- Freeradius-Users - lists.freeradius.org

Freeradius Execute Script
by fvt3 20 Mar '08

20 Mar '08

I understand that it is possible to have Freeradius execute a script when a user authenticate. What I want to do is to be able to pass that user name and the client's ip address to the script. This is my setup, I have freeradius with mysql setup. radgroupreply table: testprogramExec-Program-Wait==/usr/local/etc/raddb/test.pl When user Joe authenticates with his credential, radius would look in mysql and execute the test.pl script. How can I pass the user name "joe" and client's ip address to the test.pl script? Thanks in advance .. ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs

1 0

Re: listen { type = detail } - Forked accounting
by Arran Cudbard-Bell 20 Mar '08

20 Mar '08

Hi, With eduroam, its good practice to proxy accounting packets back to the home server. But it's also very useful to record those accounting packets. Before I just set up the proxy in pre-acct, then listed the SQL module in accounting, and let the accounting server sent the accounting-reply... I never really liked this way because if the remote accounting server was down, it would mean lots of repeat accounting packets. What I was to do now is write out the accounting packet to two detail files, something like acct-buffer-sql and acct-buffer-proxy. Use one file to populate our local SQL db, and the other to deal with proxying the accounting information back to the home server. This would mean duplicate accounting-response packets being sent, which isn't ideal. Is there any way to stop the server sending an accounting response packet when it receives the reply from the home server ? Thanks, Arran

2 1

incorrect shared secret entry authenticates successfully for freerradius
by sanjeev.kumarroy＠wipro.com 20 Mar '08

20 Mar '08

Hi, I am using the following configuration: O/S: rhel4_u5_i386 Freeradius 1.1.7 Client to test: NTRadPing 1.5 Steps undertaken: -------------------- - Installed a fresh system with rhel4_u5_i386 - Build and compile freeradius 1.1.7 on it. - Update the clients.conf file to add the client entries for the machine that uses NTRadPing 1.5 (IP of the client machine and the shared secret) - Start the radiusd daemon in debug mode (radiusd -X) - Now generate a simple PAP authentication request using NTRadPing. (Port is 1812, also provide the shared secret correctly). The authentication passes successfully as it should. Now give a junk secret key in the NTRadPing utility. The access is rejected. - However when the same cases are tried for CHAP we can see the difference. In the first case the authentication is successful; however when we give a junk shared secret the authentication should ideally have been rejected. However the authentication passes successfully. NOTE: I tried the same for MSCHAPv1 and MSCHAPv2 authentication using VPN client. There I can see clearly that the access is not granted to the VPN client. However when we look at the radius logs it can be seen that the Authentication requests responds with a Successful message. Any help or info in this regards would be highly appreciated. Thanks. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

4 8

Re: FreeRADIUS + OpenLDAP + NAS (it?s make me crazy!!! please HELP)
by Koko Kurniawan 20 Mar '08

20 Mar '08

Thank you... now it works and success. but if my client disconnect and reconnect again, now it doesn't need to input user name and password again. It's directly connected .. Is it right??? --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

2 1

Post-proxy and rlm_perl
by Julien Leloup 20 Mar '08

20 Mar '08

Hi, I have to use FreeRadius v2.0.1 in a proxy configuration for translating attributes between two vendor specific equipements (Alcatel-Lucent and Redback). In a first phase (pre-proxy so), I use the preproxy_user file to add attributes to the proxied requests and attr_filter to block others. In a second phase (post-proxy phase I assume), when the reply comes from the home FreeRadius, I have to go through the same kind of process (add attributes which values are taken from a database), but I can't find a equivalent of preproxy_user file to the post-proxy phase. I think that using a perl script with rlm_perl will do this work in the post-proxy function, but when I try to manipulate attributes from the home server response, I can't find them in the %RAD_REQUEST, %RAD_REPLY hashes, and I can see this kind of logs : rlm_perl: Added pair Attribute1 = Value1 ... with the attributes I need from the home server, but after the execution of my code in post-proxy function. I found in the wiki that %RAD_PROXY or %RAD_PROXY_REPLY could be my solution, but when I'm trying to use them, I got an error during the launching of radiusd. Does anyone know how I can get the attributes coming in the Access-Accept from my server, and put new attributes in the Access-Accept send to the original client ? Find a way to make this in rlm_perl could be a solution but if there is an other solution, directly in a FreRadius mechanism I missed during my research, I will use it instead :) Regards, Julien Leloup Axione 130/132 Boulevard Camélinat 92240 MALAKOFF FRANCE

2 2

rlm_exec use
by T Kid82 20 Mar '08

20 Mar '08

Hi everyone, I have been trying to get RADIUS to run a perl script which would authenticate users (and yes I have tried rlm_perl but I decided against it). So far all I have in the perl script itself is ------------------------------------ #!/usr/bin/perl use strict; use Data::Dumper; exit 3; ---------------------------------- This is what my debug output says when I run radtest: rad_recv: Access-Request packet from host 127.0.0.1 port 33397, id=236, length=56 User-Name = "matt" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 1645 +- entering group authorize Exec-Program output: Exec-Program: returned: 3 ++[exec] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [matt/testing] (from client localhost port 1645) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> matt attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds ------------------------------------------------------------------------------------------------- This is what I have in my radiusd.conf authorize { exec } authentication { Auth-Type Exec { exec } } ----------------------------------------------------------------------------------------------- I would think this should let all users pass through but it doesnt seem to be doing that. What am I missing here? Thanks in advance for your help, -- Tauseef

3 6

Wifi with Welcome message?
by Guillaume Chartrand 20 Mar '08

20 Mar '08

Hi, Is it possible to send or execute a script to a user when he authenticated thru wi-fi connection with particular NAS. Like when user joe successfully authenticated with the sql database, if he was connected with NAS IP address X, he receive a Welcome message X and if he authenticated with NAS Y, he receive Welcome message Y. Currently I have Freeradius 2.0 with authentification on a mssql database and it work and give an ip address to the client when is authenticated. Guillaume

3 2

CRL signature failure
by lowbassman＠gmail.com 19 Mar '08

19 Mar '08

I have a cronjob that pulls down a CRL, runs openssl to verify it's OK, and then stops radius, copies the crl into place, and then starts radius. Occasionally, around two or three times a month, I get the following errors and no one can auth to radius until the next run of the cronjob when the CRL is again pulled down. Wed Mar 19 15:01:00 2008 : Error: --> verify error:num=8:CRL signature failure Wed Mar 19 15:01:00 2008 : Error: TLS Alert write:fatal:decrypt error Wed Mar 19 15:01:00 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Wed Mar 19 15:01:00 2008 : Error: rlm_eap: SSL error error:04077068:rsa routines:RSA_verify:bad signature Wed Mar 19 15:01:00 2008 : Error: rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. Any ideas what might be causing this or how I might determine the cause? Thanks, ~Matt

1 0

RE: Error EAP
by Gustavo Chavelas 19 Mar '08

19 Mar '08

Thanks a lot of Alan. I will try to install the SSL as you suggest me. Saludos cordiales, Message: 4 Date: Wed, 19 Mar 2008 17:07:17 +0100 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Error EAP To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <47E13A35.5050702(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Gustavo Chavelas wrote: > It's very strange. I don't delete anything. > Just modified the option in eap md5 to peap, but when I try to reload > the radius with radiusd -X the program can't work and send it errors. Then the server was built *without* SSL support. PEAP needs SSL, so... > I have another test server, and same configurations work fine. > I have copied the folder raddb that work fine to my production server, > and crash, can't work again. The issue isn't the configuration files, but the libraries. > I was formatted my server, install the freeradius, I was configured my > options and can't work again. > > If I change the option peap to md5, freeradius work fine. But if try to > change md5 to peap, don't work again. > > Do you have any suggest? Install the OpenSSL libraries && header files. Then re-build FreeRADIUS. Alan DeKok.

1 0

Re: Error EAP
by Gustavo Chavelas 19 Mar '08

19 Mar '08

Hi, Ivan. Thanks for your answer. It's very strange. I don't delete anything. Just modified the option in eap md5 to peap, but when I try to reload the radius with radiusd -X the program can't work and send it errors. I have another test server, and same configurations work fine. I have copied the folder raddb that work fine to my production server, and crash, can't work again. I was formatted my server, install the freeradius, I was configured my options and can't work again. If I change the option peap to md5, freeradius work fine. But if try to change md5 to peap, don't work again. Do you have any suggest? Regardds Message: 2 Date: Tue, 18 Mar 2008 11:56:35 +0100 From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: Error EAP To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <8rxFTXYg.1205837795.4525660.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 You have broken eap.conf. Go back to the default and try again. Read instructions in the file first and *don't* delete anything you are not certain about. Ivan Kalik Kalik Informatika ISP Dana 17/3/2008, "Gustavo Chavelas" <gchavelas(a)bfmx.com.mx> pi?e: >Hi to all. > > > >I'm installing freeradius-server-2.0.2.tar.gz,i was to configured it, but >when I try to start radiusd -X, I have an error : > >rlm_eap: No such sub-type for default EAP type peap > >/usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > >/usr/local/etc/raddb/radiusd.conf[1944]: Failed to find module "eap". > >/usr/local/etc/raddb/radiusd.conf[1891]: Errors parsing authenticate >section. > >} > >} > >Errors initializing modules > > > >Im searching for solve this error, something have any suggest? > > > >Saludos cordiales, > > > ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 35, Issue 58 ************************************************

2 1