- Freeradius-Users - lists.freeradius.org

Freeradius updating /etc/hosts?
by Dave 24 Aug '09

24 Aug '09

Ive been using freeradius for years to authenticate pppoe users for my WISP., Customers get dynamic IP addresses from an IP pool. Im going to be implementing a new monitoring system, and I need to use hostnames to check on customer status. Anyone have ideas how freeradius can update /etc/hosts so a dns server such as dnsmasq can serve the hostnames of customers as their IP changes?

1 0

Invitation to connect on LinkedIn
by Durai C 23 Aug '09

23 Aug '09

1 0

IPv6 and packet sending
by Alan Buxey 23 Aug '09

23 Aug '09

hi, in my proxy.conf I have a FQDN for a proxy destination. that FQDN has a AAAA record (and all other operations to it from the server us IPv6 for transit). however, FreeRADIUS doesnt want to talk to that remote proxy via IPv6 anyone else successfully SENDING proxied packets from FreeRADIUS using IPv6? have you had to change/bork something to make it use IPv6 for the transit instead of IPv4? the FQDN also has an A record...but the RFC states that if theres a AAAA for the target then it should be used in preference to the A record..... alan

2 3

Bandwidth & Hardware Requirement Question
by Deepak 23 Aug '09

23 Aug '09

Hi all, I have done basic setup of freeradius and tested in my old PC (PIII). Now I want to do the real thing but I need some estimation regarding this. Can somebody share their knowledge on this? What is the bandwidth requirement for dedicated radius service based on numbers of user or hotspots. Yes I know more the better and more users mean more bandwidth but is there a rough formula for this? X users = Y bandwidth (roughly) Besides what kind of hardware (can I use desktop computers for this purpose), minimum memory? Can I use the radius and mysql in same server or run separate in same LAN? (recommendation) Also I need a rough estimate on how many users can be handled by one server with certain hardware+memory ideally. Some expert advice is greatly appreciated Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

4 5

MSChap via ntlm_auth problem
by Anton Brinyov 22 Aug '09

22 Aug '09

Hi! I tried to use aythentication via Active Directory domain. FreeRadius 2.1.6 return error: [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=256c4a167da6dfb6 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=d57ebadb8c21cc5b95dfc9022b621678897e529734e979ba Exec-Program output: Exec-Program: Abnormal child exit: Invalid argument [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. If I call ntlm_auth from shell I get right answer. It was tested with samba-3.0.35 and samba 3.3.4. My radiusd.conf, modules/mschap and dump of radiusd output in attachments. Thanks, Anton.

4 18

Accounting Exec-Program
by David Rodríguez Fernández 22 Aug '09

22 Aug '09

Hi list. This is my first message to the list. I have read a lot before send this message. I have freeradius version 2.1.6 and want to for every accounting packet exec a script. I have configured the ${confdir}/modules/files file with: acctusersfile = ${confdir}/acct_users and my acct_users file have: DEFAULT Acct-Status-Type == Start Exec-Program = "/etc/rad216-gprs/raddb/user_login.pl" DEFAULT Acct-Status-Type == Stop Exec-Program = "/etc/rad216-gprs/raddb/user_login.pl" The accounting is working, the radius server stores the accounting data in files, but don't execute my script. This script was working with a previous version of freeradius. I'm missing some configuration parameter, but I don't know what. Can you help? Thanks in advance.

2 1

Re: Values from LDAP
by John Smith 21 Aug '09

21 Aug '09

>>>Map the attributes in ldap.attrmap. >> >> Thanks for the prompt reply. I have put something in there: >> replyItem My-Email mail >> >> and I've tried things like %{My-Email} ... but that didn't work. > >If you have defined My-Email in freeradius then it will be %{reply:My-Email}. In my dictionary, I have: ATTRIBUTE My-Email 3010 string I can now do Reply-Message += "%{reply:My-Email}" in a post-auth section and it works. However if I change (in ldap.attrmap) mail to dn, the Reply-Message contains "". Should it be possible to read the dn in this same way? >> Can you suggest a suitable way to use this? > >replyItem Reply-Message mail > >You can add += at the end if you might be sending more messages. If I do: replyItem Reply-Message mail Then it works, however if I put the += after it, it doesn't appear. In this specific case, this is the first place Reply-Message is given a value, so appending isn't necessary, however in future cases(when not using Reply-Message) it might be useful to be able to do this. Cheers, -John -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Re: Values from LDAP
by John Smith 21 Aug '09

21 Aug '09

>> To being with I'd like to put 'mail' or 'ou' into the Reply-Message >> attribute - does anyone have any suggestions? (This is the first time I'm >> using LDAP, so please go easy if I've missed something obvious). > >Map the attributes in ldap.attrmap. Thanks for the prompt reply. I have put something in there: replyItem My-Email mail and I've tried things like %{My-Email} ... but that didn't work. I've looked through the docs at http://wiki.freeradius.org/Rlm_ldap but that didn't help. Can you suggest a suitable way to use this? Cheers, -John -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Values from LDAP
by John Smith 21 Aug '09

21 Aug '09

Hi all, I'm using Freeradius 2.1.6 talking to an LDAP server. I am able to do basic LDAP authentication and everything is fine from that point of view. What I am trying to do is retrieve some additional values from the LDAP server, I'm sure it should be a simple thing to do but I can't work out how to do it. e.g. running ldapsearch -h ldap.server -x -b"ou=auth,dc=uni,dc=co,dc=uk" "(uid=a3)" returns dn: uid=a3,ou=people,ou=auth,dc=uni,dc=co,dc=uk ou: My Department mail: email(a)example.com To being with I'd like to put 'mail' or 'ou' into the Reply-Message attribute - does anyone have any suggestions? (This is the first time I'm using LDAP, so please go easy if I've missed something obvious). Cheers, -John -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 2

How to handle multiple NAS's, auth requirements, etc.
by Gary Gatten 21 Aug '09

21 Aug '09

Hello, so for the BASIC question! First, is there any docs that explain the concepts of how all the various pieces of FR tie together? I've read a bunch of stuff and am making some headway, but some of the architecture and process flow still escapes me. If I can gain a better understanding of the internals I could probably resolve most of my own questions and better contribute to the community as well! Now, the question: We have various environments that need to authenticate and authorize using FR: VPN connections with something like (if member of "VPNGroup" then permit, else deny); vty login to network gear with (if member of "NetEngGroup" then permit, else deny); and 802.1x with dynamic VLAN assignment. I plan to use ntlm_auth for all of these to hit AD on the backend. The problem I'm having is grasping how I can do this? Do I need separate instances of FR? A bunch of "if then/else" clauses somewhere? How does FR know what type of auth is required? Am I making this more complicated than it really is? TIA for the help! In the mean time I'll keep reading and playing! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

3 3