June 2009 - Freeradius-Users - lists.freeradius.org

chap or pap
by jon jon 04 Jun '09

04 Jun '09

Hi, I have pap authentication working just fine. I want to change auth type to chap. I am using the radius book that is very outdated. Don't really understand why can't chap to work. I looked in the default file and chap auth-type is not commented out, so I am assuming that if pap authentication didn't work then chap would be the next auth type radius would try right. that is why they put pap at the bottom of the file to let the other auth types a try first. I am using mysql backend server with username and cleartext := passwords. Can anyone point me the right direction or tell me to read more:P jon

2 1

Re-compiling modules
by Rupert Finnigan 03 Jun '09

03 Jun '09

Hi All, I'm *attempting* to recompile the rlm_mschap module with a quick mod to hopefully fix my host authentication domain extraction problems. Is this as simple as running make, and copying the resulting files to "/usr/lib" (on my system atleast)?? And if so, is it just the two files I need to copy, the .la and the .so? If this eventually works I'll rebuild my rpms, but I'm looking for a quick way of finding out if this does actually behave as expected. Sorry if this is a bit of an obvious question - I've never really done much C before. Many Thanks, Rupert

2 1

ippools and Pool-Name
by up＠3.am 03 Jun '09

03 Jun '09

Hi: I am trying to configure a server-side IP pool for select pptp users to bypass the NAS's internal pool. The documentation appears sparse, but this is what I've done so far: In raddb/radiusd.conf: ippool users_pool { range-start = 172.16.1.2 range-stop = 172.16.1.253 netmask = 255.255.255.0 cache-size = 251 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = yes } In raddb/users sometestuser Pool-Name :="users_pool" Framed-Protocol == PPP, Framed-Compression = Van-Jacobson-TCP-IP However, "sometestuser" is simply allocated an IP from the NAS's internal pool, seemingly ignoring this. I also noticed that the files db.ippool and db.ipindex are not being created. Is there something else I'm missing? TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

2 5

checkval module
by Amr el-Saeed 03 Jun '09

03 Jun '09

2 2

Hiding passwords
by John Doppke 03 Jun '09

03 Jun '09

Is there a way to tell freeradius not to include passwords in the log when debugging? -John

2 1

"detail" log files
by Steve Bertrand 03 Jun '09

03 Jun '09

Hi everyone, Can someone swing the clue bat at me, and provide me with information on where I should look to find out how to disable detail log files for specific NASs only? I need to keep the detail files for legacy purposes, but only for specific NASs, and I'd like to disable the rest of them from logging there. Is this possible? Steve

2 2

re: Filtering in sites-enabled default file
by Nick Sparkes 03 Jun '09

03 Jun '09

Hello, I was wandering if anyone can help me. I am trying to set up freeradius 2.1.x In the authorized section of default, we have the following coding: if("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) { update request { Realm := "%{2}" } if(!"%{2}" || ("%{2}" == "worc.ac.uk") || ("%{2}" == "worcester.ac.uk") ){ update request { Realm := "worc" } } } else{ update request { Stripped-User-Name := "anonymous" Realm := 'local' } } switch "%{Realm}" { case "worc" { update control { Proxy-To-Realm := "worc" } update request { Realm := "worc" } # Don't do any proxy stuff here, request will be handled later. } case { update control { Proxy-To-Realm := "jrs" } update request { Realm := "jrs" } } } This should check the extension to the user name, if it is worc or Worcester it will use the realm "worc", if it is anonymous, use the "local" realm. Otherwise use the "jrs" realm. Which works fine. There is a problem, as our users are split into 2 separate section, staff & students. Above works fine for staff, as the realm "worc" handles this authentication. But we do need to filter the students & place these in another realm, "student". The staff login id is: Psna1(a)worc.ac.uk Whereas the student login is in the format: Psdn1_03(a)worc.ac.uk Would it be possible to filter on the format of the userid? The student id has `_02 on it. Regards, Nick.

2 1

Stop alive requests in a dead realm
by Santiago Balaguer García 03 Jun '09

03 Jun '09

Hi, I am using freeradius 2.1.3 for my AAA servers. I have a little problem when a third-patner RADIUS is dead. My problem is my freeradius send the following status packect every 2-5 seconds. Sending Access-Request of id 77 to 200.160.126.23 port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 1.0 seconds. Cleaning up request 3 ID 151 with timestamp +723 Waking up in 2.9 seconds. I want to avoid this test because my partner tell me that I send too many trafic ('operator' is the realm name). proxy.conf file -------------- proxy server { default_fallback = yes } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 secret = testing123 require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 } home_server virtual.example.com { virtual_server = virtual.example.com } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm operator { type = radius authhost = 200.160.126.23 :1812 accthost = 200.160.126.23 :1813 secret = my_secret strip } _________________________________________________________________ ¿Quieres ver los mejores videos de MSN? Enciende Messenger TV http://messengertv.msn.com/mkt/es-es/default.htm

2 1

is it possible one certificate for only user
by Abdullah Dizdar 03 Jun '09

03 Jun '09

Hello; I have been using freeradius with CA, eap. I am also using OPENSLL certificates My question is that how to use only one certificate for only one user. How to configure my raddb.conf, eap.conf, users for only one user. Best regards,

1 0

Re: DISABLE THREAD_TLS
by Ming-Ching Tiew 03 Jun '09

03 Jun '09

--- On Tue, 6/2/09, Ming-Ching Tiew <mctiew(a)yahoo.com> wrote: > > I am trying to compile freeradius on uclibc, it complains > of undefined symbol > __tls_get_addr. So I went to modify > src/include/autoconf.h, and commented > #define HAVE_THREAD_TLS 1, then the compilation was > successful. My question is > what do I missed from disabling THREAD_TLS ? Does it mean > performance impact ? > Will it mean freeradius will be slower, consuming more > memory or what ? > Apparently src/lib/log.c is the only source which uses HAVE_THREAD_TLS, and from the source I can see that once I disable HAVE_THREAD_TLS, in my case, the code will be USE_PTHREAD_FOR_TLS. Sorry this sounds like something for the developer folks but it remains as a user question:- What is the performance impact of disabling THREAD_TLS but USE_PTHREAD_FOR_TLS instead ? Thank you for your attention.

2 1