- Freeradius-Users - lists.freeradius.org

Re: EAP-TTLS (PAP) with Win2K3 domain not working
by Petar Marinkovic 26 Jun '09

26 Jun '09

Similar error, again when the server is starting Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } /etc/freeradius/sites-enabled/inner-tunnel[157]: ERROR: Unknown value ntlm_auth_pap for attribute Auth-Type /etc/freeradius/sites-enabled/inner-tunnel[156]: Failed to parse "update" subsection. /etc/freeradius/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Errors initializing modules That part of code in in /etc/freeradius/sites-enabled/inner-tunnel and /etc/freeradius/sites-available/inner-tunnel files, like this pap if(!control:Auth-Type) { update control { Auth-Type = ntlm_auth_pap } } Thanks in advance! Petar On Fri, Jun 26, 2009 at 11:22, Ivan Kalik <tnt(a)kalik.net> wrote: > > In eap.conf, for eap-ttls there is a line > > > > virtual_server = "inner-tunnel" > > > > I put this part of your code in > /etc/freeradius/sites-enabled/inner-tunnel > > and /etc/freeradius/sites-available/inner-tunnel files, like this > > > > Auth-Type PAP > > { > > pap > > } > > > > if(!control:Auth-Type) { > > update control { > > Auth-Type = ntlm_auth_pap > > } > > } > > Sorry, mistake in my instructions. Put that in authorize (not > authenticate) after pap. > > > and when I try to restart the server, I get following error: > > > > radiusd: #### Loading Virtual Servers #### > > server inner-tunnel { > > modules { > > Module: Checking authenticate {...} for more modules to load > > Module: Linked to module rlm_pap > > Module: Instantiating pap > > pap { > > encryption_scheme = "auto" > > auto_header = no > > } > > /etc/freeradius/sites-enabled/inner-tunnel[186]: ERROR: Unknown value > > ntlm_auth_pap for attribute Auth-Type > > > > /etc/freeradius/sites-enabled/inner-tunnel[185]: Failed to parse > > "update" subsection. > > > > /etc/freeradius/sites-enabled/inner-tunnel[176]: Errors parsing > > authenticate section. > > > > Errors initializing modules > > > > Sorry if I am asking stupid questions, but I am new to linux and > > freeradius, > > and this is all so confusing for me :) What I am doing wrong? > > > > > > On Fri, Jun 26, 2009 at 00:03, Ivan Kalik <tnt(a)kalik.net> wrote: > > > >> > First, thanks Alan for your help, I managed to make it work with AD. > >> Now > >> I > >> > want to try to test to make EAP-TTLS with PAP to authenticate users in > >> > domain. I saw this link > >> > > >> > http://lists.freeradius.org/mailman/htdig/freeradius-users/2008-March/msg00… > >> > > >> > So I added following lines to modules section of radiusd.conf > >> > > >> > exec ntlm_auth_pap { > >> > wait = yes > >> > input_pairs = request > >> > shell_escape = yes > >> > output = none > >> > > >> > program = "/path/to/ntlm_auth --username=%{User-Name} > >> --domain=EXCHANGE > >> > --password=%{User-Password}" > >> > } > >> > > >> > and I edited /etc/freeradius/sites-available/default file and > >> > /etc/freeradius/sites-enabled/default, section authenticate to > >> > > >> > Auth-Type PAP > >> > { > >> > ntlm_auth_pap > >> > } > >> > >> Don't do that. One - it's a wrong virtual server and two - it's not > >> going > >> to work. Use the same technique as in the guide for pap requests. List > >> ntlm_auth_pap in authenticate section of inner-tunnel virtual server > >> (look > >> at ttls section of eap.conf and you will see where will inner tunnel > >> requests end up). Forcing Auth-Type in users file might break a few > >> things > >> so add this to authenticate section of inner-tunnel virtual server > >> *after* > >> pap instead: > >> > >> if(!control:Auth-Type) { > >> update control { > >> Auth-Type = ntlm_auth_pap > >> } > >> } > >> > >> That will set Auth-Type to ntlm_auth_pap for a pap inner tunnel request > >> if > >> password is nowhere to be found. > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > > Ivan Kalik > Kalik Informatika ISP > >

1 0

freeradius 2.1.6 ldap + mschapv2 to authenticate
by jpablorp 26 Jun '09

26 Jun '09

Hi everyone. I've trying to setup a freeradius 2.1.6 with Ldap and mschapv2 to authenticate. when I send test from my console, this works fine. client: $ radtest user pass 10.14.56.26 0 secret. server in debug mode: Ready to process requests. rad_recv: Access-Request packet from host 172.24.104.12 port 39285, id=52, length=69 User-Name = "user" User-Password = "pass" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop [ldap] performing user authorization for user [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) -> (&(SamAccountName=user)(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) [ldap] expand: OU=Groups,DC=it,DC=test,DC=com -> OU=Groups,DC=it,DC=test,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.14.56.100:389, authentication 0 rlm_ldap: bind as admin(a)it.test.com/adminpass to 10.14.56.100:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in OU=Groups,DC=it,DC=test,DC=com, with filter (&(SamAccountName=user)(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = ldap [ldap] user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = ldap +- entering group authenticate {...} [ldap] login attempt by "user" with password "pass" [ldap] user DN: CN=user,OU=General Group,OU=Users,DC=it,DC=test,DC=com rlm_ldap: (re)connect to 10.14.56.100:389, authentication 1 rlm_ldap: bind as CN=user,OU=General Group,OU=Users,DC=it,DC=test,DC=com/pass to 10.14.56.100:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap] user user authenticated succesfully ++[ldap] returns ok Login OK: [user/pass] (from client redprivada1 port 0) Sending Access-Accept of id 52 to 172.24.104.12 port 39285 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 52 with timestamp +10 But when I try to connect. rad_recv: Access-Request packet from host 10.14.56.33 port 32768, id=174, length=189 User-Name = "user" Calling-Station-Id = "00-24-2C-83-AA-92" Called-Station-Id = "00-21-A1-9E-F9-30:redprivada1" NAS-Port = 1 NAS-IP-Address = 10.14.56.33 NAS-Identifier = "acces-ponit-wlc" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020e0016016a75616e7061626c6f5f72616d6972657a Message-Authenticator = 0x76c7af8be679e0867bb2c06d1146d7e6 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop [ldap] performing user authorization for user [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) -> (&(SamAccountName=user)(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) [ldap] expand: OU=Groups,DC=it,DC=test,DC=com -> OU=Groups,DC=it,DC=test,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Groups,DC=it,DC=test,DC=com, with filter (&(SamAccountName=user)(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user user authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "10.14.56.100" port = 389 password = "H4b4cuc69" identity = "juanpablo_ramirez(a)na.foxconn.com" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" basedn = "OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com" filter = "(&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf =CN=Wireless,OU=Groups,OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com)) " base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-U serDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Ne twork rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group- Id conns: 0x8188780 Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NA S-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y %m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/freeradius/freeradius.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.14.56.33 port 32768, id=177, length=189 User-Name = "juanpablo_ramirez" Calling-Station-Id = "00-24-2C-83-AA-92" Called-Station-Id = "00-21-A1-9E-F9-30:foxconnGDL" NAS-Port = 1 NAS-IP-Address = 10.14.56.33 NAS-Identifier = "foxconn-gdl-wlc" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02110016016a75616e7061626c6f5f72616d6972657a Message-Authenticator = 0x5fdfd0ad23a6627e34d4b79a1e5c87c7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "juanpablo_ramirez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop [ldap] performing user authorization for juanpablo_ramirez [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf=CN=Wireless,OU=Groups,OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com)) -> (&(SamAccountName=juanpablo_ramirez)(memberOf=CN=Wireless,OU=Groups,OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com)) [ldap] expand: OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com -> OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.14.56.100:389, authentication 0 rlm_ldap: bind as juanpablo_ramirez(a)na.foxconn.com/H4b4cuc69 to 10.14.56.100:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com, with filter (&(SamAccountName=juanpablo_ramirez)(memberOf=CN=Wireless,OU=Groups,OU=GDL1,OU=Sites,OU=PCEBG-Sites,DC=na,DC=foxconn,DC=com)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user juanpablo_ramirez authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> juanpablo_ramirez attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 177 to 10.14.56.33 port 32768 Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +103 Ready to process requests. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 177 to 10.14.56.33 port 32768 Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +103 Ready to process requests. I don't know what I'm missing. here is my radiusd.conf: modules { $INCLUDE ${confdir}/eap.conf ldap { server = "10.14.56.100" basedn = "OU=Groups,DC=it,DC=test,DC=com" identity = "admin(a)it.test.com" password = adminpass filter = "(&(SamAccountName=%{Stripped-User-Name:-%{User-Name})(memberOf=CN=Wireless,OU=Groups,DC=it,DC=test,DC=com))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } $INCLUDE ${(confdir)}/modules/ } authorize { preprocess suffix eap files ldap } authenticate { ldap unix mschap eap } I don't make changes in users file. It's the original file. Please help me. -- View this message in context: http://www.nabble.com/freeradius-2.1.6-ldap-%2B-mschapv2-to-authenticate-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 13

Re: attrs filtering - regex pattern matching
by Ivan Kalik 26 Jun '09

26 Jun '09

> I'd like our radius proxy server to allow an A/V pair, but, cannot find > any > examples where I can apply any regex type rules to allow a range of > values. > > For example, I received the following from a remote radius server : > > Cisco-AVPair = vpdn:ip-addresses=10.10.1.4 > > and would want to (using attrs) allow anything that matches: > > Cisco-AVPair = vpdn:ip-addresses=.* > Where ".*" would be anything following the "=" So that's not a "range of values". It's "allow anything that matches the bit before =". > How might I allow this using attrs? > > I'm running freeradius 1.0.5 > I can't upgrade to 2.x yet, so I'm looking for suggestions/feedback for > 1.x This has nothing to do with 1.x or 2.x or freeradius. If you need a regex tutorial there are plenty of them available. What you need is basic and can be found in any regex tutorial. Ivan Kalik Kalik Informatika ISP

1 0

freeradius and mobile number portability (MNP)
by Mauro Iorio - Smart Soft s.r.l. 26 Jun '09

26 Jun '09

Hi everybody, I have to configure freeradius server in order to respond to mobile number portability (MNP) query. The client which will query my server is an MVTS softswitch, but I can't interact with it until I develop at least a pseudo-running configuration because it's a legacy installation owned by one of our customers. I have read docs about MVTS but I got lost in the variety of attributes and I was wondering if someone has experience with this problem. Actually I'm looking for a sample query packet and a desired response, in order to configure everything in the right way. I will really appreciate any help, ideas, doc, sample code, whatever. Thanks, Mauro Iorio Smart Soft s.r.l.

1 0

Re: Re: Re : Re : Re : Re : Radius+Huwaei switch + auto VLan, Assignment issue
by Guk Victor 26 Jun '09

26 Jun '09

> so Vlan-assignment-mode is Integer. > > Where?are the tricks? Make attempt use Vlan-assignment-mode is string in tuning of switch.

2 2

SQL fet_row: error handling
by leopold 25 Jun '09

25 Jun '09

I noticed an unwanted behavior in rlm_sql.c In a while loop that fetches rows the return code of rlm_sql_fetch_row is not checked properly. If rlm_sql_fetch_row returns -1, then sql_get_grouplist should also fail, but it return 0 instead and in this case rlm_sql module returns "notfound" instead of "failed". Original code: int num_groups = 0; .. while (rlm_sql_fetch_row(sqlsocket, inst) == 0) { ... } (inst->module->sql_finish_select_query)(sqlsocket, inst->config); return num_groups; -------------------------------- It would be nice if you could do something like while ((ret=rlm_sql_fetch_row(sqlsocket, inst)) == 0) { .. } if (ret < 0) { /* sql fetch failed */ num_groups = -1; } (inst->module->sql_finish_select_query)(sqlsocket, inst->config); return num_groups; -- View this message in context: http://www.nabble.com/SQL-fet_row%3A-error-handling-tp24211138p24211138.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Problems with radmin
by Sebastian Heil 25 Jun '09

25 Jun '09

Hello, I tested some things with radmin and freeradius 2.1.6 on SLES 10 SP2. I started the server, started radmin, added the following debug condition: debug condition '(User-Name == "test")' and then send an acces-request with this username to server. The server crashed with the following errormessages: Thu Jun 25 13:50:26 2009 : Error: ASSERT FAILED event.c[596]: debug_flag != 0 Any idea, what this means or by what this could be caused? Thanks. Sebastian -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

2 1

Disabling users
by DAve 25 Jun '09

25 Jun '09

Good afternoon all, We recently retired our old ICRadius servers and installed FreeRadius. We run two radius servers with a third server acting as master for the radius data and as the accounting server. All is working well. Billing has approached me with an issue where they need to disable a user for lack of payment. Previously we simply changed their password through our management system and they were then unable to reconnect. Client calls, pays, we enable them again. Currently we are noticing that because of DSL, and the fact we no longer impose any limits on dialup, it may take weeks before a client is disconnected and finds their password has changed. I have read through the docs, looked into Session-Timeout and SQL counters, but I do not see how to force a client to re authenticate. What am I missing? What config information do I need to provide? What information/manual/how to have I missed? Thanks, DAve -- "Posterity, you will know how much it cost the present generation to preserve your freedom. I hope you will make good use of it. If you do not, I shall repent in heaven that ever I took half the pains to preserve it." John Quincy Adams http://appleseedinfo.org

3 4

How to compile with custom modules in v1.1.7?
by Eric Geier 25 Jun '09

25 Jun '09

I'm trying to include rlm_raw (http://osdir.com/ml/freeradius.devel/2005-01/msg00027.html) in the installation of FR 1.1.7, but it's never included at usr/lib/freeradius after install. I've tried in Ubuntu and Debian. I'm not sure if it's a general module/compiling problem or something with rlm_raw. Here's what I do: 1. Copy rlm_raw to to src/modules. 2. Add rlm_raw to stable file. 3. Add --enable-rlm_raw to the configure section in debian/rules. 4. Build using the Debian steps (http://wiki.freeradius.org/Build) I haven't made any changes at all to the rlm_raw files; do I need to? What else might I check? The config.log file in the root shows no clues, at least from what I can see. I'm not sure what other log files to check. Thanks, Eric

1 0

Re: freeradius 2.1.6 ldap + mschapv2 to authenticate
by daverummel＠boothcreek.com 25 Jun '09

25 Jun '09

Chris, So funny you say that, I was just talking about that with a co worker. I almost find myself searching for his emails and thinking that poor person who is looking for help. I hope to post a link giving exact details on how to do auth with ldap using freeradius 2. I also plan to add how to do group auth with unlang. So tired of finding bits and pieces and no one quite giving a how to do in this mailing list. ------Original Message------ From: Christopher Sheldon Sender: freeradius-users-bounces+daverummel=boothcreek.com(a)lists.freeradius.org To: FreeRadius users mailing list ReplyTo: FreeRadius users mailing list Subject: Re: freeradius 2.1.6 ldap + mschapv2 to authenticate Sent: Jun 24, 2009 5:36 PM Does anyone else who subscribes to the list specifically read every email Alan sends just to chuckle at him berating the poor, confused people seeking help? It's like reality TV. ;-) Chris. Alan DeKok wrote: > jpablorp wrote: > >> I replace eap.conf with the Default eap.conf file >> >> and this is my debug: >> > > Where you have *deleted* the real cause of the error. > > >> [peap] Had sent TLV failure. User was rejected earlier in this session. >> > > Look EARLIER in the debug log for the failure. It's really not hard. > Look for words like "reject", or "fail", or "error". > > The messages will tell you what is wrong, and why. All you need to do > is read them. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Sent on the Now Network� from my Sprint® BlackBerry

7 6