- Freeradius-Users - lists.freeradius.org

newbiie
by Khapare Joshi 29 Apr '12

29 Apr '12

I am just a new with freeradius. so please consider. This is what I am trying to do today. 1. installed pptpd server on centos 6 box, tested with chap-secert password and worked. 2. installed freeradius server to handle stuff like ip pool and authenticaton, and integrate with my existing openldap server for authentication. 3. I looked at the /etc/raddb/radiusd.conf but I do not see the the LDAP section 4. how can I integrate the my freeradius server to hook up with ldap server ? I followed this doc but got stucked. I am nearly there I think wiki.freeradius.org/PopTop any help, guide or tips would be great help. here are my versino of freeradius Installed Packages Name : freeradius Arch : x86_64 Version : 2.1.10 Release : 5.el6 Size : 5.5 M and client Installed Packages Name : radiusclient-ng Arch : x86_64 Version : 0.5.6 Release : 5.el6 Size : 102 k Repo : installed >From repo : epel Tell me what I am missing! Khapare

6 15

Re: Autoconf in Ubuntu
by newuse＠qip.ru 29 Apr '12

29 Apr '12

Thanks, but I really need the working autoconf: I am patching very old billing system: freenibs-2.2.3, it is rlm_sql-based module, so it seems working with new FR 2.x yet, but every new version of FR I need manually regenerate src/modules/rlm_nibs/rlm_nibs_mysql/configure from src/modules/rlm_nibs/rlm_nibs_mysql/configure.in and then patch src/modules/rlm_nibs/rlm_nibs_mysql/configure instead of just regenerating it.... my patches are available at http://forum.netbynet.ru/index.php?act=attach&type=post&id=67866 >> Hi all, it seems to be very old trouble, but I am not able to resolve it, I am regenerating src/modules/rlm_sql_mysql/configure >Why? >> Could you please help me to resolve trouble, btw, in FreeBSD ports all is OK, I have tried to find a patch of configure.in in my FreeBSD system, but failed (I am new to programming) >Don't break the software. >The "configure" scripts work. If you're new to programming, you have no business changing them. >Alan DeKok.

2 1

Proxy-State in a CoA proxied request
by Frédéric Gabut-Deloraine 29 Apr '12

29 Apr '12

Hello list, I run a very simple architecture for broadband access with 2 routers, 2 radius proxies and 2 radius home servers. On the side of this architecture I run a homemade script that sends PoD directly to the two routers and everything works fine. I would like to change the direct access to the routers and have all my radius messages go through the 2 proxies, including the PoD. I have upgraded in 2.1.12 because of a bug in CoA proxyfication and now the PoD are handled correctly, sent to the routers through the proxy ! But there is a problem : the two cisco routers don't support the Proxy-State attribute and send me a very clear message : fgabut@savon:~$ cat toto | radclient -x a.b.c.d:3799 disconnect toto1234 Sending Disconnect-Request of id 138 to a.b.c.d port 3799 NAS-IP-Address = x.x.x.x User-Name = "xxx(a)nautile.nc" rad_recv: Disconnect-NAK packet from host a.b.c.d port 3799, id=138, length=47 Reply-Message = "No Matching Session" Error-Cause = Invalid-Request The debug message I have on the router is : Apr 28 23:42:29.980: POD: a.b.c.d Unsupported attribute type 33 for component Apr 28 23:42:29.980: POD: a.b.c.d user xxx(a)nautile.nc 0.0.0.0 sessid 0x0 key 0x0 DROPPED Apr 28 23:42:29.980: POD: Added Reply Message: No Matching Session Apr 28 23:42:29.980: POD: Added NACK Error Cause: Invalid Request Apr 28 23:42:29.980: POD: Sending NAK from port 1700 to a.b.c.d/1814 I can't find any option to not use the attribute 33 (Proxy-State) in the process of matching the session on the router. So I guess the only solution left is to filter the Proxy-State directly on the exit of the radius proxy. The RFC3576 states that : When using a forwarding proxy, the proxy must be able to alter the packet as it passes through in each direction. When the proxy forwards a Disconnect or CoA-Request, it MAY add a Proxy-State Attribute, and when the proxy forwards a response, it MUST remove its Proxy-State Attribute if it added one. So I was wondering if there were any option to disable the add of the attribute Proxy-State when the radius server proxyfies a CoA request ? I think that the usual attr filter method won't fit there. Thanks in advance, Best regards, -- Frederic Gabut-Deloraine Network Engineer NEO TELECOMS - AS8218 21 rue La Boetie 75008 Paris Tel : +33 1.49.97.07.47 Mob : +33 6.15.07.10.30 skype : fgabutdeloraine

2 3

Autoconf in Ubuntu
by newuse＠qip.ru 29 Apr '12

29 Apr '12

Hi all, it seems to be very old trouble, but I am not able to resolve it, I am regenerating src/modules/rlm_sql_mysql/configure file by deleting src/modules/rlm_sql/drivers/rlm_sql_mysql/configure and then regenerating configure file by executing autoconf in src/modules/rlm_sql/drivers/rlm_sql_mysql/ directory under Ubuntu 10.04, but configuration fails with the following error: [code] === configuring in ./drivers/rlm_sql_mysql (/home/alex/crsc/fr_server_2_1_x/src/modules/rlm_sql/./drivers/rlm_sql_mysql) configure: running /bin/sh ./configure '--prefix=/usr/local' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. configure: WARNING: unrecognized options: --enable-ltdl-install ./configure: line 2802: syntax error near unexpected token `mysqlclient_r,' ./configure: line 2802: ` FR_SMART_CHECK_LIB(mysqlclient_r, mysql_init)' configure: error: ./configure failed for ./drivers/rlm_sql_mysql configure: error: ./configure failed for src/modules/rlm_sql [code] Could you please help me to resolve trouble, btw, in FreeBSD ports all is OK, I have tried to find a patch of configure.in in my FreeBSD system, but failed (I am new to programming) I am using FR v2.1.x branch Best regards, NewUse.

2 1

Fabricio Flores quiere chatear contigo.
by Fabricio Flores 28 Apr '12

28 Apr '12

----------------------------------------------------------------------- Fabricio Flores quiere seguir manteniendo el contacto contigo a través de algunos de los productos más interesantes y novedosos de Google. Si ya tienes Gmail o Google Talk, visita: http://mail.google.com/mail/b-fbcf0f8abf-45797e5848-dnMz7RCtO-rb8mdoRBPFTjR…. Tendrás que hacer clic en este enlace para chatear con Fabricio Flores. Para obtener Gmail, una cuenta gratuita de correo electrónico de Google con más de 7.500 megabytes de almacenamiento, y chatear con Fabricio Flores, visita: http://mail.google.com/mail/a-fbcf0f8abf-45797e5848-dnMz7RCtO-rb8mdoRBPFTjR…. Gmail ofrece: - mensajes instantáneos desde Gmail, - protección sólida contra el spam, - función de búsqueda integrada para buscar tus mensajes y un sistema muy útil para organizarlos en conversaciones, - ausencia de anuncios emergentes y de banners no orientados, - solo anuncios de texto e información relacionada relevantes según el contenido de los mensajes. Disfruta de todas estas funciones totalmente gratis. Pero todavía hay más. Si creas una cuenta de Gmail tendrás acceso a Google Talk, el servicio de mensajería instantánea de Google: http://www.google.com/talk/intl/es/ Google Talk ofrece: - servicio de chat basado en web que puedes usar desde cualquier lugar, sin descargar ninguna aplicación, - lista de contactos que se sincroniza con la de tu cuenta de Gmail, - llamadas de voz entre equipos gratuitas y de gran calidad (debes descargar el cliente Google Talk). Estamos trabajando muy duro para poder añadir funciones nuevas e incorporar mejoras, por lo que quizás te pidamos que nos hagas llegar tus comentarios y tus sugerencias de vez en cuando. Gracias por hacer que nuestros productos sean aún mejores. Gracias, El equipo de Google Para obtener más información sobre Gmail y sobre Google Talk, visita: http://mail.google.com/mail/help/intl/es/about.html http://www.google.com/talk/intl/es/about.html. Si las URL de este mensaje no funcionan, cópialas en la barra de direcciones del navegador.

1 0

Access requests logging to SQL: How to save comments for rejected requests?
by George Koulyabin 28 Apr '12

28 Apr '12

Hi. I am using FreeRADIUS 2.1.12. I tried to save results of process access requests to SQL database using postauth_query. I used 'Module-Failure-Message' attribute as a comment for rejected requests. The message 'rlm_pap: CLEAR TEXT password check failed' drops to database when password is wrong, for example. But attribute 'Module-Failure-Message' ( and attribute 'Module-Success-Message') is empty when user not found, for example. And other reasons may be. How can I save comments for rejected requests?

2 8

Re: Radacct empty
by addis 28 Apr '12

28 Apr '12

I got the configuration and now it is working. RADACCT table is getting populated. But IM still facing a problem. Online Users in Dialup_admin is not showing me anything. Any help would be appreciated. Rgrds, -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radacct-empty-tp5670009p5672341.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

setup question...
by Chris Morris 27 Apr '12

27 Apr '12

> Greetings All! > > We have set up Radius on OS X 10.6 Server running OD for use with several devices, including a Sonic Wall, and Ruckus WAPs. We have gotten everything working very nicely, but we would love to be able to include a small group of Windows users running on AD, so they can also use their network Credentials to access the WAP etc. > > The main question is - Is it possible for FreeRadius (the OS X 10.6 version) to authenticate against both OD and AD? > And the second question is obviously... how? > > Thanks in advance for your time!! Please reply directly, as I am not subscribed to the list... > > Chris Morris > Nashville, TN > > > ------------------------------ > > Hi, > >> Thanks in advance for your time!! Please reply directly, as I am not subscribed to the list... > > no answer then...and such answers from others should also be on this list to help > others and the community. > > alan Alan, that is what CC is for. Turns out however, that you have to be subscribed or your email will be rejected, so I am subscribed now if that is what you were worried about. So anyway, my original question is above if you're up for answering. Thanks again, -C

2 1

Re: Help: PAP with Sha1
by Alan DeKok 27 Apr '12

27 Apr '12

vishal_nitr wrote: > This is what I am looking for. What is the place where RADIUS does > decrypt operation. You were told to NOT ask programming questions on this list. ... >> I tried changing few things in lib/radius.c to SHA1 but with no >> success. You clearly want to do programming. I've taken the liberty of unsubscribing you. This list is NOT the place to ask these questions. Your question is likely from a school course. If so, do the work yourself. Or, your question is because of some commercial needs. If so, pay someone to do the work, or get someone competent to do it for you. This is the *FreeRADIUS* list. You are not asking questions about FreeRADIUS. Therefore, your questions do not belong here. Alan DeKok.

5 12

OT: Windows 8 beta supplicant always prefixes computer name to user name
by Martin Pauly 27 Apr '12

27 Apr '12

Hi all, sorry, this is much OT. As many, we do PEAP with the help of ntlm_auth, both wired and wireless. Today, my first Windows 8 user walked in, wanting to do wired 802.1X. Setting things exactly as in Windows 7 results in the computer name always showing up as (pseudo-)domain in the authentication dialog. It's visible, but not changable. Subsequently, what I see in the server is (real names replaced): rad_recv: Access-Request packet from host 192.168.4.249 port 1645, id=98, length=161 User-Name = "PCNAME\\username" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-11-BB-A7-94-8D" Calling-Station-Id = "F0-BF-97-D1-97-53" EAP-Message = 0x02010011014d455048495c426162616569 Message-Authenticator = 0x882ea6dd7bcb0c978b71d1da77ce7753 NAS-Port-Type = Ethernet NAS-Port = 50211 NAS-Port-Id = "FastEthernet2/0/11" NAS-IP-Address = 192.168.4.249 username is not Windows' local username, cf. last part of http://www.uni-marburg.de/hrz/internet/students/swh-en/anleitung-en/vista-u… TIA, Martin -- Dr. Martin Pauly Phone: +49-6421-28-23527 HRZ Univ. Marburg Fax: +49-6421-28-26994 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

1 1