August 2008 - Freeradius-Users - lists.freeradius.org

Re: Seek through several RADIUS severs without realms
by Alan DeKok 04 Aug '08

04 Aug '08

Ronen Kfir wrote: > Unfortunately I lost the previous message of this thread, where Alan Dekok's > respond is presented. > Anyway, the content of it was he offered to use groups membership. He also > gave a specific file: rlm_passwd which should be configured in order to > achieve groups membership as an indication which IAS server would respond > each authentication request. No. You configure groups on the FREERADIUS server. > The thing is, though went over the help file of rlm_passwd a couple of > times, I didn't see clear explanation how to configure it when working in > IAS-Active Directory environment. If you're using IAS and not FreeRADIUS, don't ask questions here. If you're using FreeRADIUS a proxy to IAS, you can configure groups on FreeRADIUS, and apply policies there. Alan DeKok.

1 0

RE: Seek through several RADIUS severs without realms
by Ronen Kfir 04 Aug '08

04 Aug '08

Unfortunately I lost the previous message of this thread, where Alan Dekok's respond is presented. Anyway, the content of it was he offered to use groups membership. He also gave a specific file: rlm_passwd which should be configured in order to achieve groups membership as an indication which IAS server would respond each authentication request. The thing is, though went over the help file of rlm_passwd a couple of times, I didn't see clear explanation how to configure it when working in IAS-Active Directory environment. Appreciate you help on this one. Cheers, Ronen As I didn't get any response yet, I would like to make my self clearer: I'm looking for alternative ways to differ among authenticated users, other then realms. I thought that the way to do it is, as I described bellow. The thing is I'm not sure how to implement this idea with in Free RADIUS. Please help me in the configuration and implamantation of this concepts. Thank you, Ronen My scenario is as follow: I use more then one strong authentication system, which is OTP (One Time Password) based and has a RADIUS interface. I use the same users repository for the various authentication systems and wish to differ between the authentication systems, using Free RADIUS .Net. I wouldn't like to use realms, as I would like users to use ordinary username and not make them use a realm. I think that the way to do it, is to create sort of loop, which will run through the various RADIUS interfaces of the OTP systems and seek for a given username. If it fails on one system, continue to the next one, and if not found in any of them, send reject access response. Best, Ronen.

1 0

Same user, different service authentication
by Prasit Gebsaap 04 Aug '08

04 Aug '08

Dear all, I am a newbie for FreeRadius, and I have set up it for WLAN authentication (EAP with username/password) and PPTP VPN. Both NAS are Cisco device (Access Point and Integrated Router). It work as I expected, but use differnent user for each service, how to configure for same user to authenticate for different service as both NAS use different authenication method? Prasit Gebsaap

2 1

postgresqlippool
by Maxim Sirenko 04 Aug '08

04 Aug '08

Hi, All! Could you answer the question on the basis of your experience? Since what version of freeradius you was successfull in using rlm_sqlippool with postgresql and what little fixes you had to do to make it work? I have 1.1.7_3 port on FreeBSD 6.2 and I'm unsuccessfull in forcing to assign an IP from sql pool rather from NAS configuration pool. In docs we encouraged to use 2.0.x to have this feature working. I cannot upgrade to 2.0.x now because my radius is under 24*7 load and I don't have spare server to test it. So I want to find out whether anyone had success with sqlippool+pgsql on 1.1.x Real successfull configs would be nice to see. Thanks. Maxim Sirenko.

4 4

No authenticate method (Auth-Type)??
by Oguzhan Kayhan 04 Aug '08

04 Aug '08

Hello, Im trying to use virtual server config for the freeradius. But i got the following error when i test the config. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user My config for the sites-enables is: ----------------------- listen { ipaddr = * port = 1821 type = auth } server one { authorize { preprocess files perl } authenticate { Auth-Type Perl { perl } } accounting { unix radutmp } session { radutmp } } server two { } client 139.179.14.250 { shortname = example-client secret = testing123 virtual_server = one } -------------------------------------- Also added the following under the modules section of radiusd.conf -------------- perl { module = /usr/local/bin/login.pl func_authenticate = authenticate func_authorize = authorize } --------------- this is the ouput of the radiusd -X. rad_recv: Access-Request packet from host 139.179.14.250 port 36926, id=31, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 139.179.14.250 NAS-Port = 10 server one { +- entering group authorize ++[preprocess] returns ok ++[files] returns noop perl_pool: item 0x88af708 asigned new request. Handled so far: 1 found interpetator at address 0x88af708 rlm_perl: Added pair User-Name = test rlm_perl: Added pair User-Password = test rlm_perl: Added pair NAS-Port = 10 rlm_perl: Added pair NAS-IP-Address = 139.179.14.250 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x88af708 ++[perl] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. } # server one Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 31 to 139.179.14.250 port 36926 PS: the same perl script works fine with single freerad config.

3 5

Freeradius proxy accounting
by Mailing List 04 Aug '08

04 Aug '08

Hi, I have freeradius (A) up and running that proxies accounting messages to another freeradius (B) . Is it possible to configure (A) in such a way that it will always will acknowedge towards the NAS even when (B) is not responding to an proxied accounting message coming from (A). Now, If (B) is down, (A) will also not respond back to the NAS and the NAS keeps on retrying. (A) is configured to put the accounting in a mysql database. Basically, I want that (A) always sends an ACK back to the NAS regardless the state of (B). Thx, Kurt

3 3

Perl_Tstack_sp_ptr
by Oguzhan Kayhan 02 Aug '08

02 Aug '08

Hello, Im trying to install a server with debian with perl module. When i enable rlm_perl i got the following error. modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/bin/login.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } freeradius: symbol lookup error: /usr/lib/perl5/auto/DBI/DBI.so: undefined symbol: Perl_Tstack_sp_ptr uname -a Linux radian 2.6.18-6-686 #1 SMP Tue Jun 17 21:31:27 UTC 2008 i686 GNU/Linux radian:/# perl -v This is perl, v5.8.8 built for i486-linux-gnu-thread-multi freeradius -v freeradius: FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Aug 1 2008 at 10:58:39 We compiled freeradius and perl again but no luck.. The problem occurs after rlm_perl loads.. if needed we can send the trace logs too. What might cause the error?

3 3

Vista Issue
by nf-vale 01 Aug '08

01 Aug '08

Alan, Do you have any news on the Vista EAP issue? For anyone having troubles with Vista there's this supplicant that works and its free: http://wire.cs.nthu.edu.tw/wire1x/ Nelson Vale

3 5

Proxy FallBack
by Marcelo Henique Cabral Ariza 01 Aug '08

01 Aug '08

Hi everybody! I am using freeradius 2.0.5, and i have a problem whith the proxy option default_fallback, my server do proxy to 3 providers and i have a default realm configured to fallback, but when home servers die the proxy set them died, but don`t do the fallback. Anyone have a sugestion? Thanks! Marcelo

1 0

RE: Pattern Matching in users file
by Garber, Neal 01 Aug '08

01 Aug '08

> You can use the "hints" file to do what you want. It does *not* say > you can only use prefix & suffix matching. I was referring to the following in the sample hints file: # Matching can take place with the the Prefix and Suffix # attributes, just like in the "users" file. # These attributes operate ONLY on the username, though. And this in the doc/README file: Customize the /etc/raddb/hints file. This file is used to give users a different login type based on a prefix/suffix of their loginname. For example, logging in as "user" may result in a rlogin session to a Unix system, and logging in as "Puser" could start a PPP session. Is there another document that describes matching on other attributes and how to add new attributes to the request. I think these paragraphs need updating. Are you saying I can do this in hints: DEFAULT Cisco-AVPair == "", My-Group := "RadioIP-MAU" DEFAULT Cisco-AVPair == "ssid=(.*)", My-Group := "Wireless %{1}" DEFAULT My-Group := "Unknown source" That is, does hints work just like the users file, except it adds any new attributes to the request? If so, this is exactly what I need! If the syntax or usage is off, can you correct me. Thanks Alan.

4 4