- Freeradius-Users - lists.freeradius.org

Re: NAS list update without restarting radius server.
by Andy Smith 23 Jan '08

23 Jan '08

Hi, well the previous info regarding this only being read at startup was specific to data in SQL, so I suppose a kill -HUP should work. But I haven't tested it :P, maybe someone else on the list can tell us, otherwise give it a go by manually updating the clients.conf and try a kill -HUP, cheers Andy. ----- Original Message ----- From: "Pawel Cieplinski" <pawel(a)parkandmarine.com> To: "'A.smith'" <a.smith(a)ukgrid.net> Sent: Wednesday, January 23, 2008 2:02 PM Subject: RE: NAS list update without restarting radius server. > >> >> Hey Pawel, >> >> why not have a script read the contents of the NAS table >> and update the freeradius clients.conf text file with the >> data, then configure freeradius to use the clients.conf file >> rather than MySQL for the secrets data? You could have it run >> every minute or so??? >> >> cheers Andy. >> > > Ok Andy but is radiusd not readind clients.conf on start ? Like data from > SQL ? > > Pawel > >> ________________________________________________ >> Message sent using UK Grid Webmail 2.7.9 >> >> >> >> >> -- >> No virus found in this incoming message. >> Checked by AVG Free Edition. >> Version: 7.5.516 / Virus Database: 269.19.9/1238 - Release >> Date: 22/01/2008 20:12 >> >> > > > > -- > No virus found in this incoming message. > Checked by AVG Free Edition. > Version: 7.5.516 / Virus Database: 269.19.9/1239 - Release Date: > 23/01/2008 10:24 > >

3 2

Re: NAS list update without restarting radius server.
by A.smith 23 Jan '08

23 Jan '08

Hey Pawel, why not have a script read the contents of the NAS table and update the freeradius clients.conf text file with the data, then configure freeradius to use the clients.conf file rather than MySQL for the secrets data? You could have it run every minute or so??? cheers Andy. ________________________________________________ Message sent using UK Grid Webmail 2.7.9

1 0

RE: multiple access credential
by Rakesh Jha 23 Jan '08

23 Jan '08

unsubscribe -----Original Message----- From: freeradius-users-bounces+rakesh=burgan.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+rakesh=burgan.com@lists.freeradius.org] On Behalf Of Thierry CHICH Sent: Wednesday, January 23, 2008 1:44 PM To: FreeRadius users mailing list Subject: Re: multiple access credential Le mercredi 23 janvier 2008, arjuna(a)ts.infn.it a écrit : > this is the problem: > > I need different kind of authentication against a Ldap dir, better with > the same username (userid,uid). > For instance, the mail attribute ? You just have to change the filter in the ldap configuration > May i use the huntgroup file to make freeradius look for different fields > into the ldap dir? > > for example: > > ou=People Your example is not very clear, I think. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0

Re: multiple access credential
by arjuna＠ts.infn.it 23 Jan '08

23 Jan '08

> > For instance, the mail attribute ? You just have to change the filter in > the > ldap configuration i need different filter for different cases. ldap configuration section in radius.conf covers only one case, is it right? > >> May i use the huntgroup file to make freeradius look for different >> fields >> into the ldap dir? >> >> for example: >> >> ou=People > > Your example is not very clear, I think. > yes sorry, i sent the email while writing... :) my fault. ou=People uid=username wireless-access-password=whatever shell-access-password=whatever2 802.3-access-password=xx:xx:xx:xx:xx:xx something like this. So i need to get the right password on the base of the "NAS" ip (NAS is not the very right word). Now is it clearer? So, can a single radius server manages this scenario? Do i need realms or huntgroup files or something else? thanks arjuna

1 0

multiple access credential
by arjuna＠ts.infn.it 23 Jan '08

23 Jan '08

this is the problem: I need different kind of authentication against a Ldap dir, better with the same username (userid,uid). May i use the huntgroup file to make freeradius look for different fields into the ldap dir? for example: ou=People

2 1

FreeRadius V2.0.0 Simultaneous-Use Problems
by Dryw Paulic 22 Jan '08

22 Jan '08

Hello Everyone, On Freeradius Version 2.0.0, I have an issue with Simultaneous-Use. Multiple logins are being caught, but the issue seems to be that the checks seem to be catching much more than they should be. In particular, I was looking at this user: mysql> select * from radgroupcheck; +----+-----------+------------------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+------------------+----+-------+ | 1 | dynamic | Auth-Type | == | Local | | 2 | static | Auth-Type | == | Local | | 8 | static | Simultaneous-Use | := | 1 | | 7 | dynamic | Simultaneous-Use | := | 1 | +----+-----------+------------------+----+-------+ 4 rows in set (0.00 sec) mysql> select * from radusergroup where username='Kat'; +----------+-----------+----------+ | UserName | GroupName | priority | +----------+-----------+----------+ | Kat | static | 1 | +----------+-----------+----------+ 1 row in set (0.00 sec) mysql> select * from radcheck where username='Kat'; +------+----------+------------+----+----------------------+ | id | UserName | Attribute | op | Value | +------+----------+------------+----+----------------------+ | 4946 | Kat | Password | == |testing123 | | 4947 | Kat | expiration | := | 15 Feb 2008 15:01:32 | +------+----------+------------+----+----------------------+ 2 rows in set (0.00 sec) I took a look at the SQL Queries used by freeradius to check the logins and decided to run them manually on my sql database: mysql> SELECT COUNT(*) FROM radacct WHERE username = 'Kat' AND acctstoptime = 0; +----------+ | COUNT(*) | +----------+ | 16 | +----------+ 1 row in set (0.00 sec) But if I run: mysql> select * from radacct where username ='Kat' \G; *************************** 26. row *************************** radacctid: 1789 acctsessionid: 00:0E:0C:2D:18:56:12008736891000 acctuniqueid: 9d581ecac1736df4 username: kat groupname: realm: nasipaddress: ###.###.###.### nasportid: nasporttype: Wireless-802.11 acctstarttime: 2008-01-20 23:22:02 acctstoptime: 2008-01-20 23:22:02 acctsessiontime: 1322 acctauthentic: RADIUS connectinfo_start: connectinfo_stop: acctinputoctets: 425841 acctoutputoctets: 170623 calledstationid: 00:0E:0C:2D:18:56 callingstationid: 00:13:e8:6a:e1:cf acctterminatecause: Admin-Reset servicetype: framedprotocol: framedipaddress: 10.51.2.56 acctstartdelay: 0 acctstopdelay: 0 xascendsessionsvrkey: NULL 26 rows in set (0.00 sec) You can see from the last row returned that they are indeed logged out. But attempts to login are futile as radpostauth shows: +------+------+--------+---------------+--------------------------+ | id | user | pass | reply | date | +------+------+--------+---------------+--------------------------+ | 97264 | Kat | testing123 | Access-Reject | 2008-01-21 09:40:50 | +------+------+--------+---------------+--------------------------+ The problem is, if you try to log this person in the server saying that they are already logged in, because the simul_count_query is picking up *ALL* rows which have accountstoptime = 0. This is an problem because all the accounting records are kept in the same place as the start and stop records, which means that there will always be records with an acctstoptime=0 in that table. Am I doing anything wrong here? Any tips on how to fix this problem would be much appreciated. Thanks in Advance! Regards, Dryw Paulic

3 4

Imagestream
by Matthew Neumark 22 Jan '08

22 Jan '08

Any imagestream users know how to setup the router to get speed limiting queues from freeradius? Matt

1 0

Version 2.0.1 has been released.
by Alan T DeKok 22 Jan '08

22 Jan '08

Version 2.0.0 was released less than two weeks ago, and has proven to be very stable and bug-free. A few issues have recently been found and fixed, and "unlang" has has some minor changes which result in much simpler policies. As a result, we are releasing 2.0.1 today. See http://freeradius.org for the announcement and download links. Feature improvements * "unlang" has been expanded to do less run-time expansion, and to have better handling of typed data. See "man unlang" for documentation and new examples. Bug fixes * The 'acct_unique' module has been updated to understand the deprecated (but still used) Client-IP-Address attribute. * The EAP-MSCHAPv2 module no longer leaks MS-CHAP2-Success in packets. * Fixed crash in rlm_dbm. * Fixed parsing of syslog configuration. The changes in "unlang" simplify references to attributes, and add type-specific checking: if (Framed-IP-Address) { # was "%{Framed-Ip-Address}" in 2.0.0 ... # not possible in 2.0.0 if ((Framed-IP-Address > 192.168.0.1) && (Framed-IP-Address < 192.168.0.4)) { ... # refer to VALUEs by name: if (Service-Type == Login-User) { ... Alan DeKok.

2 1

Re: Problem with Vista EAP-PEAP Authentication
by debug afone 22 Jan '08

22 Jan '08

Hi, Yes, Freeradius has been compiled with freeradius.org sources. You'll find below the end of Freeradius debug output : Tue Jan 22 17:18:48 2008 : Debug: Thread 4 handling request 3, (1 handled so far) User-Name = "nsouleman" NAS-IP-Address = 10.40.0.114 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000fb5905b7e" Calling-Station-Id = "0019d2ae409a" NAS-Identifier = "ap" NAS-Port-Type = Wireless-802.11 NAS-Port = 32 NAS-Port-Id = "32" Framed-MTU = 1400 State = 0x4d65e25317851beaa7122ab0f6d7758f EAP-Message = 0x020400061900 Message-Authenticator = 0x5fe3280798b9c0bf7eb60427ac59acac Tue Jan 22 17:18:48 2008 : Debug: Processing the authorize section of radiusd.conf Tue Jan 22 17:18:48 2008 : Debug: modcall: entering group authorize for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 3 Tue Jan 22 17:18:48 2008 : Debug: radius_xlat: '/usr/local/freeradius-1.1.6/var/log/radius/radacct/10.40.0.114/auth-detail- 20080122' Tue Jan 22 17:18:48 2008 : Debug: rlm_detail: /usr/local/freeradius-1.1.6/var/log/radius/radacct/%{Client-IP-Address}/auth -detail-%Y%m%d expands to /usr/locaar/log/radius/radacct/10.40.0.114/auth-detail-20080122 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "auth_log" returns ok for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "chap" returns noop for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: EAP packet type response id 4 length 6 Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "eap" returns updated for request 3 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: - authorize Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: performing user authorization for nsouleman Tue Jan 22 17:18:48 2008 : Debug: radius_xlat: '(&(objectclass=posixAccount)(uid=nsouleman))' Tue Jan 22 17:18:48 2008 : Debug: radius_xlat: 'ou=Users,dc=angers,dc=afone,dc=fr' Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: performing search in ou=Users,dc=angers,dc=afone,dc=fr, with filter (&(objectclass=posixAccount)(uid=nsouleman)) Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: Added password xxxxxxx in check items Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: looking for check items in directory... Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: Adding sambaNTPassword as NT-Password, value 06ED974D43A7B40ACF5F9798C7060A4B & op=21 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: Adding sambaLMPassword as LM-Password, value 2C720756F237E37AAAD3B435B51404EE & op=21 Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: looking for reply items in directory... Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: user nsouleman authorized to use remote access Tue Jan 22 17:18:48 2008 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Jan 22 17:18:48 2008 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall[authorize]: module "ldap" returns ok for request 3 Tue Jan 22 17:18:48 2008 : Debug: modcall: leaving group authorize (returns updated) for request 3 Tue Jan 22 17:18:48 2008 : Debug: rad_check_password: Found Auth-Type EAP Tue Jan 22 17:18:48 2008 : Debug: auth: type "EAP" Tue Jan 22 17:18:48 2008 : Debug: Processing the authenticate section of radiu Tue Jan 22 17:18:48 2008 : Debug: modcall: entering group authenticate for reque Tue Jan 22 17:18:48 2008 : Debug: modsingle[authenticate]: calling eap (rlm_ea Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: Request found, released from the li Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: EAP/peap Tue Jan 22 17:18:48 2008 : Debug: rlm_eap: processing type peap Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_peap: Authenticate Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_tls: processing TLS Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_tls: Received EAP-TLS ACK message Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_tls: ack handshake fragment handler Tue Jan 22 17:18:48 2008 : Debug: eaptls_verify returned 1 Tue Jan 22 17:18:48 2008 : Debug: eaptls_process returned 13 Tue Jan 22 17:18:48 2008 : Debug: rlm_eap_peap: EAPTLS_HANDLED Tue Jan 22 17:18:48 2008 : Debug: modsingle[authenticate]: returned from eap ( Tue Jan 22 17:18:48 2008 : Debug: modcall[authenticate]: module "eap" returns Tue Jan 22 17:18:48 2008 : Debug: modcall: leaving group authenticate (returns h Sending Access-Challenge of id 155 to 10.40.0.114 port 1073 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4ad057184faa4b804f88ebf214d9cbe0 Tue Jan 22 17:18:48 2008 : Debug: Finished request 3 Tue Jan 22 17:18:48 2008 : Debug: Going to the next request Tue Jan 22 17:18:48 2008 : Debug: Thread 4 waiting to be assigned a request Tue Jan 22 17:19:19 2008 : Debug: --- Walking the entire request list --- Tue Jan 22 17:19:19 2008 : Debug: Cleaning up request 0 ID 152 with timestamp 47961768 Tue Jan 22 17:19:19 2008 : Debug: Cleaning up request 1 ID 153 with timestamp 47961768 Tue Jan 22 17:19:19 2008 : Debug: Cleaning up request 2 ID 154 with timestamp 47961768 Tue Jan 22 17:19:19 2008 : Debug: Cleaning up request 3 ID 155 with timestamp 47961768 Tue Jan 22 17:19:19 2008 : Debug: Nothing to do. Sleeping until we see a request.

1 0

rlm_opendirectory (FR 2.0.0)
by Info 22 Jan '08

22 Jan '08

Hello all, Quick Qs about the experimental rlm_opendirectory module: * Has anyone built in this module successfully? * Is it possible to add this in without the other experimental modules and, if so, what is the proper flag? (Note, I've tried on separate runs --with-rlm_opendirectory, --enable-rlm_opendirectory, and --with-modules="rlm_opendirectory" seemingly to no avail.) * Does the module need to be built against a server version of the Framework or should I be able to build this from the libraries on any os x workstation? Cheers, Jim ___________________________________________________ James H. Graham II, Creative Director • Spark Media Group 6511 Allegheny Avenue • Takoma Park, MD 20912-4737 Tel: 301.270.4810 • Fax: 301.270.4812 • www.sparkmediagroup.com

1 0