August 2008 - Freeradius-Users - lists.freeradius.org

Device authentication and User+Device authentication
by Cristian Novac 07 Aug '08

07 Aug '08

Hi all, Could someone tell me what has to be configured to be able to do Device authentication and User+Device authentication. Thank you! Cristian NOVAC

2 11

Problem when using custom attributes for radius extra parameter
by Krunal Patel 07 Aug '08

07 Aug '08

I'm trying to configure openser & freeradius with AAA. I'm using custom mysql tables for authentication & accounting. I've modified queries in sql.conf in raddb folder. Authentication works fine. I've added additional fields in radius_extra parameter of acc module. I've added those parameters in dictionaries of radiusclient-ng & freeradius. But I get blank values for custom fields. Any idea what can be wrong? *openser.cfg* modparam("acc", "radius_extra","User-Name=$fU; Dialstatus=$avp(s:dialstatus);User-Rate=$avp(i:2016);User-Duration=$avp(i:2016);User-Clid=$fU;User_ClidName=$avp(s:callerid);User_Dst_Name=$avp(s:2014);User_Dst_Code=$avp(i:2015);User_Account_Id=$fU;Lcr_Rate=$avp(i:2030);Lcr_Duration=$avp(i:2016);Lcrtrunk_Id=$avp(i:2027);Lcr_Dst_Name=$avp(s:2028);Lcr_Dst_Code=$avp(i:2029);Real_Duration=$avp(i:2016)") *dictionary.openser* ATTRIBUTE Dialstatus 1073 string ATTRIBUTE User-Rate 1074 string ATTRIBUTE User-Duration 1075 string ATTRIBUTE User-Channel 1076 string ATTRIBUTE User-Clid 1077 string ATTRIBUTE User_ClidName 1080 string ATTRIBUTE User_Dst_Name 1081 string ATTRIBUTE User_Dst_Code 1082 string ATTRIBUTE User_Account_Id 1083 string ATTRIBUTE Lcr_Rate 1084 string ATTRIBUTE Lcr_Duration 1085 string ATTRIBUTE Lcrtrunk_Id 1086 string ATTRIBUTE Lcr_Dst_Name 1087 string ATTRIBUTE Lcr_Dst_Code 1088 string ATTRIBUTE DialedTime 1089 string ATTRIBUTE Real_Duration 1090 string ATTRIBUTE Startleg 1091 string ATTRIBUTE Stopleg 1092 string *dictionary.radius* ATTRIBUTE Dialstatus 1073 string ATTRIBUTE User-Rate 1074 string ATTRIBUTE User-Duration 1075 string ATTRIBUTE User-Channel 1076 string ATTRIBUTE User-Clid 1077 string ATTRIBUTE User_ClidName 1080 string ATTRIBUTE User_Dst_Name 1081 string ATTRIBUTE User_Dst_Code 1082 string ATTRIBUTE User_Account_Id 1083 string ATTRIBUTE Lcr_Rate 1084 string ATTRIBUTE Lcr_Duration 1085 string ATTRIBUTE Lcrtrunk_Id 1086 string ATTRIBUTE Lcr_Dst_Name 1087 string ATTRIBUTE Lcr_Dst_Code 1088 string ATTRIBUTE DialedTime 1089 string ATTRIBUTE Real_Duration 1090 string ATTRIBUTE Startleg 1091 string ATTRIBUTE Stopleg 1092 string Thanks in advance -- Krunal Patel

3 3

Scour.com invite from yawar hadi noshahi
by yawar hadi noshahi 07 Aug '08

07 Aug '08

Hey, Did you hear about Scour? It is the next gen search engine with Google/Yahoo/MSN results and user comments all on one page. Best of all we get paid for using it by earning points with every search, comment and vote. The points are redeemable for Visa gift cards! It's like earning credit card or airline points just for searching! Hit the link below to join for free and we will both get points! http://scour.com/invite/yawar/ I know you'll like it! - yawar hadi noshahi

1 0

Re: PEAP mschapv2 using xp native supplicant
by Ryan Setiawan H 07 Aug '08

07 Aug '08

2 1

MAC authenticating with mySQL database
by Kjell Bruheim 07 Aug '08

07 Aug '08

Hi all! I have been trying to read up on MAC authentication and implementing that into a sql database. The MAC authentication with a userfile was no problem. But i hit the wall when i wanted to use a database instead of text file. Is there any good HOWTO's out there on this one? The configuration of the intended network. Radius server--->wifi-routers with MAC auth--->clients The reason for this MAC authentication is for engineers to have access to internet on sites we have equipment on. But not the users of the equipment. And the reason for wanting to implement sql database to store MAC addresses in, is to make it easier for admins to edit and that we want to implement other software to also use the info for our engineers. Cheers. -- Kjell Christian Bruheim Helpdesk Supportingit

3 5

Installation problem
by Frederick William Borges Pohl 07 Aug '08

07 Aug '08

Hello, I am rather new to freeradius and I´m having trouble running the server after installation I installed using: ./configure --sysconfdir=/etc Make Make install When I try running with radiusd I get the following error: /usr/local/sbin/radiusd: error while loading shared libraries: libfreeradius-radius-2.0.5.so: cannot open shared object file: No such file or directory The libfreeradius-radius-2.0.5.so file is located at the following directory: ns1:/usr/local # find / -name libfreeradius-radius-2.0.5.so /usr/local/lib/libfreeradius-radius-2.0.5.so This is my radiusd.conf prefix = /usr/local exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${prefix}/${localstatedir}/run/radiusd db_dir = /usr/local/lib/ libdir = ${exec_prefix}/lib >From what is configured above, the libdir should be /usr/local/lib which is exactly where the file is located. Is there something I am missing? Thank you, Frederick Pohl Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada a recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor, nos informe respondendo imediatamente a este e-mail e em seguida apague-a.

3 8

ERROR: Failed to open socket: cannot bind socket: Address already in use
by Martin Silvero 06 Aug '08

06 Aug '08

: ERROR: Failed to open socket: cannot bind socket: Address already in use hello! when ejecute radiusd -X -x : Wed Aug 6 16:53:31 2008 : Error: ERROR: Failed to open socket: cannot bind socket: Address already in use Wed Aug 6 16:53:31 2008 : Error: /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 0.0.0.0 port 1812 what is? thanks!! -- -- Silvero Martin -- -- Silvero Martin

2 1

service-type passed in response
by Josh Yost 06 Aug '08

06 Aug '08

I am having a problem configuring management users for Cisco WLC. Here's my basic users file: DEFAULT Service-Type = NAS-Prompt-User, cisco-avpair += "shell:priv-lvl=2", Fall-Through = 1 test User-Password == "xxxx" Service-Type = Administrative-User, cisco-avpair += "shell:priv-lvl=15" The problem I am having is that when user "test" logs in, the access-accept packet passes the DEFAULT Service-Type Value (along with all other attributes in DEFAULT). I only want the default Service-Type value to be passed if I don't otherwise have one assigned in the individual users' entries. Any Assistance here would be much appreciated!

2 1

Where to put EAP-TLS-Require-Client-Cert = Yes ?
by Martin Silvero 06 Aug '08

06 Aug '08

for example mi have this problem: when I run radiusd-X -x strip me this mistake even if the PATH're ok. what is? > > > > > Tue Aug 5 11:00:31 2008 : Error: rlm_eap: SSL error error:06065064:digital > envelope routines:EVP_DecryptFinal_ex:bad decrypt > Tue Aug 5 11:00:31 2008 : Error: rlm_eap_tls: Error reading private key > file /usr/local/etc/raddb/certs/server.pem > Tue Aug 5 11:00:31 2008 : Error: rlm_eap: Failed to initialize type tls > Tue Aug 5 11:00:31 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: > Instantiation failed for module "eap" > Tue Aug 5 11:00:31 2008 : Error: > /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module > "eap". > Tue Aug 5 11:00:31 2008 : Error: > /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing > authenticate section. > Tue Aug 5 11:00:31 2008 : Debug: } > Tue Aug 5 11:00:31 2008 : Debug: } > Tue Aug 5 11:00:31 2008 : Error: Errors initializing modules > > > > thanks!!!!! > > > > -- > >

1 0

RES: Installation problem
by Frederick William Borges Pohl 06 Aug '08

06 Aug '08

Thanks again, Alan. Radius is now running and working fine. I tested it using radtest "radtest fpohl <password> localhost 1812 <password>" and I got an OK result "rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=162, length=20" My question is now regarding users. The user fpohl is a regular Unix user I created with useradd but it does not belong to the same group as radiusd. It is configured as follow: fpohl:x:1000:110:Fred:/home/fpohl:/bin/bash radiusd:x:107:109:Radius daemon:/var/lib/radiusd:/bin/false ns1:~ # id fpohl uid=1000(fpohl) gid=110 groups=110,16(dialout),33(video) ns1:~ # id radiusd uid=107(radiusd) gid=109(radiusd) groups=109(radiusd) How can I configure freeradius to only accept connections from users that belong to the same groups as radiusd? What I really need is to not allow all unix users to be a radius client, only the ones that belong to a specific group. If my questions are too basic and there are documents on the web that can help new users like me, please show me the way. Frederick Pohl -----Mensagem original----- De: freeradius-users-bounces+frederick.pohl=oi.net.br(a)lists.freeradius.org [mailto:freeradius-users-bounces+frederick.pohl=oi.net.br@lists.freeradius.org] Em nome de A.L.M.Buxey(a)lboro.ac.uk Enviada em: terça-feira, 5 de agosto de 2008 13:48 Para: FreeRadius users mailing list Assunto: Re: RES: Installation problem Hi, > > After running /sbin/ldconfig -v , I was able to execute radiusd. > > The only weird thing is that the daemon is not showing when I type ps aux. > > Even after running /usr/sbin/radiusd, nothing happens. yep - at this point you run radiusd -X to see whats wrong alan Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada a recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor, nos informe respondendo imediatamente a este e-mail e em seguida apague-a.

1 0