April 2009 - Freeradius-Users - lists.freeradius.org

debug log and syslog
by Jehan PROCACCIA 03 Apr '09

03 Apr '09

hello I can run debug log by starting radiusd -X , but for production, I want logs to go to a file and not stdout . When I start radiusd without -X I only get very few logs, how can I have equivalent to -X log with syslog or a log file ? or a least get more log the the very few ones I get with that config: /etc/raddb/radiusd.conf log_destination = syslog log { syslog_facility = daemon file = ${logdir}/radiusd.log } It's a freeradius-2.0.3-3.el5 on a centos 5 for now with that config I only get 2 lines in radiusd.log when I log in 802.X EAP-ttls , telling: Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [procacci] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) Sep 5 10:42:30 radiustux radiusd[14619]: Login OK: [anonymous] (from client APS_Cisco port 29 cli 00-1F-3C-59-5E-52) with radius -X I get a lot more, can I have at least more than these 2 lines ? thanks .

5 8

Acceess point not forwarding authentication request to the RADIUS
by kalesameer 03 Apr '09

03 Apr '09

I am working with freeradius 2.1.4 and DWL AP 21000 (DLink access point) and Fedora 8 linux os. I want to authenticate the windows clients using RADIUS server in my wifi network. But my AP is not forwarding request of authentication to RADIUS server.I can see the log of AP as FRI APR 03 09:30:46 2009 System --AP cold start with f/w version: v2.20eu FRI APR 03 09:30:46 2009 Wireless --WLAN1 Normal AP ready FRI APR 03 09:30:56 2009 System --Web login success from 192.168.1.251 FRI APR 03 09:31:32 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:31:44 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e FRI APR 03 09:31:44 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:31:56 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e FRI APR 03 09:31:57 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:32:09 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e FRI APR 03 09:32:09 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:32:21 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e FRI APR 03 09:32:22 2009 Wireless --Association:11G STA 00:13:02:12:16:6e associated with WLAN1 SSID = scoeit FRI APR 03 09:32:34 2009 Wireless --WLAN1 aged 11G STA 00:13:02:12:16:6e and RADIUS server shows only listening and not process any of the request. [sameer@sameerkale]# radiusd -X FreeRADIUS Version 2.1.1, for host i686-pc-linux-gnu, built on Feb 7 2009 at 14:41:27 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.0/24 { require_message_authenticator = no secret = "testing123" shortname = "scoeit" } client 192.168.1.250 { require_message_authenticator = no secret = "testing123" shortname = "accesspoint1" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "crypt" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "localhost" port = 389 password = "secret" identity = "cn=Manager,dc=sinhgad,dc=edu" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=sinhgad,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=student)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP username mapped to RADIUS User-Name rlm_ldap: LDAP password mapped to RADIUS User-Password conns: 0x8a2b110 Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ......... I tried it hard but i didnt find any solution....plz help me guys . -- View this message in context: http://www.nabble.com/Acceess-point-not-forwarding-authentication-request-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Question concerning changing a User-Name
by Bryan Graham 02 Apr '09

02 Apr '09

I'm using freeradius 2.1.4, hand compiled, and running on Solaris 10, in a zone. I've already got my server authorizing off of ldap and authenticating off of kerberos. What I would like to do is something slightly trickier. I would like to authorize off ldap and then authenticate off of kerberos, but using a different username. Optimally, this would happen by storing the alternate username in ldap, and then setting the username that will be used to authenticate against kerberos to this entry. I don't know if I would have to try to change the User-Name field (which I haven't had luck doing via the users file), or if there is some way to tell rlm_krb5 "hey, user this username instead". Worst case, I could create a mapping somewhere in a text file if needed, but storing the "other" username in ldap would be optimal. thanks, Bryan Graham

1 0

proxy setup questions
by Dallas Helquist 02 Apr '09

02 Apr '09

freeradius version: 1.0.1 (Centos4) I have the need to proxy requests based on "@domain.com" to different radius servers. I thought this would be fairly simple after reading proxy.conf, but I must be missing something! Here's the relevant portion of my proxy.conf: realm test.com { type = radius authhost = 10.19.3.8:1812 accthost = LOCAL secret = testing123 } realm test2.com { type = radius authost = 10.19.3.9:1812 accthost = LOCAL secret = testing123 } When testing via radtest using "test(a)test.com" the expected behavior happens - I see the request proxied to 1.1.1.1: <SNIP> rad_recv: Access-Request packet from host 127.0.0.1:53468, id=229, length=65 User-Name = "test(a)test.com" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 123 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: Looking up realm "test.com" for User-Name = "test(a)test.com" rlm_realm: Found realm "test.com" rlm_realm: Adding Stripped-User-Name = "test" rlm_realm: Proxying request from user test to realm test.com rlm_realm: Adding Realm = "test.com" rlm_realm: Preparing to proxy authentication request to realm "test.com" <SNIP> Sending Access-Request of id 0 to 10.19.3.8:1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 123 Proxy-State = 0x323239 Great! Now I try it with "test(a)test2.com": rad_recv: Access-Request packet from host 127.0.0.1:53482, id=7, length=66 User-Name = "test(a)test2.com" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 123 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: Looking up realm "test2.com" for User-Name = "test(a)test2.com" rlm_realm: Found realm "test2.com" rlm_realm: Adding Stripped-User-Name = "test" rlm_realm: Proxying request from user test to realm test2.com rlm_realm: Adding Realm = "test2.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 Why would it make the Authentication realm LOCAL? If I move the realm test2.com above test.com in proxy.conf then test2.com works & test.com doesn't. Can someone point me in the right direction? I've read included doc/proxy, proxy.conf & the online wiki sections on proxy. It seems so simple, yet I can't seem to figure it out! Thanks in advance. -dallas

6 8

Re: Help checking group membership with FreeRadius
by Chris Li 02 Apr '09

02 Apr '09

> Date: Mon, 23 Mar 2009 11:22:22 -0400 > From: Josh Hiner <josh(a)remc1.org> > Subject: Help checking group membership with FreeRadius > To: freeradius-users(a)lists.freeradius.org > Message-ID: <200903231522.n2NFMNxv077788(a)mxdrop218.xs4all.nl> > Content-Type: text/plain; charset=UTF-8 > Currently we have a radius server that performs authentication off our samba domain controller for wireless users. This works great. I would like to limit users so they must be a member of the wireless group in order to connect. Since the /etc/group file is on a different server I believe I cannot use the etc_group module. Also, in order to use that module the user must have a valid account on the radius server as well. > Any ideas on checking group membership? I use ntlm_auth in the mschap module for authentication in Freeradius ver 2.1.3-1. i had a similar problem a few days ago run "getent passwd username" to see if you can get a line like: smith:*:100:3243::/home/smith:/usr/bin/sh if you do, '3243' is the principal group ID of the user my solution: use a perl script 'chkgrpmembership.pl'. to check the group membership of the user. the script set 'Group' attribute if the user is found. 1. chkgrpmembership.pl use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; # # This the remapping of return values # use constant RLM_MODULE_REJECT=> 0;# /* immediately reject the request */ use constant RLM_MODULE_FAIL=> 1;# /* module failed, don't reply */ use constant RLM_MODULE_OK=> 2;# /* the module is OK, continue */ use constant RLM_MODULE_HANDLED=> 3;# /* the module handled the request, so stop. */ use constant RLM_MODULE_INVALID=> 4;# /* the module considers the request invalid. */ use constant RLM_MODULE_USERLOCK=> 5;# /* reject the request (user is locked out) */ use constant RLM_MODULE_NOTFOUND=> 6;# /* user not found */ use constant RLM_MODULE_NOOP=> 7;# /* module succeeded without doing anything */ use constant RLM_MODULE_UPDATED=> 8;# /* OK (pairs modified) */ use constant RLM_MODULE_NUMCODES=> 9;# /* How many return codes there are */ # Function to handle authorize sub authorize { my $getentResult = qx(getent passwd $RAD_REQUEST{'User-Name'}); my @resultArray = split ":", $getentResult; my $arraySize = scalar @resultArray; # Group ID 11184 = staff # Group ID 12705 = student if ($arraySize != 0) { my $groupID = $resultArray[3]; if ($groupID == 11184) { $RAD_REPLY{'Group'} = "Staff"; } elsif ($groupID == 12705) { $RAD_REPLY{'Group'} = "Student"; } else { # We only allow Staff and Student group return RLM_MODULE_REJECT; } } else { #user no found in AD return RLM_MODULE_REJECT; } return RLM_MODULE_OK; } 2.add the following lines to the modules section of radius.conf perl { module = /etc/freeradius/chkgrpmembership.pl func_authorize = authorize } 3. In the Authorize section, uncomment 'files'. Then add a line containing 'perl' after it. In the Authentication section add Auth-Type Perl { perl } 4. if you use EAP/TLS, you need to enable use_tunneled_reply, in (peap and/or ttls section) eap.conf 5. finally, you can a line to 'users' file DEFAULT Group != "wireless", Auth-Type := Reject (Sorry for starting a new thread, i subscribed to the "digest" version of the mailing list) Chris

2 1

Radclient & PHP
by AHMED KHIDR 02 Apr '09

02 Apr '09

Hii All , Please Any one have an idea how to make a PHP code to run Radclient in order to disconnect users , Thanks

7 8

integrate dhcpd and freeRADIUS logs
by deveshgade 02 Apr '09

02 Apr '09

I want to maintain a log of the username,ip address and the mac address of the client connecting to my FreeRADIUS-2.1.1 server in a wireless network. I am using dhcpd, from which the mac address of client can be obtained. I wanted to know if anyone has written a script to map radius logs to the dhcpd logs so that one would be able to compare the username,ip address and mac address of the client. Based on comparison of the above values,access to the wifi network would be granted to the user. Can anyone give me a sample or an real shell script or php script for the same?? -- View this message in context: http://www.nabble.com/integrate-dhcpd-and-freeRADIUS-logs-tp22854371p228543… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Seg Fault in 2.0.3
by Garber, Neal 02 Apr '09

02 Apr '09

I have a FR 2.0.3 server running under FreeBSD 6.3 which intermittently exits with a segmentation fault. I tried searching the list for known seg fault issues with 2.0.3 and only found one which sounded like it only happens when running under gdb. Do you think upgrading to 2.1.3 (it's the latest port for FR under FreeBSD) could potentially resolve this issue? (I'm not looking for a guarantee, just an opinion based upon whether there were known seg faults in 2.0.3 that were fixed in later releases.) Should I run FR under gdb to get more information about the seg fault? This morning it happened while I was running "radiusd -Xx" and the error occurred a few minutes after a request was successfully processed as a new request was received and before it was able to output any information about it. The server had been running for less than a week (most times it runs longer than this before crashing). So, the last two lines of output were: Tue Mar 31 07:52:08 2009 : Debug: Ready to process requests. Segmentation Fault: 11 I realize this isn't enough to diagnose the problem (but, it's all the information I currently have). Please let me know how you think it's best to proceed (e.g., upgrade, get more info about the problem, other..) Thanks in advance for any assistance/advice you can provide.

2 2

if we add a smartcard!
by new conf 01 Apr '09

01 Apr '09

Hi everybody and experts in freeradius; :) I'm a new user of the server.. I succeeded to connect a client (supplicant) over wifi to the radius server using eap method.. now, i have to secure the server private key in a smart card.. have you an idea what can I add in eap.conf and in this attribute: certificate_file = ?? I'll be grateful for your help! thanks!

1 1

RE: SQL xlat not working
by Eric Geier 01 Apr '09

01 Apr '09

> >I've googled for it. Plus someone here had mentioned "rlm_raw and use > it > >with a SQL xlat rule". I think I'm doing that, but it's not working. > Please > >let me know what might be holding it up. > > > > Lack of rlm_raw? That doesn't come with the server. But even without using a raw attribute, the SQL xlat rule doesn't work, such as: client 192.168.0.1/32 { secret = "%{sql:SELECT secret FROM APs WHERE NAS-Identifier='blah'" shortname = testnet } When googling, I think I found that when using LDAP, I would have to change a setting to get this working....I didn't find a similar setting for SQL. > >> You can load clients from nas table. See read_clients setting near > the > >> end of sql.conf file. > > > >That may work, but could I have the Name field represent something > besides > >the IP, like the NAS-Identifier? > > No. Unless you alter source code. Patches are welcome. Is there a how to I can read to learn about this?

2 1