- Freeradius-Users - lists.freeradius.org

openbsd dhcpd + freeradius
by Raja Peer 03 Jul '08

03 Jul '08

Hi, Trying to get radiusd work with local dhcp server. radiusd: FreeRADIUS Version 2.0.6, for host i386-unknown-openbsd4.1, built on Jul 2 2008 at 08:57:18 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. And I do see bootp traffic when using tcpdump for port (P) [root@myhost~]# tcpdump -i fxp1 tcpdump: listening on fxp1, link-type EN10MB 17:18:44.151478 00:19:aa:ab:65:7a 00:19:aa:ab:65:7a loopback 60: 0000 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 17:18:45.610421 192.168.176.1.698 > 192.168.176.255.698: udp 24 [ttl 1] 17:18:47.077184 802.1Q vid 30 pri 0 arp who-has 169.254.220.241 tell 169.254.220.241 17:18:47.948216 802.1Q vid 30 pri 0 arp who-has 169.254.220.241 tell 169.254.220.241 17:18:48.850477 192.168.176.1.698 > 192.168.176.255.698: udp 48 [ttl 1] 17:18:48.948337 802.1Q vid 30 pri 0 arp who-has 169.254.220.241 tell 169.254.220.241 17:18:49.570523 192.168.176.1.698 > 192.168.176.255.698: udp 24 [ttl 1] 17:18:49.968100 802.1Q vid 30 pri 0 169.254.220.241 > IGMP.MCAST.NET: igmp-2 [v2] [ttl 1] 17:18:49.979637 802.1Q vid 30 pri 0 169.254.220.241.3791 > 239.255.255.250.ssdp: udp 133 [ttl 1] 17:18:50.024981 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:50.774829 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:50.948043 802.1Q vid 30 pri 0 169.254.220.241 > IGMP.MCAST.NET: igmp-2 [v2] [ttl 1] 17:18:51.430873 192.168.176.1.698 > 192.168.176.255.698: udp 32 [ttl 1] 17:18:51.524458 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:51.965832 802.1Q vid 30 pri 0 0.0.0.0.bootpc > 255.255.255.255.bootps: xid:0xa2b988cc flags:0x8000 [|bootp] 17:18:52.274437 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:52.979528 802.1Q vid 30 pri 0 169.254.220.241.3791 > 239.255.255.250.ssdp: udp 133 [ttl 1] 17:18:53.025063 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:53.410541 192.168.176.1.698 > 192.168.176.255.698: udp 20 [ttl 1] 17:18:53.774267 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:54.147699 00:19:aa:ab:65:7a 00:19:aa:ab:65:7a loopback 60: 0000 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 17:18:54.524253 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 17:18:55.274368 802.1Q vid 30 pri 0 169.254.220.241.netbios-ns > 169.254.255.255.netbios-ns: udp 68 Checked to make sure dhcp module is included by radiusd -X. Does anyone have dhcp work with freeradius ? Thanks Raja -- View this message in context: http://www.nabble.com/openbsd-dhcpd-%2B-freeradius-tp18249568p18249568.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 4

unix auth with mysql radreply
by Oguzhan Kayhan 03 Jul '08

03 Jul '08

Hello, I setup a freeradius for chilli-coova. It uses both unix accounting (which main users are there) and mysql at the same time for accounting and logging. Just i have a little problem. If i create a user on mysql and give an attribute in radreply, it works fine. But if i create an entry in radreply (Even tried with radgroupreply and usergroup) with unix/shadow authentication, i cant get the reply message. Just radacct records works fine without a problem. Do i have to enable smthing else on radius.conf or sql.conf to use radreply for unix accounting? And also i wonder is it possible to give a default value for everyuser that authenticated via freeradius? A default group for everybody???

2 1

Using OTP authentication with Freeradius 2
by Greg Woods 03 Jul '08

03 Jul '08

I am trying to migrate from freeradius 1.1.7 to freeradius 2.0.5 and I cannot get the OTP module to work. Basically it instantiates, but when I specify "Auth-Type = OTP" in a users file entry, it complains that this is not a valid value for that attribute. This worked fine under 1.1.7 . I have been Googling, grepping the source code and reading the wiki for a couple of days now without finding anything that directly pertains to this problem. I don't know if I messed up compiling the code or configuring the server. If this is documented somewhere, please forgive me, as I have been unable to find it. Here are the relevant snippets from the -X output; the full output is attached: including configuration file /usr/local/etc/raddb/modules/otp [...] including configuration file /usr/local/etc/raddb/otp.conf [...] Module: Linked to module rlm_otp Module: Instantiating otp otp { otpd_rp = "/var/run/otpd/socket" challenge_prompt = "Challenge: %s Response: " challenge_length = 6 challenge_delay = 30 allow_sync = yes allow_async = no mschapv2_mppe = 2 mschapv2_mppe_bits = 2 mschap_mppe = 2 mschap_mppe_bits = 2 } And then it craps out at the end with: /usr/local/etc/raddb/users[4]: Parse error (check) for entry DEFAULT: Unknown value otp for attribute Auth-Type Errors reading /usr/local/etc/raddb/users The entry that worked under 1.1.7 (and which results in the above error under 2.0.5) is: DEFAULT Auth-Type = OTP Fall-Through = No Thanks for any pointers; I am pretty much dead in the water in my migration at this point. --Greg

3 9

Re: Can't find directory
by Ivan Markic 03 Jul '08

03 Jul '08

I would like /etc/raddb/

2 1

Can't find directory
by Ivan Markic 03 Jul '08

03 Jul '08

Hy i'm beginner in Linux and freeradius. Can someone help pe because, when i finish my instalationn of freeradius i can't fint etc/raddb/ directory in etc???!!! Best regards! -- Ivan Markic

5 4

checkrad not called after upgrade to 2.x
by oz 02 Jul '08

02 Jul '08

P.S. Sorry, I posted to the developers-list, but I meant the users-list, so here it should be discussed: M. S. wrote: > Can I put this in bugzilla? Seems like simultaneous use is completely broken in 2.x which is a fairly significant feature. To me checkrad seems to be broken too. I'm using 2.0.5 without virtual servers. Checkrad says, my NAS is Unknown when it is invoked, although I have it in my clients.conf: client testerx { ipaddr = 212.x.x.x secret = xxxxxxx nastype = erx } radiusd -X [...] auth: user supplied User-Password matches local User-Password +- entering group session expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp expand: %{User-Name} -> smith checkrad: Unknown NAS 212.x.x.x, not checking ++[radutmp] returns ok Multiple logins (max 1) [MPP attempt]: [smith] (from client testerx port 1610612780 cli #erx705#E60#44) Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 88 to 212.x.x.x port 50000 Reply-Message := "\r\nYou are already logged in - access denied\r\n\n" Finished request 2. [...] For our customers I have Simultaneous-Use := 1 in my users-file and checkrad is invoked, when a stale session in radutmp is found: # radwho -ir smith,04279558,PPP,S1610612780,Wed 12:2,212.x.x.x,x.x.x.x It is possible, that in 2.0.3 checkrad was ok, because I noticed no problems with Simultaneous-Use there ... but maybe accidentally. Is it really a bug in freeradius-2.0.5? oz

2 4

Dear freeradius-users@lists.freeradius.org July 86 OFF!
by VIAGRA � Official Site 02 Jul '08

02 Jul '08

1 0

change session-timeout
by sub 02 Jul '08

02 Jul '08

Hello everybody, I looked around a bit but without success. I currently use freeradius for several services and I have the following scenario: - a user is authenticated through a NAS; - due to some event my application/script or something recalculate the Session-Timeout value, normally decreasing it of X seconds. Can I send the updated value of the Session-Timeout attribute to the NAS? Thanks, -- sub

2 1

Proxy help
by David Mitchell 02 Jul '08

02 Jul '08

I've having a problem getting the proper attributes set on my response packets when using a proxy. If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only", it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only", Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance, -David Mitchell -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 10

how to remove double quote in access-accept answere
by Thomas LAVIGNE 02 Jul '08

02 Jul '08

Hello, Does anybody know how to remove the "" in the answere arround presto ? Please find here an example of the access-accept answere sended by my FreeRadius server. ---BEGINING--- Sending Access-Accept of id 6 to 212.xx.xx.xx port xxx Redback-Subscriber-Profile-Name := "presto" Service-Type := Framed-User Framed-Protocol := PPP Framed-IP-Address := 255.255.255.254 ---END--- Thank you very much, Regards, Thomas

2 1