February 2011 - Freeradius-Users - lists.freeradius.org

Re: Unable to authenticate in case of multilingual characters
by karnik jain 06 Feb '11

06 Feb '11

Hello Sir, But the issue is you have written the Chinese charter directly in place of user name rather than writing its equivalent UTF-8 into users file as said by you. users: "現年快樂" Auth-Type := Accept My doubt is How can I write UTF-8 encoded (may be HEX form) in users file. Because I have did the same in place of Chinese I have written the hex equivalent of ∞ infinity symbol which is also a multilingual character in place of username and sent the request containing hex equivalent of UTF-8 of ∞ infinity symbol. Kindly correct me If i am wrong. -Karnik jain On Fri, Feb 4, 2011 at 10:25 PM, James J J Hooper <jjj.hooper(a)bristol.ac.uk>wrote: > --On 04 February 2011 22:02 +0530 karnik jain <karnik.jain(a)gmail.com> > wrote: > > Hi Alan, >> >> I have written multilingual character *∞ *directly in RADIUS server's >> *users file.* >> without encoding it into UTF-8. >> * >> * >> Do I need to write Username in *user file of RADIUS server *after >> converting it >> into UTF-8 to make the *whole thing work*? >> >> If Yes then How can I write UTF-8 characters into *users file of RADIUS >> server.* >> >> Do I need to write directly the *HEX of encoded characters* or some other >> way >> into the *users file of RADIUS server as shown in attached users file of >> RADIUS server*? >> * >> * >> I have double check that the UTF-8 Encoder of mine is working fine. >> Multilingual character = ∞ (infinity symbol) is having equivalent >> form in HEX = *0xe2889e* >> and UTF-8 encoding of *0xe2889e* is = *0xf8 0xb8 0xa2 0x9e.* >> >> *Can any one please look into to above issue * >> *and guide me How can I configure the files of free RADIUS server * >> *to use USER-NAME field other than **US-ASCII like * >> *Chinese etc.?* >> * >> * >> *Regards,* >> *Karnik jain* >> > > Hi Karnik, > If you put UTF in the users file and UTF in the User-Name in the radius > request it will work. For example: > > users: > "現年快樂" Auth-Type := Accept > > ...and then testing it: > > echo 'User-Name = "現年快樂"' | radclient -x 137.222.253.91:16010 auth SECRET > Sending Access-Request of id 161 to 137.222.253.91 port 16010 > User-Name = "現年快樂" > rad_recv: Access-Accept packet from host 137.222.253.91 port 16010, id=161, > length=20 > > Regards, > James > > -- > James J J Hooper > Network Specialist > Information Services > University of Bristol > http://www.wireless.bristol.ac.uk > -- > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 5

Simultaneous-Use = 1 not working
by raisedtozero 06 Feb '11

06 Feb '11

Hello I do have a free radius. It uses system authentication (unix users) Heres my radiusd.conf excerpt <nabble_embed> unix { # # Cache /etc/passwd, /etc/shadow, and /etc/group # # The default is to NOT cache them. # # For FreeBSD and NetBSD, you do NOT want to enable # the cache, as it's password lookups are done via a # database, so set this value to 'no'. # # Some systems (e.g. RedHat Linux with pam_pwbd) can # take *seconds* to check a password, when th passwd # file containing 1000's of entries. For those systems, # you should set the cache value to 'yes', and set # the locations of the 'passwd', 'shadow', and 'group' # files, below. # # allowed values: {no, yes} cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 # # Define the locations of the normal passwd, shadow, and # group files. # # 'shadow' is commented out by default, because not all # systems have shadow passwords. # # To force the module to use the system password functions, # instead of reading the files, leave the following entries # commented out. # # This is required for some systems, like FreeBSD, # and Mac OSX. # passwd = /etc/passwd shadow = /etc/shadow group = /etc/group # # The location of the "wtmp" file. # This should be moved to it's own module soon. # # The only use for 'radlast'. If you don't use # 'radlast', then you can comment out this item. # radwtmp = ${logdir}/radwtmp } </nabble_embed> and my users file is this: <nabble_embed> DEFAULT Auth-Type = System Simultaneous-Use = 1, Fall-Through = 1 </nabble_embed> Ive configured my clients files and has the proper NAS type. Problem is multiple user can login. How do i resolve that? Please help Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Simultaneous-Use-1-not-working-tp33… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

radius authentication support for telnet server.
by vijay s sheelavantar 06 Feb '11

06 Feb '11

Hello Friends,I want to authenticate telnet users using Free Radius server. I have pam_radius_auth.so and configured it for ssh which is working fine. For telnet also I have created a file "/etc/pam.d/telnet"  and trying to authenticate using freeRadius server. But it is not happening. Kindly let me know how can i authenticate telnet users using freeRadius? Thanks & Regards,Vijay S.

2 1

Re: Radius Client UDP port selection
by vijay s sheelavantar 06 Feb '11

06 Feb '11

I am talking about pam_radius_client. I want this pam_radius_auth.so client to select a particular UDP port to communicate with external radius server. so that server can send authentication responce on the same port back to client.

2 2

how to test authentication process using Access-Challenge response
by Gregor Bruhin 05 Feb '11

05 Feb '11

Hi, I'm currently playing around with freeradius to implement a two-way authentication using smsotp. Is there a way to test the whole authentication process, including access-challenge packets without using a real radius client device? Many thanks and best regards, Greg

3 3

Radius Groups / Profiles
by npayne 05 Feb '11

05 Feb '11

I have installed freeradius with daloRadius. I have then created a group / profile to cut off after using a certain amount of data. I have the following problem. It does not cut the user off when the limit was reached but it will reject the user when he/she tries to log in again. The DB only gets updated with the used octets once the users logs off. How do I get the session to be terminated when the max octets is reached? Thanks Neill -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-Groups-Profiles-tp3372247p33… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Separate rlm_perl in each virtual server
by Alexander Shikoff 05 Feb '11

05 Feb '11

Hello, I have two virtual servers and I need to process events in these servers with different perl scripts. Is there a way to configure separate rlm_perl instances for each virtual server? Thanks. -- MINO-RIPE

3 7

Unable to authenticate in case of multilingual characters
by karnik jain 04 Feb '11

04 Feb '11

Hi, While I am doing testing of my RADIUS client with multilingual characters consits in the username to check my multilingual support module. At that time I am using* FREE RAIDUS server*, I have attached all configuration files related to my setup with this mail. *username :* ∞ *password :* gameover I have sent the username after encoding username = ∞ that is 0xe2889e into UTF-8 that is 0xf8 0xb8 0xa2 0x9e to RADIUS server. But I am not able to authenticate user with the *FREE RAIDUS server*, who wants to login with the above credentials everthough there is not problem in UTF-8 encoded characters. So, Can you please help me out to resolve this issue or pointing me out if i am going in some wrong way by looking into the config file attached. I have also attached the error log of the RADIUS server and wireshark output with this mail. Regards, Karnik jain

3 3

Radius Client UDP port selection
by vijay s sheelavantar 04 Feb '11

04 Feb '11

Hello Friends, Now the radius client UDP port is selected randomly, Is there a way by which i can mention the server to use perticular UDP port  as client port. 1. Is there a way where i can configure port numbers for client and server?2. Or if i need to change the code then in which function i have to change? I want client udp port number should be greater than 32767. Kindly help me. Thanks and Regards,VIJAY S.

4 3

Question regarding nested WiMAX TLV formatting
by Adrien Demarez 04 Feb '11

04 Feb '11

Dear all, I wish to deploy FreeRadius on a WiMAX setup, and I need a modern version of FreeRadius in order to use WiMAX-Packet-Flow-Descriptor-v2 and nested TLVs (according to http://freeradius.1045715.n5.nabble.com/Sub-TLV-s-td3336559.html, I should use the git/2.2 version of FreeRadius - which I did compile and run successfully). My question is about how to configure/describe/format the nested TLVs in the reply (not in the dictionary), either in the "users" file or in the MySQL tables (e.g. in "radgroupreply"). Indeed, in the following example : how can I express the fact that the WiMAX-PFDv2-Packet-Data-Flow-Id attribute is *inside* the WiMAX-Packet-Flow-Descriptor-v2 ? what should I put in the "value" field for "WiMAX-Packet-Flow-Descriptor-v2", since the real "value" is constituted by the following TLVs ? How can I say "end-tlv" at some point so that the "Some-other-attribute" is no longer inside WiMAX-Packet-Flow-Descriptor-v2 but is at the root level ? INSERT INTO `radgroupreply` (`id`, `groupname`, `attribute`, `op`, `value`) VALUES (1, 'Gold', 'WiMAX-Packet-Flow-Descriptor-v2', ':=', '??') (2, 'Gold', 'WiMAX-PFDv2-Packet-Data-Flow-Id', ':=', '1') # inside the first one ... (100, 'Gold', 'Some-other-attribute', ':=', 'foobar') Best regards, -- Adrien Demarez

2 1