June 2008 - Freeradius-Users - lists.freeradius.org

Setting Post-Proxy-Type ??
by Mustapha Bouikhif 11 Jun '08

11 Jun '08

Hi All, I am having problemes getting Post-Proxy-Type to work in FreeRadius (FR); I did tests with FR v2.0.3 and FR v2.0.5 after update without success; Here is what i want to do: Use attr_rewrite to write some attributes (those for setting VLAN) in proxy replies received from the home server. So I had defined 3 sections for attr_rewrite in radiusd.conf: modules { ....... attr_rewrite addtunneltype { attribute = Tunnel-Type searchin = proxy_reply searchfor = "[+ ]" replacewith = "VLAN" new_attribute = yes } attr_rewrite addtunnelmediumtype { attribute = Tunnel-Medium-Type searchin = proxy_reply searchfor = "[+ ]" replacewith = "IEEE-802" new_attribute = yes } attr_rewrite addvlaninvitedr4 { attribute = Tunnel-Private-Group-ID searchin = proxy_reply searchfor = "[+ ]" replacewith = "VISITEUR" new_attribute = yes ......... } post-proxy { post_proxy_log attr_filter.post-proxy Post-Proxy-Type post.proxy.dr4 { addtunneltype addtunnelmediumtype addvlaninvitedr4 } The huntgroup file looks like: Nomade_Eduroam NAS-IP-Address == 193.51.XXX.YYY Nomade_Eduroam NAS-IP-Address == 130.79.XXX.ZZZ Nomade_Eduroam NAS-IP-Address == 195.220.XXX.TTT The uses file looks like: DEFAULT Huntgroup-Name == "Nomade_Eduroam", Realm == "DEFAULT", Post-Proxy-Type := post.proxy.dr4 In proxy.conf file, I have set: post_proxy_authorize = yes When I started radiusd (in debug mode), it tells me : Parse error (check) for entry DEFAULT: Unknown value for post.proxy.dr4 for attribute Post-Proxy-Type I don't know what i am doing wrong ? Any help is appreciated Thanks -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

2 2

Re: Problems compiling Freeradius 2.0.4 on Fedora 8 [Updated to 2.0.5]
by Piero Giobbi 11 Jun '08

11 Jun '08

Hi again. Sorry Alan, i forgot to include "the" problem when i try to build freeradius 2.0.5 on Fedora 8. Below is from make: collect2: ld returned 1 exit status gmake[6]: *** [radeapclient] Error 1 gmake[6]: Leaving directory `/root/freeradius-server-2.0.5/src/modules/ rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/freeradius-server-2.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-server-2.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-server-2.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-server-2.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-server-2.0.5' make: *** [all] Error 2 OpenSSL> version OpenSSL 0.9.8g 19 Oct 2007 OpenSSL> Linux 2.6.25.4-10.fc8 #1 SMP Thu May 22 23:34:09 EDT 2008 i686 i686 i386 GNU/Linux Below is warnings from the configure. thx. p 10 jun 2008 kl. 16.08 skrev freeradius-users-request(a)lists.freeradius.org : > Hi, > >> Update on FR 2.0.5 with Fedora 8 (from configure): >> >> [root@ns freeradius-server-2.0.5]# ./configure | grep -i warning >> config.status: WARNING: ./Make.inc.in seems to ignore the -- >> datarootdir >> setting >> config.status: WARNING: ./src/include/build-radpaths-h.in seems to >> ignore >> the --datarootdir setting >> chmod: cannot access `check-radiusd-config': No such file or >> directory >> configure: WARNING: silently not building rlm_eap_ikev2. >> configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 >> EAPIKEv2/connector.h. >> configure: WARNING: the TNCS library isn't found! >> configure: WARNING: silently not building rlm_eap_tnc. >> configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. >> configure: WARNING: silently not building rlm_sql_iodbc. >> configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. >> configure: WARNING: silently not building rlm_sql_postgresql. >> configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h >> libpq. >> configure: WARNING: oracle headers not found. Use >> --with-oracle-home-dir=<path>. >> configure: WARNING: silently not building rlm_sql_oracle. >> configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. >> configure: WARNING: silently not building rlm_sql_unixodbc. >> configure: WARNING: FAILURE: rlm_sql_unixodbc requires: sql.h. >> >> .. If it makes more sense... > > so, you dont have the required includes etc for building IKEv2, TNC, > IODBC, > postgresql or Oracle support into the server. > > do you use any of these? if not, then whats the problem? > > alan

3 2

Radius on server X; VPN on server Y; Samba on server Z
by Sascha Kiefer 10 Jun '08

10 Jun '08

Hi, I have the following: * Radius on server X * VPN on server Y * Samba on server Z Each server is located on a different continent. :-) Ok, user "foo" now connects to the VPN server and gets authorized by radius. Fine. Now, i want him to allow to connect to the samba server. Ideally without entering any user+password combination (is that safe enough?); i thought about, restricting samba connections only from ip-addresses of the VPN server. But he only is allowed to access his private space under samba. He is not alloed to access the space of another user "bar". Any hints on that issue? Thank you. Sascha

4 3

RADIUS APIs
by pallavi dharmadhikari 10 Jun '08

10 Jun '08

Hi all, I am writing a radius application to send authentication requests to the Freeradius server using different authentication methods. For that I would like to know about different APIs which will be used in the RADIUS application. Can somebody tell me more information about that? Thank you pal

2 2

EAP-TLS with different CA per user?
by Frank Sweetser 10 Jun '08

10 Jun '08

I have a configuration which I need, but haven't been able to figure out how to make freeradius do it. I have two users, A and B, both authenticating over wireless using EAP-TLS. User A has a certificate which has been signed by CA X, and B has one signed by CA Y. What I need is to tell freeradius that certificates presented by user A should only be checked against CA X, and similarly B only by Y. Putting both X and Y in the same CA list won't work in this case due to what appears to be a limitation in OpenSSL. I've been over all the existing docs I can find, and I haven't been able any way to do this. Anyone have any suggestion what I might try? -- Frank Sweetser fs at wpi.edu | For every problem, there is a solution that WPI Senior Network Engineer | is simple, elegant, and wrong. - HL Mencken GPG fingerprint = 6174 1257 129E 0D21 D8D4 E8A3 8E39 29E3 E2E8 8CEC

7 13

PEAP and TTLS simultaneously?
by Tim Tyler 10 Jun '08

10 Jun '08

Freeradius experts, I am running Freeradius 1.1.3 on a Centos 5 system. My desire is to support PEAP mschapv2 clients against our ldap server's LM and NT passwords. We also want to support some other clients with a TTLS - PAP against the posix passwords in our same ldap server. I can get each configuration solution to work independently, but I can't get them to work when I try to combine them into one configuration. 1. Is it possible to support both PEAP-mschapv2 and TTLS-PAP using the same ldap server with each user having both password hashes supported? 2. If so, can someone suggest how I would combine the two configurations properly? 3. Would this be easier to accomplish if we were using a 2.x version of Freeradius? My only problem is that Centos and Redhat seem to take forever in supporting the most recent open source applications so I would have to find another RPM update source. I have included both configurations that work independently and the output of a TTLS -PAP attempt that fails when both configurations are combined into one configuration. Here is my general TTLS config: #TTLS-pap method modules { ldap ldap_2x { server = {cut out} identity = password = basedn = filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /etc/openldap/cacerts/cacert.cer dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess chap mschap suffix eap staff ldap_2x } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type ldap_2x { ldap_2x } eap } Here is my PEAP config: #PEAP mschapv2 method ldap ldap_1x{ server = {cut out} identity = password = basedn = filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /etc/openldap/cacerts/cacert.cer dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 authtype = ldap timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess chap mschap suffix ldap_1x eap files } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } Here is the output of a command line TTLS attempt from the server: # /usr/sbin/radiusd -X -y Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded LDAP ldap: server = "testldap.beloit.edu" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=beloit,dc=edu" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/etc/openldap/cacerts/cacert.cer" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "tac2tmaw" ldap: basedn = "dc=beloit,dc=edu" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = yes ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_2x-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_2x-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_2x rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x85d71f8 Module: Instantiated ldap (ldap_2x) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "2okacaip" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) ldap: server = "testldap.beloit.edu" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=beloit,dc=edu" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/etc/openldap/cacerts/cacert.cer" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "tac2tmaw" ldap: basedn = "dc=beloit,dc=edu" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_1x-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_1x-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_1x rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x85ea9a8 Module: Instantiated ldap (ldap_1x) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 144.89.40.88:33050, id=31, length=57 User-Name = "tyler" User-Password = "chair" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tyler", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for tyler radius_xlat: '(uid=tyler)' radius_xlat: 'dc=beloit,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to testldap.beloit.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: starting TLS rlm_ldap: bind as cn=Manager,dc=beloit,dc=edu/tac2tmaw to testldap.beloit.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=beloit,dc=edu, with filter (uid=tyler) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value E02C0DC6138F12F76F424596E04E10E2 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value 0A5283563091373BAAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user tyler authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for tyler radius_xlat: '(uid=tyler)' radius_xlat: 'dc=beloit,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to testldap.beloit.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: starting TLS rlm_ldap: bind as cn=Manager,dc=beloit,dc=edu/tac2tmaw to testldap.beloit.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=beloit,dc=edu, with filter (uid=tyler) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value E02C0DC6138F12F76F424596E04E10E2 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value 0A5283563091373BAAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_2x" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 31 to 144.89.40.88 port 33050 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 31 with timestamp 484e906c Nothing to do. Sleeping until we see a request. Tim Tyler Network Engineer - Beloit College tyler(a)beloit.edu

2 1

Re: Problems compiling Freeradius 2.0.4 on Fedora 8 [Updated to 2.0.5]
by Piero Giobbi 10 Jun '08

10 Jun '08

Hi. Update on FR 2.0.5 with Fedora 8 (from configure): [root@ns freeradius-server-2.0.5]# ./configure | grep -i warning config.status: WARNING: ./Make.inc.in seems to ignore the -- datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting chmod: cannot access `check-radiusd-config': No such file or directory configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-home- dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: sql.h. .. If it makes more sense... p 7 jun 2008 kl. 12.00 skrev freeradius-users- request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > Today's Topics: > > 1. Re: Problems compiling Freeradius 2.0.4 on Fedora 8. > (A.L.M.Buxey(a)lboro.ac.uk) > 2. Re: logging of tls logons (Vladimir Vassiliev) > > Från: A.L.M.Buxey(a)lboro.ac.uk > Datum: lö 7 jun 2008 09.40.22 GMT+02:00 > Till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > Ämne: Re: Problems compiling Freeradius 2.0.4 on Fedora 8. > Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > > hi, > > what version of OpenSSL do you have? > > alan > > > > > Från: Vladimir Vassiliev <vova(a)edu.yar.ru> > Datum: lö 7 jun 2008 09.54.16 GMT+02:00 > Till: freeradius-users(a)lists.freeradius.org > Ämne: Re: logging of tls logons > Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > >> So, how can I get in logs exactly common names? > > As I understand, only way to do it is > > check_cert_cn = %{User-Name} > > in eap.conf? > > -- > Vladimir Vassiliev <vova(a)edu.yar.ru> > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Dictionary : Ericsson-AB Packet Core Networks
by rsg 10 Jun '08

10 Jun '08

Hi, Does anyone know of the RADIUS dictionary for Ericsson-AB PCN (Enterprise ID 10923) ? The currently available dictionary is for Ericsson -AB generic (VID 193) only. Many thanks in advance. sg.

1 0

need help on accounting respond
by Do Nguyen Ha 10 Jun '08

10 Jun '08

> hi all > > i need help on account of freeradius > > Accounting Respond Message: > > AttributeID Vendor ID Sub Attribute ID Status Attribute Name > Type Value > 26 9 101 O > h323-credit-amount String Customer balance at the time of > authentication > 26 9 103 M+ > h323-return-code Integer 5 > 26 9 109 O > h323-billing-model Integer Type of billing service for a specific > call: > > 0 = credit customer (post-paid) > > 1= debit card (prepaid) > > 2= limited service (prepaid) > > 3= limited service (postpaid) > 26 9 110 O > h323-currency String Customer currency in the form of > 3-character value from ISO 4217 (e.g. USD) > > > now i want freeradius reply to the client with Accounting Respond with the > structure of message above > > the M+ : is required > > where do i edit to make it works > > > > Thanks > > Ha` > Message: 4 > Date: Mon, 09 Jun 2008 13:16:34 +0100 > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: Fw: need help on accounting respond > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <ahvE3AEn.1213013794.6975800.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Wherever you keep user details - users file, sql, ldap, ... > > Ivan Kalik > Kalik Informatika ISP > > Hi IvanKalik can you give me an example of it i use MySQL, at this time only testing with some subscribers the radacct table is now empty, what information should i put could you give me an example of radacct table i send attached file which is the sample of Accounting request Thanks Ha`

2 1

RE: rlm_ippool fail
by Ivan Kalik 10 Jun '08

10 Jun '08

>You are suposed to delete those files when you are changing ip pool >range. Module should be able to start without them. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 5/6/2008, "Alan DeKok" <aland at deployingradius.com> piše: > >>tg_melo at bol.com.br wrote: >>> I had a freeradius server 1.1.7 running up with some errors when doing updates in radacct (mysql) some hours after it just started. Since then, I decided to upgrade to >>2.0.4. But now, it refuses to start with the error "rlm_ippool: Failed to open file $(raddbdir)/db.ippool: No such file or directory". >> >> Does the file exist? FreeRADIUS is at the mercy of the OS here. If >>the OS says "no such file or directory", it means "no such file or >>directory". No amount of playing with the FreeRADIUS configuration will >>make the file suddenly exist. >> >>> Finally, /usr/local/etc/raddb/ is with the right permissions to the user freeradius. >>> So, what's wrong? >> >> Does the db.ippool file exist? >> >> Alan DeKok. >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> OK. I was able to recreate this when I installed 2.0.5. All modules using db.* files (counters, ippool, ...) were affected. Turned out that there is an error in radiusd.conf: prefix = @prefix@ exec_prefix = @exec_prefix@ sysconfdir = @sysconfdir@ localstatedir = @localstatedir@ sbindir = @sbindir@ logdir = @logdir@ raddbdir = @raddbdir@ radacctdir = @radacctdir@ # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # Should likely be ${localstatedir}/lib/radiusd db_dir = $(raddbdir) <<== It should be: db_dir = ${raddbdir} (brackets are wrong) Ivan Kalik Kalik Informatika ISP

2 1