- Freeradius-Users - lists.freeradius.org

Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory
by John 18 Mar '10

18 Mar '10

Hello, We want to setup freeRADIUS with Peap/MSCHAPv2 talk to Apple Open Directory. I found this option 'use_open_directory'. But looks we need to install freeRADIUS on the same machine with Open Directory.(https://lists.freeradius.org/pipermail/freeradius-users/2010-Feb… Do we have to run freeRADIUS on the same machine with OpenDirectory? Is there a work-around that we can run freeRADIUS seperate from OpenDirectory? Best. John

2 2

freeradius and vlan assignment
by omega bk 18 Mar '10

18 Mar '10

hi, assume that the switch does not support the "auth-fail" and has 2 vlan ( vlan inside and vlan outside ), is it possible in the users file to put a condition like: if (user belong to Ldap-group=inside) assign to vlan = inside else assign to vlan = outside is that possible ? thanks

2 2

framed-ip-address based on nas-ip-address
by power159 18 Mar '10

18 Mar '10

Hi , As there was a mistake in my previous email title and as I had big improvement in processing my problem I am sending a new email . As I said in previous email I want to configure freeradius to reply different framed-ip-addresses based on nas servers . I found following email in the archive which helped a lot : http://lists.cistron.nl/pipermail/freeradius-users/2009-January/msg00630.ht… the only problem that I have is if user is membership of 2 groups . freeradius is processing none of them ! even if both are matching ! but if I remove one of groups its working without any problem ! and assigning ip from ip pool read-groups is on here is my tables : select * from radcheck; +----+----------+---------------+----+--------+ | id | username | attribute | op | value | +----+----------+---------------+----+--------+ | 4 | test1 | User-Password | := | 123456 | +----+----------+---------------+----+--------+ select * from radgroupcheck; +----+-----------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+-------------+ | 1 | group1 | Nas-IP-Address | == | 192.168.1.5 | | 2 | group1 | Pool-Name | := | pool1 | | 3 | group2 | Nas-IP-Address | == | 192.168.1.6 | | 4 | group2 | Pool-Name | := | pool2 | +----+-----------+----------------+----+-------------+ select * from radusergroup; +----------+-----------+----------+ | username | groupname | priority | +----------+-----------+----------+ | test1 | group1 | 0 | | test1 | group2 | 0 | +----------+-----------+----------+ select * from radippool; +----+-----------+-----------------+--------------+-----------------+------------------+-------------+----------+----------+ | id | pool_name | framedipaddress | nasipaddress | calledstationid | callingstationid | expiry_time | username | pool_key | +----+-----------+-----------------+--------------+-----------------+------------------+-------------+----------+----------+ | 1 | pool1 | 90.90.90.1 | | | | NULL | | 0 | | 2 | pool1 | 90.90.90.2 | | | | NULL | | | | 5 | pool2 | 91.90.90.1 | | | | NULL | | 0 | | 6 | pool2 | 91.90.90.2 | | | | NULL | | | +----+-----------+-----------------+--------------+-----------------+------------------+-------------+----------+----------+

2 2

(no subject)
by Richie Lee 18 Mar '10

18 Mar '10

http://sagunnthecompany.com/TNJHLhOER9.html _________________________________________________________________ Stay in touch. http://go.microsoft.com/?linkid=9712959

1 0

Re: Talking to Windows 2003 AD
by Iain Grant 18 Mar '10

18 Mar '10

Thanks Alan, The double '==' in the ntlm_auth command was the culprit. Things are working today. p.s. I had already stripped the usernames and verified the password so that was fine. Iain Grant Linux System Administrator Scottish Crop Research Institute Date: Wed, 17 Mar 2010 17:23:37 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Talking to Windows 2003 AD To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20100317172337.GA16756(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Now when I go to the next step and enable this in /etc/raddb/modules/mschap > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username==%{%{Stripped-User-Name}:-%{User-Name:-None}} --domain=%{%{mschap:NT-Domain}:-OURDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" radiusd -X and show us at least that bit where that command is called. you have 2 == is your command. is that intentional? you are allowing usernames that havent been sanitised or are blank (none) - is that intentional? alan ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

1 0

Building modules in C++ modules
by Abu Marcose 18 Mar '10

18 Mar '10

Is it possible to build modules in C++ (g++ compiler)? I have taken the rlm_example.c file, renamed as cpp and then run make and I see some errors reported in the libradius header files. Before I spend time trying to figure out what the errors are, just wanted to make sure that this has been done before. Here are the errors reported in any case... g++ -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -DIE_LIBTOOL_DIE -I/home/marcose/Downloads/freeradius-server-2.1.8/src -I/usr/include -c rlm_grid.cpp -fPIC -DPIC -o .libs/rlm_grid.o In file included from /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:30, from rlm_grid.cpp:27: /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/libradius.h:160: error: expected type-specifier before ';' token /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/libradius.h:339: error: expected ')' before 'operator' /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/libradius.h:339: error: expected initializer before 'operator' In file included from /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:33, from rlm_grid.cpp:27: /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/conffile.h:94: error: expected ',' or '...' before 'template' In file included from rlm_grid.cpp:27: /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:246: error: declaration of 'home_server* auth_req::home_server' /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/realms.h:88: error: changes meaning of 'home_server' from 'typedef struct home_server home_server' /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:582: error: expected ')' before 'operator' /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:582: error: expected initializer before 'operator' rlm_grid.cpp: In function 'int grid_instantiate(CONF_SECTION*, void**)': rlm_grid.cpp:76: error: invalid conversion from 'void*' to 'rlm_grid_t*' rlm_grid.cpp: In function 'int grid_authorize(void*, REQUEST*)': rlm_grid.cpp:108: error: 'pairmake' was not declared in this scope make: *** [rlm_grid.lo] Error 1

2 3

RADIUS_CLIENT_MAX_WAIT does not work
by R C 18 Mar '10

18 Mar '10

Hi, I am testing my radius server with eapol_test that comes with the wpa_supplicant. If the radius server is down, I want the eapol_test to not give up trying to talk to the radius server. So, i set the parameter RADIUS_CLIENT_MAX_WAIT to 99999 seconds and the eapol_test timeout to 10000. But, still, it will stop just before the next client retransmit that is in 48 seconds. Is there any other parameter that i should modify? thanks for your help. Following is taken from src/radius/radius_client.c from wpa_supplicant. /* Defaults for RADIUS retransmit values (exponential backoff) */ #define RADIUS_CLIENT_FIRST_WAIT 3 /* seconds */ #define RADIUS_CLIENT_MAX_WAIT99999 /* seconds */ #define RADIUS_CLIENT_MAX_RETRIES 10 /* maximum number of retransmit attempts * before entry is removed from retransmit * list */ #define RADIUS_CLIENT_MAX_ENTRIES 30 /* maximum number of entries in retransmit * list (oldest will be removed, if this * limit is exceeded) */ #define RADIUS_CLIENT_NUM_FAILOVER 4 /* try to change RADIUS server after this * many failed retry attempts */ Thanks, RC.

1 0

Automatic Radius Accounting when Authenticated
by Teguh Kurniawan 18 Mar '10

18 Mar '10

Hi, Is possible in FR 2.x doing automatic accounting when client is authenticated. Thank's Teguh Kurniawan

3 5

Invitation to connect on LinkedIn
by Badrul Anuar 17 Mar '10

17 Mar '10

LinkedIn ------------Badrul Anuar requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Badrul Accept invitation from Badrul Anuar http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… View invitation from Badrul Anuar http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… ------ (c) 2010, LinkedIn Corporation

1 0

Reduce debug output in eapol_test
by R C 17 Mar '10

17 Mar '10

hi, does any one know how to reduce or completely remove debug output when an eapol_test is run? this is for performance reasons. thanks in advance for your help. rc.

2 1