- Freeradius-Users - lists.freeradius.org

Debug option to view generated key
by Vineet Verma 24 Aug '10

24 Aug '10

Does FreeRADIUS offer a debug option that displays the key generated during EAP-TLS (or the unencrypted MPPE keys sent out)? I understand this would be a security risk in a live network but it would be helpful for debugging issues found in the lab. Thanks, Vineet

2 1

Screwy RHEL problem
by Daniel Davidson 23 Aug '10

23 Aug '10

I am migrating our system to freeradius2, I have a test environment that works well on my fedora system that I am moving to a new server. I can authenticate with the server perfectly if I start the server using radiusd -X, however if I then cancel that and run it with the RHEL startup script it doesnt work. I messed with the startup script so that it would run with -X, and noticed my problem right away. If I run the raidusd -X from command line it loads the ldap module, when I run the script, it doesnt load the ldap module. I see no reason for this to happen, does anyone have any experience with this problem? If so, what is the solution? I double checked the permissions and they should be correct. thanks, Dan [root@radius modules]# radiusd -X FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Dec 30 2009 at 13:46:28 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ ... including configuration file /etc/raddb/modules/ldap ...... successful auth [root@radius modules]# /etc/init.d/radiusd start Starting RADIUS server: FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Dec 30 2009 at 13:46:28 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ .... no ldap line ..... failed auth

1 1

Filter multivalued attributes in rlm_sql
by JUND, Aurélien 23 Aug '10

23 Aug '10

Dear All, I would like to filter the Callback_Number in order to use it for my mysql authorisation request When I use : sql_user_name = "%{reply:Callback-Number}" I always get the first value of the Callback-Number, but I would like to use only the one starting with "TEST=". Is there a way to filter a multivalued atytribute to use it for the sql_user_name? Logs: #Here I fetch the ldap directory where is store the attributes Jul 12 12:23:02 radius-wifi1-aub freeradius[7990]: [ldapClear] looking for check items in directory... Jul 12 12:23:02 radius-wifi1-aub freeradius[7990]: rlm_ldap: SFRuserPassword -> Cleartext-Password == "xxx" Jul 12 12:23:02 radius-wifi1-aub freeradius[7990]: rlm_ldap: SFRlogin -> User-Name == "toto" Jul 12 12:23:02 radius-wifi1-aub freeradius[7990]: [ldapClear] looking for reply items in directory... #As the attribute I search is multivalued I used the += operator to get all the values Jul 12 12:23:02 radius-wifi1-aub freeradius[7990]: rlm_ldap: SFRserviceId -> Callback-Number =~ "ID=728277507" Jul 12 12:23:02 radius-wifi1-aub freeradius[7990]: rlm_ldap: SFRserviceId -> Callback-Number =~ "TEST=0603079410" Jul 12 12:23:02 radius-wifi1-aub freeradius[7990]: rlm_ldap: SFRserviceId -> Callback-Number =~ "REF=1020589" Jul 12 12:13:28 radius freeradius[7915]: rlm_ldap: login -> User-Name == "toto" Jul 12 12:13:28 radius freeradius[7915]: [ldapClear] looking for reply items in directory... Jul 12 12:13:28 radius freeradius[7915]: rlm_ldap: serviceId -> Callback-Number =~ "ID=728277503" Jul 12 12:13:28 radius freeradius[7915]: rlm_ldap: serviceId -> Callback-Number =~ "TEST=603075433" Jul 12 12:13:28 radius freeradius[7915]: rlm_ldap: serviceId -> Callback-Number =~ "REF=1020197" +++[ldapClear] returns ok Jul 12 12:23:02 radius-wifi1-aub freeradius[7990]: [sql_crm_abv] #011expand: %{reply:Callback-Number} -> ID=728277503 #for the return of sqlècrm_abv I would like to get %{reply:Callback-Number} -> TEST=0603079410

2 2

Radius relay the request to another one if there is an access-reject
by Gregory Bellier 23 Aug '10

23 Aug '10

Hi all! I need to set up something and I would like your opinion on how to do it. Freeradius (v2.1.8) asks kerberos/ldap to authenticate and authorize. What I want to do is if a Radius doesn't find anything (meaning access-reject) then it asks another Radius located at another host. Therefore Radius would relay the request. I started looking into this and I think I could do this somehow by configuring Radius as a proxy. Do you agree if this is the correct way to do? Feel free to let me know if you have some inputs which could help me. Regards, Gregory.

1 0

pam auth_radius and user database / session close error message
by Chris Berger 23 Aug '10

23 Aug '10

Hi, I'm using pam_auth_radius PAM module to authenticate against an RSA SecurId radius server. It works fine but I need to pre-create the users on the system. I was wondering if it's possible to use the LDAP directory for the valid user accounts. I'm under linux Debian/Lenny. I tried to define pam_ldap in /etc/pam.d/common-account : account sufficient pam_ldap.so and leave the common-auth use radius (also session) auth sufficient pam_radius_auth.so debug but it does not seem to work. I may miss something. Theorically i think it's possible, isn't it? Other little problem with the pam_auth_radius module, when restricting persissions on the /etc/pam_auth_radius.conf file (shared secret for RADIUS server), I get this message when closing the session : pam_close_session: Cannot make/remove an entry for the specified session details : Aug 20 14:57:09 debian su[11840]: pam_unix(su:session): session opened for user chris by root(uid=1001) Aug 20 14:57:10 debian su[11840]: pam_radius_auth: Could not open configuration file /etc/pam_radius_auth.conf: Permission denied Aug 20 14:57:10 debian su[11840]: pam_unix(su:session): session closed for user chris Aug 20 14:57:10 debian su[11840]: pam_close_session: Cannot make/remove an entry for the specified session I think it's needed to contact the radius server for accounting, but it is not a secure configuration, even if using one time passwords Thanks for your help, Chris

1 0

(no subject)
by green green 23 Aug '10

23 Aug '10

http://hayesqeci.carpettediem.fr/fipugo.html Protect YourBe dDesir e Ovecrome ro'ds sofftness Your doze of male energy

1 0

Freeradius username, password + MAC address auth
by ziko 23 Aug '10

23 Aug '10

Hello. I am running freeradius 2.1.7 server on my Centos. I am using mysql database. everything works ok! I am using username password method for auth, but now i want to add mac address auth method too. I want Radius server checks username, password and MAC addresses at the same time when the user authenticate. How can i do this? I am using mikrotik as nas.

1 0

radiusclient configuration file format
by Murray Long 23 Aug '10

23 Aug '10

Hi All, Where can I find documentation on the format file format required by the radiusclient command? Thanks, Murray

1 0

Supplicant for Windows (XP, Vista and W7)
by rrperez 23 Aug '10

23 Aug '10

Hi, Does anyone knows a supplicant that might work on windows platforms such as XP, Vista and Windows 7? -- View this message in context: http://old.nabble.com/Supplicant-for-Windows-%28XP%2C-Vista-and-W7%29-tp294… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 7

Multiple ip range
by Student University 23 Aug '10

23 Aug '10

can please help me of how i can configure multiple ip address range for multipe groups of users . my scenario like this : user group A should receive ip from Range 1 user group B should receive ip from Range 2 Thanks In advance ...

3 4