- Freeradius-Users - lists.freeradius.org

Query regarding Grouping devices and users for login Access
by ajay raut 01 Dec '07

01 Dec '07

Hi, I am trying one test setup in my LAB on RADIUS. As i am new to all the feature of Radius, I need one information on Radius feature urgently....So any information regarding this will be very helpful for me. The Query is... assume a scenario..there is an organisation having centralized Radius server for shell login on all the WAN devices like routers and Switches. Organisation needs a configuration previlleges to be grouped regionwise means the devices which are local to a particular location the local adminstrator can configure it but they will not have any access previlleges to other devices.. This should be done regionwise... Meaning of this we need to configure a RADIUS for grouping devices and users in a same group . Thanking u in advance for any inputs.. Thanks, Ajay Raut --------------------------------- Get easy, one-click access to your favorites. Make Yahoo! your homepage.

3 2

Re: rlm_passwd and EAP-MD5
by Alan DeKok 01 Dec '07

01 Dec '07

Kolbjørn Barmen wrote: >> HUP does not work reliably, and cannot be made to, for architectural reasons. >> However, Alan has recently added code to the CVS HEAD which will reload >> *certain* portions of the server (just "users" files I believe) safely on HUP. > > Well, that's not a big difference from my point of view, since restarting > the server is done quite quickly anyhow. I'm more surpriced that I have to > do anything, I would expcet that one can change passwords in a passwd-file > without having to restart anything - I actually took that for granted. So... you didn't read the documentation to see how it behaved. And when you were told how it behaved, your response is to complain. Go read the main README in the source. Section 5 is meant for you. i.e. you're complaining that you don't like the behavior of something you downloaded for free, AFTER you received free support on this mailing list. > But ok, I guess I can create a script that does what I thought freeradius > did already, monitor the passwd file and restart freeradius when it > notices changes. Instead of complaining, you could submit patches to FreeRADIUS to make it work better. But I would be naive to expect someone with your attitude to do that. Alan DeKok.

1 0

unsubcribe-freeradius-users@list.freeradius.org
by affia＠ipnet.net.id 01 Dec '07

01 Dec '07

--------------------------------------------------------------------------------------- Our email server deny .zip attachement and using graymilter Please rename .zip to example: .ziper Please read http://www.acme.com/software/graymilter ---------------------------------------------------------------------------------------

1 0

Re: rlm_passwd and EAP-MD5
by Phil Mayers 30 Nov '07

30 Nov '07

Kolbjørn Barmen wrote: > On Thu, 29 Nov 2007, A.L.M.Buxey(a)lboro.ac.uk wrote: > >> Hi, >> >>> Hm, does this mean that even now when I use rlm_passwd and tacacs >>> passwd file, I need to HUP radiusd whenever someone changes their >>> password? >> dont HUP the server, restart the process. > > But is this for real? I need to restart the server if someone changes > their password in the file that is configured with rlm_passwd? Yes > > If so, that's not just a minor annoyance :P > Then use an SQL database. HUP does not work reliably, and cannot be made to, for architectural reasons. However, Alan has recently added code to the CVS HEAD which will reload *certain* portions of the server (just "users" files I believe) safely on HUP. You could possibly contribute (or pay someone to do so) code to do this for rlm_passwd, but to be honest - why bother when SQL is available?

2 1

exec ntlm_auth doesn't fail
by Dead6re 30 Nov '07

30 Nov '07

I am trying to get exec ntlm_auth to work so I can use ms-chap authentication but I am having a problem. Trying to use the radtest tool I sent a valid username but an incorrect password but yet FreeRadius still sends back an access-accept. Why? --------------------------- Log ----------------------------------------------------- Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32770, id=205, length=56 User-Name = "9430" User-Password = "hello" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "9430", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ntlm_auth auth: type "ntlm_auth" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "ntlm_auth" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 Sending Access-Accept of id 205 to 127.0.0.1 port 32770 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 205 with timestamp 474ea5b4 Nothing to do. Sleeping until we see a request. --------------------------- Radiusd.conf ----------------------------------------- modules { exec ntlm_auth { wait = no program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --username=9430 --password=aaa" } ...... } authenticate { ntlm_auth ...... } -- View this message in context: http://www.nabble.com/exec-ntlm_auth-doesn%27t-fail-tf4896518.html#a14023756 Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Re: rlm_passwd and EAP-MD5
by Alan DeKok 30 Nov '07

30 Nov '07

Kolbjørn Barmen wrote: > Hm, does this mean that even now when I use rlm_passwd and tacacs passwd > file, I need to HUP radiusd whenever someone changes their password? The rlm_passwd documentation doesn't say it will re-read the file when it changes. Alan DeKok.

1 0

Re: rlm_passwd and EAP-MD5
by A.L.M.Buxey＠lboro.ac.uk 30 Nov '07

30 Nov '07

Hi, > But is this for real? I need to restart the server if someone changes > their password in the file that is configured with rlm_passwd? > > If so, that's not just a minor annoyance :P there are other modules which provide non-restart functionality such as SQL password modules - there has also been recent work in CVS head to make certain modules compatible with a HUP. however, HUP and server restart - think logically about what is the difference? When you HUP you tear down and make unavailable the server anyway. some very nasty things happen in most daemons that are hup'able. at least the freeradius HUP work that has been undertaken keeps all the states alive. alan

1 0

Packets in Accounting ?
by Edvin Seferovic 30 Nov '07

30 Nov '07

Hello, what happened to the Acct-Input/Output-Packets in Accounting. MySQL schema doesn't have those fields anymore. Any special reason ? Regards, E:S

1 0

Expiration module?
by Evert 30 Nov '07

30 Nov '07

Hi all! I'm trying to implement expiration, as mentioned in the wiki at http://wiki.freeradius.org/Radiusd.conf But all this gives me is: Failed to link to module 'rlm_expiration': rlm_expiration.so: cannot open shared object file: No such file or directory Is the wiki outdated on this point? Regards, Evert

2 3

Problem compiling freeradius 1.1.7
by Patrice Oliver 29 Nov '07

29 Nov '07

Hello, I have a problem compiling freeradius 1.1.7 When I use the make command, just after ./configure, I get the following error message : *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/admin/freeradius/freeradius-1.1.7/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /home/admin/freeradius/freeradius-1.1.7/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.1.7.so -o .libs/rlm_perl-1.1.7.so What's wrong ? Regards. -- *Hospices Civils de Beaune* *Patrice OLIVER* /Chef de Projet Ville Hôpital/ /Responsable Réseau & Sécurité/ BP 104 21203 BEAUNE Cedex Tél. 03 80 24 44 09 Fax. 03 80 24 45 90 ------------------------------------------------------------------------ Ce message, y compris les pièces jointes, est établi à l'attention exclusive de son ou ses destinataires et est confidentiel. Toute utilisation non conforme à sa destination, toute diffusion ou publication, totale ou partielle, est interdite sauf autorisation expresse de l'expéditeur. Si vous n'êtes pas le destinataire de ce message, merci d'avertir l'expéditeur de l'erreur de distribution puis de le détruire. Tout message électronique est susceptible d'altération et son intégrité ne peut être assurée. L'expéditeur décline toute responsabilité dans l'hypothèse où il aurait été modifié ou falsifié.

5 6