- Freeradius-Users - lists.freeradius.org

Re: Pam_radius_Auth - Problem
by Geoff Mitchell 28 Jun '07

28 Jun '07

Markus, Did you get any replies to your post from the 18th about pam_radius_auth not working, as I am having exactly the same issue. What I have found out is that the pam_radius_auth module is fine, except when the user is not in the password file. At this point it would seem that something is not getting initialised correctly which results in the call to conv->conv, which should prompt you for the password and then return it in resp->resp, constantly comes back with ^H ^\177INCORRECT. As this translates to the value you saw in your password field, I have to suspect that something is broken within PAM and requires the modules to work around this if the user is not in the password file. The problem I am having is working out how to work around the problem, so I am interested as to if you got a reply to your post. Thanks Geoff

1 0

duplicate requests...
by suganthi velusamy 28 Jun '07

28 Jun '07

--------------------------------- Bollywood, fun, friendship, sports and more... you name it, we have it.

3 3

sqlippool reject authentication if no IP?
by Hugh Messenger 28 Jun '07

28 Jun '07

With my current configuration, if sqlippool cannot assign an IP, the authentication still succeeds. How can I set things up so if no IP is available, the authentication will fail with some informative Reply-Message, like the simultaneous use session control does? -- hugh

3 2

Question about dictionnary
by Thomas LAVIGNE 28 Jun '07

28 Jun '07

Hello all, I'm new to the world of Linux and FreeRadius and of course also new to this list. I need to build up a Radius Server with FreeRadius. It will answere request coming from ADSL users, relayed by a RadisuProxySmartEdge Redback. On my test server, I've successfully installed the OS, FreeRadius the MySQL server, the SSH server, apache and phpmyadmin. Some Radius Client test show that it seems to work with a test-user in MySQl Database. I got Access-Accept. My problem is that the customer ask me to ?change/add? dictionary for supporting "RedBack attributes". I need to add user name and password for each users and and three common value for all users. I'm not sure how to do that. Include an other file, modify the main dictionary file ? Can someone please explain me how to play with dictionary. Everything was installed this WE, so I guess I have all the last version. (some guide I found talk about unexisting folder, or about radiusd which seems little bit different of FreeRadius). I hope I was clear enough. Thank you for reading me. Any help will be greatly appreciate. Good night. Regards, Thomas

6 7

2.0.0 Depracated conditional expansion ":-"
by Hugh Messenger 28 Jun '07

28 Jun '07

The default mysql-dialup.conf queries are generating a lot of these warnings: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: INSERT INTO radpostauth (id, user, pass, reply, date) VALUES ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (id, user, pass, reply, date) VALUES ('', 'radiustest', 'test123', 'Access-Accept', '2007-06-27 13:34:51') I'm assuming the warning is telling me that things like '%{User-Password:-Chap-Password}' should now be '%{%{User-Password}:-%{Chap-Password}}', as per 'man unlang': Conditional Syntax Conditional syntax similar to that used in Unix shells may also be used. %{%{Foo}:-bar} If %{Foo} has a value, returns that value. Otherwise, returns literal string "bar". %{%{Foo}:-%{Bar}} If %{Foo} has a value, returns that value. Otherwise, returns the expansion of %{Bar}. This is the same for every conditional variable in the mysql-dialup.conf file, of which there are quite a few. If they do need changing, I'll be quite happy to do that and send you a fixed file. -- hugh

2 1

Re: 2.0.0 documentation for radiusd.conf
by Hugh Messenger 28 Jun '07

28 Jun '07

Alan DeKok <aland(a)deployingradius.com> said: > Hugh Messenger wrote: > ... > > I like this new unlang. > > Thanks. It makes me much more confident in releasing a 2.0 that is > *much* better than 1.1. My only suggestion is adding some examples to the man page, and/or in the config file comments. I'm sure you already intend to do this, just wanted to get it back on your radar. As has been noted by others, unlang is likely to top the league table of FMF's (Frequently Misunderstood Features). BTW, reproducing my 1.1.6 setup on 2.0.0 has actually been remarkably painless. In fact, the only problematic parts have been unrelated to core radiusd. It's just been things like getting PAM/winbind working on the test server (repeat after me, "install pam-devel BEFORE ./configure"), and some teething trouble with the MySQL sqlippool stuff, which Peter has jumped on. Good work, guys. > Alan DeKok. -- hugh

2 1

Re: 2.0.0-pre sqlippool
by Hugh Messenger 28 Jun '07

28 Jun '07

I said: > 2) Where can I find the sqlippool schema in 2.0.0? I went ahead and used the same schema from 1.1.6, seems to be OK. But I'd still like to know where to find it documented, for next time I need it. Anyway, there seems to be a few issues in the mysql-ippool-dialup.conf file. 1) In the allocate-find query ... allocate-find = "SELECT FramedIPAddress FROM radippool \ WHERE pool_name = '%{reply:Pool-Name}' AND expiry_time < NOW() \ ORDER BY pool_name, (UserName <> '%{User-Name}'), (CallingStationId <> '%{Calling-Station-Id}'), expiry_time \ LIMIT 1 \ FOR UPDATE" It seems to want %{check:Pool-Name}. Which is weird in itself, because 'man unlang' doesn't mention a 'check' list type, it should be 'request'. But that doesn't work! The only thing that seems to work in 2.0.0 is %{check:Pool-Name}. Can't just be %{Pool-Name}, either. 2) In the allocate-update query ... allocate-update = "UPDATE radippool \ SET NASIPAddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ CallingStationId = '%{Calling-Station-Id}', UserName = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE FramedIPAddress = '%{FramedIPAddress}'" ... I have to change the %{FramedIPAddress} to %I to get this query to work. 3) Looks like the file is line wrapped at 80 chars, all long lines had to be joined back together. I don't know if this was an artifact of the way I checked out / updated in cvs, or if the file is actually like that. > -- hugh -- hugh

4 7

Re: 2.0.0-pre sqlippool
by Hugh Messenger 28 Jun '07

28 Jun '07

Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> said: > Remember to change any value substitutions to the new scheme > > %{%{foo}:-%{bar}} You just answered my rather long winded question about the 'deprecated' warnings, before I asked it. I've fixed all occurrences, and all warnings have gone away. I'll send Alan / Peter the fixed files when I've tested them a little more. There's a couple of other little gotchas I'm working on in the MySQL queries. > :) Indeed. > Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) > Authentication, Authorisation and Accounting Officer -- hugh, Everything And The Kitchen Sink Officer

1 0

Re: Help: eap/peap + 8021x + freeradius + Win2k3/AD
by Hugh Messenger 28 Jun '07

28 Jun '07

Hangjun He <elmerhe(a)yahoo.com.cn> said: > But there are no enough memory on my linux system to install samba. > > What should I do? Install more memory. As Alan said, you have to have Samba to do what you want to do. > John -- hugh

1 0

Easy way to detect EAP
by Arran Cudbard-Bell 28 Jun '07

28 Jun '07

Is there a more reliable method of detecting EAP then checking for the presence of an EAP-Message, I heard mention of an EAP-Type attribute... guessing this is set by the EAP module in authorize ? Is this a control attribute ? -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

4 9