October 2008 - Freeradius-Users - lists.freeradius.org

Re: Redback attributes
by Alexandre Chapellon 23 Oct '08

23 Oct '08

Le 22.10.2008 12:16, Chris a écrit : > Are you certain it didn't tear down the session and immediately > rebuild it? That's what I would expect it to do. I'm gonna check this > > You need to somehow use RADIUS accounting to update a database that > the RADIUS server will use to Access-Reject further connection > attempts. The Redback isn't going to keep track of anything like that. Of course, the NAS doesn't make any decision about authenticating > > Sorry, but I don't have anything more for you, though I would be > really surprised if nobody had written such a beast already. If not > specifically for the Redback, then another NAS. > > Take a look at rlm_counter. It works already for Session-Timeout > > On Oct 22, 2008, at 3:05 PM, Alexandre Chapellon wrote: > >> Hello, >> >> I have redback NASes for bringing up DSL connections. >> I would like to make the RedBack boxes bring connection down for a user >> once he has reached his total amount of traffic allowed (UP+DOWN). >> Does anyone using redback devices (or not!) knows how to achive this? I >> tried sending the Session-Traffic-Limit to the boxes, but it didn't >> seemed to change anything! >> Does anyone knows what this attribute is for? >> >> regards >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > >

2 3

more proxy problems
by Paul A 23 Oct '08

23 Oct '08

Hi, hoping someone has some advise on thise but I had DNIS proxy working and im not sure what I did and now it has stopped working. In the acct_users file I have DEFAULT Called-Station-Id == "5500", Proxy-To-Realm := "xxx" Fall-Through = yes In the proxy file I have realm xxx { type = radius authhost = xxxx:1645 accthost = xxxx:1646 secret = something } But when I test it never seems to trigger the DNIS proxy setup. This is what I get below, also named realms are working. rad_recv: Access-Request packet from host 209.213.66.12:1650, id=114, length=94 User-Name = "ectest" User-Password = "test123" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "5500" Proxy-State = 0x471e493f7f0000010495000000000000000000000000000000000000 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ectest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list ---

2 1

Error in the negotiations certificates
by Martin Silvero 23 Oct '08

23 Oct '08

Hello again (I was sick) > There is an EAP-TLS "howto" on the FreeRADIUS web site (type "EAP-TLS > howto" into google). It may help. Alan ok, this is the HOWTO I was watching and following to create the certificates and that's why I try to find some other suggestions to the problem for me, > Except that the error messages mean you haven't done that. The error > messages show that you've created *two* sets of certificates (client, > CA, server). You've put one set of certificates on the client, and a > completely different set of certificates on the server. Do you want to say that imported bad certificates? I followed all the steps in the HOWTO and README, along with some collaborations in order to achieve this but so far nothing. Alan am very grateful for your help, I will continue trying and seeking information.

1 0

control-socket name one character short
by Zoltan Ori 23 Oct '08

23 Oct '08

I have installed version 2.1.1 on FreeBSD 7.0 from source obtained at download link on www.freeradius.org. The server "just works"! Thank you Mr. DeKok et. al. I wanted to try radmin, so I copied control-socket from sites-available to sites-enabled. When I started the server I received # radiusd -X <snip> radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } Failed setting permissions on /usr/local/var/run/radiusd/radiusd.sock: No such file or directory # # ls /usr/local/var/run/radiusd radiusd.soc The socket was created but the name was missing a character I tried on a FreeBSD 6.2 box with the same results. Other than not being able to enable control-socket, everything else works fine. I did try building from the github sources, but received an error: . . . gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/usr/home/tester/Work/RADIUS/radius-2.1.1z/src -c valuepair.c -fPIC -DPIC -o .libs/valuepair.o valuepair.c: In function `pairread': valuepair.c:1737: error: `pair' undeclared (first use in this function) valuepair.c:1737: error: (Each undeclared identifier is reported only once valuepair.c:1737: error: for each function it appears in.) valuepair.c:1742: error: break statement not within loop or switch valuepair.c:1747: error: case label not within a switch statement valuepair.c:1762: error: break statement not within loop or switch valuepair.c: At top level: valuepair.c:1768: error: syntax error before "if" gmake[4]: *** [valuepair.lo] Error 1 gmake[4]: Leaving directory `/usr/home/tester/Work/RADIUS/radius-2.1.1z/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/home/tester/Work/RADIUS/radius-2.1.1z/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/home/tester/Work/RADIUS/radius-2.1.1z/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/home/tester/Work/RADIUS/radius-2.1.1z' gmake: *** [all] Error 2 Judging from the commit times, I believe valuepair.c was in the process of being changed and may already be fixed. When do you sleep Mr. DeKok? -- Zoltan Ori

5 14

Ldap-UserDn character set problem?
by John Hawkes-Reed 23 Oct '08

23 Oct '08

Hello. I'm attempting to bring up a FreeRadius-2.1.1 rig that auths against AD. NTLM authentication seems to work well, but LDAP authorisation appears to hit a problem when extracting the DN: rlm_ldap: Entering ldap_groupcmp() [files] expand: ou=staff,dc=uk,dc=mydomain,dc=com -> ou=staff,dc=uk,dc=mydomain,dc=com [files] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=jhreed) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=staff,dc=uk,dc=mydomain,dc=com, with filter (sAMAccountName=jhreed) rlm_ldap: ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{check:Ldap-UserDn}))(&(objectClass=G roupOfUniqueNames)(uniquemember=%{check:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dJohn Hawkes-Reed\2cOU\3dIT\2cOU\3dStaff\2cDC\3duk\2cDC\3dmydomain\2cDC\3dcom))(&( objectClass=GroupOfUniqueNames)(uniquemember=CN\3dJohn Hawkes-Reed\2cOU\3dIT\2cOU\3dStaff\2cDC\3duk\2cDC\3dmydomain\2cDC\3dcom))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=vpn-users,ou=Security Groups,ou=Groups,dc=uk,dc=mydomain,dc=com, with filter (|(&(objectClass=GroupOfNames)(member=CN\3dJohn Hawkes-Reed\2cOU\3dIT\2cOU\3dStaff\2cDC\3duk\2cDC\3dmydomain\2cDC\3dcom))(&( objectClass=GroupOfUniqueNames)(uniquemember=CN\3dJohn Hawkes-Reed\2cOU\3dIT\2cOU\3dStaff\2cDC\3duk\2cDC\3dmydomain\2cDC\3dcom))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group cn=vpn-users,ou=Security Groups,ou=Groups,dc=uk,dc=mydomain,dc=com not found or user is not a member. Running ldapsearch against AD shows the following: # vpn-users, Security Groups, Groups, uk.mydomain.com dn: CN=vpn-users,OU=Security Groups,OU=Groups,DC=uk,DC=mydomain,DC= com objectClass: top objectClass: group cn: vpn-users member: CN=John Hawkes-Reed,OU=IT,OU=Staff,DC=uk,DC=mydomain,DC=com distinguishedName: CN=vpn-users,OU=Security Groups,OU=Groups,DC=uk,DC=mydomain,DC=com I can find a similar bug mentioned in the archives, but that appeared to be an older version of the code. Hopefully that's enough debug to enable someone to point me in the right direction. (Other than 'Don't use AD then...') -- John Hawkes-Reed -- Future Publishing Limited (registered company number 2008885) is a wholly owned subsidiary of Future plc (registered company number 3757874), both of which are incorporated in England and Wales and share the same registered address at Beauford Court, 30 Monmouth Street, Bath BA1 2BW. This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error please reply to this email and then delete it. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Future. The recipient should check this email and any attachments for the presence of viruses. Future accepts no liability for any damage caused by any virus transmitted by this email. Future may regularly and randomly monitor outgoing and incoming emails and other telecommunications on its email and telecommunications systems. By replying to this email you give your consent to such monitoring. ***** Save resources: think before you print.

1 1

Certificate types supported on freeradius EAP-TLS
by John 23 Oct '08

23 Oct '08

hi, I am using freeradius 1.1.6. I want to know which certificate format can be supported on EAP-TLS module? Does it support .pfx format? Thanks. John. --------------------------------- 雅虎邮箱，您的终生邮箱！

3 3

Redback attributes
by Alexandre Chapellon 22 Oct '08

22 Oct '08

Hello, I have redback NASes for bringing up DSL connections. I would like to make the RedBack boxes bring connection down for a user once he has reached his total amount of traffic allowed (UP+DOWN). Does anyone using redback devices (or not!) knows how to achive this? I tried sending the Session-Traffic-Limit to the boxes, but it didn't seemed to change anything! Does anyone knows what this attribute is for? regards

1 0

mysql erros
by Alexandre J. Correa - Onda Internet 22 Oct '08

22 Oct '08

Hello, what these erros means ? Tue Oct 21 23:45:56 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #21 Tue Oct 21 23:45:58 2008 : Error: WARNING: Unresponsive child (id 2945448848) for request 27153 Tue Oct 21 23:45:58 2008 : Error: WARNING: Unresponsive child (id 2937060240) for request 27154 Tue Oct 21 23:45:58 2008 : Error: WARNING: Unresponsive child (id 2928671632) for request 27155 Tue Oct 21 23:45:58 2008 : Error: WARNING: Unresponsive child (id 3030645648) for request 27156 Tue Oct 21 23:46:00 2008 : Error: WARNING: Unresponsive child (id 2970614672) for request 27157 Tue Oct 21 23:46:01 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #20 Tue Oct 21 23:46:11 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #26 Tue Oct 21 23:46:15 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #25 Tue Oct 21 23:46:16 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #23 Tue Oct 21 23:46:20 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #24 thanks ! -- Sds. Alexandre Jeronimo Correa Onda Internet - http://www.ondainternet.com.br OPinguim Hosting - http://www.opinguim.net Linux User ID #142329 UNOTEL S/A - http://www.unotel.com.br

3 2

MAC authentification
by Frederik.Niedernolte＠Bertelsmann.de 22 Oct '08

22 Oct '08

I want to use freeRADIUS for a global MAC authentification but I cannot find any tutorials for that. What must I do realize it? Thanks in advance. Best regards, F. Niedernolte

8 13

Windows CE domain
by scott woodard 22 Oct '08

22 Oct '08

Hi, Free Radius 2.1 It is working just fine on Windows XP and Windows Mobile. However Windows CE is asking for a username and domain. On Windows XP and Mobile it is just asking for username and password. Here is the output from radiusd -x -X Wed Oct 22 06:56:19 2008 : Debug: ++[preprocess] returns ok Wed Oct 22 06:56:19 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed Oct 22 06:56:19 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed Oct 22 06:56:19 2008 : Debug: ++[chap] returns noop Wed Oct 22 06:56:19 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed Oct 22 06:56:19 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed Oct 22 06:56:19 2008 : Debug: ++[mschap] returns noop Wed Oct 22 06:56:19 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed Oct 22 06:56:19 2008 : Debug: rlm_realm: No '@' in User-Name = "barcode\gun1", looking up realm NULL Wed Oct 22 06:56:19 2008 : Debug: rlm_realm: No such realm "NULL" Wed Oct 22 06:56:19 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Any suggestions? Thanks

2 3