- Freeradius-Users - lists.freeradius.org

log request to Freeradius server from unknown client
by Yacuk 26 May '10

26 May '10

Hi, I'm trying to log request to my Freeradius server from unknown client... But i can see it only in debug mode :( here is debug(skipped some things) =============== freeradius -X FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/sqlippool.conf including configuration file /etc/freeradius/sql/mysql/ippool.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "test123" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = yes Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. =================================================== Ignoring request to authentication address * port 1812 from unknown client =========== Thanks for your answer!

3 2

rlm_perl version?
by Jan Zacharias 26 May '10

26 May '10

Hi! First off: thanks for releasing 2.1.9, great job! I'm trying to get the freenac check_mac perl script running and get this error: freeradius: symbol lookup error: /usr/lib/perl/5.10/auto/Fcntl/Fcntl.so: undefined symbol: Perl_Istack_sp_ptr Afaik this means that the embedded perl interpreter (rlm_perl) is too old for the perl libraries that are "use"ed in the check_mac script (aka rad2vmps). However I was unable to find out what version of libperl is required for rlm_perl to work. My freeradius version is 2.1.9, just compiled it. Perl verion is v5.10.1. If you tell me that I need perl v.5.8.x libraries, how can I tell freeradius to look for the libraries in a folder like /usr/lib/perl/5.8.x instead of the default. At least "libdir = /usr/lib/perl/5.8.x" in radiusd.conf does not do the trick,I already tried it this way. I want the the old perl libs only to be used by freeradius, not systemwide. Thanks for your help, Jan

6 11

RE: Freeradius-Users Digest, Vol 61, Issue 112
by Hanno Schupp 26 May '10

26 May '10

The reset put it back to 9.10.1 which might explain the lack of vpn connection. Would have been good to check the version after resetting and if in doubt reflashing with a newer version. -----Original Message----- From: freeradius-users-bounces+hanno.schupp=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+hanno.schupp=gmail.com@lists.freeradius.org ] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, 26 May 2010 9:17 p.m. To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 61, Issue 112 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..."

1 0

freeradius certificate noob doubt
by shirkavand 26 May '10

26 May '10

Hi There, Ok i am following the next tutorial in order to use certificates+freeRadius: http://deployingradius.com/documents/configuration/eap.html After executing: $ cd /etc/raddb/certs $ make Do i have to copy/paste any of the files created to the supplicant to make it work? Cheers

2 3

..::Hunt Groups::..
by Alfonso Alejandro Reyes Jiménez 26 May '10

26 May '10

Hi, I'm trying to restrict access to several users to an specific service (some users can access only our cisco devices and some others only the juniper devices) as far as we know we can use huntgroups for that. The thing is that there's no information about them, only if you are working with a database. Right now we can't install a database to work with the radius server because we don't own it. Do you have a tutorial, book or something that can help us with that configuration?? Thanks in advance. Alfonso.

4 6

Re: execute programme when receiving account packet
by Alan DeKok 25 May '10

25 May '10

Toure Mamadou wrote: > The program is execute but only for access-request. > Regards. See the 'accounting' section of raddb/sites-available/default

2 1

RE: execute programme when receiving account packet
by Toure Mamadou 25 May '10

25 May '10

Hi i've try exec { wait = yes program = "/bin/sh /opt/mytest %{User-Name}" input_pairs = request output_pairs = reply shell_escape = yes output = none } The program is execute but only for access-request. Regards. -----Message d'origine----- De : freeradius-users-bounces+mamadou.toure=vipnet.ci(a)lists.freeradius.org [mailto:freeradius-users-bounces+mamadou.toure=vipnet.ci@lists.freeradius.or g] De la part de Toure Mamadou Envoyé : lundi 24 mai 2010 22:06 À : freeradius-users(a)lists.freeradius.org Objet : execute programme when receiving account packet Hi, All i'd like to execute an external program when receiving an Accounting-Request. I've try exec ipoque { wait = yes program = "/bin/sh /opt/mytest %{User-Name}" input_pairs = request output_pairs = reply shell_escape = yes output = none packet_type = Accounting-Request } But the program is not execute even if I comment packet_type = Accounting-Request line (#packet_type = Accounting-Request). Can someone help me please. Regards. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

configuring proxy base on eap-type
by Fred MAISON 25 May '10

25 May '10

Hello freeradius-users, Is there any way to proxy freeradius unsupported eap-type to an external radius ? I have a working setup using inner-tunnel. If I understand correctly, in this case, inner-eap are tunneled to localhost on port 1814 by default. My goal is to have eap-juac (Juniper/Funk Software) tunneled to a Juniper UAC device. I try to avoid my actual proxy setup where a specific real is tunneled to UAC. The problem is that end-users can bypass UAC proxying by simply changing their domain identity ... Best regards Fred MAISON

3 6

radius connection and vrf
by Arjun Prasad 25 May '10

25 May '10

Hi, Can any body explain with example the meaning of "binding radius connection to a particular vrf". in what scenario it will be useful. Thanks, Arjun Prasad

1 0

about how to return some attributes only in Access-Accept packet
by weiwei fang 25 May '10

25 May '10

Hello, all! I want some attributes only sent back to users in Access-Accept packet, but won't appear in Access-Challenge packet? How could I do? Now I just add the attribute in MySQL database, however, it is also contained in Access-Challenge packet. Thanks a lot for your kindly help!

2 1