- Freeradius-Users - lists.freeradius.org

Re: Freeradius + OpenLDAP
by youness hsina 30 May '08

30 May '08

thank you for your response! when i run my server in debugging mode , it seems to work very well! radius# *radiusd -X -A & *** Starting - reading configuration files ... reread_config: reading radiusd.conf [...] Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 *Ready to process requests.* ** but i want to make a test with a user who is located in openldap server. and i don't know how i can do this. Regards, uness

4 5

Thank you and Diameter question
by Raj Patel 30 May '08

30 May '08

Hi People First thank you, I been reading this mailing list for some time and I found it great source of help I want to share some info with you and than ask a question We are slowly moving here into Java and starting to have Diameter requirements I found OpenBloX Java Diameter a great source of help (i think its GPL)and it seems to meet our requirements (* http://sourceforge.net/projects/openblox/**) * as anyone else been using it, I will be happy for some feedback I guess this is the right place for a feedback with so many AAA gurus around J so sorry again for my post Thanks In advance RP

4 4

Need help with Radiusclient-ng
by Pete Kay 30 May '08

30 May '08

Hi, I am trying to write a client using Radiusclient-ng to authenticate with Freeradius. I understand this question may be related to radiusclient-ng speficially, but I can't find any radiusclient-ng specific mailing list, so I just hope someone may be able to help me out here. I am modifiying radiusclient-ng's radexample.c and there are two questions I have: 1. How to change the radiusclient setting so it is sending in password in Digest format? Since my freeradius is configured to use Digest as Auth-Type, I need to use the Digest Auth-type but radiusclient is sending in password in Cleartext out-of-box. 2. How to send additinal attribute or user-defined attribute from radclient.c? I need to use that additional attribute to tell freeradius what table to use for authentication. Any help and suggestion will be greatly appreciated. Regards, Pete

2 1

can't initiate SIM , no RAND1 attribute
by Kalyani Garigipati (kagarigi) 30 May '08

30 May '08

Hi I have tried the eap-sim test by putting the triplets in the eapsim-in.txt also. But I am still getting the same errors... Please let me know in which file I should be keeping those triplets. It would be of great help in someone attach the configuration file. Regards, Kalyani [preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "cisco.com" for User-Name = "1234567892(a)cisco.com" rlm_realm: No such realm "cisco.com" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 25 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type sim can not initiate sim, no RAND1 attribute rlm_eap: Default EAP type sim failed in initiate rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [1234567892(a)cisco.com/<via Auth-Type = EAP>] (from client cisco port 0 cli 1234567892(a)cisco.com) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 1234567892(a)cisco.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 0 ID 189 with timestamp +16

1 0

help freeradius pam
by Angel Camacho Villan 30 May '08

30 May '08

hello, i try to config pam for works with freeradius somebody can helpme to config the file /etc/pam.d/login /etc/pam.d/gdm thanks.. atte Angel

1 0

Re: Fw: Invalid user (rlm_ldap: Access Attribute denies access) -Digest Authentication With FreeRADIUS and OpenLDAP
by Hoa But 29 May '08

29 May '08

Hello Ivan, Thanks for the tip. I thought no dialupAccess attribute does not matter since I am not on remote. I am on a lan connection. Okay, I will configure that now and see what happens. Thanks, Hoa -----Original Message----- >From: Ivan Kalik <tnt(a)kalik.net> >Sent: May 29, 2008 3:08 PM >To: freeradius-users(a)lists.freeradius.org >Subject: Re: Fw: Invalid user (rlm_ldap: Access Attribute denies access) -Digest Authentication With FreeRADIUS and OpenLDAP > >>> >>>I am getting "Invalid user (rlm_ldap: Access Attribute denies access)" > >And a bit earlier in the debug you have: > >>>rlm_ldap: no dialupAccess attribute - access denied by default > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

rlm_checkval module
by Yeargan Yancey 29 May '08

29 May '08

Version: FreeRADIUS 2.0.4 I read the configuration file comments, searched the forums, and even read the source code for rlm_checkval, but am still having trouble getting it working the way I think it should. I am somewhat new to this, so perhaps I missed something obvious. I have an LDAP database. I do have LDAP authentication working without checkval. In the LDAP database, we have an attribute named 'host' that is meant to be a list of NAS IP addresses. This attribute is of type string and multi-valued. A sample LDAP entry might look something like this: dn: uid=testuser,ou=people,o=company host: 192.168.0.1 host: 192.168.0.2 host: 192.168.0.3 I added this to the ldap.attrmap file: checkItem NAS-IP-Address host and then added this to the radiusd.conf file: checkval hostaccess { item-name = NAS-IP-Address check-name = NAS-IP-Address data-type = string notfound-reject = yes } and then added 'hostaccess' after 'ldap' in the authorize section of sites-available/default file. When I perform a test (like this): radtest testuser testpass localhost 10 testing123 I get the following 'radiusd -X' output: [...] Listening on authentication address * port 1812 Listening on accounting address * port 1813 User-Name = "testuser" User-Password = "testpass" NAS-IP-Address = 192.168.0.1 NAS-Port = 10 [...] rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=unt, with filter (uid=testuser) rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute host as RADIUS attribute NAS-IP-Address == 192.168.0.1 rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: NAS-IP-Address, Value: ???? rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.1 rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.2 rlm_checkval: Value Name: NAS-IP-Address, Value: 192.168.0.3 ++[hostaccess] returns reject Invalid user (rlm_checkval: This NAS-IP-Address is not allowed for the user): [testuser/testpass] (from client localhost port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 2 seconds [...] The "Item Name: NAS-IP-Address, Value: ????" bothered me a bit. I don't understand what that means. I think that should show the value from the Access-Request message, but "????" did not make any sense. There is a value present in the request, otherwise it would reject for a missing VP. The value is clearly there. Now I tried changing to 'data-type = ipaddr' in the checkval configuration, but that seems to be ignored in the source code. The source code seems to compare only string, octet, date, and integer and ignores other types simply returning noop. How should I correctly check that the NAS-IP-Address is listed in the LDAP database's 'host' attribute? Respectfully, Yancey

4 3

Re: mod_auth_radius bus errors
by Rick 29 May '08

29 May '08

Rick wrote: > > I'm attempting to use mod_auth_radius (the cvs string is out-of-date, > > but it's the latest from freeradius.org for Apache 1.3), > > Latest from CVS? Or...? Actually, from http://www.freeradius.org/mod_auth_radius/mod_auth_radius.c Building it from cvs works - thanks! > > to > > authenticate to a Safeword RADIUS server, but when I authenticate, > > Apache bus errors - on auth failure, however, it doesn't. There's > > nothing useful logged, and no core file, basically, the server thinks > > I've authenticated, and Apache logs: > > There were issues with older versions of the module. The code in CVS > should have this fixed. We need to issue a new version of the module > which contains the fixes.

1 0

Assign Ip-Pool based on NAS-Ip-Address
by Giovanni Lovato 29 May '08

29 May '08

I would like to assign IP addresses from pools based on which NAS the request comes from. Can I achieve this? Users are stored in LDAP and NAS on SQL.

5 7

FreeRadius trims value of the Cisco-AVPair attribute
by Evgeney Bakhtin 29 May '08

29 May '08

If I execute a query: SELECT id AS AttrID, 'zhekha2' AS Login, attr AS AttrName, IPPhone.VoIP_GetAttrib('zhekha2','','',attr,'1','') AS AttrValue,':=' AS Oper FROM IPPhone.Attrib WHERE op IS NULL AND service=1 I have: # AttrID Login AttrName AttrValue Oper 1 3 zhekha Session-Timeout 0 := 2 4 zhekha h323-credit-time 0 := 3 5 zhekha h323-billing-model 0 := 4 7 zhekha Cisco-AVPair h323-ivr-in=terminal-alias:zhekha,0921877; := 5 9 zhekha XPGK_XROUTING_ROUTING := But in freeradius log I have: Sending Access-Accept of id 149 to 89.251.105.114 port 48099 Session-Timeout := "0" h323-credit-time := "0" h323-billing-model := "0" Cisco-AVPair := "h323" Finished request 10. What I do wrong?

4 5