- Freeradius-Users - lists.freeradius.org

Wildcard username
by Nalin Mistry 12 Jan '10

12 Jan '10

I am interested in configuring a wildcard username for authentication of request from a specific NAS. Is this feasible from the Web portal or do I need to add an entry in one of the conf files. Any help would be appreciated including examples how one would go about doing this.

1 0

My Static IP Client conf. not work
by Tevfik Ceydeliler 12 Jan '10

12 Jan '10

Hi Adrian, I change the operator for Framed IP Address and Netmask. But nothing changed. Client get Access-Accept but no IP address assigned. I check it with "ipconfig" Regards... Tevfik Ceydeliler -----Original Message----- From: freeradius-users-bounces+tevfik.ceydeliler=astron.yasar.com.tr(a)lists.freeradius.org [mailto:freeradius-users-bounces+tevfik.ceydeliler=astron.yasar.com.tr@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, January 11, 2010 6:59 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 57, Issue 31 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: My Static IP Client conf. not work (Adrian Boros) 2. Re: rlm_sqlippool required? (John Dennis) 3. NT/LM password from LDAP (PAP works, MSCHAP doesn't). (Lech Karol Paw?aszek) ---------------------------------------------------------------------- Message: 1 Date: Mon, 11 Jan 2010 09:38:18 -0500 From: "Adrian Boros" <adrian(a)dsl4u.ca> Subject: RE: My Static IP Client conf. not work To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <0fc901ca92cb$b789fad0$269df070$@ca> Content-Type: text/plain; charset="us-ascii" Hello Tevfik, Try changing the operator from == to := when assigning the Framed IP and Framed Netmask. I would also recommend it for others but you're better off reading the following link which should give you an understanding of the operators in use: http://wiki.freeradius.org/Operators Best regards, Adrian Boros -----Original Message----- From: freeradius-users-bounces+adrian=dsl4u.ca(a)lists.freeradius.org [mailto:freeradius-users-bounces+adrian=dsl4u.ca@lists.freeradius.org] On Behalf Of Tevfik Ceydeliler Sent: Monday, January 11, 2010 4:55 AM To: freeradius-users(a)lists.freeradius.org Subject: My Static IP Client conf. not work Hi, I have a client, when I put this client into an IP pool everything is ok. But when I move him for framed-Ip (static IP),he can't get that IP address. Note: I use a secovid as realm and NAS is Telecom Operator (For APN) I dont know what i should check. Can you help me to start? ################################################################# Here is the user configuration: FOR POOL --> tevfikceydeliler Service-Type == Framed-User,Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Pool-Name := BirmasGPRS For Static IP --> tevfikceydeliler Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Framed-IP-Address == 172.30.65.90, Framed-IP-Netmask == 255.255.255, Framed-MTU = 1500, Framed-Routing = None, Framed-Protocol = PPP, Service-Type = Framed, Fall-Through = Yes AND DEFAULTS --> DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP DEFAULT Auth-Type := Accept ################################################### Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 2 Date: Mon, 11 Jan 2010 11:38:31 -0500 From: John Dennis <jdennis(a)redhat.com> Subject: Re: rlm_sqlippool required? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4B4B5407.8060901(a)redhat.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 01/09/2010 04:33 PM, John Kane wrote: >> John Kane wrote: >>> Is the rlm_sqlippool required when allocating IPs from an SQL DB? >> >> Yes. >> >>> I am >>> trying to set this up on a 1.1.3 install, and don't see that module. >> >> Install 2.1.8. >> >> Alan DeKok. >> - > > Thanks Alan, unfortunately I am chained to Red Hat RPMs on this project, > and their latest is 1.1.3 without the rlm_sqlippool module. I pulled > the 1.1.3 down from the FreeRADIUS site, and it has that module (maybe > our RH friend John Dennis can explain to me why it is on the FR site but > not the RH RPM, and if I should open a ticket to RH to get it added). More current versions of FreeRADIUS than 1.1.3. are available for RHEL 5 and CentOS5, see: http://wiki.freeradius.org/Red_Hat_FAQ The latest build for RHEL5 is 2.1.7, I'll be adding 2.1.8 shortly. Note these are not official builds. We anticipate 2.1.7 will show up as an official build in the RHEL 5.5 update under the package name freeradius2. 2.1.8 was released after the cut off date, thus RHEL 5 will only have 2.1.7 and 1.1.3. As for why 1.1.3 didn't ship with rlm_sqlippo0l (it does ship with rlm_ippool) I can't tell you, it was before my time. If you would like to open a bug against the 1.1.3 RHEL 5.5 version please contact your support TAM. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ ------------------------------ Message: 3 Date: Mon, 11 Jan 2010 17:58:50 +0100 From: Lech Karol Paw?aszek <ike(a)szluug.org> Subject: NT/LM password from LDAP (PAP works, MSCHAP doesn't). To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4B4B58CA.8070706(a)szluug.org> Content-Type: text/plain; charset="utf-8" Hello. I've working FreeRADIUS installation for 802.1x authentication and authorization using EAP-TLS with passwords - NT/LM hashes - stored in LDAP. And it works nice. Right now I'm deploying (yes. at this particular moment!) IPsec/L2TP VPN which will be utilizing RADIUS via ppp connection. And for PAP it works nice. However MSCHAP doesn't want to work. I'm kinda lost because EAP connection uses MSCHAP(v2) as well and this one works flawlessly. ;-) Am I missing something? I believe it should work. Or it cannot? I've attached FreeRADIUS' logfile. Any pointers/hints much appreciated. Kind regards, -- Lech Karol Paw?aszek <ike> "You will never see me fall from grace" [KoRn]

2 1

Mysql database
by Noro Hasina 12 Jan '10

12 Jan '10

Hi all! I'm a project aim to take in place an hot spot with freeradius. I've installed freeradius with source in the freeradius web site, Now, I should create the database but, mysql.sql but I don't find it. Anyone could help me pliz. where can I get it please? Thank you!

2 2

Can not 'make' FreeRadius from ports manually
by Коньков Евгений 11 Jan '10

11 Jan '10

Здравствуйте, FreeRadius. #uname -a FreeBSD vpn.in 7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #5: Tue Nov 24 01:46:35 EET 2009 kes@vpn.in:/usr/obj/usr/src/sys/KES_KERN_v72 i386 # cd /usr/ports/net/freeradius2 #make fetch #make extract #make patch #cd work/freeradius-server-2.1.8 #./configure --without-rlm_krb5 --without-rlm_ldap --without-rlm_sql_mysql -- without-rlm_sql_postgresql --without-rlm_sql_unixodbc --without-rlm_sql_firebird --with-rlm_perl --without-rlm_python --without-rlm_ruby --without-dhcp --withou t-rlm_smb --without-rlm_sql_oracle --quiet --prefix=/usr/local --libdir=/usr/loc al/lib/freeradius-2.1.8 --localstatedir=/var --with-system-libtool --with-docdir =/usr/local/share/doc/freeradius --with-logdir=/var/log --with-openssl-includes= /usr/include --without-rlm_eap_ikev2 --without-rlm_eap_tnc --without-rlm_eap2 -- without-rlm_opendirectory --without-rlm_sql_db2 --without-rlm_sql_iodbc --withou t-rlm_sql_sqlite --without-rlm_sql_sybase --with-vmps --prefix=/usr/local --mand ir=/usr/local/man --infodir=/usr/local/info/ --build=i386-portbld-freebsd7.2 No errors are. # make "Make.inc", line 83: Missing dependency operator "Make.inc", line 86: Need an operator "Make.inc", line 88: Missing dependency operator "Make.inc", line 91: Need an operator "Make.inc", line 93: Missing dependency operator "Make.inc", line 94: Missing dependency operator "Make.inc", line 95: Need an operator "Make.inc", line 96: Need an operator "Make.inc", line 98: Need an operator "Make.inc", line 99: Need an operator "Make.inc", line 105: Missing dependency operator "Make.inc", line 108: Need an operator "Makefile", line 70: Missing dependency operator "Makefile", line 71: Missing dependency operator "Makefile", line 88: Need an operator "Makefile", line 89: Need an operator make: fatal errors encountered -- cannot continue But this: # cd /usr/ports/net/freeradius2 # make install clean makes and installs fine. But I need to define next in src/main/modules.c #define HAVE_LT_DLADVISE_INIT Which operators must be here? line 83+: ifneq ($(WITH_OPENSSL_MD5),) LIBRADIUS_WITH_OPENSSL = 1 CFLAGS += -DWITH_OPENSSL_MD5 endif ifneq ($(WITH_OPENSSL_SHA1),) LIBRADIUS_WITH_OPENSSL = 1 CFLAGS += -DWITH_OPENSSL_SHA1 endif -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 4

FreeBSD 8.0 port + perl hook problem
by Nick Rogers 11 Jan '10

11 Jan '10

I'm having problems getting the latest FreeBSD port of freeradius2 to work with a perl hook that requires the IO perl module. I realize this is likely a FreeBSD ports compilation problem but I am hoping someone here can shed some light. There seems to be some kind of shared library linking issue between the freeradius2 and perl packages compiled from RELEASE_8_0 ports tree branch. If one tries to use freeradius in conjunction with a perl hook (script) for authentication, and the perl script requires a perl module relying on a compiled shared object file (e.g., IO), then freeradius will fail to load the perl script and throws errors. Below is a dump that should make it easy to replicate the problem. This was done after freshly installing 8.0-RELEASE-i386 onto a system from the official ISO. Note that I have also tried to compile the ports myself and run into the same problem on i386 and amd64 architectures. I am going to try and compile the ports using portupgrade as suggested by someone on this list and see if that changes anything. Any further help would be greatly appreciated. Thanks! # uname -a FreeBSD 8.0-RELEASE FreeBSD 8.0-RELEASE #0: Sat Nov 21 15:48:17 UTC 2009 root@almeida.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386 # pkg_info # # # pkg_add -r freeradius Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.0-release/Latest/fr…... Done. Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.0-release/All/pytho…... Done. ==== Note that some of the standard modules are provided as separate ports since they require extra dependencies: bsddb databases/py-bsddb gdbm databases/py-gdbm sqlite3 databases/py-sqlite3 tkinter x11-toolkits/py-tkinter Install them as needed. ==== Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.0-release/All/perl-…... Done. Removing stale symlinks from /usr/bin... Skipping /usr/bin/perl Skipping /usr/bin/perl5 Done. Creating various symlinks in /usr/bin... Symlinking /usr/local/bin/perl5.8.9 to /usr/bin/perl Symlinking /usr/local/bin/perl5.8.9 to /usr/bin/perl5 Done. Cleaning up /etc/make.conf... Done. Spamming /etc/make.conf... Done. Cleaning up /etc/manpath.config... Done. Spamming /etc/manpath.config... Done. Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.0-release/All/liblt…... Done. Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.0-release/All/gdbm-…... Done. Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.0-release/All/libic…... Done. Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.0-release/All/gette…... Done. Fetching ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.0-release/All/gmake…... Done. ===> Created group freeradius ===> Created user freeradius ===> Setting user and group in radiusd.conf ===> Bootstrapping default certificates, please wait... ===> Adjusting ownership of directory /usr/local/etc/raddb ===> Adjusting ownership of directory /var/log/radacct ===> Adjusting ownership of directory /var/run/radiusd ===> Adjusting ownership of /var/log/radius.log ===> Adjusting ownership of /var/log/radutmp ===> Adjusting ownership of /var/log/radwtmp ===> Updating libdir in /usr/local/etc/raddb/radiusd.conf =============================================================================== To enable FreeRADIUS, put the following line in /etc/rc.conf radiusd_enable="YES" The sample configuration can be found at /usr/local/share/examples/freeradius/raddb If you are upgrading FreeRADIUS, you are advised to use this as a reference for updating your configuration. FreeRADIUS will look for its configuration directory at /usr/local/etc/raddb by default. If you did not already have a configuration at this location, the sample configuration has been copied to this location and has been bootstrapped. If you wish to point FreeRADIUS to a configuration at a different location, put the following line in /etc/rc.conf radiusd_flags="-d /path/to/raddb" To start the server in normal (daemon) mode, run: /usr/local/etc/rc.d/radiusd start and to stop the server, run: /usr/local/etc/rc.d/radiusd stop To start the server in debugging mode, run: /usr/local/etc/rc.d/radiusd debug You are advised to make cautious changes to the configuration, and to test frequently, using debugging mode where necessary. Try to resist the temptation to disable or delete things that you don't understand - you may well break things! The documentation has been installed at /usr/local/share/doc/freeradius Useful configuration advice can be found in the FreeRADIUS Wiki at http://wiki.freeradius.org =============================================================================== # # pkg_info en-freebsd-doc-20090913 Documentation from the FreeBSD Documentation Project freeradius-2.1.6 A free RADIUS server implementation gdbm-1.8.3_3 The GNU database manager gettext-0.17_1 GNU gettext package gmake-3.81_3 GNU version of 'make' utility libiconv-1.13.1 A character set conversion library libltdl-2.2.6a System independent dlopen wrapper perl-5.8.9_3 Practical Extraction and Report Language python26-2.6.2_3 An interpreted object-oriented programming language # # cat /usr/local/etc/raddb/radiusd.conf user = freeradius group = freeradius raddbdir = /usr/local/etc/raddb logdir = /var/log libdir = /usr/local/lib pidfile = /var/run/radiusd/radiusd.pid prefix = /usr/local exec_prefix = ${prefix} localstatedir = /var sbindir = ${exec_prefix}/sbin radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = /var/log/radius.log log_destination = files max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 256 listen { ipaddr = * port = 1812 type = auth } listen { ipaddr = * port = 1813 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad proxy_requests = no snmp = no security { max_attributes = 200 reject_delay = 1 status_server = no } thread pool { start_servers = 1 max_servers = 16 min_spare_servers = 0 max_spare_servers = 5 max_requests_per_server = 0 } modules { perl { module = /tmp/freeradius_hook } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0644 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { challenge = "Password: " auth_type = perl } tls { private_key_password = private_key_file = /etc/ssl/server.key certificate_file = /etc/ssl/server.crt CA_file = /etc/ssl/server.crt dh_file = /usr/local/etc/raddb/dhparam random_file = /space/rxg/rxgd/bin/random } ttls { default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes } peap { default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes } } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } } authorize { preprocess eap perl } authenticate { Auth-Type PERL { perl } eap } preacct { preprocess acct_unique } accounting { detail radutmp perl } session { radutmp } # # # cat /tmp/freeradius_hook #!/usr/bin/perl use strict; use diagnostics; use IO (); # # # perl /tmp/freeradius_hook # # radiusd -X FreeRADIUS Version 2.1.6, for host i386-portbld-freebsd8.0, built on Oct 23 2009 at 17:50:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf group = freeradius user = freeradius including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" libdir = "/usr/local/lib" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 256 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no log_stripped_names = no security { max_attributes = 200 reject_delay = 1 status_server = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/tmp/freeradius_hook" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } Can't load '/usr/local/lib/perl5/5.8.9/mach/auto/IO/IO.so' for module IO: /usr/local/lib/perl5/5.8.9/mach/auto/IO/IO.so: Undefined symbol "PL_sv_undef" at /usr/local/lib/perl5/5.8.9/mach/XSLoader.pm line 70. at /usr/local/lib/perl5/5.8.9/mach/IO.pm line 11 Compilation failed in require at /tmp/freeradius_hook line 6. BEGIN failed--compilation aborted at /tmp/freeradius_hook line 6 (#1) (F) The module you tried to load failed to load a dynamic extension. This may either mean that you upgraded your version of perl to one that is incompatible with your old dynamic extensions (which is known to happen between major versions of perl), or (more likely) that your dynamic extension was built against an older version of the library that is installed on your system. You may need to rebuild your old dynamic extensions. Uncaught exception from user code: Can't load '/usr/local/lib/perl5/5.8.9/mach/auto/IO/IO.so' for module IO: /usr/local/lib/perl5/5.8.9/mach/auto/IO/IO.so: Undefined symbol "PL_sv_undef" at /usr/local/lib/perl5/5.8.9/mach/XSLoader.pm line 70. at /usr/local/lib/perl5/5.8.9/mach/IO.pm line 11 Compilation failed in require at /tmp/freeradius_hook line 6. BEGIN failed--compilation aborted at /tmp/freeradius_hook line 6. at /tmp/freeradius_hook line 6 rlm_perl: perl_parse failed: /tmp/freeradius_hook not found or has syntax errors. /usr/local/etc/raddb/radiusd.conf[65]: Instantiation failed for module "perl" /usr/local/etc/raddb/radiusd.conf[169]: Failed to find module "perl". /usr/local/etc/raddb/radiusd.conf[169]: Failed to parse "perl" entry. Errors initializing modules #

3 7

FreeRADIUS + DHCP config
by Ale Luna 11 Jan '10

11 Jan '10

Hello to all.... I'm new in linux & RADIUS, first I configure a FreeRADIUS 2.1.7 in the most basic way and it runs very well but now I'm trying to configure a FreeRADIUS 2.1.8 with DHCP server and I need somebody to point me in the right direction to configure it... the steps I took to configure were root@servidor1-desktop:/home/servidor1/Desktop/freeradius-server-2.1.8# ./configure --with-dhcp root@servidor1-desktop:/home/servidor1/Desktop/freeradius-server-2.1.8# make root@servidor1-desktop:/home/servidor1/Desktop/freeradius-server-2.1.8# vi share/dictionary Un-comment the line containing $INCLUDE dictionary.dhcp . . . # # The Cisco VPN300 dictionary is the same as the altiga one. # You shouldn't use both at the same time. # #$INCLUDE dictionary.cisco.vpn3000 $INCLUDE dictionary.cisco.vpn5000 $INCLUDE dictionary.cisco.bbsm $INCLUDE dictionary.clavister $INCLUDE dictionary.colubris $INCLUDE dictionary.cosine $INCLUDE dictionary.dhcp $INCLUDE dictionary.digium $INCLUDE dictionary.epygi $INCLUDE dictionary.erx $INCLUDE dictionary.ericsson $INCLUDE dictionary.extreme $INCLUDE dictionary.freeradius $INCLUDE dictionary.freeswitch $INCLUDE dictionary.fortinet $INCLUDE dictionary.foundry $INCLUDE dictionary.gandalf $INCLUDE dictionary.gemtek $INCLUDE dictionary.h3c . . . save the file. . . . $INCLUDE dictionary.colubris $INCLUDE dictionary.cosine $INCLUDE dictionary.dhcp $INCLUDE dictionary.digium $INCLUDE dictionary.epygi $INCLUDE dictionary.erx $INCLUDE dictionary.ericsson $INCLUDE dictionary.extreme $INCLUDE dictionary.freeradius $INCLUDE dictionary.freeswitch $INCLUDE dictionary.fortinet $INCLUDE dictionary.foundry $INCLUDE dictionary.gandalf $INCLUDE dictionary.gemtek $INCLUDE dictionary.h3c :w root@servidor1-desktop:/home/servidor1/Desktop/freeradius-server-2.1.8# make install But when I run my radiusd -X I have the following output ************************************************************************************************** root@servidor1-desktop:/usr/local/etc/raddb# radiusd -X FreeRADIUS Version 2.1.8, for host i686-pc-linux-gnu, built on Jan 8 2010 at 16:50:59 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/BACK.ippool including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.10 { require_message_authenticator = no secret = "miaccesspoint" shortname = "TP-Link" } client 192.168.1.245 { require_message_authenticator = no secret = "miaccesspoint" shortname = "Linksys" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. *************************************************************************************************** I can see I don't have the line . . . including configuration file /usr/local/etc/raddb/sites-enabled/dhcp . . . and . . . radiusd: #### Loading Virtual Servers #### server dhcp { modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating ok always ok { rcode = "ok" simulcount = 0 mpp = no } Module: Checking dhcp DHCP-Request {...} for more modules to load Module: Linked to module rlm_passwd Module: Instantiating mac2ip passwd mac2ip { filename = "/usr/local/etc/raddb/mac2ip" format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no Module: Checking dhcp (null) {...} for more modules to load /usr/local/etc/raddb/sites-enabled/dhcp[159]: No name specified for Post-Auth-Type block } # modules } # server . . . and . . listen { type = "dhcp" ipaddr = * port = 67 } . . Like other users in this mailing list So my question is ... What am I doing wrong ??? or I need to configure any other thing ??? Please I need somebody to put me in the right direction all my doubts I can solve with this mailing list but I can't find the answer to my problem.... Thanks in advance.... Greetings all

2 1

rlm_sqlippool required?
by John Kane 11 Jan '10

11 Jan '10

Is the rlm_sqlippool required when allocating IPs from an SQL DB? I am trying to set this up on a 1.1.3 install, and don't see that module. Thanks, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

3 4

My Static IP Client conf. not work
by Tevfik Ceydeliler 11 Jan '10

11 Jan '10

Hi, I have a client, when I put this client into an IP pool everything is ok. But when I move him for framed-Ip (static IP),he can't get that IP address. Note: I use a secovid as realm and NAS is Telecom Operator (For APN) I dont know what i should check. Can you help me to start? ################################################################# Here is the user configuration: FOR POOL --> tevfikceydeliler Service-Type == Framed-User,Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Pool-Name := BirmasGPRS For Static IP --> tevfikceydeliler Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Framed-IP-Address == 172.30.65.90, Framed-IP-Netmask == 255.255.255, Framed-MTU = 1500, Framed-Routing = None, Framed-Protocol = PPP, Service-Type = Framed, Fall-Through = Yes AND DEFAULTS --> DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP DEFAULT Auth-Type := Accept ################################################### Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

Cisco-AVpair accounting client-mac-address with unlang
by Joe Maimon 11 Jan '10

11 Jan '10

I have this in preacct, and it works. if ("%{Cisco-AVpair[3]}" =~ /^client-mac-address=(.+)$/) { if (!Calling-Station-Id) { update request { Calling-Station-Id := "%{1}" } } } However this is ugly. I dont want to have to know which Cisco-AVpair it is, it should work whichever the order or number there is. It does not seem to work any other way. I know other directions to head include cisco_vsa_hack or the rlm_policy and others. I would appreciate any tips. Thanks, Joe

4 11

RE: Re: Design question considering 802.1x + edirectory + Active Directory
by Ramm-Ericson, Johannes 10 Jan '10

10 Jan '10

Alan DeKok wrote: >> - Is there any downloadable Freeradius + LDAP virtual machine for testing ?? > > No. Download a virtual machine, and install FreeRADIUS on it. Actually; there is: http://www.vmware.com/appliances/directory/69328 Having said that; I haven't tested it myself, I don't know which version of FreeRadius is installed, I can't see much in the way of documentation, etc. So, if you test this be aware that there are limitations and all things considered it may be better to start with a clean virtual machine and install the latest version of FreeRadius on it as suggested. Regards, J.

2 1