- Freeradius-Users - lists.freeradius.org

Re: ssh authentication failed problem use freeradius & pam_radius
by 小牧 11 May '12

11 May '12

Hello,Alan. Thank you for you response. Alan wrote: > This is an issue with PAM on the client machine. Some other module is doing password checking. When the password check fails, it re-sets the password to "INCORRECT". That password is then sent to the pam_radius module. Go fix the client so that the PAM modules don't change the password. My /etc/pam.d/sshd file contains the following settings: -bash-3.2# cat sshd #%PAM-1.0 auth sufficient pam_radius_auth.so debug auth include system-auth account sufficient pam_radius_auth.so account required pam_nologin.so account include system-auth password sufficient pam_radius_auth.so password include system-auth session sufficient pam_radius_auth.so session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so

2 1

ntlm and mysql
by Paolo Barbato 11 May '12

11 May '12

On a test deployment I've both mysql and ntlm (AD) configured. If I use EAP no problem to authenticate users on both backend. But…in the process to use a Cisco WLC captive portal I've verified that only sql works. If I add in users DEFAULT Auth-Type = ntlm_auth, then also AD users are authenticated, but not mysql ones. radiusd -X reports in this case: ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = ntlm_auth Instead in absence of DEFAULT Auth-Type = ntlm_auth in users, I logs : ==== rad_recv: Access-Request packet from host 150.178.3.53 port 55249, id=114, length=77 User-Name = "barbato" User-Password = "xxxxxxxxxxx" NAS-IP-Address = 150.178.33.105 NAS-Port = 1 Message-Authenticator = 0x122864a655b86ac6d24c76e360fac328 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "barbato", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "barbato" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> barbato [sql] sql_set_user escaped user --> 'barbato' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'barbato' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'barbato' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User barbato not found ++[sql] returns notfound ++? if (ok) ? Evaluating (ok) -> FALSE ++? if (ok) -> FALSE ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [barbato] (from client rfxnet1 port 1) Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> barbato attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated === radtest behave the same. So it's seems I miss something somewhere….any suggestion from the list ? Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

2 2

Volume Limit per user monthly
by yagizozen 11 May '12

11 May '12

Hello Guys, I am crazy about this freeradius and thank all of the developers who work for freeradius application. It is great that you are doing such an open source application for everyone who needs. I am reading everything that I found about anything related to FR. And I have a question :) Firstly let me tell that, if the answer of my question that I am going to ask is located in some doc or another place in documentation just link the doc name and I will read it if I did not so I do not consume your time. First of all, the GGSN (NAS), that FR is communication is a Huawei system. I manage to succeed limiting a user usage per day (with respect to session time) with the use of session-timeout AVP that is located in the ACCESS-ACCEPT packet sent to my huawei GGSN and GGSN understand that and try to reauthenticate after that value. But the thing that I want is to limit the volume of the usage of a user in a month with the use of the Acct-Input-Octets and Acct-Output-Octets AVPs. But I am having trouble with impelemnting this. I guess I need to generate a counter and this counter should count the Input and Output Octets located in the accounting section and if it is over the limit that I defined in the users file. Thank you inadvance. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Volume-Limit-per-user-monthly-tp568… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 7

freeradius GUI
by mimir 11 May '12

11 May '12

Do you know any other application that provides GUI for freeradius? I checked daloradius but it is not supported most of features. For example, I want to monitor freeradius alarms via GUI. Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius-GUI-tp5700219.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

wiki problems...
by Paolo Barbato 11 May '12

11 May '12

accessing http://wiki.freeradius.org return forbidden ------------------------------------------------------------------------------------------------ Paolo Barbato Consorzio RFX corso Stati Uniti,4 35127 Padova - Italy Network Administrator phone: +39 049 8295097 fax: +39 049 8700718 ------------------------------------------------------------------------------------------------

4 11

Attributes
by Shawky Skaff 11 May '12

11 May '12

Hi, In dialup admin, under the groups and users I have the option to add an attribute, however the option which I need is not in the list. The list provided is - Protocol - IP address - IP netmask - Framed-MTU - Compression Used - Service Type - Session Timeout - Idle Timeout - Port Limit - Lock Message The option which I need to add is Framed-Route, how can I do this? Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

2 2

Realms
by Shawky Skaff 11 May '12

11 May '12

Hi, I'm stuck on realms. Basically when I test a user with the realm name, the radius debug throws an error telling me "No such realm" How would I go about configuring a realm? I believe it's got something to do with proxy.conf? Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

1 1

How to exclude particular user from the logging
by dorje2007＠seznam.cz 10 May '12

10 May '12

Hi is it possible to exclude particular user to not being logged in the radius.log file ? I have some users that periodically connect and download config files from the routers and they filled the log quite a lot Thanks Pet

2 3

Prob web wiki.freeradius.org
by Torsten Lehmann 10 May '12

10 May '12

Hallo, http://wiki.freeradius.org/ (or faq) returns: Forbidden regards Torsten

8 11

FreeRadius as proxy with SoH support
by Tobias Berndes 10 May '12

10 May '12

Hello, how can i configure my freeradius server as a proxy to the master radius server in my network, but the freeradius server have to use SoH for Packetfence. Thank you! Tobi

2 1