- Freeradius-Users - lists.freeradius.org

Re: Re: Restart radiusd after new user added
by Alexandre Chapellon 03 Aug '09

03 Aug '09

Yes uncomment thoose lines, then restart freeradius. Re run radmin and pass it the "hup files" command. regards Don't forget to reply to the list it may help some else. Le lundi 03 août 2009 à 14:14 +0000, Paul.Blalock(a)gmail.com a écrit : > It looks like the control socket file > in /etc/freeradius/sites-enabled/ is a short-cut > to /etc/freeradius/sites-available/, and the file already has uid/gid > and mode =rw, but they are all commented out. Should I un-comment them > and then try it again? > > On Jul 31, 2009 5:37pm, Alexandre Chapellon > <alexandre.chapellon(a)mana.pf> wrote: > > > > > > > > > > Le vendredi 31 juillet 2009 à 16:17 -0500, Paul Blalock a écrit : > > > > > > I tried the radmin> hup files, command, with no luck. The command > was accepted, but it did nothing. > > > > > > > > > > > > > > What version of freeradius are you runing? > > > > > > > > If you have 2.1.1 or greater, just activate the control socket as a > virtual server (see in /etc/freeradius/sites-available) by linking it > to /etc/freeradius/sites-enabled/ > > > > Check that the soket is in read/write mode (mode =rw) and it has > correct uid/gid. > > > > Restart freeradius (yeah I know that's what we want to avoid :p) > > > > > > > > Then run radmin (as root), and try "hup files" > > > > > > > > This works properly on my setup... > > > > > > > > > > > > > > -- > > > > Paul > > > > > >

1 0

Chrooting freeradius 2.1.6
by Adam Osuchowski 03 Aug '09

03 Aug '09

Hi, what exactly should be placed in directory which freeradius 2.1 chroots to? I tried to configure chrooted environment for freeradius and I had to place all rlm_*.so (along with dependencies) and dictionary.* files inside chroot directory because chroot() is called earlier than these files are read. Even if I put modules names in instantiate section, it doesn't help. Also, putting these files under current directory is not a solution due to modules dependencies. Am I doing something wrong or it is impossible to jail freeradius into empty (or containing only /dev/log and /dev/urandom devices) directory? IMHO, it would be more logical to chroot after all initialization work was done and all files have been read. Regards.

3 2

Freeradius with AD integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

I was following http://deployingradius.com/documents/configuration/active_directory.html to create freeradius with AD integration. And also I was success to join with my domain net join. In this case I'm not using kerberos to join with my domain and only use samba. I'm no problems with radiusd.conf .. and normally start radiusd .. but if I use account from AD.. always Access Reject.. Please help me...

4 3

Freeradius with AD Integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

In this first time.. I'm surely was following http://deployingradius.com/documents/configuration/active_directory.html and successfully to join with my domain.. This problem is why always rejected if I use radtest <User_From_AD> <Password_From_AD> localhost 1812 testing 123... ?? There is no debug when I used radiusd -X... Sorry about my English..

2 1

invalid operator in auth section
by Hegedus Gabor 03 Aug '09

03 Aug '09

Hi ! I have a question, What is the operator I can use in the post auth section for this matching Nas-Port-id =* "tty" In the users file it is works, but I want use it in post auth section. The regular expression ("tty[0-9]") could be good but i don't know how to do. Module: Checking post-auth {...} for more modules to load Expected comparison at: =* /usr/local/radius/etc/raddb/sites-enabled/default[401]: Errors parsing post-auth section. Is any idea? Thank you!

2 1

Freeradius with AD Integration
by Hari Novferdianto 03 Aug '09

03 Aug '09

reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain= radius.satelite.net --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) exec: wait = yes exec: program = "/usr/sbin/ntlm_auth --request-nt-key --domain= radius.satelite.net --username=%{mschap:User-Name} --password=%{User-Password}" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (ntlm_auth) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. .. Everything is fine when I start radiusd -X and radiusd... But if I use radtest <user_from_AD> <password_from_AD> localhost 1812 testing123 It's always... rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=125, length=20 please help me..

2 1

(need help) integrating freeradius with novel eDirectory
by diponegoro dipo 03 Aug '09

03 Aug '09

I have freeradius installed on my ubuntu, and novel eDirectory on SLES 10. Is it possible to integrating freeradius with eDir? I've been searching on google and stil can not find any documentation. so I try to configure it using documentation for freeradius (on sles), and it's failed. Any help would be apreciated. Thank You. ps: sorry for my english

2 1

Proxy accounting message
by HM Wong 03 Aug '09

03 Aug '09

Hi all, I have 2 NAS devices which will deliver RADIUS accounting message to my billing server. Now my billing system will receive all accounting info for all users. I would like to do billing record only for some of my users so that I would like to filter the others. I built a freeradius 1.x to proxy accounting message from NAS devices to billing server. Is it possible to configure the freeradius filter/limit the proxy of accounting message based on user in database or files? Thanks, HM

2 2

Re: Freeradius-Users Digest, Vol 52, Issue 9
by Gilbert Lo 03 Aug '09

03 Aug '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Re: Decoupled accounting
by Devinder Singh 03 Aug '09

03 Aug '09

Hi This is my directory listing which file should i copy to the XP machine linux-h9qt:/etc/raddb/certs # ls 01.pem bootstrap ca.key client.crt client.p12 dh index.txt.attr.old random serial.old server.csr server.pem 02.pem ca.cnf ca.pem client.csr client.pem index.txt index.txt.old README server.cnf server.key xpextensions 03.pem ca.der client.cnf client.key devinder(a)palettemm.com.pem index.txt.attr Makefile serial server.crt server.p12 2009/8/3 Devinder Singh <devinbhullar(a)gmail.com>: > I dont get any errors now when i run radiusd -X > > > does that mean the certs are generated OK > > 2009/8/3 Devinder Singh <devinbhullar(a)gmail.com>: >> what do i do next i want to install teh cert on my windows XP machine? >> >> 2009/8/3 Devinder Singh <devinbhullar(a)gmail.com>: >>> Yes got it to work Ivan >>> >>> Thanks >>> >>> i did >>> >>> chown root:radiusd /etc/raddb/certs/random and for dh >>> >>> >>> >>> 2009/8/3 Devinder Singh <devinbhullar(a)gmail.com>: >>>> user = radiusd >>>> group = radiusd >>>> >>>> how do i chown the entire cert directory? >>>> >>>> 2009/8/3 Ivan Kalik <tnt(a)kalik.net>: >>>>>> so how do i go about in this >>>>>> >>>>>> chown root:radiusd /etc/raddb/certs/dh >>>>>> >>>>>> chown root:radiusd /etc/raddb/certs/random >>>>>> >>>>>> is that correct? >>>>> >>>>> chown whole certs directory. I don't know what user does your radiusd run >>>>> under. I am quite sure root/radiusd is wrong. It's either root:root or >>>>> radius:radius in default configuration. It could be different in binary >>>>> distributions. Check user/group settings in radiusd.conf. >>>>> >>>>> Ivan Kalik >>>>> Kalik Informatika ISP >>>>> >>>>> >>>> >>>> >>>> >>>> -- >>>> Devinder >>>> >>> >>> >>> >>> -- >>> Devinder >>> >> >> >> >> -- >> Devinder >> > > > > -- > Devinder > -- Devinder

1 0