- Freeradius-Users - lists.freeradius.org

Re: FreeRadius with 3COM
by Guk Victor 12 Nov '09

12 Nov '09

> Hi All, thanks. Now the 3COM is authenticationing on freeradius. But i > don?t know how to set diferent priorities to users; My 3COM is 4210 > and have 3 levels of priority. Does anybody know how to send the level > of priority by freeradius? Thanks. If I got it right you, you need access to the switch for a management: console, telnet, web. Then do the following: # local-user admin password simple YOUR_PASSWPRD service-type ssh telnet terminal level 3 # user-interface aux 0 7 authentication-mode password set authentication password simple YOUR_PASSWPRD user-interface vty 0 4 authentication-mode password user privilege level 3 set authentication password simple YOUR_PASSWPRD #

2 1

Deprecate the X-Ascend-* attributes in dictionary.ascend?
by Bjørn Mork 12 Nov '09

12 Nov '09

The dictionary.ascend file contains both Ascend VSAs and some historical Ascend specific extensions in the lower (1-255) RADIUS attribute space. These are prefixed with "X-Ascend-". But nowadays, quite a few of these collide with official standard attributes. Although this is not a problem for the RADIUS server or other applications mapping from name to value, it does pose a problem for applications mapping from value to name. E.g. radclient, which will happily believe that 123 is X-Ascend-Call-Attempt-Limit instead of the RFC 4818 defined Delegated-IPv6-Prefix: ~$ radclient -x localhost:1812 auth foo -f test Sending Access-Request of id 237 to 127.0.0.1 port 1812 User-Name = "ipv6-foo(a)example.com" Password = "bar" rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=237, length=100 Framed-IP-Address = 192.168.3.4 Framed-IPv6-Prefix = 2001:db8:2:1::/64 Framed-Interface-Id = 8765:5678:abcd:1234 X-Ascend-Call-Attempt-Limit = 0x003020010db8000300000000000000000000 ERX-Ipv6-Primary-Dns = 2001:db8::53 Even worse, I believe rlm modules like rlm_perl which also map from value to name for their internal representation of the attributes, will do the same. I.e., if you write a script for rlm_perl, expecting a Delegated-IPv6-Prefix, you'll be up for a surprise... My suggestion is splitting dictionary.ascend in two separate dictionary files, keeping only the VSA part included by default. Or at least split out all attributes colliding with standard attributes. Bjørn

1 1

Re: Freeradius-Users Digest, Vol 55, Issue 55
by Gilbert Lo 12 Nov '09

12 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

The best deals on pilules in the web. Show her that you want her!
by Awotwi Barton 12 Nov '09

12 Nov '09

http://flupsiagvec.net/ Give your desire the significant support! Laughable prices on male supplements! Best counter-measure against loss of sensual potential. Don't hesitate - order today! It is your time to make love with hellish heat and heaven delight! Try the best from the sphere of love-boosting solutions!

1 0

SSL renegotiation ?
by John 12 Nov '09

12 Nov '09

Hi, I found a new man-in-the-middle attack with SSL. http://www.sslshopper.com/article-ssl-and-tls-renegotiation-vulnerability-d… I am afraid if freeRADIUS use SSL renegotiation? The freeRADIUS version is 1.1.6. We use EAP-TLS and the backend OpenLDAP server with TLS connection. Does freeRADIUS use SSL renegotiation ? Thanks. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 1

I need some help with freeradius 2.0.4
by Wagner Pereira 11 Nov '09

11 Nov '09

Hi, guys. Please, could someone read this output from freeradius' debugging mode to help me? Thanks in advance. (I just omitted some informations such as IP, User-Password etc) My scenario is: - Server: Debian GNU/Linux lenny x86_64 kernel 2.6.26-2-amd64 - Freeradius 2.0.4 - MySQL 5.0.51a - Calling Station: Windows XP Professional 32 bits SP3 - Software client: SSH Secure Shell 3.2.9 - NAS client: Cisco6500 Catalyst - IOS versão 12.2(17r)S4 Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 121 with timestamp +17 Ready to process requests. rad_recv: Access-Request packet from host NAS-IP-Address port 21645, id=121, length=82 NAS-IP-Address = NAS-IP-Address NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "User-Name" Calling-Station-Id = "Calling-Station-Id" User-Password = "User-Password" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "User-Name", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "User-Name" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop expand: %{User-Name} -> User-Name rlm_sql (sql): sql_set_user escaped user --> 'User-Name' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'User-Name' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'User-Name' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'User-Name' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'pop-sp' ORDER BY id rlm_sql (sql): User found in group pop-sp expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'pop-sp' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "User-Password" rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [User-Name/User-Password] (from client cisco6500 port 1 cli Calling-Station-Id) +- entering group post-auth rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> User-Name rlm_sql (sql): sql_set_user escaped user --> 'User-Name' expand: %{User-Password} -> User-Password expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'User-Name', 'User-Password', 'Access-Accept', '2009-11-11 11:33:27') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'User-Name', 'User-Password', 'Access-Accept', '2009-11-11 11:33:27') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 121 to NAS-IP-Address port 21645 Framed-Compression := Van-Jacobson-TCP-IP Framed-Protocol := PPP Service-Type := Login-User Framed-MTU := 1500 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 121 with timestamp +23 Ready to process requests. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br (11) 3091-8902

2 4

Algum brasileiro nessa lista?
by Wagner Pereira 11 Nov '09

11 Nov '09

Boa tarde, Há algum brasileiro nessa lista querendo trocar experiência sobre freeradius+mysql? -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br (11) 3091-8902

3 6

[Fwd: Re: [Fwd: I need some help with freeradius 2.0.4]]
by Wagner Pereira 11 Nov '09

11 Nov '09

4 7

Re: Algum brasileiro nessa lista?
by yahmamotto yahmamotto 11 Nov '09

11 Nov '09

Parabéns >tbm sou > >2009/11/11 Thiago Cesar <thiago(a)kionux.com.br> > >> Sim eu sou brasileiro e ultilizo essa lista. >> >> Att. >> >> On Wed, 11 Nov 2009 14:50:09 -0200, Wagner Pereira < wpereira(a)pop-sp.rnp.br >> > >> wrote: >> > Boa tarde, >> > >> > Há algum brasileiro nessa lista querendo trocar experiência sobre >> > freeradius+mysql? >> > >> > >> -- >> "A entrada de seus negócios para o mundo virtual" >> Thiago Cesar >> Diretor TI >> MSN: thiago_rodrigues(a)hotmail.com >> Skype: thiago_ceor >> ----------------------------------------------- >> http://www.kionux.com.br >> Kionux Soluções em Internet LTDA. >> Av. Garibalde, 1114 - Sala 15 - Vila A CEP 85861-550 - Foz do Iguaçu - PR >> Telefone: +55 (45) 3572-5000 >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > >-- >Att. >Alisson F. Gonçalves >Sistemas de Informação - UFGD >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Send accounting packets to multiple proxy servers
by Patric 11 Nov '09

11 Nov '09

Hi all, FreeRADIUS 2.1.7 I currently have a server A that proxies accounting packets to server B. I would like server A to proxy those same accounting packets to server C as well. Currently this is my setup: Server A clients.conf: ------------- client server_B_ip { ipaddr = server_B_ip secret = server_B_secret require_message_authenticator = no virtual_server = requests_from_server_B } sites-enabled/default: ---------------------- ... accounting { detail detail-radrelay } ... server requests_from_server_B { authorize { files } preacct { preprocess acct_unique } accounting { detail sql } } So as I understand it, all incoming accounting requests are written to the detail and the detail-radrelay files, except if its from server B, in which case it only writes to the detail file so that it is not reproxied, correct? Then I have: proxy.conf: ----------- home_server copy-acct-to-home-server { type = acct ipaddr = server_B_ip port = 1813 secret = server_B_secret response_window = 10 zombie_period = 20 no_response_fail = yes } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server } realm DEFAULT { acct_pool = my_acct_failover nostrip } sites-enabled/copy-acct-to-home-server: --------------------------------------- server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail-combined load_factor = 10 retry_interval = 10 } preacct { suffix } accounting { ok } } What do I need to add to get the detail-combined entries sent to server C as well? Does my proxy.conf need to look like this?: home_server copy-acct-to-home-server { type = acct ipaddr = server_B_ip port = 1813 secret = server_B_secret response_window = 10 zombie_period = 20 no_response_fail = yes } home_server copy-acct-to-server-C { type = acct ipaddr = server_C_ip port = 1813 secret = server_C_secret response_window = 10 zombie_period = 20 no_response_fail = yes } home_server_pool my_acct_failover { home_server = copy-acct-to-home-server home_server = copy-acct-to-server-C } realm DEFAULT { acct_pool = my_acct_failover nostrip } Im not too sure where to go here, any help would be much appreciated as always! Many thanks, Patric

1 0