May 2010 - Freeradius-Users - lists.freeradius.org

radiusGroupName and utf-8
by HRZ Konten 21 May '10

21 May '10

Hello list, I use freeradius 2.1.8 and OpenLDAP 2.4.17. In LDAP I have the radius.schema and want to use the attribute radiusGroupName to authorize access with Huntgroups and LDAP-Groups in users file. My LDAP-Groups come from a Database and they are all in utf-8 and have characters like ä, ü etc. But in radiusGroupName is allowed only IA5. I can change the schema and allow utf-8 as changing Syntax from *IA5String* (OID=1.3.6.1.4.1.1466.115.121.1.26) to *DirectoryString* (OID=1.3.6.1.4.1.1466.115.121.1.15). Would that be a Problem for freeradius, if it get utf-8 characters for the LDAP-Groups? I appreciate any help, Cheers Irina

1 0

ISG DHCP relay
by Igor Smitran 20 May '10

20 May '10

I am sorry for contacting list for my problem, but i have searched for more than 15 days trying to find the solution with no success: 1. i have a cisco ISG with DHCP relay that points to freeradius 2. freeradius will send access accept or access reject based on mac address, nas ip etc. this scenario works ok for CPE devices, but not for CM devices because CM devices need TFTP server name and TFTP file name. I am unable to find right reply message format. So, my problem is BOOTP part. Is there any way to send those data to ISG so that ISG can combine those data and send it to CM device? Again, i am sorry for asking this question here but it is partially tied to freeradius functionality. I hope there is someone on this list that has more experience with ISG and freeradius to point me to right direction. Thank you...

5 12

wildcard matching on username?
by Jiann-Ming Su 20 May '10

20 May '10

I'm running freeradius 2.1.8 with a MySQL backend. I'm want to do MAC based authentication for network access control on my switch. Is it possible to specify a wildcard for the username (mac address)? That is, if I have a bunch of computers with the same OUI on the NIC's, how do I configure freeradius to just match on the OUI without adding each MAC address as a user? Thanks for any tips and insights.

1 0

certs files missing?
by shirkavand 20 May '10

20 May '10

Hi there, I am trying to use certificates with freeradius. I am following steps given here http://deployingradius.com/ The step #2 (Get EAP<http://deployingradius.com/documents/configuration/eap.html> working using "snake oil" certificates) says that i have to execute the following commands: $ cd /etc/raddb/certs $ make but in my freeradius installation the "certs" folder does not have any make file, so if i try to run above commands i get errors. In fact my installation does not have several files that the tutorial suppose that should exist, they are: a) make fille b) ca.cnf c) sefver.cnf d) xpextensions Any idea why these files are missing? Cheers, Shirkavand

3 4

FW: MS AD / OpenLDAP with PAP - is it really not possible ?
by Pawel Cieplinski 20 May '10

20 May '10

Hello I have got application that allow only to authenticate using PAP method. My Goal would bo to use Active Directory as a abckend User Database, but I found that: "Once the PAP authentication test has been successful, the next step for sites using Active Directory is to configure the system to perform user authentication against Active Directory. The clear-text passwords are unavailable through Active Directory, so we have to use Samba" Is it true ? The same page describing to use ntlm_auth instead, But I cannot found how to pass attributes from LDAP Database using ntlm_auth to Radius Client. Is it possible to reply attributes from LDAP using ntlm_auth ? Best Regars Pawel.

2 1

Re: Building and sending Acct packets
by Alan DeKok 20 May '10

20 May '10

Stefan A. wrote: > I have some use cases, where I have to send an Accounting packet to an > RADIUS Accounting Server to provision the user on this server. The > trigger for that accounting packet must not be necessarily an accounting > packet, coming from a NAS. It might also be a RADIUS Access Request. ... > So for me, the best option would be to configure a line like > > provison_serverA > > What would be the module, I have to configure for that reason? There is no module to do that. > My Process does not require me, to wail for an ACK, to go on… What would > be a configuration option for this? There is no configuration option to do that. You can run radclient as an external program. See rlm_exec, and "man radclient". Alan DeKok.

1 0

Re: freeradius + mysql trouble
by Ski Mountain 20 May '10

20 May '10

I was simply using the debian package manager version, seams to work file for what I need. >is version of freeradius supplied by distro or package manager? > >have you uncommented calls to sql - eg in the default >server or inner-tunnel (look in the required/needed sections, eg >authorize, authenticate etc). i also note you dont have SSL >support so wont be able to do any EAP stuff. > >alan That was exactly the problem, none of the docs mention that file which is why I missed it. >Part way through, it says: > >Edit /etc/raddb/sites-available/default ... > >You didn't do that. >># /usr/sbin/freeradius -X >>FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 >>Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.

1 0

Segmentation fault on 2.1.7 during HUP
by coja 20 May '10

20 May '10

Hello all! We use 2.1.7 version of freeradius+mysql 5 running on RHEL4u8. We tried to apply PIN authentication based on file users which located in /etc/raddb. I inserted to crontab reload (HUP) command which runs every 30 minutes. After the period of time we found that radiusd crashed with Segmentation fault error in sql_log module. I turned off this module, but it didn't help us. Now it's happening with voip-postpaid module which was adapted to mysql. I read docs/bugs and tried to trace the bug, but in gdb radius was working 3 days without any crash. All that I have my configs and debug output after radiusd -X Could anybody please tell me what I should do? May be I have to recompile FR with some another options or my configs fail. I tried 2.1.8 and it didn't help me. Thank You very much! [sql] expand: %{User-Name} -> 2018 [sql] sql_set_user escaped user --> '2018' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '2018' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = '2018' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User 2018 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "2018" [pap] Using clear text password "2018" [pap] User authenticated successfully ++[pap] returns ok Login OK: [2018] (from client test port 0 cli 1115551212) +- entering group post-auth {...} [sql] expand: %{User-Name} -> 2018 [sql] sql_set_user escaped user --> '2018' [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', 'HIDDEN', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '2018', 'HIDDEN', 'Access-Accept', '2010-05-17 20:07:14') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '2018', 'HIDDEN', 'Access-Accept', '2010-05-17 20:07:14') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> 2018 [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 2018 [sql_log] sql_set_user escaped user --> '2018' Segmentation fault -- View this message in context: http://old.nabble.com/Segmentation-fault-on-2.1.7-during-HUP-tp28590790p285… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

hostname variable ?
by Fred MAISON 20 May '10

20 May '10

Hello Freeradius-Users, Is there any way to reference hostname (in fact hostname -s) in configuration files, in order to have identical configuration files tree on both a normal and a backup freeradius 2.1.8 server ? For example, to manage differents listen addresse on normal and backup : suppose a variable %{hostname} contains result of command hostname -s, On both normal and backup servers, we could have this : $INCLUDE %{hostname}.listen.conf # expands as $INCLUDE normal.listen.conf on so called normal server # expands as $INCLUDE backup.listen.conf on so called backup server /etc/raddb/normal.listen.conf : listen { type = auth port = 1812 ipaddr = 10.1.1.1 } listen { type = acct port = 1813 ipaddr = 10.1.1.1 } ..... /etc/raddb/backup.listen.conf listen { type = auth port = 1812 ipaddr = 10.1.1.2 } listen { type = acct port = 1813 ipaddr = 10.1.1.2 } ..... best regards, Fred

2 2

State of 2.x?
by Alex French 20 May '10

20 May '10

Hi, We're running 1.1.8 on FreeBSD 5.3 and have been delaying the move to 2.x until absolutely necessary. Given the recent libtool22 issues, I'm thinking it's time to move. Just wondering if people would recommend moving now to 2.1.9 or waiting a while longer for a stable 2.2? Thanks -- Alex

3 3