October 2009 - Freeradius-Users - lists.freeradius.org

Clear Text PAP passwords - how to enable
by Alex M 18 Oct '09

18 Oct '09

hey all we keep upgrading FR servers and i got stuck with problem where I need PAP (I think) well i need clear text password and its not working for my user. When i send request through NTRAdping w/ CHAP all works well but when I'm using device as NAS nothing works :( I hope some one can point me out in right direction. Here is my output: ============================================================================ rad_recv: Access-Request packet from host XXX.XXX.XXX.11 port 64094, id=152, length=136 NAS-IP-Address = 192.168.0.112 NAS-Identifier = "XXX.XXXXXXX.com" User-Name = "alex" User-Password = "mypass" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 0 Framed-IP-Address = 192.168.2.254 Called-Station-Id = "00:0d:b9:XX:XX:XX" Calling-Station-Id = "00:0e:35:XX:XX:XX" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "alex", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> alex attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 152 to XXX.XXX.XXX.11 port 64094 Waking up in 4.9 seconds. Cleaning up request 1 ID 152 with timestamp +827 Ready to process requests.

3 3

Variable passing between autz,acct stages
by flamur2 17 Oct '09

17 Oct '09

Hi, Is it possible to pass a variable from authorization modules to accounting modules, (by using Tmp-String* attributes) ? My radius config is like this authorization is done via files module, where Tmp-String-0 is set: "u1" Crypt-Password := "$1$7ZSTJ83K$IUVxdrj8TxA2nftXzx7AH.", Tmp-String-0 := "pppoe25", Expiration := "10 Jan 2010" accounting is done via sql. In sql module (used only for accounting) I need to reference Tmp-String-0, is this possible ? Thanks, Flamur

2 1

Getting pervious module return code in rlm_perl
by Nasser Heidari 17 Oct '09

17 Oct '09

Hi, Currently I've a Perl module that checks my Users NAS-IP-Address. I want to know how can I call (get) pervious module return code in Perl script? Because now I run this module for all my users, either the pervious module rejects or accepts user . Thanks

2 1

Re: 3GPP string Attributes, containing encapsulated information...
by Alan DeKok 17 Oct '09

17 Oct '09

Stefan A. wrote: > Is there a way to get Information out of the > 3GPP-GPRS-Negotiated-QoS-profile? Perl. > The Attribute is defined in the dictionary as: > ATTRIBUTE 3GPP-GPRS-Negotiated-QoS-profile 5 string > > The Value of a String might be: 99-0B811F7396878774010000 > > To get the encapsulated "Traffic Class", I will need the most left 3 bits of > the first '7' of the string. > It would be 7 --> 0111 --> 011 --> 3 Ugh. Why do people design such complicated protocols? > Is there a function available, to do this? No. FreeRADIUS doesn't support bit-packed structures. There isn't a lot of reason to do that, because Perl does it much better. Alan DeKok.

1 0

Check_item still wraps at 4gb
by Marcel Grandemange 16 Oct '09

16 Oct '09

Good Day. Hopying I can get some help. I have been trying for years now too simply cap users based on data transferred above 4gb. It has only been now that I discovered , where the problem lies. I can log data over 4gb no issue, nas sends gigawords to radius and gets inserted into db no probs. However, my data counter fails to authenticate customers properly is any accounts are set to above 4Gb. And I found why. It seems that the "check_item" still wraps at 4gb! How can I solve this? Regards

3 3

segfault when rlm_perl used
by Michael Chernyakhovsky 16 Oct '09

16 Oct '09

Hi, i build FR 2.1.7 on slackware 13.0 (glibc-2.9) with perl 5.10.0. every time, i kill radiusd, message like radiusd[5754]: segfault at 0 ip b73e2213 sp bfb86dac error 4 in libc-2.9.so[b736b000+15a000] appears in the log. This is not good bad, but worst when radiusd crashed on run-time. Then in logs appears message like: Oct 13 21:58:53 rs kernel: radiusd[11441]: segfault at 20004 ip b7478636 sp b502bcb0 error 4 in rlm_perl-2.1.7.so[b73cb000+15b000] Oct 14 22:09:56 rs kernel: radiusd[17687]: segfault at 8 ip b731e35d sp b6f61ce0 error 4 in rlm_perl-2.1.7.so[b71fd000+15b000] Oct 14 22:14:06 rs kernel: radiusd[18374]: segfault at 8 ip b73d735d sp b701ace0 error 4 in rlm_perl-2.1.7.so[b72b6000+15b000] Oct 15 18:07:58 rs kernel: radiusd[23858]: segfault at 8 ip b745935d sp ae89cce0 error 4 in rlm_perl-2.1.7.so[b7338000+15b000] Oct 15 18:08:56 rs kernel: radiusd[23896]: segfault at c ip b74d400e sp ae919c90 error 4 [b73b5000+15b000] Oct 15 18:09:55 rs kernel: radiusd[24042]: segfault at 8 ip b736935d sp b07acce0 error 4 in rlm_perl-2.1.7.so[b7248000+15b000] when i comment out all "perl" statement in config, any segfault ("in rlm_perl-2.1.7.so" and "in libc-2.9.so") disappears. Regards, Michael.

2 2

How to disable threads in 2.1.7
by Craig Campbell 16 Oct '09

16 Oct '09

I am trying to build a version of 2.1.7 without threads (trying to debug an abandoned child process issue). on a redhat AS5 Linux system Every configure option I try seems to be ignored. In config.log I find entries like, Using built-in specs. Target: x86_64-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk --disable-dssi --enable-plugin --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --with-cpu=generic --host=x86_64-redhat-linux Thread model: posix I have tried the following options for configure, all with no apparent luck, ./configure --with-threads=no ./configure --disable-threads ./configure --enable-threads=NO ./configure --enable-threads=no --with-threads=no --disable-threads --disable-thread --with-thread=no ./configure --disable-threads --disable-thread ./configure --disable-pthreads --disable-thread ./configure --disable-pthreads --disable-thread Has anyone determined how to disable threads? Thanks, -craig -------------------------------------------------------------------------------- Craig Campbell craig.campbell(a)ccraft.ca CampbellCraft Consulting Inc 2 Kenny Court Whitby, Ontario Canada L1R 2L8 905 922-2789 __________ Information from ESET Smart Security, version of virus signature database 4514 (20091016) __________ The message was checked by ESET Smart Security. http://www.eset.com

6 10

Freeradius2 configuration challenges ( Binding IP address & failure of radtest
by adaigle＠vl.videotron.ca 16 Oct '09

16 Oct '09

Hello I am new with FreeRadius and trying to get Freeradius2, version 2.1.7 running on top of CentOS , to do a simple test with WLAN users. First off all, I am not able to configure the raduis server with an IP address . I am getting the following message: [root@localhost Alain]# /usr/sbin/radiusd -i 192.168.1.123 -p 1812 -X FreeRADIUS Version 2.1.7, for host i386-redhat-linux-gnu, built on Sep 18 2009 at 10:59:17 radiusd: #### Opening IP addresses and Ports #### Failed binding to authentication address 192.168.1.123 port 1812: Cannot assign requested address There appears to be another RADIUS server running on the authentication port 1812 Second when I leave 127.0.0.1 in the radiusd.conf file and I use localhost. I get the following message doing a radtest : [root@localhost Alain]# radtest steve testing localhost 1812 testing123 Sending Access-Request of id 170 to 127.0.0.1 port 1812 User-Name = "steve" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=170, length=20 The following is what appear on the radiusd debug screen: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Thanks for your help ! Al

4 11

Re: Several LDAP searches
by Francisco Javier Valdera Garcia 16 Oct '09

16 Oct '09

Ivan Kalik escribió: >>>> I am configuring a freeradius server (version 2.1.7). I need two listen >>>> sections, both to authenticate users using the same LDAP server. The >>>> thing is that I need to do different searches with different filters, >>>> depending on which listen section is asked. What is the best way to >>>> configure this, if there is one? I have read the documentation, the >>>> wiki >>>> and the configuration files and I couldn't figure it out. >>>> >>>> >>> Configure two ldap instances and use them in virtual servers listen >>> sections point to. >>> >>> >> Thanks for the help, but I'm pretty new at freeRadius, can anyone tell >> me how do I do this? >> > > http://wiki.freeradius.org/Rlm_sql#Instances > > Same applies to ldap or any other module. If you are using groups: > > http://wiki.freeradius.org/Rlm_ldap#Group_Support > > Ivan Kalik > Kalik Informatika ISP > > Thanks a lot, Ivan, it worked like a charm :D. Greetings, Francisco Javier.

1 0

Users and groups with Microsoft AD
by Mr. You 16 Oct '09

16 Oct '09

Hello, I've tried searching the web before actually submitting this post in order to cover all angles. I know it's possible for freeradius to authenticate against Microsoft AD groups, users, etc. However, is it possible to authenticate by combining groups? In other words, can freeradius authenticate against users AND groups? I would like to say only members of computers AND users are allowed to authenticate against freeradius while all others are rejected. Is this even possible? Or, is there something about using peap and combining groups that will not allow this to occur? Currently I'm running freeradius 2.1.6 on freebsd 7.2 and windows 2003. Thanks!

2 1