- Freeradius-Users - lists.freeradius.org

Authenticate computers with their hostnames
by Difan Zhao 19 Apr '10

19 Apr '10

Good afternoon, Sorry to bother you guys again! I am trying to authenticate Windows XP PCs (sp2) with their hostnames. It looks like PC will try to use its hostname (in format host/<computer_name.domainname>) to authenticate when no user is logged in. I configured the "users" file and also the post-auth section of "default" file to force accepting the request. In the debug it shows it does accept and send back the response. I also captured the packets in the wireshark. However the NAS (Cisco 3750 switch with newest firmware) doesn't take it and simply ignored it and send the request again. It repeated three times and eventually failed... Users file: host/neteng-sp1.gtcorp.com Auth-Type := Accept Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = "3", Tunnel-Preference = 0x000000 Sites-available/default file: post-auth { ... if(request:User-Name == "host/neteng-sp1.gtcorp.com"){ update reply { Auth-Type := Accept Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = 3 Tunnel-Preference = 0 } } ... } Actually it doesn't look like it's Freeradiusd's problem since it did send back the response. It's the NAS which doesn't process the reply... However does anybody know why? Did I miss any attributes? Anyway to work around this problem? Alan, I think you told me once that it's not easy to fool the NAS to accept all requests... Is this one of the case we are talking about?? Thank you and have a good weekend! Difan Zhao Network Engineer difan.zhao(a)guest-tek.com www.guest-tek.com <http://www.guest-tek.com/> Office: 403-509-1010 ext 3048 Cell: 403-689-7514 Guest-tek(tm) delivers broadband networking solutions to businesses serving mobile users. Our products provide fast and easy plug-and-play Internet access, IP Video-on-Demand, and Voice over IP to end users. Through our superior implementation and support services, our partners gain a sustainable competitive edge. With headquarters in Calgary and Irvine, Guest-tek(tm) has been serving hospitality and related industries since 1996. The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

2 2

FAQ
by Jonathan Hutchins 19 Apr '10

19 Apr '10

Thanks to whoever fixed the FAQ!

1 0

Win PPP auth in Debian
by Jonathan Hutchins 19 Apr '10

19 Apr '10

This feels like trying to set up NORAD just to catch a baseball.

1 0

3GPP2-Prepaid-Acct-Quota
by Alexander 19 Apr '10

19 Apr '10

Dear all, after solving my 'check user traffic quota at login time' problem I try to take the next step and disconnect active sessions if user's traffic limited is exceeded. My Cisco LNS supports 3GPP2 VSA attributes. Therefore I took a look at 3GPP2-Prepaid-Acct-Quota AKA cdma-prepaid-accounting-quota. AFAIK FR does not support 3GPP but does its features suffice to achieve what I described above? If not, are there other ways to disconnect an active user from an Cisco LNS based on RADIUS attributes and user traffic quota? I would like to avoid another script and radkill if possible. Are there best practices to do this? Cheers, Alexander

2 2

FR 2.1.8 + dialup admin: Online users
by Alexander 19 Apr '10

19 Apr '10

Dear all, I am having troubles with user_finger.php3 because "Online users" do not show up. Problem is that there are no entries in radacct with 'AcctStopTime'. Entries show up in my radacct table when the user session ends and a AcctStopTime gets logged. But then the user is not online anymore ;-) Any ideas? Cheers, Alexander

1 0

FreeRadius 2.1.8 doesn't compile under Cygwin 1.7.5 `_lt_libltdl_LTX_preloaded_symbols'
by José Manuel Jiménez Ramírez 19 Apr '10

19 Apr '10

Trying to build FreeRadius from Cygwin I always have the same compilation error: gcc .libs/radiusd.def .libs/radiusdS.o -o radiusd.exe .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /freeradius-server-2.1.8/src/lib/.libs/libfreeradius-radius.a -lws2_32 -lresolv -lpthread -lcrypt /usr/lib/libltdl.dll.a -lssl -lcrypto /usr/lib/gcc/i686-pc-cygwin/4.3.4/../../../../i686-pc-cygwin/bin/ld: warning: --export-dynamic is not supported for PE targets, did you mean --export-all-symbols? .libs/modules.o: In function `setup_modules': /freeradius-server-2.1.8/src/main/modules.c:1358: undefined reference to `_lt_libltdl_LTX_preloaded_symbols' collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Error 1 make[4]: Leaving directory `/freeradius-server-2.1.8/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/freeradius-server-2.1.8/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/freeradius-server-2.1.8/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/freeradius-server-2.1.8' make: *** [all] Error 2 I think that there are some problems with libtool and libltl, then searching in the mail list I made the changes said by Alan Dekok, in the src file 'freeradius-server-2.1.8\src\main\modules.c', Adding: #define lt__PROGRAM__LTX_preloaded_symbols \ lt_libltdl_LTX_preloaded_symbols And in the Make.inc: Update CFLAGS to add -DIE_LIBTOOL_DIE But always obtain the same compilation error. I need to use a FreeRadius version which supports Sha256 as the certificate signature Any help would be fantastic. I need to use FreeRadius under Cygwin and there isn´t a lot of information in the mailing list. Thanks, Jose Manuel

1 0

Compiling rlm_perl on Solaris 10
by Dean, Barry 19 Apr '10

19 Apr '10

I have been having problems compiling rlm_perl on Solaris 10 Intel and have spent days googling for an answer. Most answers say: "use --without-rlm_perl", which is not much use when you actually *need* it! Here is what I did to solve it, hopefully this will save someone some pain: Firstly, my source that built without rlm_perl fine on 9th April 2010, stopped compiling on 16th April 2010 after some Solaris patches! I got an error telling me that ltdl.h was not found. This is fixed by defining CFLAGS in the environment before the ./configure stage: setenv CFLAGS -I/<path to freeRADIUS source>/libltdl (C shell type shells) CFLAGS="-I/<path to freeRADIUS source>/libltdl" ; export CFLAGS (sh shells and derivatives) Over hurdle one! What caused this I still have no idea. Now you have to do: ./configure --with-static-modules=perl When that is complete, you have to edit <path to freeRADIUS source>/src/main/Makefile> and locate the line: MODULE_LIBS = $(STATIC_MODULES) and edit it to include the path to your DynaLoader.a for your version of Perl, mine was as below: MODULE_LIBS = $(STATIC_MODULES) /usr/perl5/5.8.4/lib/i86pc-solaris-64int/auto/DynaLoader/DynaLoader.a Now build the source with make. It should compile! Over hurdle two... Before you can now run radiusd, you will need to do what it says at the end of the make, and add a library path to LD_LIBRARY_PATH so libperl.so can be found, mine was: setenv LD_LIBRARY_PATH ${LD_LIBRARY_PATH}:/usr/perl5/5.8.4/lib/i86pc-solaris-64int/CORE and it all comes together and you get a radiusd with rlm_perl that actually runs.. Over the last hurdle! All I have to do now is write some clever Perl, figure out where to call it and I will be on the home straight! Best of luck to other Solaris users... ---------------------- Barry Dean Principal Programmer/Analyst Networks Group Computing Services Department

1 0

overwrite ldap dynamic vlan assigment
by Marc Boisis-Delavaud 19 Apr '10

19 Apr '10

Hello, For all of my ssid, I use dynamic vlan assigment according to ldap attribute. -> rlm_ldap: radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 = "4" Now , only with eduroam ssid , I want to staticly assign a new vlan. This is what I want : if Cisco-AVPair = "ssid=eduroam" then Tunnel-Private-Group-Id:0 = "40" What is the best method to do it ? Merci de penser à la planète! N'imprimez pas inutilement les documents transmis par courrier électronique. ----------------------------------- Marc Boisis-Delavaud tel: 05 46 45 82 14 Centre de Ressources Informatiques (http://cri.univ-lr.fr) Université de La Rochelle -----------------------------------

1 0

Passwords in cert
by Peter Carlstedt 19 Apr '10

19 Apr '10

Hello everyone, was wondering if I can use different passwords when making the certs for ca.cnf, server.cnf & client.cnf? What i mean is if it has to be the same password in "output_password" & "input_password" for all of the files? Best regards/ Peter Carlstedt _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

1 0

Dear freeradius-users@list.xs4all.nl SALE #592160
by VIAGRA INC 19 Apr '10

19 Apr '10

1 0