- Freeradius-Users - lists.freeradius.org

Fwd: final rlm_perl question, hopefully...
by FreeRadius-ML 26 Jul '07

26 Jul '07

Hi All, Ok, after reviewing all the information that was received, I've setup my FreeRadius as following: 1. The authorize and authenticate sections are setup to activate digest and perl. 2. My rlm_perl script utilizes the following lines in order to return the unencrypted user password back to FreeRadius for digest authentication: $RAD_CHECK{'Cleartext-Password'} = "xxxxxx"; # Remove this line for production $RAD_CHECK{'User-Password'}="xxxxxx"; # Remove this line for production I just put these inside my script for checking, later on this information will be retrieved from an external source. Now, FreeRadius activates my rlm_perl module, no problem, as I can see the various reply fields being setup, however, I'm still getting the following error: rlm_perl: RAD_REQUEST: Client-IP-Address = 192.168.2.80 rlm_perl: RAD_REQUEST: Digest-Response = 632905a2325f672f049800eda7df9ee4 rlm_perl: RAD_REQUEST: User-Name = z2l(a)192.168.2.80 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.2.80 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: Sip-Uri-User = z2l rlm_perl: RAD_REQUEST: Digest-Attributes = ARRAY(0xbbc93f0) rlm_perl: RAD_REPLY: Reply-Message = User accepted by z2l WSDL rlm_perl: RAD_REPLY: z2l-Duration = 60 rlm_perl: RAD_REPLY: z2l-Status = 2 rlm_perl: RAD_REPLY: z2l-Session = 833abb3d-d047-4d0d-a40e-2e147049f96d rlm_perl: Added pair Reply-Message = User accepted by z2l rlm_perl: Added pair z2l-Duration = 60 rlm_perl: Added pair z2l-Status = 2 rlm_perl: Added pair z2l-Session = 833abb3d-d047-4d0d-a40e-2e147049f96d rlm_perl: Added pair Cleartext-Password = z2l rlm_perl: Added pair User-Password = z2l rlm_perl: Added pair Auth-Type = digest perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xb933260 modcall[authorize]: module "perl" returns ok for request 5 rlm_realm: Looking up realm "192.168.2.80" for User-Name = "z2l(a)192.168.2.80" rlm_realm: No such realm "192.168.2.80" modcall[authorize]: module "suffix" returns noop for request 5 modcall: leaving group authorize (returns ok) for request 5 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Login incorrect: [z2l(a)192.168.2.80/<no User-Password attribute>] (from client 192.168.2.80 port 5060) Delaying request 5 for 1 seconds Finished request 5 Going to the next request Waking up in 3 seconds... Now, my configuration is very very simple. In the authorize I have digest and perl enabled, in authenticate I have only digest enabled. If I read the debug correctly, the authorization is going ok: modcall[authorize]: module "perl" returns ok for request 5 rlm_realm: Looking up realm "192.168.2.80" for User-Name = "z2l(a)192.168.2.80" rlm_realm: No such realm "192.168.2.80" modcall[authorize]: module "suffix" returns noop for request 5 modcall: leaving group authorize (returns ok) for request 5 However, the authentication section fails: rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Login incorrect: [z2l(a)192.168.2.80/<no User-Password attribute>] (from client 192.168.2.80 port 5060) So, I'm either returning something in the wrong way, or I've broken something again. Any pointers on the issue would be highly appreciated. Regards, Z2L

2 2

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

Thank you very much Ivan. It´s very useful to know that 2.0 could include this features. But, also, it's very useful to know if 1.1.6 includes or not any of these. And this is an important question. In the past I wasted so much time reading, searching and testing features that finally were impossible for a certain version of software ..... Another key is the stability. 2.0 is a pre-release and the service must not support outages or bugs. Of course, we shall update to 2.0 as soon as the software can be reasonably stable. But now, the only programmed update in the next future is 1.1.7. Thanks again for such useful information Nicolas > >Have a look at 2.0. It can do if/than/else in .conf files >so you should >be able to define different sql statements for different >cases. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 26/7/2007, "Nicolas Velazquez" <nicolas.velazquez at >uam.es> pie: > >>Hi, >> >>We are using freeradius 1.1.6, now, to provide >>access for our wireless network only. >>The accounting is very detailed and >>comprehensive: IP addresses, usernames, packets, roles, >APs, SSIDs, etc. >> >>Now, we are starting to use the same radius to >>give 802.1x access to our wired network. >> >>The key is that the accounting records for a wired switch >are VERY different. >>Now, AP and SSID, are nonsense items, for example. >>But we need another records. >> >>Can freeradius use different accounting sql inserts >depending on NAS? >> >>Is there any document showing something like this? >>I have read many documents but I can not find a clear >answer. >> >>This was the main question. >> >>A related tiny question is as follows. >>The most comfortable configuration will be to use >>different accounting inserts depending on huntgroups. >>Then we could select sql inserts for one >>huntgroup (all our wired NASes) and different sql >>insert for another huntgroup (all our wireless NASes). >>The addition, remove or change of the different >>NASes could be made modifying only the lists contained in >the huntgroups file. >>It could be very clean and useful. >>But, when I read the huntgroups documentation I >>have the strong suspect I can´t do this. >> >>Thank you very much in advance, >> >> Nicolas Velazquez >> > >

2 1

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

>Date: Thu, 26 Jul 2007 13:31:37 +0100 >From: <tnt(a)kalik.co.yu> >Subject: Re: SQL and different accounting records by NAS >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <qI6MczRx.1185453097.0743660.tnt(a)kalik.co.yu> >Content-Type: text/plain; charset=ISO-8859-2 > >Have a look at 2.0. It can do if/than/else in .conf files >so you should >be able to define different sql statements for different >cases. > >Ivan Kalik >Kalik Informatika ISP > Thank you very much Ivan. It´s very useful to know that 2.0 could include this features. But, also, it's very useful to know if 1.1.6 includes or not any of these. And this is an important question. In the past I wasted so much time reading, searching and testing features that finally were impossible for a certain version of software ..... Another key is the stability. 2.0 is a pre-release and the service must not support outages or bugs. Of course, we shall update to 2.0 as soon as the software can be reasonably stable. But now, the only programmed update in the next future is 1.1.7. Thanks again for such useful information Nicolas

1 0

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

>Date: Thu, 26 Jul 2007 13:31:37 +0100 >From: <tnt(a)kalik.co.yu> >Subject: Re: SQL and different accounting records by NAS >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: <qI6MczRx.1185453097.0743660.tnt(a)kalik.co.yu> >Content-Type: text/plain; charset=ISO-8859-2 > >Have a look at 2.0. It can do if/than/else in .conf files >so you should >be able to define different sql statements for different >cases. > >Ivan Kalik >Kalik Informatika ISP > Thank you very much Ivan. It´s very useful to know that 2.0 could include this features. But, also, it's very useful to know if 1.1.6 includes or not any of these. And this is an important question. In the past I wasted so much time reading, searching and testing features that finally were impossible for a certain version of software ..... Another key is the stability. 2.0 is a pre-release and the service must not support outages or bugs. Of course, we shall update to 2.0 as soon as the software can be reasonably stable. But now, the only programmed update in the next future is 1.1.7. Thanks again for such useful information Nicolas

1 0

debug_level
by VM 26 Jul '07

26 Jul '07

Hi everyone, I can't find anything the various documentation sources related to the debug_level parameter. Made a grep on the doc folder, searched Google and FreeRadius Wiki... It seems to be usually put to a value of 0. Can you explain what are the relevant values for this parameter and what it is supposed to control ? My need is to get debug information on ldap communication but could not start FreeRadius in debug mode because the resulting logs must be stored in a file for further analysis (I can't stay in front of my display waiting for a random crash to happen). Does this paramter allow this ? If not, is there another way ? Thanks in advance, Vincent ****** ATTENTION : Nouvelle adresse et nouveaux numéros de telephone ****** Vous pouvez dorénavant nous joindre ou nous écrire aux coordonnées suivantes : Tél : 01 70 56 51 51 Fax : 01 70 56 51 52 Nouvelle Adresse: 7 place Marcel Rebuffat Parc d'activités de Villejust 91971 Courtaboeuf 7 cedex

2 1

Freeradius + DHCP +vlans ???
by George Beitis 26 Jul '07

26 Jul '07

Hey guys I am a bit new to the scene and i am having a few problems with configuring freeradius. In essence what i want is that the user, once verified to be assigned to a specific vlan and get an ip address from a dhcp server, which will be aware of the vlans and there for assign different address and subnets to each. Does this scenario make any sense? Will it be the freeradius server that will be notifying the dhcp server to aquire an address for the client? Will the dhcp server then contact the access point to let it know what address the client has been given and it in its turn give it to the client? Or will it be that the access point will contact the dhcp server once it has the reply from the freeradius server, giving it the vlan id/number and requesting an ip address and other info? Is this the right or wrong way of going about this? regards George

3 10

Dusty Doris
by Fabio Silva 26 Jul '07

26 Jul '07

Dusty doris are you here? i need talk to you. and your mail dusty(a)doris.cc doesnt work... Sorry for all, Regards

1 0

SQL and different accounting records by NAS
by Nicolas Velazquez 26 Jul '07

26 Jul '07

Hi, We are using freeradius 1.1.6, now, to provide access for our wireless network only. The accounting is very detailed and comprehensive: IP addresses, usernames, packets, roles, APs, SSIDs, etc. Now, we are starting to use the same radius to give 802.1x access to our wired network. The key is that the accounting records for a wired switch are VERY different. Now, AP and SSID, are nonsense items, for example. But we need another records. Can freeradius use different accounting sql inserts depending on NAS? Is there any document showing something like this? I have read many documents but I can not find a clear answer. This was the main question. A related tiny question is as follows. The most comfortable configuration will be to use different accounting inserts depending on huntgroups. Then we could select sql inserts for one huntgroup (all our wired NASes) and different sql insert for another huntgroup (all our wireless NASes). The addition, remove or change of the different NASes could be made modifying only the lists contained in the huntgroups file. It could be very clean and useful. But, when I read the huntgroups documentation I have the strong suspect I can´t do this. Thank you very much in advance, Nicolas Velazquez

2 1

Op values for Attributes
by liran tal 26 Jul '07

26 Jul '07

Hey everyone, I was wondering... are the Op values for certain RADIUS attributes will always be the same or it is completely dynamic to assign any Op value to any attribute. For example, the Max-All-Session attribute, is it always assigned the := op or may it be assigned += , =* , != etc... some other Ops. Thanks, Lir.

2 2

FreeRADIUS 1.1.7 has been released
by Alan DeKok 25 Jul '07

25 Jul '07

Feature improvements * Updated LDAP documentation * Added note on DH parameters in eap.conf, and debugging messages which complain if DH is used, but not configured properly. * Updated the Mikrotik dictionary. Added a note that the sample dictionary they supply is broken. * Output more information on blocked threads, which should help narrow down which modules is causing the problem. * Added more eDirectory support. * rlm_ldap now prints out attributes in the standard format * Enabled server-side handling of procedures in MySQL Bug fixes * Added NT-Hash support for mschap_xlat * Corrected documentation to point to correct location of files * Checks for more recent FreeBSD versions * use -DLDAP_DEPRECATED to avoid OpenLDAP crashes * Use correct value for authentication name in rlm_mschap * Fix over-ride for usernames when use_tunneled_reply = yes Alan DeKok.

1 0