- Freeradius-Users - lists.freeradius.org

pam_radius on RHEL AS4 (64-bit)
by GABRIEL CAPILI, BLOOMBERG/ 731 LEXIN 27 Sep '07

27 Sep '07

I compiled the latest pam_radius-1.3.17, on Red Hat Linux AS 4.0 Update4. When I ran 'make', I got: "cc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function `pam_sm_authenticate': pam_radius_auth.c:1102: warning: assignment from incompatible pointer type cc -Wall -fPIC -c -o md5.o md5.c ld -Bshareable pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so" -and it looked like it created the 'pam_radius_auth.so". When I 'file pam_radius_auth.so', it shows: "pam_radius_auth.so: ELF 64-bit LSB shared object, AMD x86-64, version 1 (SYSV), not stripped" which to me looks fine, and added it to /lib/security. I added "auth sufficient pam_radius_auth.so" to /etc/pam.d/sshd and "auth sufficient /lib/security/pam_radius_auth.so" to /etc/pam.d/ system.auth files. I tested w/ ssh, it doesn't authenticate. Will it work w/ 64- bit? Thanks. -Gabe

1 0

Re: Openser+Asterisk+Freeradius
by Live Great 27 Sep '07

27 Sep '07

Hi, is there any documentation or hyper links I can follow for the setup? Thanks SW ----- Original Message ---- From: ram <talk2ram(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wednesday, September 26, 2007 5:57:15 PM Subject: Re: Openser+Asterisk+Freeradius On 9/26/07, Live Great <livegreat007(a)yahoo.com> wrote: Hi, Is this the solution to provide an accurate billing/accounting function? What is the goal for integrating this 3 software? I've been searched google for a while, but couldn't find a clear answer. Your comment is much appreciated. yes its does depends on the deployment ram Thanks SW - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Asterisk+openser+Freeradius
by Live Great 27 Sep '07

27 Sep '07

Hi, Is this the solution to provide an accurate billing/accounting function? What is the goal for integrating this 3 software? I've been searched google for a while, but couldn't find a clear answer. Where can I download documentation about this setup? Your comment is much appreciated. Thanks SW

1 0

How to send different attributes a miscellaneous nas
by Medvedev Maxim 26 Sep '07

26 Sep '07

How I can solve a problem of sending of different attributes miscellaneous NAS from which the user in combination FR+sql or FR+ldap comes? > Multiple groups per user don't work properly. And that is what you want. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 26/9/2007, "Medvedev Maxim" <sp_root at mail.ru> pise: > >>In FreeRadius 1.1.7+LDAP group handling work ? >> >>> 1. You need to enter priority for the groups in usergroup table. >>> 2. SQL group handling doesn't really work in 1.1.x versions. Upgrade to >>> 2.0. >>> >>> Ivan Kalik >>> Kalik Informatika ISP >>> >>> Dana 25/9/2007, "Elaalala Erence" <sp_root at mail.ru> pise: >>> >>>>Hi, >>>> >>>>freeradius 1.1.7 + postgres 8.1.9 >>>> >>>>radgroupcheck not work (( >>>> >>>>http://wiki.freeradius.org/Rlm_sql >>>>point 5 not work (( >>>> >>>>Why attributes are summarised ? >>>> >>>>Help me! >> >> >> >>-- >>Best regards, >> Medvedev Maxim mailto:sp_root at mail.ru >> >>- >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >> -- Best regards, Medvedev Maxim mailto:sp_root@mail.ru

2 1

NAS IPs in LDAP?
by Jorgen Lundman 26 Sep '07

26 Sep '07

Currently using freeradius-1.1.2 Solaris openldap-2.3.19, but not live so upgrade is fine. I have successfully setup FreeRadius to use LDAP for the user/pass, and profiles. However on the legacy Radius servers, the administration that was most frequent is adding/removing/modifying the list of NAS IPs that is allowed to talk to us, and for which services. Plus this need to be synchronised with all Radius servers. Is it possible to also store the NAS IPs in LDAP, so changes can be done centrally? At the moment they are listed clients.conf. Lund -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

5 9

how can I control a user
by ann kok 26 Sep '07

26 Sep '07

Hi all how can I control to allow a user logon only in dynamic ip ipool in radius server? Thank you again ____________________________________________________________________________________ Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, news, photos & more. http://mobile.yahoo.com/go?refer=1GNXIC

2 1

Exec-Program based on LDAP Attribute
by John Wever 26 Sep '07

26 Sep '07

I need to be able to fire off a script via the Exec-Program (or some other method) based upon a successful authentication and the value of an LDAP attribute on the user's account. I tried putting the following in the acct_users... DEFAULT Acct-Status-Type == Start, CustomAttrib == true Exec-Program = "/path/to/script.sh %u %{Framed-IP-Address} %{CustomAttrib}" I've tried setting the ItemType of the CustomAttrib to checkItem and replyItem, but neither method worked. My script needs access to the username and the Framed-IP-Address. Any suggestions?

2 3

unlang question
by Norbert Wegener 26 Sep '07

26 Sep '07

I am using a recent 2.0.0-pre cvs snapshot. For 802.1x authentication AD is querried for a valid machine account and VLAN, which the ldap modules put into the radius-attribute Huntgroup-Name. The client authenticates via a certificate. Everything works as expected. Nevertheless someone inspecting the switch logs found: 12277052: .Sep 26 13:33:45.914: RADIUS: Received from id 1645/86 139.25.78.162:1812, *Access-Challenge,* len 1130 12277053: .Sep 26 13:33:45.914: RADIUS: authenticator 41 6D FD 2B B1 E6 81 32 - 92 3A 05 C1 96 B9 A5 E9 12277054: .Sep 26 13:33:45.914: RADIUS: *Tunnel-Private-Group[81] 18 "VL-SBS-AD02-0001" *12277055: .Sep 26 13:33:45.914: RADIUS: *Tunnel-Medium-Type [65] 6 00:ALL_802 [6] *12277056: .Sep 26 13:33:45.914: RADIUS: *Tunnel-Type [64] 6 00:VLAN [13] *12277057: .Sep 26 13:33:45.914: RADIUS: EAP-Message [79] 255 and claimed, the Access-Challenge with Tunnel-Private-Group, Tunnel-Medium-Type etc. are not RFC compatible. I can see those values in radiusd -AX, too, but didn't care. My question is: Is he right? If so: How would I have to change the configuration? In my sites-enabeld/default I have: ... # ldap1/2 set control:Huntgroup-Name. redundant { ldap1 ldap2 } ##################################################################################################################################### if ("%{sqlnastype:SELECT vl_vlan from vlan where vl_vlan = '%{control:Huntgroup-Name}' and vl_nasname='%{NAS-IP-Address}'}" == "%{control:Huntgroup-Name}" ) { # das vlan gibt es auf dem swicht update reply { Tunnel-Private-Group-ID ="%{control:Huntgroup-Name}" Tunnel-Medium-Type = IEEE-802 Tunnel-Type = VLAN } } .. This works as expected. Sending Access-Challenge of id 135 to 172.31.110.149 port 1645^M Tunnel-Private-Group-Id:0 = "VL-SBS-AD02-0001"^M Tunnel-Medium-Type:0 = IEEE-802^M Tunnel-Type:0 = VLAN^M EAP-Message = 0x0104040a0dc000001860160301004a02000046030146fa71a8d8d8395908fa88327d699ee4477b8e014f81fc6f5aabfabb26dda89a204f927ec5aaa134ac60f488278826fbd8be697e5826f45b2890e527d58ca26a0a00040016030113710b00136d00136a0005f6308205f2308204daa003020102020a136547850002003ae484300d06092a864886f70d01010505003081f6310b300906035504061302444531133011060a0992268993f22c64011916036e657431173015060a0992268993f22c64011916077369656d656e733110300e060355040a13075369656d656e7331453043060355040b133c49737375696e6720434120666f72206d6163^M EAP-Message = 0x68696e652063657274696669636174657320696e20746865205369656d656e7320414420666f72657374313a3038060355040b1331436f7079726967687420284329205369656d656e73204147203230303320416c6c20726967687473207265736572766564312430220603550403131b5369656d656e732049737375696e6720434120436c617373204144301e170d3037303832323233333131325a170d3038303231383233333131325a3025312330210603550403131a64653730313874632e77773930312e7369656d656e732e6e657430819f300d06092a864886f70d010101050003818d0030818902818100d420d44e29fdfd018e8ff279b4^M EAP-Message = 0x04d0421c8612c6cd6ba909bb50feca6a71089e6212ef9ae86a3a0cd12f201b25e62ec7395e1365a8bac4477551fed6c41183e2210a3b524e013f80952f7f7efef179f6b48d1a7e219a8e0e789d561b8472485f7792a6e51514018b40e1f90feb314aff3d7a55baceb56b72af1d1bb04ee8a4a30203010001a38202d4308202d0301d0603551d0e041604143349edcf20cbe55a68d010a8df8878bbce1714e4303306092b060104018237150a04263024300a06082b06010505070302300a06082b06010505070301300a06082b06010505080202300b0603551d0f0404030205a030270603551d250420301e06082b0601050507030206082b06010505^M EAP-Message = 0x07030106082b06010505080202303c06092b0601040182371507042f302d06252b060104018237150887e4bc2b85a7c80a85d19529a08c6d819ffa1381219eaf36869ee33d020164020103301f0603551d2304183016801453cf2cd0fe413db6c4731640813764d8702909993081e50603551d1f0481dd3081da3081d7a081d4a081d18681ce6c6461703a2f2f2f434e3d5369656d656e7325323049737375696e672532304341253230436c61737325323041442832292c434e3d6d63686d393335612c434e3d4344502c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e6669677572^M EAP-Message = 0x6174696f6e2c44433d7369656d656e732c44433d6e65^M Message-Authenticator = 0x00000000000000000000000000000000^M State = 0xcf369d304b83244706a446310ed5b92e^M Finished request 1 state 5^M Going to the next request^M The complete output can be found at http://www.wegener-net.de:/freeradius Norbert Wegener

2 1

R: merging accounting records from two databases
by Francesco Cristofori 26 Sep '07

26 Sep '07

> Hi, Hi Stella, I ran in your problem just quite weeks ago and I solved this way: - Use mysql replication for syncing the two database (you have to make db1 slave of db2 and db2 slave of db1: every record inserted in one db will be automatically inserted in the other one) - Use heartbeat (or whatever you like most) to configure a virtual ip for the two db servers. (eg: db1 has 10.0.0.1 , db2 has 10.0.0.2, virtual ip is 10.0.0.3) - Configure sql module to point to the virtual ip (eg: 10.0.0.3) so the radius servers are unaware of the underlying mysql cluster. You can find lots of docs on google about every topi listed above. > Cheers, > Stella Hth, Francesco.

1 0

merging accounting records from two databases
by Stella 26 Sep '07

26 Sep '07

Hi, We're setting up two radius servers and configuring them so the accounting records are inserted into a mysql database. For redundancy, we're having two radius servers and two database servers. Both radius servers will attempt to write the records to the primary database, if that fails, the secondary database will be used. However, I only see one place in the radius sql.conf file to set the database connection settings. Is there anyway to set the connection settings for a secondary database, or is there no failover? If not, what do people suggest we use? A load balancer or some such? Another problem with this setup is that there may be records in the secondary database which I need to add to the primary database. The main issue I have is when the start record of a session is in one database and the stop record is in the other. I need to match these two records up, so I have all the records in both databases. Is there any application out there that will do this or do I need to write my own? Surely someone else has encountered the same issue? So can anyone advise on the above or point me at some documentation that explains how to do this? All help much appreciated! Cheers, Stella

3 2