- Freeradius-Users - lists.freeradius.org

phpRadmin,dialupAdmin?
by RANDRIAMAMPIONONA José Johnny 04 Aug '09

04 Aug '09

Hello, Does anyone know if these projects still active! In fact , I d like to install it on my server but it looks like non-existent! Thanks! Sincerly! -- JJohnny R.

2 1

rlm_ldap: ldap_search() failed: Operations error
by Alba 03 Aug '09

03 Aug '09

Hello all, I'm receiving this message: rlm_ldap: ldap_search() failed: Operations error and I found in the list archives ( http://www.nabble.com/FreeRadius-cannot-Authenticate-to-Windows-AD-td196909…) this information: > rlm_ldap: ldap_search() failed: Operations error > http://bugs.freeradius.org/show_bug.cgi?id=183 > You're running into two issues: > > - the OpenLDAP client libraries don't use the >authentication credentials they're given when following references. > > - Active Directory is following references because your domain >controller has two domains, and the user isn't found in one, so it's >being referred to the other domain. > >The patch might help, but your LDAP queries should be made more specific. > Alan DeKok. But I can't see the bug information ("Page not found"). Does anyone know were I can find this information or other information about what this message means? Thanks in advance for your help. Regards, Alba

3 6

Re: Re: Restart radiusd after new user added
by Alexandre Chapellon 03 Aug '09

03 Aug '09

Yes uncomment thoose lines, then restart freeradius. Re run radmin and pass it the "hup files" command. regards Don't forget to reply to the list it may help some else. Le lundi 03 août 2009 à 14:14 +0000, Paul.Blalock(a)gmail.com a écrit : > It looks like the control socket file > in /etc/freeradius/sites-enabled/ is a short-cut > to /etc/freeradius/sites-available/, and the file already has uid/gid > and mode =rw, but they are all commented out. Should I un-comment them > and then try it again? > > On Jul 31, 2009 5:37pm, Alexandre Chapellon > <alexandre.chapellon(a)mana.pf> wrote: > > > > > > > > > > Le vendredi 31 juillet 2009 à 16:17 -0500, Paul Blalock a écrit : > > > > > > I tried the radmin> hup files, command, with no luck. The command > was accepted, but it did nothing. > > > > > > > > > > > > > > What version of freeradius are you runing? > > > > > > > > If you have 2.1.1 or greater, just activate the control socket as a > virtual server (see in /etc/freeradius/sites-available) by linking it > to /etc/freeradius/sites-enabled/ > > > > Check that the soket is in read/write mode (mode =rw) and it has > correct uid/gid. > > > > Restart freeradius (yeah I know that's what we want to avoid :p) > > > > > > > > Then run radmin (as root), and try "hup files" > > > > > > > > This works properly on my setup... > > > > > > > > > > > > > > -- > > > > Paul > > > > > >

1 0

Chrooting freeradius 2.1.6
by Adam Osuchowski 03 Aug '09

03 Aug '09

Hi, what exactly should be placed in directory which freeradius 2.1 chroots to? I tried to configure chrooted environment for freeradius and I had to place all rlm_*.so (along with dependencies) and dictionary.* files inside chroot directory because chroot() is called earlier than these files are read. Even if I put modules names in instantiate section, it doesn't help. Also, putting these files under current directory is not a solution due to modules dependencies. Am I doing something wrong or it is impossible to jail freeradius into empty (or containing only /dev/log and /dev/urandom devices) directory? IMHO, it would be more logical to chroot after all initialization work was done and all files have been read. Regards.

3 2

Freeradius with AD integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

I was following http://deployingradius.com/documents/configuration/active_directory.html to create freeradius with AD integration. And also I was success to join with my domain net join. In this case I'm not using kerberos to join with my domain and only use samba. I'm no problems with radiusd.conf .. and normally start radiusd .. but if I use account from AD.. always Access Reject.. Please help me...

4 3

Freeradius with AD Integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

In this first time.. I'm surely was following http://deployingradius.com/documents/configuration/active_directory.html and successfully to join with my domain.. This problem is why always rejected if I use radtest <User_From_AD> <Password_From_AD> localhost 1812 testing 123... ?? There is no debug when I used radiusd -X... Sorry about my English..

2 1

invalid operator in auth section
by Hegedus Gabor 03 Aug '09

03 Aug '09

Hi ! I have a question, What is the operator I can use in the post auth section for this matching Nas-Port-id =* "tty" In the users file it is works, but I want use it in post auth section. The regular expression ("tty[0-9]") could be good but i don't know how to do. Module: Checking post-auth {...} for more modules to load Expected comparison at: =* /usr/local/radius/etc/raddb/sites-enabled/default[401]: Errors parsing post-auth section. Is any idea? Thank you!

2 1

Freeradius with AD Integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain= radius.satelite.net --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) exec: wait = yes exec: program = "/usr/sbin/ntlm_auth --request-nt-key --domain= radius.satelite.net --username=%{mschap:User-Name} --password=%{User-Password}" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (ntlm_auth) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. .. Everything is fine when I start radiusd -X and radiusd... But if I use radtest <user_from_AD> <password_from_AD> localhost 1812 testing123 It's always... rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=125, length=20 please help me..

2 1

(need help) integrating freeradius with novel eDirectory
by diponegoro dipo 03 Aug '09

03 Aug '09

I have freeradius installed on my ubuntu, and novel eDirectory on SLES 10. Is it possible to integrating freeradius with eDir? I've been searching on google and stil can not find any documentation. so I try to configure it using documentation for freeradius (on sles), and it's failed. Any help would be apreciated. Thank You. ps: sorry for my english

2 1

Proxy accounting message
by HM Wong 03 Aug '09

03 Aug '09

Hi all, I have 2 NAS devices which will deliver RADIUS accounting message to my billing server. Now my billing system will receive all accounting info for all users. I would like to do billing record only for some of my users so that I would like to filter the others. I built a freeradius 1.x to proxy accounting message from NAS devices to billing server. Is it possible to configure the freeradius filter/limit the proxy of accounting message based on user in database or files? Thanks, HM

2 2