- Freeradius-Users - lists.freeradius.org

RE: PHP issues with PHP 4.3.9 and dialup_admin
by Josh Howlett 20 Jun '07

20 Jun '07

Ethan, Have you got the freeradius-mysql RPM installed? josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Ethan Dicks > Sent: 20 March 2007 21:00 > To: freeradius-users(a)lists.freeradius.org > Subject: PHP issues with PHP 4.3.9 and dialup_admin > > I've been digging around all day and I've seen other people > describe the same symptoms I'm having, but the follow-ups > typical asy "Oh, I fixed it", but don't describe the fix. It > seems that something resembling my symptoms goes back to the > version of dialup_admin that shipped with freeRADIUS 1.0.1, > so I am not convinced what I'm seeing is _specifically_ a PHP > 4.3 problem, but given the changes with registers_global from > 4.1.0 to 4.2.0, I thought it would be prudent to mention that. > > My setup is... > CentOS 4.4.2 (RHEL 4 without the RedHat trademarks and graphics) > Apache 2.0.52 > PHP 4.3.9 > mysql 4.1.20 > freeRADIUS 1.1.5 > dialup_admin ? (CVS snapshot 20070320) > firefox 1.5.0.10 > > I have freeRADIUS installed and working with users stuffed > into a flat file, verified with 'radtest'. I can get the > main page of dialup_admin to come up, but I get blank screens > and lots of PHP errors logged when I try to invoke nearly any > button. My radius database has tables, but no rows, since I > was trying to set up dialup_admin to start inserting users > and groups. I have set PHP's registers_global to 'on' via > /etc/php.ini and verified that it's on with phpinfo(), and I > still get dozens of errors per mouse-click... > > Here's a typical example - the output is generated when > clicking on the 'new group' button: a long list of 'undefined > constant', 'undefined variable', and 'undefined index' > following the warning that there's no prefix on a function > call to say what its namespace is. > I'm putting the error dump at the bottom to keep it from > creating a huge gulf between sections of this query. > > I know it must look familar because I've found several > references to errors that look just like this in the mailing > list archives. What's lacking is the solution. > > Am I just missing a setup step somewhere? Am I running > servers and packages that are just too new and untested? > > Thanks, > > -ethan > > > [client 127.0.0.1] PHP Notice: import_request_variables(): > No prefix specified - possible security hazard in > /usr/local/dialup_admin/conf/config.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/conf/config.php3 on line 66, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/conf/config.php3 on line 73, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/conf/config.php3 on line 76, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_username_mappings_file - assumed > 'general_username_mappings_file' in > /usr/local/dialup_admin/conf/config.php3 on line 86, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_username_mappings_file - assumed > 'general_username_mappings_file' in > /usr/local/dialup_admin/conf/config.php3 on line 87, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/conf/config.php3 on line 106, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: show in > /usr/local/dialup_admin/htdocs/group_new.php3 on line 3, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_lib_type - assumed 'general_lib_type' in > /usr/local/dialup_admin/htdocs/group_new.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_user_edit_attrs_file - assumed 'general_user_edit_attrs_file' > in /usr/local/dialup_admin/lib/attrshow.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/attrshow.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > accounting - assumed 'accounting' in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > userdb - assumed 'userdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasdb - assumed 'nasdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasadmin - assumed 'nasadmin' in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 17, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_accounting_attrs_file - assumed > 'general_accounting_attrs_file' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 23, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_accounting_attrs_file - assumed > 'general_accounting_attrs_file' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 24, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/attrshow.php3 on line 24, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > accounting - assumed 'accounting' in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > userdb - assumed 'userdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasdb - assumed 'nasdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasadmin - assumed 'nasadmin' in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: acct_attrs in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: ua in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: fl in > /usr/local/dialup_admin/lib/attrshow.php3 on line 40, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 40, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: uf in > /usr/local/dialup_admin/lib/attrshow.php3 on line 36, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 36, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 44, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/defaults.php3 on line 18, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/sql/attrmap.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/sql/defaults.php3 on line 3, referer: > http://localhost/dialup/buttons.php3 > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

1.1.6 rpmbuild on centos 4.4
by Andrew Long 20 Jun '07

20 Jun '07

I know this is a little off topic, but would appreciate any help. Following instructions at http://radiuswiki.suntel.com.tr/Build I am getting... [root@dev SPECS]# rpmbuild -bb freeradius.spec error: Failed build dependencies: libtool-ltdl-devel is needed by freeradius-1.1.6-0.i386 On Cent 4.4 there is no libtool-ltdl or devel package. I don't quite understand this, as this machine is identical to another on which I built freeradius from source (not rpmbuild, though). I can find a libtool-ltdl for FC, but it puts me in a spiral of failed deps... Anyone have a clue? Regards, Andrew Long

3 3

mschapv2 and users file
by Matt Cobb 20 Jun '07

20 Jun '07

I have freeradius 1.1.4 setup as a proxy to an upstream radius server which works. I also want to put guests in a local users file and use MSCHAPV2 on them, but didn't get it to work. I was able to get PAP and CHAP working. Here is the MSCHAPV2 configuration I tried: users file: cobb User-Password=="secret" proxy.conf: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm guests { type = radius authhost = LOCAL:1812 accthost = LOCAL:1813 secret = whatever } realm testlab.com { type = radius authhost = 172.16.0.3:1812 accthost = 172.16.0.3:1813 secret = testing } realm DEFAULT { type = radius authhost = 172.16.0.3:1812 accthost = 172.16.0.3:1813 secret = testing } radius.conf: prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var/lib sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = /var/log/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 1812 listen { ipaddr = * port = 1645 type = auth } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no } ldap { server = "ldap.your.domain" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = yes } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } } instantiate { exec expr # daily } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { preprocess chap mschap suffix ntdomain eap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique suffix ntdomain # # Read the 'acct_users' file files } accounting { detail unix radutmp } session { radutmp } post-auth { } post-proxy { eap } I get this error about the mschap response being incorrect. A request form the same client that is proxied back to IAS with mschapv2 works. rlm_realm: Looking up realm "guests" for User-Name = "cobb@guests" rlm_realm: Found realm "guests" rlm_realm: Adding Stripped-User-Name = "cobb" rlm_realm: Proxying request from user cobb to realm guests rlm_realm: Adding Realm = "guests" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "ntdomain" returns noop for request 0 modcall: leaving group (returns noop) for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry cobb at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: Told to do MS-CHAPv2 for cobb@guests with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. I also tried changing the users file to have NT-Password == "0xB6FFB3200061D7B7928F0D932F095128" But then freeradius just said it couldn't create the NT-Password: rlm_mschap: No User-Password configured. Cannot create NT-Password, followed by the previous error. How do I configure MSCHAPv2 to a local users file?

7 11

Exec-Program-Wait
by Felipe Ceglia - PY1NB 20 Jun '07

20 Jun '07

Hi gurus! Should this work, or am I missing something? radiusd -x doesnt outupt any call to this script. When I run it thru users file, it is called, and works. mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mendes' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+-------------------+----------------------------------------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+-------------------+----------------------------------------------+----+ | 24 | dialup2 | Exec-Program-Wait | php /intranet/prod/src/checkradius.php %u %n | := | +----+-----------+-------------------+----------------------------------------------+----+ 1 row in set (0.00 sec) Thank you, Felipe Ceglia

2 1

1.1.6 README error?
by Andrew Long 20 Jun '07

20 Jun '07

The README for 1.1.6 states... "New users of FreeRADIUS should prefer using Cleartext-Password over User-Password. That is, if the documentation or a web page says to configure User-Password in a database or server configuration file, the documentation is likely out of date, and you should use User-Password instead." I am wondering if the last line is supposed to read, " use Cleartext-Password instead." Regards, Andrew Long

3 3

Additionally set/provided variables... how to access them?
by Mark J Elkins 20 Jun '07

20 Jun '07

My telcom incumberant allows me to authenticate my clients on his network - providing me with both ADSL and Dialup facilities - which I then sell on to my clients. I need to be able to distinguish between these two different service types. My telco sends .... %{Telkom-Access-Type} and when I (for example) look in the environment - I see TELKOM_ACCESS_TYPE either set to "dsl" or "dial" - just what I need.... but I am trying to accesss these values inside some MySQL. In my "useracct" table - I have a table value called "aces_typ" (ie - Access-Type) which contains either the word "dial" or "dsl". In my "authorize_check_query" statement - I have.... AND ( aces_typ='%{Telkom-Access-Type}' OR '%{Telkom-Access-Type}'='' ) (I also do authenticate from NAS's which do not set that value (ie - My own AS5300) - hence the check for it not being set - Hmm - how do I set that in my Cisco?) This gives (in radiusd -X) the debug warning message of.... WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Telkom-Access-Type} So how do I correctly access and use this value???? -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

4 9

Re : Sending CA certificate during EAP-TLS
by Eshun Benjamin 20 Jun '07

20 Jun '07

Is there any way to configure free radius + eap-tls module to avoid to send CA certificate during EAP-TLS negotiation? You may have to read the RFC :-). You need the certificates to do EAP-TLS ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Rafa Marin <rafa.marinlopez(a)gmail.com> À : freeradius-users(a)lists.freeradius.org Envoyé le : Mercredi, 20 Juin 2007, 13h16mn 05s Objet : Sending CA certificate during EAP-TLS Hi all, Is there any way to configure free radius + eap-tls module to avoid to send CA certificate during EAP-TLS negotiation? As Free Radius is sending it right now EAP-TLS packets get fragmented and I would like to avoid it. Thanks in advance. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

4 4

Support for PEAP-Mschapv2 and PEAP-GTC simultaneously?
by Colleen C. Morrissey 20 Jun '07

20 Jun '07

Hi, I am running version 1.1.6 and have had a successful 802.1x/PEAP-GTC deployment for 3+ years. With Vista it looks like I have to move to 802.1x/PEAP-MSCHAPv2 - can not find peap-gtc supplicant. I was able to get 802.1x/PEAP-MSCHAPv2 working. My question is can I somehow support both simultaneously with the same freeradius daemon (I know I can simply run a second daemon on different port supporting the other but that will require me to do lots of work on infrastructure/ssids to point to different servers)? Does anybody happen to have this working and be willing to post config? Or any other ideas? Thank you for your time. Colleen Morrissey

4 8

Re: dialup_admin user password question
by Jay Banks 20 Jun '07

20 Jun '07

> On Wed 20 Jun 2007, Jay Banks wrote: >> I spent most of the day getting dialup_admin to work, and I did get it to >> work. Not being an mysql expert, I have to say what a blessing Webmin >> turned out to be on the project. It sure was nice to be able to easily >> use >> Webmin to look at data in the database table. > > Please do not hijack threads on the mailing list. Please start your own > thread! I've gone back through and read the latest posts. Unless I missed it, I have only seen two other discussions on Dialup Admin, and that was a bad link to download it, and a blank password for Mikrotik. I read the PAP - CHAP thread, if that is what I "hijacked" my apologies. I see that as related, maybe, but the real issue was with where Dialup Admin was telling it how to store a password. I worked all day on Dialup Admin and just overlooked it. And as I stated, was just looking for someone to point me in the right direction since I was going to be out of the office for a couple of days and wanted to hit the ground running when I returned to work. Feeling it had to be a Dialup Admin issue, I looked through the admin.conf again this morning. For people searching the archives, here was the line I missed: # # can be one of crypt,md5,clear # general_encryption_method: clear Change the above line from crypt to clear. This is located under this section: general_auth_request_file: The "general_auth_request_file" threw me off a little. I was thinking "password" at the time. Thanks, Jay Banks http://groups.yahoo.com/group/mikrotik-wisp

1 0

authenticating Linux and Windows servers with freeradius
by vasanth kumar 20 Jun '07

20 Jun '07

Hi everybody, This is sambu, I have configured FreeRadius-1.0.1-1 with Openldap-2.2.13-2 on Fedora 3. Both are running on (ip: 192.168.0.131) same machine and working very well. afterwards I configured ssh on the same machine where Freeradius running using PAM modules for authenticaton, it is correctly authenticating with Freeradius. Also I worked with routers and switches to authenticate with Freeradius, they are also correctly authenticating with Freeradius server for user name and password. My question is how to authenticate both Windows and Linux servers and ssh,telnet,ftp,apache running on different machines with Freeradius server. Is it possible to authenticate both Linux and Windows server and all other services with Freeradius? Please help me.Thanks vasanth

2 1