- Freeradius-Users - lists.freeradius.org

R: Sqlippool & debian - sql_get_socket unresolved symbol
by Francesco Cristofori 31 Oct '07

31 Oct '07

> Try editing the Makefiles so that rlm_sqlippool links to rlm_sql. > Maybe that will solve the problem. I tried to do this, but I'm not a good coder so I filed a bug against the debian package. > Alan DeKok. Thanks, Francesco.

1 0

Re: Turn of user acc - MySQL
by Marinko Tarlac 31 Oct '07

31 Oct '07

Subject: Re: Turn of user acc - MySQL > > Deleting user from the database - bad idea. You do want him back? I have users inside another table (name, address, id etc..) and only those who need access I transfer to radcheck table. So if I remove them from radcheck, I can easily turn them back. > > Auth-Type Reject is a check item so it would go into rad(group)check > table. It's better to create a group for suspended users and swithch > user to it than to add the attribute to each user. > > Think about using sqlcounters and/or Epiration attribute. Good ideas so I will think about it... Best regards > > Ivan Kalik > Kalik Informatika ISP > > > Dana 30/10/2007, "Marinko Tarlac" <mangia81(a)gmail.com> pi?e: > > >Hello > > > >I made small web based application and it uses MySql database. I can > >add user accounts, create packages, add access points etc and now I > >need to create script for user control. > > > >Question is next. Is it better to remove the username from radcheck > >table or it is better option to add access-reject atribute for > >specific user in radreply table. Is there any better solution. Also > >I'm thinking to create small perl script which I can call during auth > >process. > > > >I'm not sure did you understand me :) > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > > > ------------------------------ > > Message: 7 > Date: Wed, 31 Oct 2007 11:53:23 +1000 (EST) > From: David Hobley <david.hobley(a)mionegroup.com> > Subject: Re: Configure authentication via LDAP Group membership issue > [sec=unclassified] > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <3661210.62301193795603796.JavaMail.root(a)mail.onegrp.com> > Content-Type: text/plain; charset="utf-8" > > Frank, > > Thank you - greatly appreciated. This made me realise that my thinking was foggy when I had defined group memberships. All working now. > > Cheers, > David > ----- Original Message ----- > From: "Frank MR Ranner" <Frank.Ranner(a)defence.gov.au> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Sent: Wednesday, 31 October 2007 10:20:36 AM (GMT+1000) Australia/Brisbane > Subject: RE: Configure authentication via LDAP Group membership issue [sec=unclassified] > > ... > _______________________________ > > The memberUid attribute in a posixgroup is supposed to hold the uid, not > the uidNumber. That would make your groupmembership_filter = > "(memberUid=%{User-Name})" or more robustly, > groupmembership_filter = > "(&(memberUid=%{Stripped-User-Name:-%{User-Name}})(objectClass=posixGrou > p))" > > Regards, > Frank Ranner > > >

1 0

no DB handles
by Lucas Aimaretto 31 Oct '07

31 Oct '07

Hi all, I've seen many of these messages in the radius.log ... Wed Jun 15 15:10:23 2005 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 What does it mean ? How to solve this ? Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

11 23

The best encryption/access control scheme
by Ian Truelsen 31 Oct '07

31 Oct '07

I have become in charge of a small wireless ISP at my local marina and am looking for the best way to control access and encrypt for security. Currently I have a Linksys WRT54G router running DD-WRT firmware and a PC that I have now converted over to a linux box for freeradius, etc. The major stumbling block is that we have clients with equipment that cannot deal with WPA encryption, and so, I think, I am forced to use WEP key. Now, the main concern is access control, as in the past there have been those in the area abusing the open AP and draining all the bandwidth. So, what would be the best scheme to use for setting this up? Is a freeradius login/pass scheme with WEP key encryption the best that I can manage, or are there other options? Thanks. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com

2 1

Configure authentication via LDAP Group membership issue
by David Hobley 31 Oct '07

31 Oct '07

I have set up a VPN pointing to a FreeRadius server and have it authenticating successfully against my LDAP server, but I would also like to limit access to only those people who are a member of the VPN group. Normally, this would be simple, but because of the LDAP server I am using, the hierarchy looks like this: User Account: ldapsearch -h ldap -x -b "dc=MY,dc=DOMAIN" "(uid=firstname.lastname)" dn: uid=firstname.lastname,ou=people,dc=MY,dc=DOMAIN uidNumber: 1024 ... Group entry is: ldapsearch -h ldap -x -b "dc=MY,dc=DOMAIN" "(cn=VPN Users)" dn: cn=VPN Users,ou=groups,dc=MY,dc=DOMAIN memberUid: 1024 ... So I need to somehow configure Radius to search on me, get my uidNumber and then search on the group. If I skip the searching to get the uidNumber, I can configure the Radius (for this single account) correctly: In the ldap module I include: ... groupname_attribute = cn groupmembership_filter = "(memberUid=1024)" with the following entry in the users file: DEFAULT Auth-Type = LDAP Fall-Through = 1 DEFAULT LDAP-Group == "VPN Users" Service-Type = Administrative-User and this works as expected, but is there any way I can substitute the 1024 for an ldap search result so I can dynamically return the uidNumber for the %{User-Name} field? Thanks! Cheers, David

2 3

Turn of user acc - MySQL
by Marinko Tarlac 31 Oct '07

31 Oct '07

Hello I made small web based application and it uses MySql database. I can add user accounts, create packages, add access points etc and now I need to create script for user control. Question is next. Is it better to remove the username from radcheck table or it is better option to add access-reject atribute for specific user in radreply table. Is there any better solution. Also I'm thinking to create small perl script which I can call during auth process. I'm not sure did you understand me :)

2 1

delayed Access Reject response
by Florin Andrei 30 Oct '07

30 Oct '07

Using freeradius-1.1.7 on Linux Fedora 7. Authentication backend is "unix". Clients so far are Cisco and pam_radius_auth If authentication is correct, the reply from server is sent back to the client quick enough. If the password is incorrect, the Access Reject reply is delayed until the user enters the password the second time. It's like the server waits for the next auth attempt to send back the Reject. What could be the cause? -- Florin Andrei http://florin.myip.org/

3 3

Re: Freeradius-Users Digest, Vol 30, Issue 110
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola: freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: PAM_RADIUS_AUTH (Sobanbabu Bakthavathsalu) 2. pam_radius_auth updated spec file, please include in future releases (Florin Andrei) 3. Re: pam_radius_auth updated spec file, please include in future releases (Florin Andrei) 4. Cert Problem with EAP-TTSL, SecureW2 (1.0.5-->1.1.7) (Martin Pauly) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Oct 2007 21:31:09 +0530 From: Sobanbabu Bakthavathsalu Subject: RE: PAM_RADIUS_AUTH To: FreeRadius users mailing list Message-ID: <50E6D895B5B13C4FB2D86D295813A4830CECEC9005(a)BLRKECMBX05.ad.infosys.com> Content-Type: text/plain; charset="us-ascii" Hi Nick, Thank you for the response. There is no firewall in between the RADIUS server and Solaris server (RADIUS client), only an Cisco router with standard ACL. I have verified the ACL matches counter and found that the request from the clinet itself is not reachign the router. Is that host entries in /etc/hosts file wont work for this, do I need a DNS server for RADIUS server name authentication to work with pam_radius_auth. The server in question is not configured for any DNS server for name resolution, it uses the hosts file only. Hope this provides more information. Regards Soban ________________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [freeradius-users-bounces(a)lists.freeradius.org] On Behalf Of Nick Owen [nowen(a)wikidsystems.com] Sent: 30 October 2007 15:37 To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH On 10/30/07, Sobanbabu Bakthavathsalu wrote: > > Hi > > I am trying install the PAM_RADIUS_AUTH on a Solaris 10 server to use RADIUS for user authentication. > I have managed to successfully compile and install the pam plugin. > When I tried to telnet to the machine from a different server I am getting the following error. > > Failed looking up IP address for RADIUS server radius1 (errcode=12) > > I have made a host entry for this server name in /etc/hosts file and able to ping the RADIUS server with name. > But still its not working. > > Could you please help on resolving this. > Lots of times this is a firewall issue where the port opening is set for tcp and not UDP. check that. Check that both are using port 1812, if that is what you are using. Have you edited your telnet pam entry? I'm not familiar with solaris, but that is what I would check. More info would be helpful too. HTH, Nick -- -- Nick Owen WiKID Systems, Inc. 404.962.8983 http://www.wikidsystems.com Commercial/Open Source Two-Factor Authentication - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS*** ------------------------------ Message: 2 Date: Tue, 30 Oct 2007 09:51:56 -0700 From: Florin Andrei Subject: pam_radius_auth updated spec file, please include in future releases To: freeradius-users(a)lists.freeradius.org Message-ID: <4727612C.8090901(a)andrei.myip.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed I attached an updated spec file for pam_radius_auth. The original one fails when building as non-root. I fixed that and made a few other minor changes. It would be nice if the build system could generate this spec file from a template, automatically replace the version number inside the spec with the actual version of the pam_radius_auth tarball, and include the automatically generated spec in the tarball. That way, users could generate RPM packages out of the tarball by simply downloading the archive and running: rpmbuild -ta pam_radius...(version number here)...tar.gz Thanks, -- Florin Andrei http://florin.myip.org/ ------------------------------ Message: 3 Date: Tue, 30 Oct 2007 10:04:51 -0700 From: Florin Andrei Subject: Re: pam_radius_auth updated spec file, please include in future releases To: freeradius-users(a)lists.freeradius.org Message-ID: <47276433.7080402(a)andrei.myip.org> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" Florin Andrei wrote: > I attached an updated spec file for pam_radius_auth. No, I didn't. _Now_ I did. :-/ -- Florin Andrei http://florin.myip.org/

1 0

Re: Freeradius-Users Digest, Vol 30, Issue 108
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola: freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: web based admin (liran tal) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Oct 2007 11:29:38 +0200 From: "liran tal" Subject: Re: web based admin To: "FreeRadius users mailing list" Message-ID: <3ed55890710300229o68359039x7993dd6229412169(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Hey Michael, On 10/29/07, Hawkins, Michael wrote: > What do people recommend I use as a web front end for FreeRadius when > managing AAA on a Cisco network via FreeRadius? > > I've seen daloradius but that is geared to wireless hotspots. I've taken > a quick look at phpRADmin and also ASN but I'm not sure which one is > more mature and would like to know other peoples thoughts. Or is > dailupadmin itself good enough? > > Any advice given is very much appreciated. I personally don't think of daloRADIUS as geared towards hotspots deployment but rather have an integrated support for that. If you find it lacking any "enterprise" scale features or missing some functionality that you require I'd love to hear from you so I can push all efforts for development on those topics. Regards, Liran. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 30, Issue 108 ************************************************* CON CARIÑO MARIBEL HERNÁNDEZ LÓPEZ __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: Freeradius-Users Digest, Vol 30, Issue 107
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola: freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Cisco sslvpn authentication with freeradius (satish patel) 2. freeRADIUS with Active-derectory (Hangjun He) 3. Re: freeRADIUS with Active-derectory (Alan DeKok) 4. Re: SSL certificate problems (Alan DeKok) 5. Re: Class attribute in accounting record. (Alan DeKok) 6. Re: web based admin (satish patel) ---------------------------------------------------------------------- Message: 1 Date: Tue, 30 Oct 2007 05:41:30 +0000 (GMT) From: satish patel Subject: Cisco sslvpn authentication with freeradius To: freeradius-users Message-ID: <47025.12580.qm(a)web8405.mail.in.yahoo.com> Content-Type: text/plain; charset="iso-8859-1" Dear all I have cisco SSLVPN gateway and i want to authenticate user freeradius authentication server but i need more input from community what type of control i can done with it ?? Is it possible to control some user session or number of time to control is there anybody have done it ??/ $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- 5, 50, 500, 5000 - Store N number of mails in your inbox. Click here.

1 0