- Freeradius-Users - lists.freeradius.org

radius syntax checker
by sr2690＠columbia.edu 24 Jun '09

24 Jun '09

All, I am newbie with radius configuration. I wanted to know is there any way to check syntax in radius configuration files. I want to see if it is possible to check for illegal character in configuration file during restarting radius server with init script. Please advise on this. Thanks

2 1

radgroupreply issue with freeradius,mysql and daloradius
by mikoi 24 Jun '09

24 Jun '09

Hello. I am having problems getting the radgroupreply attributes to work. radreply works fine when adding reply attributes to users. Now i have a user defined that belongs to a group (for example. SSL). This group has groupreply attributes rfc 2865. (Class). But when trying with radtest it does not seem to check for groups.. SQL-conf: mysql> select * from usergroup; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | ssluser | SSL | 1 | +----------+-----------+----------+ 1 row in set (0.00 sec) mysql> mysql> select * from radgroupreply; +----+-----------+-----------+----+------------+ | id | groupname | attribute | op | value | +----+-----------+-----------+----+------------+ | 10 | SSL | Class | = | ou=bblblbk | +----+-----------+-----------+----+------------+ 1 row in set (0.00 sec) radtest: [root@centos]# radtest ssluser ssluser localhost 1812 testing123 Sending Access-Request of id 178 to 127.0.0.1 port 1812 User-Name = "ssluser" User-Password = "ssluser" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=178, length=20 [root@centos]# radiusd -X debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 47384, id=178, length=59 User-Name = "ssluser" User-Password = "ssluser" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ssluser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> ssluser [sql] sql_set_user escaped user --> 'ssluser' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'ssluser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'ssluser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'ssluser' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "ssluser" [pap] Using clear text password "ssluser" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 178 to 127.0.0.1 port 47384 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 178 with timestamp +2 Ready to process requests. I am probably missing something obvious here. Thankful for som help. Regards M -- View this message in context: http://www.nabble.com/radgroupreply-issue-with-freeradius%2Cmysql-and-dalor… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

Freeradius, PostgreSQL and One-Time-Password backends
by mikoi 24 Jun '09

24 Jun '09

Hello. I am trying to replace an old Cisco Secure ACS with Freeradius. My idea is to use PostgreSQL as a database where all information is added (users, nases etc), but instead of passwords i want Freeradius to ask a backend One-Time Password system (safeword) if a users profile contains a value. For instance: Auth-database = safeword or Auth-database=Portwise Is this possible to do and if so can you give some info how to configure this? Regards M -- View this message in context: http://www.nabble.com/Freeradius%2C-PostgreSQL-and-One-Time-Password-backen… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 12

Access provide to TWO Servers dependant on Group?
by Neville 24 Jun '09

24 Jun '09

Let me explain my setup. I have TWO Servers, with one running PoPtop+Radius plugin / freeradius 2.1.6 / SQL DaloRadius Setup Connection is INTERNET>PPP>FREERADIUS>LAN User X connects to Server A and authenticates against freedradius running on Server A and is provided with Access use mschap v2 authentication and this works fine.. What I would like to do is setup Server B to authenticate against freeradius on Server A, but ONLY allow access to Server B if the connecting user belongs to a specific Group. If group is the correct approach? I'm looking at setting up TWO Groups. Default Group to allow access to Server A only, but if you belong to GROUPX, you will be allowed access to both Server A and Server B. How do I setup this access in SQL against a user and what Check / Reply attributes, if any do I need to use? Many Thanks for your Support Nev

2 1

Variable name for Minute
by Sajeewa Warnakulasuriya 24 Jun '09

24 Jun '09

Hi all, I understand that variable %H is for request hour, I was wondering the variable name for request minute? This is so that I can rotate the sql relay log file every minute. Regards, Sajeewa Warnakulasuriya Systems Development Manager ispONE is a wholesale ISP built to help internet access resellers and independent ISPs to compete in the Australian marketplace through ONE Brand, ONE Provider, ONE Solution. Level 14 520 Collins Street Melbourne 3000 VIC Phone: 1300 663 400 Fax: 1300 665 400 E-Mail: sajeewaw(a)ispone.com.au Web: http://www.ispone.com.au/

3 8

RE: rlm_raw not included in compile
by Eric Geier 24 Jun '09

24 Jun '09

The module isn't being included after install (it's not with the other modules in the usr/lib/freeradius dir) When I run "./autoconf.sh", it says No Such File or Directory. Right now I'm trying this from Ubuntu 8.04. I've installed "autoconf" and "autoconf2.13" I found usr/bin/autoconf...so I thought I'd give that a try. When I run "usr/bin/autoconf" from the source root dir of FR, it says Warning AC_CONFIG_SUBDIRS you should use literals .../.../lib/autoconf/status.m4:919 AC_CONFIG_SUBDIRS is expanded from...configure.in:1120: the top level I see acconfig.h in the source root dir of FR; should I do anything with this? The FR installation notes say for me to use Debian build steps; should I make the same edits as you did to the debian /rules file? After doing these steps, I follow the debian build step: fakeroot dpkg-buildpackage -b -uc Thanks, Eric > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of Johan Meiring > Sent: Monday, June 22, 2009 9:26 AM > To: FreeRadius users mailing list > Subject: Re: rlm_raw not included in compile > > Eric Geier wrote: > > Johan, > > > > I'm a Linux/freeradius newbie, and I don't understand what you meant > by "had > > to run autogen.sh first". > > > > I had to do the following: > > 1) dump rlm_raw in src/modules > 2) run "touch src/modules/rlm_raw/configure" from the freeradius source > root directory. > 3) run "./autoconf.sh" from the freeradius source root directory. > 4) I use debian so I edited debian/rules > looked for the "configure" line, and added: > --with-modules=rlm_raw \ > --with-experimental-modules \ > If you do a manual compile, add this to you configure line. > If you use something else, ask them how to add it to configure. > > > > I'm actually using 1.1.7.so I don't think I need to make the two > changes you > > mentioned. > > > > Also, what did you mean by "touch src/modules/rlm_raw/configure" and > "added > > rlm_raw to debian configure by editing debian/rules" in a previous > post? > > > > Thanks! > > Eric > > > >> -----Original Message----- > >> From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > >> [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] > On > >> Behalf Of Johan Meiring > >> Sent: Friday, May 29, 2009 12:16 PM > >> To: FreeRadius users mailing list > >> Subject: Re: rlm_raw not included in compile > >> > >> Alan DeKok wrote: > >>>> Does anyone have a clue how to add rlm_raw to the current git tar > >> file? > >>> $ tar -zxf freeradius-server-2.1.7.tar.gz > >>> << add rlm_raw >> > >>> $ tar -zcf freeradius-server-2.1.7.tar.gz freeradius-server-2.1.7 > >>> > >> It wasn't that simple because rlm_raw did not contain a configure > >> script. > >> > >> You had to run autogen.sh first. > >> > >> > >>>> PS:he rlm_raw I'm using comes from > >>>> http://lists.cistron.nl/pipermail/freeradius-devel/2005- > >> January/007873.html > >>> That was before version 2.0 was released. You'll likely have to > >>> update the module to use the new API's && header files in 2.0. > >>> > >> Using my "copy and paste" method of c coding (I know VERY little > about > >> c) I maneged to copy the code from the old rlm_raw into rlm_example. > >> > >> I needed to make two changes to get it to compile. > >> > >> 1) replace strNcpy with strncpy > >> 2) replace radlib_safeprint with fr_print_string > >> > >> It compiled and IT WORKS!!! > >> > >>> Alan DeKok. > >> > > > -- > > > Johan Meiring > Cape PC Services CC > Tel: (021) 883-8271 > Fax: (021) 886-7782 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - www.avg.com > Version: 8.5.339 / Virus Database: 270.12.87/2195 - Release Date: > 06/22/09 06:54:00

2 1

IP Pools How ?
by Dogus Yalman 24 Jun '09

24 Jun '09

Hello ; New to this great mailing list and the whole linux world so please bare with me. :) Im using FreeRADIUS Version 1.1.7 with fedora core 10 and my freeradius frontend is DMA Softlabs Radius Manager. http://www.dmasoftlab.com/cont/home My clients are authenticating through distrubuted remote pppoe servers on a wireless network. I want to use freeradius Ip Pool functionality to assign dynamic public IPs to customers since my frontend doesnt support that feature. Is there a step by step approach on how to do it ? is just modyfying the radius.conf and users file is enough? Do i have to create any sql tables for this ? Thanks and greetings from Northern Cyprus

2 1

FreeRADIUS and syslog message changes
by JR Mayberry 23 Jun '09

23 Jun '09

Hi, OK - so I'm using an proxy setup and need better logging. Sample messages Jun 23 13:54:59 localhost radiusd[23703]: Login OK: [rmayberr] (from client 0.0.0.0/0 port 1812) Assuming that 0.0.0.0/0 is coming from the clients file. Adding individual clients isn't an option. I want this log to include the Client-IP-Address or NAS-IP-Address instead of the clients file entry. I've tried other options like a perl module that looks at RADIUS attributes, but freeradius doesn't call post_proxy on an Access-Reject, so I can only log authentication accepts... Ideas how to get this accomplished? Thanks

3 2

Re: Re : Re : Re : Re : Radius+Huwaei switch + auto VLan, Assignment issue
by Guk Victor 23 Jun '09

23 Jun '09

You will place use-tunneled-reply=yes in peap config. This is right config 3Com 4500(V3.03.00): # domain default enable company # dot1x dot1x authentication-method eap undo dot1x handshake enable # radius scheme Radius server-type extended primary authentication x.x.x.x primary accounting x.x.x.x key authentication qwerty key accounting qwerty user-name-format without-domain # domain company scheme radius-scheme Radius vlan-assignment-mode string accounting optional # # interface Ethernet1/0/1 stp edged-port enable broadcast-suppression pps 3000 packet-filter inbound link-group 4999 rule 0 dot1x port-method portbased dot1x # File "users": username Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "2"

2 1

Re: NAS-IP-Address modified during Access-Request process
by kevin leblanc 23 Jun '09

23 Jun '09

On Mon, Jun 22, 2009 at 23:08, Ivan Kalik <tnt(a)kalik.net> wrote: > > I installed freeradius 2 but my problem is still there. > > To remember it : > > > > I configured Freeradius to look in openldap directory to authenticate and > > authorize an user. > > The authentication phase is OK > > During the authorize phase, a ldap search is done : if the user is member > > of > > a group identified by the host ip he wants to connect, the user is > > authorized. > > The problem is here : freeradius receives an Access-Request packet with a > > NAS-IP-Address (the good one) and to search in the ldap, it doesn't send > > the > > ip received in the packet but another one ! > > Dynamic expansion for Ldap and SQL-Group doesn't work in users file. I can > replicate this. But it works in unlang: > > if(Ldap-Group == "%{NAS-IP-Address}) { > ... > } > > will work just fine. > > Ivan Kalik > Kalik Informatika ISP > > :) It works fine ! To help users who have the same problem, I put these lines in authorize section : if(Ldap-Group == "%{NAS-IP-Address}") { ok } else { reject } Thanks ! -- KeV

1 0