May 2008 - Freeradius-Users - lists.freeradius.org

RomelDutta wants to keep up with you on Twitter
by RomelDutta 12 May '08

12 May '08

To find out more about Twitter, visit the link below: http://twitter.com/i/4f1f94b0c7346025ec6e15519105f5031e871c00 Thanks, -The Twitter Team About Twitter Twitter is a unique approach to communication and networking based on the simple concept of status. What are you doing? What are your friends doing—right now? With Twitter, you may answer this question over SMS, IM, or the Web and the responses are shared between contacts. This message was sent by a Twitter user who entered your email address. If you'd prefer not to receive emails when other people invite you to Twitter, click here: http://twitter.com/i/optout/abdcfc01be34644e916679f286282c27ea97dd4c

1 0

Recommendations for manging user password
by thekat 11 May '08

11 May '08

Thank you all for responding to my first post in getting FreeRadius set up and working on a Solaris 10 box. I am working on creating the (non-priviledged) user environment that will run the server. I have successfully set up a working Radius server to work with a FirePass VPN appliance.. FirePass uses PAP for authentication.. however I have authenticated using both local and PAP. <code> "charlie" Auth-Type := Local, User-Password == "hello" Reply-Message = "Hello, %u" "charles" Auth-Type := PAP, User-Password == "hello" Reply-Message = "Hello, %u" </code> This works like this: -- FirePass appliaance has a SSL login page. -- User enters creditials -> validates against FreeRadius -- User is shown a "static" page on the FirePass Server with a Static Link. I will have about 75 users and need to set up password aging.. Using system (non-shell) accounts with IDs in /etc/password could be an option I did read the "Expired" thread and I can write a script to update that field if necessary.. My Goal --- let the user know their password has expired --- let them change it themselves.. --- age the password for 90 days --- I really don't want a MySQL database ( I don't know MySQL but could learn if I have to) I am hoping someone can point me in the right direction.. Charles

3 3

ippool usage question
by John Joe 11 May '08

11 May '08

Hy, What happens if the ip addresses from the ippool are finished? I have some moments when the clients are receiving ip addresses from 10.67 subnet allthow i have nothing configured for this. --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

3 2

Can any one help me out by sending the detailed info of how to do the radius confis for Routers plz!!!!
by shanmugavel Balu 10 May '08

10 May '08

Thanks in Advance, shan

2 1

huntgroups are failing auth - missing Chap Password
by Terry Pelley 09 May '08

09 May '08

FreeRADIUS Version 1.1.7 I am using the FreeRADIUS.net Windows version of the software. at least for the time being. I am trying to set up a very basic single user account for a very specific purpose and have created the account as follows. hunttest User-Password == "hunttest", Huntgroup-Name == "hunttest" My huntgroups file has a huntgroup called hunttest with a single NAS IP Address listed as follows. public NAS-IP-Address == 10.252.9.2 when the user huntest attempts to authenticate it fails. My RADIUS Log shows the following entry. Wed May 7 15:07:25 2008 : Auth: Login incorrect (rlm_chap: Clear text password not available): [hunttest/<CHAP-Password>] (from client NAS04 port 5 cli 00-1E-8C-0E-8E-70) Wed May 7 15:07:25 2008 : Auth: Login incorrect (rlm_chap: Clear text password not available): [hunttest/<CHAP-Password>] (from client NAS04 port 5 cli 00-1E-8C-0E-8E-70) Can some one tell me what is wrong. I am simply trying to create a config that will allow the user hunttest to authenticate only if the request comes from the client NAS04. Perhaps a huntgroup is not the best way to do this.

4 7

Altering extra table in SQL module
by Barry 09 May '08

09 May '08

Hi List In my accounting_start_query I would like to update another table in the same database with the NASIPAddress. What would be the best way to do this? Could I add a ; at the end of the query and add another one to the same quoted string or should I use the exec() module? Thanks Barry

3 2

Load testing tool recommendation
by Anders Holm 09 May '08

09 May '08

So, I'm building a complete solution, from scratch. As such, the business owners have some requirements on how many requests it should be handle today per second and "some point in the future" as well. Would there be any good load testing tools, or some handy way to figure out how many tps my current setup can handle? I've got a dirt simple Perl script that forks out x radtest processes and I'm just right now seeing how many a second I can ship. Problem being, the RADIUS server is happily letting me melt down to "client" systems, without breaking a sweat. I'd like to load the server, not the clients .. :) I want to see where it eventually breaks down, which seems a task in its own right. Any pointers would be much appreciated. I'd rather have something I can fire off from command line then a GUI solution, for obvious reasons. Cheers! //anders

2 1

hello
by Misael Vasquez Sosa 09 May '08

09 May '08

which free radius version I should used for Solaris 10?? thanks

3 2

rlm_sql_oracle compilation woes
by Anders Holm 09 May '08

09 May '08

Hi Folks. This is a potential newbie question, though I seem unable to find any answers in the FAQ or in the archives, so ... I'm trying to compile the rlm_sql_oracle module for FreeRadius 2.0.3 using Oracle 10.2 client. Now, I've tried every suggestion the configure scripts has thrown at me, and none seem to find my header files. ORACLE_HOME is set to where the client resides. I have the headers in a different location though, so I've used the --with-oracle-home-dir and friends to try and point to where those reside. Always getting the same answer back from configure, which is it can't find oci.h, which is in the specified locations... Would anyone have any examples or pointers I can poke a stick at and see if I am just doing things backwards? Any pointers would be highly appreciated. //anders

3 3

Redundant LDAP Servers
by Jason Traeden 08 May '08

08 May '08

I am running freeradius version 2.0.4 and using LDAP against Active Directory. When I have a single LDAP server setup my authentication works great. I am having trouble using the redundant ldap settings. Here is some config data ldap ad01 { server = ocdc01.overstock.com port = 389 identity = "CN=LDAP Bind,OU=Special,OU=OSTK_Accounts,DC=overstock,DC=com" password = xxxxxx basedn = OU=OSTK_Accounts,DC=overstock,DC=com filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) " ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter ="(|(&(objectClass=group)(member=%{control:Ldap-UserDn}))(&(objec tClass=top)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf #ldap_debug = 0xFFFF } ldap ad02 { server = ocdc01.overstock.com port = 389 identity = "CN=LDAP Bind,OU=Special,OU=OSTK_Accounts,DC=overstock,DC=com" password = xxxxxx basedn = OU=OSTK_Accounts,DC=overstock,DC=com filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) " ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter ="(|(&(objectClass=group)(member=%{control:Ldap-UserDn}))(&(objec tClass=top)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf #ldap_debug = 0xFFFF } instantiate { exec expr expiration logintime ldap ad01 ad02 } authorize { preprocess redundant { ad01 { fail = 1 ok = return } ad02 { fail = 1 ok = return } } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { redundant { ad01 { fail = 1 ok = return } ad02 { fail = 1 ok = return } } } } DEFAULT Ldap-Group == "CN=g.acl.neteng,OU=Groups,OU=OSTK_Accounts,DC=overstock,DC=com" Auth-Type := Accept, Foundry-Privilege-Level = 0, Foundry-Command-String = *, Foundry-Command-Exception-Flag = 0, Foundry-INM-Privilege = 15, Fall-Through = No DEFAULT ad01-Ldap-Group == "CN=g.acl.neteng,OU=Groups,OU=OSTK_Accounts,DC=overstock,DC=com" Auth-Type := Accept, Foundry-Privilege-Level = 0, Foundry-Command-String = *, Foundry-Command-Exception-Flag = 0, Foundry-INM-Privilege = 15, Fall-Through = No DEFAULT ad02-Ldap-Group == "CN=g.acl.neteng,OU=Groups,OU=OSTK_Accounts,DC=overstock,DC=com" Auth-Type := Accept, Foundry-Privilege-Level = 0, Foundry-Command-String = *, Foundry-Command-Exception-Flag = 0, Foundry-INM-Privilege = 15, Fall-Through = No Here is some debug info rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ad02-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ad02-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ad02 rlm_ldap: Over-riding set_auth_type, as there is no module ad02 listed in the "authenticate" section. rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ad01-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ad01-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ad01 rlm_ldap: Over-riding set_auth_type, as there is no module ad01 listed in the "authenticate" section. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Thanks Jason -- Jason Traeden Network Engineer Overstock.com 6350 South 3000 East Salt Lake City, UT 84121 jtraeden(a)overstock.com Desk 801-947-3889 Cell 801-699-1379

2 8