- Freeradius-Users - lists.freeradius.org

The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c
by 李立明 14 Jun '10

14 Jun '10

Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help ----------------

2 1

Re: Problem running 'radiusd -X'
by Zhouhuai Shen 13 Jun '10

13 Jun '10

Hi, >>> I have a problem running the 'radiusd -X'. The error messages are as the following: >>default new install from source? the EAP part needs some certs being made.....see >>this bit: >>> make_cert_command = "/etc/raddb/certs/bootstrap" >>this runs /etc/raddb/certs/bootstrap script to make some temporary basic/fake >>certs for testing. perhaps the user/group that radiusd is being run as cannot >>run the script. >>run the script manually and see what happens I have manually run the script, looks better. But when I run the 'radiusd -X' again, other errors appear: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error loading randomness rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. } } Can you please advise me again what's the problem? Cheers, Henry _________________________________________________________________ Want to be a Space Travel Agent? If it exists, you'll find it on SEEK http://clk.atdmt.com/NMN/go/157639089/direct/01/

2 1

Conditions for executing module
by Mindaugas Riauba 13 Jun '10

13 Jun '10

Hello, FR 2.1.9 and novice in FR module programming. :) How to define some conditions in users/acct_users file when to use our module? It is quite heavy and we'd like to avoid its execution in as many cases as possible. I tried such configuration in users. Idea comes from http://freeradius.org/radiusd/doc/Autz-Type DEFAULT Auth-Type := Ourclient, Calling-Station-Id == "333" DEFAULT Auth-Type := Accept And adding this to sites-enabled/default: Auth-Type Ourclient { ourclient } But rlm_files complains about unknown value for Auth-Type. Should I just define this new Auth-Type in dictionary (then which range of values is for local use?) or there is more elegant solution? Regards, Mindaugas

2 2

Re: Freeradius-Users Digest, Vol 62, Issue 56
by lenard.smith＠gmail.com 12 Jun '10

12 Jun '10

Help Sent from my BlackBerry® by Boost Mobile -----Original Message----- From: freeradius-users-request(a)lists.freeradius.org Date: Sat, 12 Jun 2010 12:00:12 To: <freeradius-users(a)lists.freeradius.org> Subject: Freeradius-Users Digest, Vol 62, Issue 56 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c ( ??? ) ---------------------------------------------------------------------- Message: 1 Date: Sat, 12 Jun 2010 16:43:51 +0800 From: " ??? " <09120560(a)bjtu.edu.cn> Subject: The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c To: freeradius-users(a)lists.freeradius.org Message-ID: <MAVUSEBQQPRYQOASLDHPTQUMPLHW.09120560(a)bjtu.edu.cn> Content-Type: text/plain; charset="gb2312" Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help.

1 0

The question about #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c
by 李立明 12 Jun '10

12 Jun '10

Hi,all I find #define WIMAX2ATTR(x) ((24757 << 16) | (x)) in rlm_wimax.c, but I don`t understand its meaning. I appreciate your help.

1 0

attribute name manipulation
by Alexandre Chapellon 12 Jun '10

12 Jun '10

Hello, I want to remove some attribute from my access-accept messages regardless the value of this attribute. I tough I could use the "!*" but the wiki says it's not usable as a reply item. Further more "!*" is not present in unlang(5) if I try to use it freeradius says config file have a syntax error. How can i remove an attribute from the reply message (regardless of its value)? Additionnally I'd like to rename some attribute returned by the radreply query.... is there anything specific for this job or is it adding new attribute with the value of the previous one and then deleting the previous one? Regards. -- Alexandre Chapellon <alexandre.chapellon(a)mana.pf> Mana SAS

2 1

AD Auth - problem with some chars in user's DN
by Nelson Vale 12 Jun '10

12 Jun '10

Hi all, I've recently found a problem authenticating some users in AD (2003) when the user's Distinguish Names have one or more of the following characters: " ' ` (double quotes, apostrophe or grave accent), using freeradius 2.0.2 and 2.1.9 versions: "... [ldap] login attempt by "johndoe" with password "test123;" [ldap] user DN: CN=John "The Man" Doe,OU=students,DC=domain,DC=localal [ldap] (re)connect to 192.168.0.73:389:389, authentication 1 [ldap] bind as CN=John "The Man" Doe,OU=students,DC=domain,DC=localal/test123; to 192.168.0.73:389:389 [ldap] waiting for bind result ... [ldap] Bind failed with invalid credentials ..." ( the correct DN for this user is "CN=John "The Man" Doe,OU=students,DC=domain,DC=local" ) The rlm_ldap module is performing the user authentication using a DN that as two more characters as it should be (the "al" in the end), and the number of these extra characters is the same as the number of the occurrences of the characters described above. The characters that cause this problem are the ones from the src/lib/valuepair.c pairparsevalue() function (PW_TYPE_STRING type), and if they are removed from there the authentication will be processed successfully ( I know, if they are there there must be some reason ). I've managed to fix this in rlm_ldap by quoting the characters in the vp_user_dn->vp_strvalue, but I'm not sure if this will fix all the problems that can arise from this. Have anyone ever had such a problem? I know that it's a little unusual to have these characters in user's names but AD allows it ... Thx, Nelson Vale

2 4

howto use the attribute of "Access-Period"
by Spacelee 12 Jun '10

12 Jun '10

I set the value to 3600, but it says [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "3600" for attribute name "Access-Period" -- Spacelee

2 1

Re: LDAP groups
by Alan DeKok 12 Jun '10

12 Jun '10

Génaël VALET wrote: > I use LDAP groups for EAP-PEAP Authentication in wifi WPA context. For now, > I used a DEFAULT line in "users" file like this : > > DEFAULT ldap_1x-Ldap-Group != "radius" , Auth-Type := Reject > Reply-Message = "ACCES REFUSE" > > I have a LDAP Group named "radius" but I don't know howto permit another one > LDAP Group See "unlang". The LDAP group comparison has some oddities, unfortunately. authorize { ... if ((LDAP-Group == X) || (LDAP-Group == Y)) { # OK } else { update reply { Reply-Messages := "Access refuse" } reject } } Alan DeKok.

1 0

checking DN of user certificate
by Riccardo Veraldi 11 Jun '10

11 Jun '10

Hello, when using EAP-TLS I would like to check the DN of hte user certificate and in particulare I need to check the Locality (L) string to matcha particular string. Is it possible in some way ? thanks Rick

2 1