- Freeradius-Users - lists.freeradius.org

FreeRADIUS 2 Installation failed on ubuntu hardy
by Khan 17 Apr '09

17 Apr '09

Hello everyone, I am new to VoIP, its my first time installing FR on my server. I followed the instructions and first installed dependencies and then FR. My installation process and other steps i took can be found on this link: http://voiprookie.blogspot.com/ I tried to install it several time but no luck, first I used aptitude which installed the 1.x version so i removed it and then I used synaptic to install that didn't work, finally i took manual approach and installed it as posted on the link above. However during installation I have seen many warnings, I tried to capture the screen dump which can be found at this link: http://pastebin.com/f1d50a81 Obviously it didn't install right but i have no clue where to go from here, could anyone please help me guide to the right procedure. The version on other information are posted on my bloggspot link. Does installing, removing, and re-installing several times screwed up my server and now it wouldn't let me install ? Please help!!! Thanks ya'all in advance... Khan

4 3

problev with radius
by Волошин Вячеслав 17 Apr '09

17 Apr '09

radiusd -v: radiusd: FreeRADIUS Version 1.0.4, for host , built on Jun 19 2005 at 14:01:31 Copyright (C) 2000-2003 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Has this error, when client connected in radius server: In /var/log/radius/radius.log Fri Apr 17 09:25:50 2009 : Error: Discarding duplicate request from client gnugk:48117 - ID: 126 due to unfinished request 229 Fri Apr 17 09:26:22 2009 : Auth: Login OK: [4413] (from client gnugk port 0 cli 4413) Fri Apr 17 09:33:32 2009 : Error: Discarding duplicate request from client st17-gw:1232 - ID: 15 due to unfinished request 235 Fri Apr 17 09:33:34 2009 : Error: Discarding duplicate request from client st17-gw:1232 - ID: 15 due to unfinished request 235 Fri Apr 17 09:33:40 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 16 due to unfinished request 236 Fri Apr 17 09:33:42 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 16 due to unfinished request 236 Fri Apr 17 09:33:51 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 17 due to unfinished request 237 Fri Apr 17 09:33:53 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 17 due to unfinished request 237 Fri Apr 17 09:34:17 2009 : Error: Dropping conflicting packet from client rep-hsgw01:2972 - ID: 206 due to unfinished request 238 Fri Apr 17 09:34:20 2009 : Error: Dropping conflicting packet from client rep-hsgw01:2972 - ID: 206 due to unfinished request 238 Fri Apr 17 09:35:22 2009 : Error: Dropping conflicting packet from client st17-gw:1233 - ID: 18 due to unfinished request 239 Fri Apr 17 09:35:24 2009 : Error: Dropping conflicting packet from client st17-gw:1233 - ID: 18 due to unfinished request 239 Fri Apr 17 09:35:35 2009 : Error: Dropping conflicting packet from client rep-hsgw01:2972 - ID: 207 due to unfinished request 240 Fri Apr 17 09:35:38 2009 : Error: Dropping conflicting packet from client rep-hsgw01:2972 - ID: 207 due to unfinished request 240 Fri Apr 17 09:36:36 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 19 due to unfinished request 241 Fri Apr 17 09:36:38 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 19 due to unfinished request 241 Fri Apr 17 09:36:42 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 20 due to unfinished request 242 Fri Apr 17 09:36:44 2009 : Error: Discarding duplicate request from client st17-gw:1233 - ID: 20 due to unfinished request 242 Fri Apr 17 09:36:49 2009 : Error: Discarding duplicate request from client st17-gw:1234 - ID: 21 due to unfinished request 243 Fri Apr 17 09:36:51 2009 : Error: Discarding duplicate request from client st17-gw:1234 - ID: 21 due to unfinished request 243 Fri Apr 17 09:37:05 2009 : Error: Discarding duplicate request from client st17-gw:1234 - ID: 22 due to unfinished request 244 Fri Apr 17 09:37:07 2009 : Error: Discarding duplicate request from client st17-gw:1234 - ID: 22 due to unfinished request 244 when the reboot radiusd, auth and accounting req normal processing: Fri Apr 17 09:51:53 2009 : Error: Discarding duplicate request from client st17-gw:1258 - ID: 74 due to unfinished request 303 Fri Apr 17 09:51:54 2009 : Error: Discarding duplicate request from client st17-gw:1259 - ID: 75 due to unfinished request 304 Fri Apr 17 09:52:01 2009 : Error: Discarding duplicate request from client st17-gw:1260 - ID: 76 due to unfinished request 305 Fri Apr 17 09:52:05 2009 : Info: Ready to process requests. Fri Apr 17 09:52:09 2009 : Auth: Login OK: [miracle] (from client st17-gw port 367362 cli 00:14:A4:46:73:26) Fri Apr 17 09:52:12 2009 : Auth: Login OK: [stepanov] (from client st17-gw port 367363 cli 00:0E:A6:3A:A5:4E) Fri Apr 17 09:52:13 2009 : Auth: Login OK: [260130] (from client rep-hsgw01 port 2151678103 cli 00:1F:C6:A6:F9:A6) What this mean this error? Formula+ LTD, т.(8617) 61-02-01 ф.(8617) 61-34-16 м.(918) 634-7550 voloshin(a)maks.net www.formulaplus.ru

2 1

Help with LDAP groupOfNames?
by Jason Antman 16 Apr '09

16 Apr '09

I just upgraded to FreeRadius 2.1.1, as per some off-list advice, but still am having issues with this... I've Googled and read docs to no avail, probably as I don't know much of anything about Radius at all - and just need this (seemingly relatively simple) thing. I'm running FreeRADIUS 2.1.1 (SuSE package) and OpenLDAP 2.3.19. I have an access point that will do captive portal, but only via RADIUS, not via LDAP natively. I already have an LDAP server running, so I just added a new groupOfNames called "WirelessUsers". Basically, *all* I want RADIUS to do is check the username and password, and assuming they are correct, either allow or deny based on whether the user is a member of "WirelessUsers". According to radtest, I have it working with LDAP, but it allows everyone with a valid username and password access, regardless of the WirelessUsers group - and I'm not seeing anything related to that group in the LDAP logs or anything related to groups at all in `radiusd -f -X`. I can't seem to find anything concrete online for freeradius1 relating to groupOfNames, so I've just been trying random things that I found online (for raddb/users) hoping one would work. RELEVANT CONFIGS (only relevant portions, comments removed) raddb/sites-enabled/default: authorize { ldap } authenticate { Auth-Type LDAP { ldap } } raddb/modules/ldap: ldap { server = "127.0.0.1" basedn = "dc=example,dc=com" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no #access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupname_attribute = "cn" #groupmembership_filter = (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-\ UserDn}))) groupmembership_filter = (|(&(objectClass=GroupOfNames)(member=%{check:LDAP-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{\ check:LDAP-UserDn}))) groupmembership_attribute = WirelessUsers #groupmembership_attribute = "memberof" timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } raddb/users: #DEFAULT Auth-Type = LDAP # Fall-Through = yes # #DEFAULT Ldap-Group != "wireless", Auth-Type := Reject # # # # # #DEFAULT Ldap-Group != "cn=WirelessUsers,ou=groups,dc=midlandparkambulance,dc=com", Auth-Type := Reject # #DEFAULT Auth-Type := LDAP # # # DEFAULT Ldap-Group == WirelessUsers DEFAULT Auth-Type := Reject (For users, I've tried each of the pairs of commented-out lines, as per different things I found online.) I'm sure this is horribly simple, but I just can't seem to figure it out from the docs or from extensive googling. Thanks for any help, Jason Antman

2 2

Re: Pharmacy Online Sale 70% OFF!
by VIAGRA � Pfizer Inc. 16 Apr '09

16 Apr '09

About this mailing: You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the "Unsubscribe" link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers' content nor any of the goods or service advertised. Prices and item availability subject to change without notice. ©2009 Microsoft | Unsubscribe at http://niceswell.com | More news at http://niceswell.com | Prvacy at http://niceswell.com Microsoft Corporation, One Microsoft Way, Redmond, WA 98052

1 0

Tagged attributes problem and rlm_perl in FreeRADIUS 2.1.4
by Alexandr Kovalenko 16 Apr '09

16 Apr '09

Hello! I've already asked about the very same problem with tagged attributes and rlm_perl in FreeRADIUS 1.1.7, and Ivan Kalik <tnt(a)kalik.net> told me that he tested it on 2.1.4, so I've upgraded to new version: FreeRADIUS Version 2.1.4, for host i386-portbld-freebsd7.1, built on Apr 16 2009 at 10:42:09 But the problem persist. But now it became even worse, it does not authorize even for the first time. Log file attached. If I uncomment $RAD_REPLY{'ERX-Service-Activate:2'} = "deny" line in code radiusd just dies. When it is commented radiusd returns attributes ERX-Service-Activate and ERX-Service-Statistics without tag. Thanks in advance for help. Code snippet of my rlm_perl authorize( ) function: if (($RAD_REQUEST{'User-Name'} eq 'admin') and ($RAD_REQUEST{'User-Password'} eq 'test')) { %RAD_REPLY = undef; $RAD_REPLY{'ERX-Service-Activate:1'} = "telesys"; $RAD_REPLY{'ERX-Service-Statistics:1'}[0] = "time-volume"; $RAD_REPLY{'ERX-Qos-Parameters'}[0] = "internet_tr_value 2097152"; $RAD_REPLY{'ERX-Qos-Parameters'}[1] = "internet_tr_value_in 2097152"; # $RAD_REPLY{'ERX-Service-Activate:2'} = "deny"; $RAD_REPLY{'ERX-Qos-Profile-Name'} = "SP_Tele_Internet"; $RAD_REPLY{'Framed-IP-Address'} = '10.0.112.2'; $RAD_REPLY{'Framed-IP-Netmask'}= "255.255.255.255"; $RAD_REPLY{'ERX-Primary-DNS'} = "77.91.190.21"; $RAD_REPLY{'ERX-Secondary-DNS'} = "77.91.190.24"; return RLM_MODULE_OK; } else { return RLM_MODULE_REJECT; }; -- Alexandr Kovalenko http://uafug.org.ua/

2 4

priority in radcheck and radgroupcheck
by Oguzhan Kayhan 16 Apr '09

16 Apr '09

Hi, I have a simultaneous-use information belongs to a users radgropcheck.. What i want is, if i enter a value to users radcheck, it should bypass the radgroupcheck value..how it is possible?? For now, whatever i make the simultaneous use value for user, it uses the default settings from the radgroupcheck.

2 3

strange for me
by Tseveendorj 16 Apr '09

16 Apr '09

Hello, I configured bandwidth shape in FreeRADIUS's MySQL with following in radgroupreply table Cisco-AVPair := ip:sub-policy-Out=256Kbps but today I defined Pool-Name attribute in radcheck table tseveen Pool-Name := pool the problem is when I defined Pool-Name attribute then bandwidth shape doesn't work. I can download something 1.2Mbps How do I define both bandwidth shape and Pool ? Really appreciate for any help. Sincerely, Tseveen

2 3

Re: Dynamically set password_attribute
by James Devine 16 Apr '09

16 Apr '09

Being able to verify the mac against the ldap database is the best scenario, the mysql database we are using for accounting only. I added: DEFAULT User-Name =~ "([0-9a-fA-F]{2}:){5}[0-9a-fA-F]" Auth-Type := Accept to the users file, but I am still see it setting auth type to ldap after authorization: Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: waiting for bind result ... Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: Bind was successful Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: performing search in dc=gwis, with filter (&(macaddress=00:1f:3a:21:62:f8)(aaaenable=1)) Thu Apr 16 13:59:32 2009 : Info: [ldap] looking for check items in directory... Thu Apr 16 13:59:32 2009 : Debug: rlm_ldap: aaasimultaneoususe -> Simultaneous-Use == 1 Thu Apr 16 13:59:32 2009 : Info: [ldap] looking for reply items in directory... Thu Apr 16 13:59:32 2009 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Thu Apr 16 13:59:32 2009 : Info: [ldap] Setting Auth-Type = LDAP On Wed, Apr 15, 2009 at 5:06 PM, Kenneth Grady <klg(a)lanl.gov> wrote: > If you don't want LDAP to authenticate your mac addresses you need to > set the Auth-Type before it gets set to ldap. > You can do that a number of ways (I use #3) > > 1) try macs in the users file > 00:1f:3a:21:62:f8 ClearText-Password := "00:1f:3a:21:62:f8" > or > DEFAULT User-Name =~ > > "^00:1f:3a:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]:[a-fA-F0-9][a-fA-F0-9]$", > Auth-Type := Accept > > 2) or add mac addresses in your mysql database > INSERT INTO radcheck VALUES > (null,"${MAC-Address}","ClearText-Password",":=","${MAC-Address}"); > or > INSERT INTO radcheck VALUES > (null,"${MAC-Address}","Auth-Type",":=","Accept"); > > 3) a combination of put the DEFAULT and all MAC-Addresses in the mysql > database and don't have ldap set the Auth-Type > INSERT INTO radgroupcheck values (null,"DEFAULT","Auth-Type",":=","LDAP"); > INSERT INTO radusergroup VALUES ("DEFAULT","DEFAULT",1); > INSERT INTO radgroupcheck values (null,"MAC","Auth-Type",":=","Accept"); > #for each MAC you want to accept replace the 00: with your mac addresses > INSERT INTO radusergroup VALUES ("00:00:00:00:00:00","MAC",1); > DELETE FROM radusergroup where username ="00:00:00:00:00:00"; > and in modules/ldap > ldap { > ... > set_auth_type = no > } >

2 1

Freeradius+Java application api call and authenticate
by sollunga 16 Apr '09

16 Apr '09

i am using Cisco ACS for authenticating my vpn users, now i thought of using two factor auth in place against the direct authentication by ACS, on this process one of the googling guided me to try proxying the ACS to Freeradius and call some scripts to talk to the java application. now by making the ACS to do proxying at network configuration, i can see the request is flowing to freeradius from ACS, and the freeradius does "" [chap] rlm_chap: Attribute "User-Name" is required for authentication. ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Delaying reject of request 27 for 1 seconds "" after a while it says "" [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "Doe" with CHAP password [chap] Using clear text password "hello" for user Doe authentication. [chap] chap user Doe authenticated succesfully ++[chap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 63 to "" i am trying to figure out where could be the issue once after this process, i need to send the same to a java application and get a success status from there and authenticate this user. could it be possible? team i am a newbie here, i am just a sys admin, and now trying extend my knowledge, please help me. -- View this message in context: http://www.nabble.com/Freeradius%2BJava-application-api-call-and-authentica… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 12

other device to store configuration!
by new conf 16 Apr '09

16 Apr '09

hello to all; I have a question.. and i hope I'll have a reply or an idea!! If I have to store my files of configuration (eap, keys, randoms, dh..) in a usb device, have you an idea: how can I configure my freeradius? thanks you for your help!

4 10