- Freeradius-Users - lists.freeradius.org

rewrite attribute with perl module
by Asaad 06 Mar '09

06 Mar '09

Hi ALL i have attribute Session-Timeout with value 360000 at radreply database and want to modify the value when the radius return it when radius replies, i enabled perl module and enable it at post-auth at the perl sub post-auth i added ..... print attr $RAD_REPLY{'Session-Timeout'} = "5" ; ..... print attr ..... return RLM_MODULE_UPDATED but that not affect the return vlaue : Thu Mar 5 23:22:30 2009 : Debug: rlm_perl: RAD_REPLY: Cisco-AVPair = throttle=55 Thu Mar 5 23:22:30 2009 : Debug: rlm_perl: RAD_REPLY: Session-Timeout = 360000 Thu Mar 5 23:22:30 2009 : Debug: rlm_perl: RAD_REPLY: Framed-IP-Address = xxxxx Thu Mar 5 23:22:30 2009 : Debug: rlm_perl: RAD_REQUEST: SQL-User-Name = user ............... Thu Mar 5 23:22:30 2009 : Debug: rlm_perl: RAD_REPLY: Cisco-AVPair = throttle=55 Thu Mar 5 23:22:30 2009 : Debug: rlm_perl: RAD_REPLY: Session-Timeout = 5 Thu Mar 5 23:22:30 2009 : Debug: rlm_perl: RAD_REPLY: Framed-IP-Address = xxxxxx but radius sent back Sending Access-Accept of id 1 to 192.168.100.10:32830 Framed-IP-Address := xxxx Cisco-AVPair = "throttle=55" Session-Timeout = 360000 with value of 360000 not (5) and then i enabled the perl module on authorize and authentication section at radius.conf and put the same pervious code in the same subs (authorize and authentication ) at perl module , but i got the same result , value not changed and also the same result when change the return code to become RLM_MODULE_UPDATED any hint please ?!! , can i modify the value of reply attributes ? Thanks lot _________________________________________________________________ Windows Live™ Contacts: Organize your contact list. http://windowslive.com/connect/post/marcusatmicrosoft.spaces.live.com-Blog-…

2 1

Exec-Program-Wait and FreeRadius 2.1.1
by Michael Schramm 05 Mar '09

05 Mar '09

Hello, we're about to migrate from Freeradius 0.9 to 2.1. During this we're noticed, that the Atribute "Exec-Progam-Wait" and "Exec-Program" are deprecated. We used this feature to start a script (which generates special Cisco AV-Pairs). Our Freeradius backend is a mysql database. Now my Problem is that the attributes doesn't work. So we tried with the exec module. Thie works fine, but we want to execute different scripts depending on the the group the user is inserted and I want to manage this via Databse like it was in version 0.9. Can you give me a clue how to deal with, because didn't find anything about this in the documentation. Thanks a lot and best regards Michael Schramm

2 1

openvpn client ip attrib
by Hegedus Gabor 05 Mar '09

05 Mar '09

HI! Can you help me, I don't know how can i send back the client ip address to the openvpn client. The cisco vpn 3000 works correctly with cvpn3000 directory. Are there any directory for openvpn? or which return attrib name I can use? Thank you! Gabor

2 1

No known good password
by Ove Fagerheim 05 Mar '09

05 Mar '09

Hello all Are there room for a newbee question here? This is my first Radius server. I get the message "No known good password" when trying to authenticate users. The users are coming from one of two possible VPN tunnels. I assume "clients.conf" is correctly configured. Any help is highly appreciated. Best regards Ove Fagerheim >From "Users.conf": <snip> user1 Service-Type == Framed-User, User-Password == "password", # Adresses from 10.194.0.1 to 10.194.63.254 # Auth-Type = System, Framed-IP-Address = 10.194.0.1, Framed-IP-Netmask = 255.255.192.0, Fall-Through = Yes DEFAULT Service-Type == Framed-User, Huntgroup-Name == "Huntgroup-1", Framed-Protocol = GPRS-PDP-Context, NAS-Identifier = STCGGSN3, Called-Station_id = "My-Station-Id-String", Reply-Message = "%u is granted access" user1 Service-Type == Framed-User, User-Password == "password", # Adresser fra 10.192.64.1 til 10.192.127.254 # Auth-Type = System, Framed-IP-Address = 10.192.64.1, Framed-IP-Netmask = 255.255.192.0, Fall-Through = Yes DEFAULT Service-Type == Framed-User, Huntgroup-Name == ""Huntgroup-2", ", Framed-Protocol = GPRS-PDP-Context, NAS-Identifier = FBUGGSN3, Called-Station_id = "My-Station-Id-String", Reply-Message = "%u is granted access" <snip> >From "Huntgroups": <snip> Huntgroup-1 NAS-IP-Address == 172.x.x.0 Huntgroup-1 NAS-IP-Address == 172.x.x.1 . . . Huntgroup-1 NAS-IP-Address == 172.x.x.14 # # Huntgroup-2 NAS-IP-Address == 172.y.y.240 Huntgroup-2 NAS-IP-Address == 172.y.y.241 . . . Huntgroup-2 NAS-IP-Address == 172.y.y.254 <snip> logfile "log\radius\radacct\"NAS-IPAddress"\auth-detail-20090303.log: (username is client telephone number) <snip> Packet-Type = Access-Request Tue Mar 3 08:37:36 2009 NAS-IP-Address = 172.x.x.2 NAS-Identifier = "STCGGSN3" Called-Station-Id = "My-Station-Id-String" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 16861232 User-Name = "user1" User-Password = "password" Calling-Station-Id = "user1" Client-IP-Address = 172.x.x.2 Huntgroup-Name = "Huntgroup-1" <snip> logfile "log\radius\radius.log" <snip> Mon Feb 16 12:00:54 2009 : Info: Ready to process requests. Mon Feb 16 12:01:49 2009 : Auth: Login incorrect: [user1/password] (from client TelenorTVK1 port 35970456 cli 4790622859) Mon Feb 16 12:02:04 2009 : Auth: Login incorrect: [user1/password] (from client TelenorTVK1 port 33168936 cli 4790622859) Mon Feb 16 12:02:17 2009 : Auth: Login incorrect: [user1/password] (from client TelenorTVK1 port 30960664 cli 4790622859) Mon Feb 16 12:03:57 2009 : Info: Using deprecated naslist file. Support for this will go away soon. Mon Feb 16 12:03:57 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Feb 16 12:03:57 2009 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon Feb 16 12:03:57 2009 : Info: WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! Mon Feb 16 12:03:57 2009 : Info: Ready to process requests. <snip> If the abow errors is unrelated to my issue, I still would very much appreciante any hints on how to fix them.

6 16

Can freeradius do a CoA Push.
by Simon Herriotts 04 Mar '09

04 Mar '09

Hey, New user to freeradius, nice little bit of work. Wondering if anyone knows how/if you can do a CoA Push. ie change SLA policy-map levels via a radius push to an existing user. Cheers Simon

3 7

Rejections
by Jack D. Martin Jr. 04 Mar '09

04 Mar '09

I am using freeradius 2.1.3 using MySQL for my IP pool and user auth tables in my small ISP. What I need to do is have customers that get rejected with a bad password assigned to a particular IP pool. I am sure this is possible, but can't find it. I assume I am just looking for the wrong keywords - LOL. Can somebody point me in the right direction? Thanks in advance. Jack Martin Magic Wireless Internet Service Providers LLC P.O. Box 278 104 W. Main Oilton, OK 74052 www.magicwisp.com

4 7

OT: Implementing RSA's SecurID
by Greg Vickers 04 Mar '09

04 Mar '09

Hi, (Apologies for an OT post) I was wondering if anyone know of any user list that would contain a community of people who implement systems like RSA's SecurID? The reason is that I am researching who else has implemented SecurID and am trying to find if there is another company or organisation who has implemented it in the way we wish to. Thanks, -- Greg Vickers Phone: +61 7 3138 6902 IT Security Engineer & Project Manager Queensland University of Technology, CRICOS No. 00213J

3 2

Please can someone help I'm new on the list
by Gustavo Román 04 Mar '09

04 Mar '09

I'm trying to install Radius EAP/TLS but when I enable the EAP module, I get the following Error: rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1960] Unknown module "eap". radiusd.conf[1907] Failed to parse authenticate section. Can someone help me. Thanks

2 1

Two factor authentication to both LDAP directory and SecurID
by Greg Vickers 04 Mar '09

04 Mar '09

Hi all, Firstly, this relates to a question asked for our project by Amy Hawke: http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-January/msg… Since the above conversation, I've had an email discussion with Alan DeKok and clarified a few things - it seems that what we want to do is achievable with FreeRADIUS so I'd like to ask the list. Situation: We have an existing LDAP directory which holds username and password information. We purchased RSA's SecurID with the intention of implementing a second factor of authentication to be used in conjunction with our existing username and password. At the time, it was not realised that the intention of SecurID is to replace your existing source of authentication information - which will not be doing! Scenario: To pilot the SecurID product, we selected VPN access to a part of our network, protected by a Cisco ASA5500 series device. We are in the process of moving away from the MS IAS RADIUS solution to FreeRADIUS. We know that MS IAS cannot do what we want to do. What we want to do: When a user attempts to access the VPN, have them provide their username/password as well as (their same) username and tokencode from their SecurID fob. It is OK if they provide the password and tokencode separately or together. (I spoke to the folks at Radiator, and they have a programming ability in their RADIUS server to chop up the password field before it's authenticated, i.e. have the tokencode and password provided in the same field at the client, then take the first eight characters of the 'password' field, send that string plus the username to SecurID via RADIUS, and the rest of the characters from the 'password' field and the username to our LDAP directory.) Ideally we would prompt them for username, password and tokencode at the same time. Can FreeRADIUS do this (it seems that Access-Challenge is exactly what we want: http://en.wikipedia.org/wiki/RADIUS#AAA) or a similar thing to solve our requirement? Thanks, -- Greg Vickers Phone: +61 7 3138 6902 IT Security Engineer & Project Manager Queensland University of Technology, CRICOS No. 00213J

2 6

FR 2.1.3 compile problem
by Chris Howley 03 Mar '09

03 Mar '09

Alan, I encountered the following problem (see below) when attempting to compile the latest version of 2.1.3 (stable code) from the git tree. Your help in fixing this problem would be appreciated. Thanks, Chris Environment: SunOS XXXXXX 5.10 Generic_120012-14 i86pc i386 i86p gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o /sandbox/radiusd/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypt /usr/local/lib/libltdl.so -lssl -lcrypto -R/usr/local/lib Undefined first referenced symbol in file lt__PROGRAM__LTX_preloaded_symbols .libs/modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/sandbox/radiusd/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/sandbox/radiusd/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/sandbox/radiusd/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/sandbox/radiusd' gmake: *** [all] Error 2

3 2