- Freeradius-Users - lists.freeradius.org

2.0.0-pre2 missing radrelay functionality?
by Brian De Wolf 21 Nov '07

21 Nov '07

While looking into fixes for my previous post, I began poking at 2.0.0-pre2. I see that radrelay's functionality is supposed to have been merged into the main server, but I do not see where it has the same capability of relaying accounting packets to other RADIUS servers. Has this functionality been removed? There is no mention of it in the man page or the example configuration, but I would hope it's in there somewhere, otherwise radrelay should probably still exist.

2 1

With passwords only
by build 21 Nov '07

21 Nov '07

G'day All, This is my first post so I'd like to thank those who make this list possible. I see this has been asked before but I could not find a complete answer in the archive or google. I want to setup a freeRADIUS server on a debian etch system to authenticate for a WRT54G AP using username/passwords only (no certificates). I've tried to use a few howtos and just ignore the certificates bit but no success yet. Does anyone know of a HowTo that I can use to get started? Thanking you in anticipation, build

4 8

log radius users
by stefek143 20 Nov '07

20 Nov '07

yes >Are you running server in debug mode (radiusd -X)? >Ivan Kalik >Kalik Informatika ISP >Dana 20/11/2007, "stefek143" <stefek143 at wp.pl> piše: >>ok, i set log_auth = yes and also i've uncomented detail_log and detail reply_log and everything what i have in file radius.log is "Tue Nov 20 20:38:14 2007 : Info: Using deprecated naslist file. Support for this will go away soon." and in another files " /radacct, radutmp , radwatch.log, radwtmp" i have nothing :/, what's wrong ? >> >> >>

2 1

log radius users
by stefek143 20 Nov '07

20 Nov '07

ok, i set log_auth = yes and also i've uncomented detail_log and detail reply_log and everything what i have in file radius.log is "Tue Nov 20 20:38:14 2007 : Info: Using deprecated naslist file. Support for this will go away soon." and in another files " /radacct, radutmp , radwatch.log, radwtmp" i have nothing :/, what's wrong ?

2 1

please help not allow the many connections from single user
by ann kok 20 Nov '07

20 Nov '07

Hi We has big problem to have many connections from single user in DSL clients A single user can authenticate on the different LNS server to use the internet connection. how can we prevent it? As our users are using the dynamic ip, the ip address is assigned by the LNS not the radius in this case, the ip pool can't be defined in the radius setting. Right? Can you help to give us detail info? thank you so much ____________________________________________________________________________________ Be a better pen pal. Text or chat with friends inside Yahoo! Mail. See how. http://overview.mail.yahoo.com/

4 12

log radius users
by stefek143 20 Nov '07

20 Nov '07

Hi Everybody. Is possible to log which pupil were used my radius system if i using eap-tls method to auth and ldap to autz if is possible, could you help me show what i have to change in confings Thank You.

2 1

licensing issue
by jerry jose 20 Nov '07

20 Nov '07

respected, i would like to implement the services of Freeradius server for one of our upcoming projects(Voip based application).i would like some information regarding : 1)i would like the server to interact with one of our clients programs and perform some some data retrieval tasks,ie the server recieves a request and will call an external program to perform the remaining tasks.i would like to know whether such an external program would come under GPLV2 or 3.The server performs the redirection the rest processing is performed by our application, the result will be notified by the server to the client. 2)can freeradius be used in windows (with cygwin) awaiting your reply. regards

2 1

Re:FreeRadius for wireless authentication
by cdemel 20 Nov '07

20 Nov '07

Hi I am new to radius and the list. I need to configure a free radius server to authenticate wireless users using the Organisations CA certificate which is on Netscape. wireless users will use individual certificates which are generated from the CA of the organisation. any help or documentation mostly appriciated. regs Cdem

1 0

DEFAULT entry in users file (1.0.5-->1.1.7)
by Martin Pauly 19 Nov '07

19 Nov '07

Hi everybody, sorry to ask, but I don' get it. I'm still trying to upgrade from 1.0.5 to 1.1.7. Previously, my users fiel looked like this: [some static entries for special users] [some entries with Auth-Type=Reject for special conditions] DEFAULT Auth-Type = LDAP, Called-Station-Id == "our-dialup-number" Service-Type = Framed-User, Framed-Protocol = PPP, [more reply-items for dialup users] # All other requests: simply match against LDAP # Replace 'outer' attribute User-Name with value from variable # ==> This yields the true username from inside the tunnel in case of # anonymous outer identification with 802.1x DEFAULT Auth-Type = LDAP User-Name = `%{User-Name}`, Reply-Message = "Matched DEFAULT user entry in staff-RADIUS" So all my normal users' passwords are checked against LDAP, using LDAP bind-as-user. There's a properly configured LDAP section in radiusd.conf, of course. With 1.1.7 (and perhaps with any version >=1.1.4), Auth-Type = LDAP seems to be gone, but what on earth do put there instead? The static entries (with cleartext-password for 1.1.7) work fine, With a users file like DEFAULT User-Name = `%{User-Name}` the server complains loudly about the missing Auth-Type when asking with radtest: rad_recv: Access-Request packet from host 127.0.0.1:41995, id=59, length=58 User-Name = "martin" User-Password = "testpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "pauly0", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "pauly0" rlm_realm: Proxying request from user pauly0 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 69 radius_xlat: 'pauly0' modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. So how do I direct the server to use LDAP without setting Auth-Type? Or is radtest somehow the wrong test tool in the new scenario?? Thanks, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

2 2

Rlm_sqlcounter - how to configure weekly reset on every Sunday?
by Lee Sing Chyun 19 Nov '07

19 Nov '07

Hi, I'm trying to configure a sqlcounter that is reset every Sunday 0:00AM: sqlcounter weeklycounter { counter-name = Weekly-Session-Time check-name = Max-Weekly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = weekly # For mysql: query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } After that, I did a radtest. From the resulting SQL trace, I notice "%b" is expanded as 7 days earlier than today. For instance, when running radtest on 20 Nov 2007 1:16AM (a Tuesday), "%b" gets expanded to 13 Nov 2007 0:00AM (a Tuesday too), which is not my desired outcome. Hence, how do I configure a sqlcounter that is reset every Sunday 0:00AM? Thanks in advance, and sorry if there're any obvious mistakes that I have overlooked. -- sc

1 0