.

1 0

Beginner Help Compile.
by Jack Schneider 12 Oct '08

12 Oct '08

Hi, All I am about to compile per (freeradius 2.1.1 server) INSTALL doc on my Debian Lenny-AMD64 uptodate system. I have seen Debian put things in non-standard places. Are there any gotcha's I should be aware of???? -- What else should I read first? TIA, Jack

2 1

Link problem in v2.1.1
by John Center 12 Oct '08

12 Oct '08

Hi, I think I found a problem when compiling v2.1.1: gmake[4]: *** No rule to make target `-lreadline', needed by `radmin'. Stop. In src/main/Makefile: radmin: radmin.lo $(LIBREADLINE) $(LIBRADIUS) util.lo log.lo conffile.lo $(LIBTOOL) --mode=link $(CC) $(LDFLAGS) $(LINK_MODE) -o $@ $^ $(LIBS) I think it should be: radmin: radmin.lo $(LIBRADIUS) util.lo log.lo conffile.lo $(LIBTOOL) --mode=link $(CC) $(LDFLAGS) $(LINK_MODE) -o $@ $^ $(LIBS) "-lreadline -ltermcap" are already in LIBS in Make.inc, so I don't think LIBREADLINE is needed here. -John -- John Center Villanova University

2 2