- Freeradius-Users - lists.freeradius.org

Bring India together
by Sunkara RaviPrakash 04 Jan '09

04 Jan '09

1 0

problem with WLAN+MYSQL
by x03ml 04 Jan '09

04 Jan '09

hello list, i have a litle problem here. I setup freeradius to work with mysql and an access point together. when i start the freeradius i have this: (a lot of output) rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to hotspot@localhost:/hotspot rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.rad_recv: Access-Request packet from host 10.10.10.251:1812, id=61, length=71 User-Name = "x03" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000801783033 NAS-IP-Address = 10.10.10.251 Message-Authenticator = 0x85068ed9e75d7bde97669e3960e6342f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: 'x03' rlm_sql (sql): sql_set_user escaped user --> 'x03' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = BINARY 'x03' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = BINARY 'x03' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = BINARY 'x03' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = BINARY 'x03' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 and the client cant authenticate. i think i dont need the MS-CHAP and Auth-Type local, but i have all of that commented in my radiusd.conf someone have a clue about this? thanks a lot if i ask for a test with radtest from a computer in lan i get success, but if i ask to ap auth me i get this in freeradius output:

2 2

Strategy for grouping users for authentication
by Alex French 03 Jan '09

03 Jan '09

Hi, We are using Freeradius 1.1.7 to authenticate a large group of users for one service, with a pgsql backend. I would now like to start using our radius servers to also authenticate other groups of users for specific services, e.g. admin users who can access an apache frontend etc using PAM. My question is, what's the best way to classify and group the users to ensure that group X can access one service but group Y can access another, etc? My first thought is to use an attribute like the NAS-Id to identify the service and require certain user groups for each Nas id in the clients file. However, this does not allow any more granularity than the machine making the request -- for example, login, POP and httpd may all be on the same server but have different groups that should be able to access them. Can anyone point me in the right direction? Thanks, Alex

3 3

Tru64 SIA Compilation Failure
by J Springer 03 Jan '09

03 Jan '09

Tru64 5.1b, Patch kit 6, cc, SIA ./configure; make Is gcc required? make[6]: Entering directory /usr/install/freeradius-server-2.1.3/src/modules/rlm_unix' /usr/install/freeradius-server-2.1.3/libtool --mode=compile cc -g -DNDEBUG -I/usr/install/freeradius-server-2.1.3/src -I/usr/install/freeradius-server-2.1.3/libltdl -c rlm_unix.c mkdir .libs cc -g -DNDEBUG -I/usr/install/freeradius-server-2.1.3/src -I/usr/install/freeradius-server-2.1.3/libltdl -c rlm_unix.c -DPIC -o .libs/rlm_unix.o cc: Error: rlm_unix.c, line 340: In this statement, "name" is not declared. (undeclared) if (sia_ses_init (&ent, 1, info, NULL, name, NULL, 0, NULL) != -----------------------------------------------^ cc: Error: rlm_unix.c, line 343: In this statement, "ret" is not declared. (undeclared) if ((ret = sia_ses_authent (NULL, passwd, ent)) != SIASUCCESS) { -------------^ cc: Error: rlm_unix.c, line 343: In this statement, "passwd" is not declared. (undeclared) if ((ret = sia_ses_authent (NULL, passwd, ent)) != SIASUCCESS) { ------------------------------------------^ make[6]: *** [rlm_unix.lo] Error 1 make[6]: Leaving directory `/usr/install/freeradius-server-2.1.3/src/modules/rlm_unix'

2 1

rlm_sql_oracle and instant client 11.1 rpm install
by Alok Vimawala 03 Jan '09

03 Jan '09

Hello, I spent the last few days fighting to get FreeRadius 2.1.3 installed on a RHEL-5 box with the Oracle Instant Client + SDK rpm install. The Oracle client version is 11.1. Every time, I issued the configure command it would skip over building the rlm_sql_oracle module. I eventually modified the configure.in file in "./src/modules/rlm_sql/ drivers/rlm_sql_oracle/" I went ahead and created a patch for the directory in question, but I am not sure where to submit it to. I tried using the bugs.freeradius.org website, but it was unable to create an account (the system never emailed me with a password). If you folks can direct me to where I can do that, it would be most appreciated. Thanks, Alok ----------------------------------------------------- Alok Vimawala Senior Network Administrator Housing Information Technology Office University of Michigan avimawal(a)umich.edu

3 4

Group Authorization Question
by Mike Diggins 02 Jan '09

02 Jan '09

I have authentication working from my cisco ASA550 VPN appliance to a FreeRadius 2.1.1 server, using NTLM_AUTH for backend authentication. That all works. Now I need to add authorization into the mix. 1. On the Radius server, I want to add a group X with a list of authorized usernames. 2. On the VPN side, the user selects a profile, and logs in, but I only want members of group X to be able to connect to that profile, even if the authentication is correct. I have no idea how to make the connection between the group profile I select on the VPN side, with the group X on the radius side. I'm not even sure how (or where) to create such a group with freeRadius. Can anyone point me in the right direction? -Mike

4 7

CoA-Request and Disconnect-Request in the server
by Alan DeKok 02 Jan '09

02 Jan '09

Thanks to a sponsor (details to follow), the server now has limited support for CoA-Request and Disconnect-Request. The functionality enables you to define policies that *originate* a CoA-Request or Disconnect-Request. i.e. "if user has used their bandwidth quota for the month, disconnect them". As always, there are some caveats: * the server cannot RECEIVE CoA requests. * the server cannot therefore PROXY CoA requests * the NAS MUST support CoA for this to work * The NAS must be listed as a "home_server" of type "CoA". See raddb/sites-enabled/originate-coa for more details. Alan DeKok.

1 0

FreeRADIUS and Foxpro
by Michael Schwartzkopff 02 Jan '09

02 Jan '09

Hi, is there anybody having Foxpro as a backend database. Is this possible? Thanks for sharing your experiences. Michael Schwartzkopff.

2 1

Somewhat OT: Captive portal on acess points instead complex supplicant at level end user?
by Sergio Belkin 02 Jan '09

02 Jan '09

Hi, Currently I'm using: *OpenWRT Kamikaze in AP's *Freeradius 2.1.2 *LDAP End users either use ttls or peap on their notebooks, as I have a LDAP server, each use his username and a password. Problem with this approach is that is somewhat complex for end users, they must either install a software or do a complicated configuration (think in end users terms, please). I'd want to have a open wireless network and that each user access to captive portal and enter his username and password, that captive portal "redirects" request to freeradius and freeradius in turn queries to ldap server. I'd want to know if CoovaAP (or something similar, what?) can perform such task as portal captive installed on APs. I'd be glad to read suggestions Thanks in advance!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

5 6

freeradius on ubuntu 8.04
by John Hottel 31 Dec '08

31 Dec '08

All: I have recently built a new freeradius server. I built an old one a few years ago that has served me very well. I am not sure of the freeradius version on my new server, as i installed it using the apt-get process. The server is working great for the most part, but i am having a weird problem. I am using freeradius to do a radius to ldap conversion. We have Novell Edir 8.7.3 running ldap servers. My old freeradius box is running suse 7.2 and freeradius .0.9.3. It is attaching to the same ldap server and i have no issues with it. My issue is the first ldap connection works great. The first time. I then see a message on the server saying: "Nothing to do. Sleeping until we see a request." If i happen to make a login attempt within 15 seconds of that coming up, i see: "---Walking the entire request list--- Waking up in 1 seconds... sending Access-Reject waking up in 4 seconds... " When i try again, it works. Any ideas what this could be? If you need more info as to my version of freeradius, i will be more then happy to supply the info, if you tell me how to retrieve it :) Thanks for your help! John

3 6