- Freeradius-Users - lists.freeradius.org

Re: Window domain (win server 2k3) ----- Free-Radius ----- NAS -------Access Point )))) ((((( STA
by Le Sang 07 Sep '08

07 Sep '08

Dear All, I'm sorry I forgot attach file debug-info. Here is the debugging output: [root@localhost ~]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Instantiated exec (ntlm_auth) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.200.100:32775, id=1, length=62 User-Name = "user" User-Password = "lab4man1" Message-Authenticator = 0x1631bbb58aed9a05ef6b72e282e28282 rad_recv: Access-Request packet from host 192.168.200.100:32775, id=1, length=62 Sending Access-Reject of id 1 to 192.168.200.100 port 32775 Can anybody help me on this behavior? Thanks. --- On Fri, 9/5/08, tnt(a)kalik.net <tnt(a)kalik.net> wrote: From: tnt(a)kalik.net <tnt(a)kalik.net> Subject: Re: Window domain (win server 2k3) ----- Free-Radius ----- NAS -------Access Point )))) ((((( STA To: freeradius-users(a)lists.freeradius.org Date: Friday, September 5, 2008, 1:18 PM >Can anybody please help me on this problem? > Not unless you post the debug. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 5

undefined symbol
by Alexandre Chapellon 07 Sep '08

07 Sep '08

I have a problem loading freeradius since i enabled sqlippool i get the following message: freeradius: symbol lookup error: /usr/lib/freeradius/rlm_sqlippool-2.0.5.so: undefined symbol: sql_get_socket here the result of an ldd against rlm_sqlippool: ldd /usr/lib/freeradius/rlm_sqlippool-2.0.5.so linux-gate.so.1 => (0xf57fe000) libfreeradius-radius-2.0.5.so => /usr/lib/freeradius/libfreeradius-radius-2.0.5.so (0xb7f54000) libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb7f37000) libresolv.so.2 => /lib/tls/i686/cmov/libresolv.so.2 (0xb7f23000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb7f0b000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7dbc000) /lib/ld-linux.so.2 (0xb7f7b000) and none of the linked library contains any sql_get_socket symbol (in fact for most of thoose lib files nm returns no symbols) What the hell did I miss?

4 6

Windows Login
by Kirk Wallace 07 Sep '08

07 Sep '08

I have a fresh install of Freeradius 1.1.7build4 on my Ubuntu 8.04 system. I used this link to do the bob test: http://deployingradius.com/documents/configuration/pap.html which was successful. Then I created myself (kwallace) as a user and tested with radtest, again with success. Then I went to my Windows 2000 notebook with a wifi link through a WRT54GL and OpenWRT as a bridge, using the notebook's VPN connection feature and the same username and password and got "Error 691:Access was denied because the username and/or password was invalid on the domain." Below should be the relevant files. http://www.bumpernipple.com/freeradius-X http://www.bumpernipple.com/clients.conf http://www.bumpernipple.com/users Any hints on how correct this or better present my problem would be appreciated. Kirk

2 3

Hmm... 2.1.0 && radmin
by Alan DeKok 07 Sep '08

07 Sep '08

Looking at this a little more, it looks like a bug crept in at the last minute that prevents radmin from working. <sigh> I'll issue 2.1.1 on Monday. It's been an interesting week. Alan DeKok.

3 4

rlm_unix
by Mark Jones 06 Sep '08

06 Sep '08

I am installing a new server running freeradius 2.0.5 to replace a server running 1.1.7. In our unique situation I have until now been using the rlm_unix module in multiple instances to read about 5 different passwd/shadow file combinations. This was fine until 2.05 were the ability to specify the path to those files has been removed. I know it is suppose to be replaced with the rlm_passwd module but was hoping there was an easier way. Mark Jones London Operations Managed Network Systems 171 Queens Ave Suite 515 London Ontario N6A 5J7 519-679-5207

2 5

Simultaneous login Issue on Freeradius
by Praveen Kumar 06 Sep '08

06 Sep '08

Hi, I am a newbie for FreeRadius. I need some information on freeradius regarding my requirement for authentication and session control. I want to setup the system like.. 1 One centralized server running on a Linux machine for authentication. 2 Client Linux machine in the network which should connect to the server whenever any user log in into the machine. 3 Once authenticated, the user should be allowed the single-sign on. 4 The session for that user should be restricted to one in simultaneous log in. i.e The user which is already log in should not be allowed to login into other machine in the network. 5 The machine should not allow any user to log in by using the local log in setting (/etc/passwd). i.e The machine should be connected the network or Internet for log in. I found that freeradius has the feature of authentication and session control, but not sure that the above setup can be supported and how to configure freeradius for this. Thanks in advance for the reply. Waiting for the reply. Regards Manoj

4 6

Re: sqlcounters for traffic
by Alexandre Chapellon 06 Sep '08

06 Sep '08

Edvin Seferovic a écrit : > > rlm_sqlcounter: Sent Reply-Item for user scott, > Type=Session-Traffic-Limit, value=12792 > > Which part don’t you understand? Sqlcounter returned it. How does the > log part of the RADIUS Packet looks like? It should contain the > “Session-Traffic-Limit” if it can be found in the dictionary, right? > What i don't understand is that i cannot find this in the sent reply, whereas it seems to be processed correctly by the module. > > > E:S > > > > *From:* > freeradius-users-bounces+edvin.seferovic=kolp.at(a)lists.freeradius.org > [mailto:freeradius-users-bounces+edvin.seferovic=kolp.at@lists.freeradius.org] > *On Behalf Of *Alexandre Chapellon > *Sent:* Samstag, 06. September 2008 01:53 > *To:* FreeRadius users mailing list > *Subject:* sqlcounters for traffic > > > > I want to se sqlcounters to count bytes transferred from clients so > that i manage quota. > Aiming this i configured the following counter: > > sqlcounter bytesQuota { > counter-name = traffic_quota > check-name = Max-Traffic > reply-name = Session-Traffic-Limit > sqlmod-inst = mysqldb > key = User-Name > reset = hourly > query = "SELECT SUM(acctinputoctets + acctoutputoctets) FROM > radacct WHERE UserName='%{%k}'" > } > > My first problem is that the Session-Traffic-Limit (from the redback > dictionnary) is not returned. I can't see it neither in the output of > radtest nor with radsniff. > Yet, looking at the output of radiusd -X i can see it's correctly > understood by freeradius: > > rlm_sqlcounter: Check item is greater than query result > rlm_sqlcounter: Authorized user scott, check_item=12000, counter=10891 > rlm_sqlcounter: Sent Reply-Item for user scott, > Type=Session-Traffic-Limit, value=12792 > ++[bytesQuota] returns ok > > Does anyone has a clue? > > Alexandre Chapellon a écrit : > > You're right, adding the name of my sqlcounter in the instantiate > section lake it works. > thx :) > > Alan DeKok a écrit : > > Alexandre Chapellon wrote: > > > whenever i launch freeradius -X I get the folloawing error: > > /etc/freeradius/users[205]: Parse error (check) for entry scott: Invalid > > octet string "101" for attribute name "Max-Traffic" > > > > > The modules are initialized in *order*. The sqlcounter module creates > the attributes on the fly. But... it can't do this if it hasn't been > run yet. > > > > Line 205 is the line where user scott is defined in users files. > > I have tryed setting up my own dictionnary (which i think shouldn't be > > needed) with the Max-Traffic attribute defined as interger > > > > VENDOR ME > > ATTRIBUTE Max-Traffic 1 integer > > > > > That isn't the correct dictionary file format, but it's not relevant, > either. > > > > But that doesn't help. I have read all over the web that sqlcounter with > > mysql are considered as stable enough for production , so am quite > > surprised of this issue... > > Any idea? > > > > > List "sqlcounter" in the "instantiate" section. It will be > initialized before the "users" file is read. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > ------------------------------------------------------------------------ > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Freeradius Usage
by Jesse Stone 06 Sep '08

06 Sep '08

Thank you for the quick response. I may not have mentioned this previously but I am by no means a linux/networking expert. The company I work for is pro-MS. Recently, I got the urge to get back into Linux and here I am. My thinking (in regards to network structure) was that I wanted applications intended to the public as far away from my local lan as posible. The local lan requires the app server though- OpenVPN, Samba (as a PDC), misc other things so I wanted it available to the local lan but not to the DMZ. My main questions though are with Freeradius. My setup is for "hobby" purposes only and already I would have difficulty telling you exactly which users have access to what. I want to using a technology like Freeradius or LDAP create 1 central place on the app server that EVERYTHING would authenication to. In a perfect world, the end result would be that I could type something like this: select %user% from permissionsDB and be returned something like this: SSH: NO, OpenVPN: YES, Samba: %Specific group% (which indicates shares available), Shell Access: No, ect Basically, I want a setup where I can easilly scale upwards without having to "teach" each new application how to use a DB. Freeradious also can authenicate my wireless users when would also be great as for all I know, half my bandwidth is being used by my neighbors. -Jesse On Fri, Sep 5, 2008 at 4:34 PM, Edvin Seferovic <edvin.seferovic(a)kolp.at>wrote: > Hi, > > > > excuse me for asking, but why dont you set up the AppServer in your DMZ ? > you could have ( what I call ) the T – structure > > > > >< --- INTERNET --> GATEWAY ( server1 ) <---> LOCAL LAN > > I > > I DMZ > > I > > SERVER2 + APPServer > > > > It depends how your users use the gateway and how are they suppose to > connect to the Internet. > > > > Regards, > > E:S > > > > > > *From:* freeradius-users-bounces+edvin.seferovic=kolp.at@ > lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic<freeradius-users-bounces%2Bedvin.seferovic> > =kolp.at(a)lists.freeradius.org] *On Behalf Of *Jesse Stone > *Sent:* Samstag, 06. September 2008 01:25 > *To:* FreeRadius users mailing list > *Subject:* Freeradius Usage > > > > Hi All, > > > > I am new to this mailing list and am about to ask a probably very silly > question. Please feel free to direct me to resources that'll help me answer > them. > > > > I want to setup the following: > > > > Gateway [server1] > > - nic1 = Internet > > - nic2 = DMZ [server2] > > - nic3 = Router w/ Wireless -> App Server [Server3] (FREERADIUS > SERVER HERE) -> Local Lan > > > > I read a lot about both Freeradius and LDAP and cannot determine if either > can accomplish my goals. > > > > What I want is: > > > > 1) 1 central place where all user authenication takes place: SSH, Shell > Access, Samba, OpenVPN, Mumble, Any other app that requires user > administration. > > 2) This information stored in a SQL type database so that I can build my > own custom apps to report on user usage, performance ect. > > 3) My router has wireless and I have enabled the security features. I > would still like authenication to take place before a wireless user is > allowed on the network. > > > > For example, > > > > Currently, I have this: Router w/ Wireless -> App Server [Server3] + Local > Lan > > > > I want this: Router w/ Wireless -> App Server [Server3] -> Local Lan > > > > Is Freeradius the best approach for my needs? Do I need anything else? > > > > -Jesse > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Freeradius Usage
by Jesse Stone 05 Sep '08

05 Sep '08

Hi All, I am new to this mailing list and am about to ask a probably very silly question. Please feel free to direct me to resources that'll help me answer them. I want to setup the following: Gateway [server1] - nic1 = Internet - nic2 = DMZ [server2] - nic3 = Router w/ Wireless -> App Server [Server3] (FREERADIUS SERVER HERE) -> Local Lan I read a lot about both Freeradius and LDAP and cannot determine if either can accomplish my goals. What I want is: 1) 1 central place where all user authenication takes place: SSH, Shell Access, Samba, OpenVPN, Mumble, Any other app that requires user administration. 2) This information stored in a SQL type database so that I can build my own custom apps to report on user usage, performance ect. 3) My router has wireless and I have enabled the security features. I would still like authenication to take place before a wireless user is allowed on the network. For example, Currently, I have this: Router w/ Wireless -> App Server [Server3] + Local Lan I want this: Router w/ Wireless -> App Server [Server3] -> Local Lan Is Freeradius the best approach for my needs? Do I need anything else? -Jesse

2 1

Window domain (win server 2k3) ----- Free-Radius ----- NAS ------- Access Point )))) ((((( STA
by Le Sang 05 Sep '08

05 Sep '08

Dear all, I tried to configure free-radius for authenticate user on window domain but i couldn't find the solutions for this behavior. Here is my topology: Window domain (win server 2k3) ----- Free-Radius ----- NAS ------- Access Point )))) ((((( STA 1/. On domain I had groups: administrator with full privileges and user with limitted privilege. 2/. On free-radius: Used the document showed on http://deployingradius.com with authenticate type was NTLM. 3/. On NAS: I provided ip address of RAS and port authen & accouting right. My problem happened below: - On Radius i could test users on domain successfully. - On NAS: + First: in NAS had textboxes for testing users. In this I could authenticate for users on window domain success. + Second: using users in the first one i talked (above) login to NAS with auth through RAS. My problem happened at here. I couldn't login to NAS. After that, I used command "radiusd -x" and always got the message: access reject. I found up in the debugging output and saw: process login to NAS of user was sent to radius. But the radius could not use user's attributes to compare with attributes of this user on domain. Can anybody please help me on this problem? Thanks.

3 2