- Freeradius-Users - lists.freeradius.org

Re: Packets in Accounting ?
by Alan DeKok 01 Dec '07

01 Dec '07

Edvin Seferovic wrote: > what happened to the Acct-Input/Output-Packets in Accounting. MySQL > schema doesn’t have those fields anymore. Any special reason ? Were they ever in the schema? I don't see them in 1.1.x. Alan DeKok.

2 1

Newbie: What does this mean (Wrong NAS port ID)?
by Piero Giobbi 01 Dec '07

01 Dec '07

Hi all. Im using freeradius 1.1.7 with Proxim AP4000 and it works. But i get this in my syslog. Error: rlm_radutmp: Logout entry for NAS ap-serverummet port 9 has wrong ID What does this mean? Can i ignore it? Can't really find anything useful on the net.. client-conf: client 10.0.5.191 { secret = xxx shortname = ap-serverummet nastype = other # localhost isn't usually a NAS... } thx. p

2 1

LDAP Authentication: filter problem
by Carlos Parada 01 Dec '07

01 Dec '07

Hi all, I'm using an LDAP-based authentication. I'd have a simple (typical filter) like this filter = uid=%{User-Name} Now, in addition, I'd need to authenticate based on a Service-Info attribute. So I need something like filter = "(&(uid=%{User-Name})(radiusServiceInfo=%{Service-Info})) The problem is that when Service-Info doesn't come in the Radius packet (because is not mandatory for me), it doesn't work, and I see on LDAP the following filter="(&(uid=test1)(?=undefined))" If Service-Info not present, I would expect something like filter="(&(uid=test1)(radiusSeviceInfo=))" Worse, in fact, what I need is a filter slightly different like filter = "(&(uid=%{User-Name})(!(radiusServiceInfo=%{Service-Info}))) In that case (using the !), the query sent is the following filter="(&(uid=test1)(?=error))" I've already search about that on the freeradius mailing-lists and I didn't saw any report about this problem. Is that any kind of bug? Or am I doing something wrong? I appreciate some help. Best Regards, Carlos Parada

2 1

Query regarding Grouping devices and users for login Access
by ajay raut 01 Dec '07

01 Dec '07

Hi, I am trying one test setup in my LAB on RADIUS. As i am new to all the feature of Radius, I need one information on Radius feature urgently....So any information regarding this will be very helpful for me. The Query is... assume a scenario..there is an organisation having centralized Radius server for shell login on all the WAN devices like routers and Switches. Organisation needs a configuration previlleges to be grouped regionwise means the devices which are local to a particular location the local adminstrator can configure it but they will not have any access previlleges to other devices.. This should be done regionwise... Meaning of this we need to configure a RADIUS for grouping devices and users in a same group . Thanking u in advance for any inputs.. Thanks, Ajay Raut --------------------------------- Get easy, one-click access to your favorites. Make Yahoo! your homepage.

3 2

Re: rlm_passwd and EAP-MD5
by Alan DeKok 01 Dec '07

01 Dec '07

Kolbjørn Barmen wrote: >> HUP does not work reliably, and cannot be made to, for architectural reasons. >> However, Alan has recently added code to the CVS HEAD which will reload >> *certain* portions of the server (just "users" files I believe) safely on HUP. > > Well, that's not a big difference from my point of view, since restarting > the server is done quite quickly anyhow. I'm more surpriced that I have to > do anything, I would expcet that one can change passwords in a passwd-file > without having to restart anything - I actually took that for granted. So... you didn't read the documentation to see how it behaved. And when you were told how it behaved, your response is to complain. Go read the main README in the source. Section 5 is meant for you. i.e. you're complaining that you don't like the behavior of something you downloaded for free, AFTER you received free support on this mailing list. > But ok, I guess I can create a script that does what I thought freeradius > did already, monitor the passwd file and restart freeradius when it > notices changes. Instead of complaining, you could submit patches to FreeRADIUS to make it work better. But I would be naive to expect someone with your attitude to do that. Alan DeKok.

1 0

unsubcribe-freeradius-users@list.freeradius.org
by affia＠ipnet.net.id 01 Dec '07

01 Dec '07

--------------------------------------------------------------------------------------- Our email server deny .zip attachement and using graymilter Please rename .zip to example: .ziper Please read http://www.acme.com/software/graymilter ---------------------------------------------------------------------------------------

1 0

Re: rlm_passwd and EAP-MD5
by Phil Mayers 30 Nov '07

30 Nov '07

Kolbjørn Barmen wrote: > On Thu, 29 Nov 2007, A.L.M.Buxey(a)lboro.ac.uk wrote: > >> Hi, >> >>> Hm, does this mean that even now when I use rlm_passwd and tacacs >>> passwd file, I need to HUP radiusd whenever someone changes their >>> password? >> dont HUP the server, restart the process. > > But is this for real? I need to restart the server if someone changes > their password in the file that is configured with rlm_passwd? Yes > > If so, that's not just a minor annoyance :P > Then use an SQL database. HUP does not work reliably, and cannot be made to, for architectural reasons. However, Alan has recently added code to the CVS HEAD which will reload *certain* portions of the server (just "users" files I believe) safely on HUP. You could possibly contribute (or pay someone to do so) code to do this for rlm_passwd, but to be honest - why bother when SQL is available?

2 1

exec ntlm_auth doesn't fail
by Dead6re 30 Nov '07

30 Nov '07

I am trying to get exec ntlm_auth to work so I can use ms-chap authentication but I am having a problem. Trying to use the radtest tool I sent a valid username but an incorrect password but yet FreeRadius still sends back an access-accept. Why? --------------------------- Log ----------------------------------------------------- Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32770, id=205, length=56 User-Name = "9430" User-Password = "hello" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "9430", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ntlm_auth auth: type "ntlm_auth" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "ntlm_auth" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 Sending Access-Accept of id 205 to 127.0.0.1 port 32770 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 205 with timestamp 474ea5b4 Nothing to do. Sleeping until we see a request. --------------------------- Radiusd.conf ----------------------------------------- modules { exec ntlm_auth { wait = no program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --username=9430 --password=aaa" } ...... } authenticate { ntlm_auth ...... } -- View this message in context: http://www.nabble.com/exec-ntlm_auth-doesn%27t-fail-tf4896518.html#a14023756 Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Re: rlm_passwd and EAP-MD5
by Alan DeKok 30 Nov '07

30 Nov '07

Kolbjørn Barmen wrote: > Hm, does this mean that even now when I use rlm_passwd and tacacs passwd > file, I need to HUP radiusd whenever someone changes their password? The rlm_passwd documentation doesn't say it will re-read the file when it changes. Alan DeKok.

1 0

Re: rlm_passwd and EAP-MD5
by A.L.M.Buxey＠lboro.ac.uk 30 Nov '07

30 Nov '07

Hi, > But is this for real? I need to restart the server if someone changes > their password in the file that is configured with rlm_passwd? > > If so, that's not just a minor annoyance :P there are other modules which provide non-restart functionality such as SQL password modules - there has also been recent work in CVS head to make certain modules compatible with a HUP. however, HUP and server restart - think logically about what is the difference? When you HUP you tear down and make unavailable the server anyway. some very nasty things happen in most daemons that are hup'able. at least the freeradius HUP work that has been undertaken keeps all the states alive. alan

1 0