- Freeradius-Users - lists.freeradius.org

Gigaword support
by eugene＠snowball.co.za 22 May '07

22 May '07

I would like to have updated mysql querries for FreeRadius that supports gigawords. Please assist.

2 1

Radius compatibility questions
by Ouahiba MACHANI 22 May '07

22 May '07

Hi, Can anyone give me details about FreeRadius compatibility? My questions are : 1- Dose radius operate easily with Cisco equipments (including firewalls, VPN, … ) and other hardware VPN servers? 2- The same question for software VPN, such as Microsoft Routing and Remote Access Server (RRAS)? 3- the same question for access points? 3- What version or variants of the following standards and methods dose radius support : X802.1X, EAP-X? - Is there available plug-in that allow to interface with ActiveDirectory ? LDAP directories ? Databases (Oracle, MySQL, etc) ? Where can I find the features of the actual version of radius? I want to develop a plug-in for FreeRadius. This plug-in should be able to handle authentication requests send from a VPN server (either hardware, Cisco or a Software (MS RRAS) implementation) or an AccessPoint. The second requirements, is that this plug-in should be able to interface with the different users Data store including ActiveDirectory, LDAP directories and Databases, to accomplish user authentication. How should I proceed to do this? Should I develop multiples modules? Is their any existing code that I can use to develop such a plug-in? Any additional indication are welcome. Thanks in advance.

3 2

Integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication
by xuebin gong 22 May '07

22 May '07

Hi, All, I am user and want to integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication. Our operating system is Fedora 5 Linux. (1)Install freeRadius-1.1.6 After following the instruction of installation in http://wwww.freeradius.org, install freeRadius-1.1.6 on Fedora Linux 5, run radius server in debug mode radiusd -X ...... Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. FreeRadius was installed succeefully. (2)Configure freeRadius-1.1.6 (2.1) Configure radiusd.conf (2.1.1) LDAP module ldap{ server = "10.0.0.118" identity = "cn=Manager,dc=mtcable,dc=net" password = mtncnl1970 basedn = "dc=mtcable,dc=net" filter = "uid=%{Stripped-User-Name:-%{User-Name}}" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } (2.1.2) authorize module uncomment ldap line authorize{ ...... ldap ...... } (2.1.3) authenticate module uncomment block ldap block: authenticate{ ...... Auth-Type LDAP { ldap } ...... } (2.2) edit /usr/local/etc/raddb/users Uncomment the following lines: DEFAULT Auth-Type = LDAP Fall-Through = 1 (3)Install openLDAP (4)Configure openLDAP (5)Add one LDAP entry for testing dn: uid=jjeep, ou=radius, rccd=AAA3140018f, dc=mtcable,dc=net userPassword:: aabbccdd cn: jeep uid: jjeep radiusAuthType: local radiusSimultaneousUse: 1 homeDirectory: // objectClass: top objectClass: posixAccount objectClass: radiusprofile uidNumber: 7012 gidNumber: 100 After add this entry to LDAP, we reset the password to "888888" (5)Test After run test command line radtest jjeep "888888" localhost 1 testing123 The following is information from running Radiusd -X: ...... rad_recv: Access-Request packet from host 127.0.0.1:32771, id=192, length=57 User-Name = "jjeep" User-Password = "888888" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jjeep", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jjeep radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.0.0.118:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1 970 to 10.0.0.118:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=mtcable,dc=net, with filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for req uest 0 rlm_pap: WARNING! No "known good" password found for the use r. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "jjeep" with password "888888" radius_xlat: 'uid=jjeep' radius_xlat: 'dc=mtcable,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mtcable,dc=net, with filter uid=jjeep rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [jjeep] (from cl ient localhost port 1) Delaying request 0 for 1 seconds Finished request 0 Going to the next request The following is logfile: ...... May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" method=128 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 RESULT tag=97 err=0 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId radiusCallbackNumber radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SEARCH RESULT tag=101 err=0 nentries=3 text= May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH base="dc=mtcable,dc=net" scope=2 deref=0 filter="(uid=jjeep)" May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH attr=uid May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SEARCH RESULT tag=101 err=0 nentries=3 text= It looks like LDAP search successfully and found 3 entries, but redius server could not find any objects. What is wrong with my integration? Thanks In Advanced Robin ____________________________________________________________________________________ Need Mail bonding? Go to the Yahoo! Mail Q&A for great tips from Yahoo! Answers users. http://answers.yahoo.com/dir/?link=list&sid=396546091

3 2

DialupAdmin Question.
by Joseph Sullivan 22 May '07

22 May '07

Hello Group, I am trying to use Dialup Admin on Free Radius 1.1.6. I have the admin.conf file all setup, it will add, remove users from the MySQL db, but it will not do the radius check by clicking on Check Server. It outputs this: Monday, 21 May 2007, 09:10:14 MDT Server: 127.0.0.1:1812 (test user cowpuppy) Then It just hangs there. I have tried everything in the admin.conf file, setting the host to localhost, the hostname, the public ip address, and it still just hangs there, and it never hits the actual radius server or completes the check. Also, I can login with the user cowpuppy just fine but dialup admin never shows this when I look at the stats for cowpuppy. When I run this command: radtest cowpuppy testpass localhost 0 testing123 It accepts me, and it shows that in the radius.log, but dialup admin doesn't recognize that. I think it is a logging issue. It looks like it needs to log to the SQL server... I am still working on that... As always, thanks for any help you can offer. Cheers!! Joseph Sullivan

2 1

Oracle 10g
by Ashraf Al-Basti 22 May '07

22 May '07

Dear All, is it possible to run Freeradius using oracle 10g DB on different servers? i have freeradius 1.0.1-3 under Redhat AS4 (rpm package). please how can compile freeradius to use the oracle DB?

4 4

RE: NAS ignoring Access-Accept
by Hugh Messenger 21 May '07

21 May '07

Wolfgang Rosenauer <wolfgang(a)rosenauer.org> said: > I ran radiusd -X and saw that freeradius sent an Access-Accept reply to > the NAS' ip address and source port. Could you post the entire -X log for an example request? > Thanks, > Wolfgang -- hugh

3 3

Should I use FR 2.0.0 or 1.1.6?
by John Horne 21 May '07

21 May '07

Hi, I expect the freeradius developers will hate me for asking this, but is there an estimate of when the final version of FR 2.0.0 will be released? I have four servers to upgrade - 3 currently run FR 1.0.1 and one is already upgraded to 1.1.6. I am at an academic site, and the students are currently taking their exams. As such, within the next few weeks most of the staff/students will have left, and I can start to get on with the upgrades and other things. This gives me a window of a couple of months at least to do the upgrades. The question is, do I install FR 2.0.0 now (even as a pre-release) so that upgrading to the final version should be relatively trivial, or do I stay with 1.1.6 knowing that at some future point, perhaps soon after the start of next term, I have to upgrade again to 2.0.0? I notice that upgrading from 1.x to 2.x requires going through the config files, and will obviously require some testing, so upgrading to 2.x may not be trivial. That is, I can't do it in a short time, but I can upgrade from 1.0.1 to 1.1.6 quickly because I already have one server done. I suppose another possibility could be to run 3 servers at 1.1.6 and one at 2.0.0 :-) Hmm, sounds interesting... I should add that all 4 servers are 'live', but I have kept the 1.1.6 server mainly out of use for the past few months. As such we can run our service on 3 servers. Anyone any comments or suggestions? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

3 2

DialupAdmin Question.
by Joseph Sullivan 21 May '07

21 May '07

Hello Group, I am trying to use Dialup Admin on Free Radius 1.1.6. I have the admin.conf file all setup, it will add, remove users from the MySQL db, but it will not do the radius check by clicking on Check Server. It outputs this: Monday, 21 May 2007, 09:10:14 MDT Server: 127.0.0.1:1812 (test user cowpuppy) Then It just hangs there. I have tried everything in the admin.conf file, setting the host to localhost, the hostname, the public ip address, and it still just hangs there, and it never hits the actual radius server or completes the check. Also, I can login with the user cowpuppy just fine but dialup admin never shows this when I look at the stats for cowpuppy. When I run this command: radtest cowpuppy testpass localhost 0 testing123 It accepts me, and it shows that in the radius.log, but dialup admin doesn't recognize that. I think it is a logging issue. It looks like it needs to log to the SQL server... I am still working on that... As always, thanks for any help you can offer. Cheers!! Joseph Sullivan

1 0

Problem in runnning radius server
by prajakta choudhari 21 May '07

21 May '07

Hi all: I have just started to configure the Radius Server. I have downloaded and installed the latest freeradius and openssl software. I am trying to configure EAP-TLS authentication and currently using the default certificates in raddb/certs directory. eap.conf is as follows: eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } Whenever i try to run the radiusd i get the following error: Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: file not found radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1959] Unknown module "eap". radiusd.conf[1906] Failed to parse authenticate section. I just cannot figure out the problem. I am new radius server user. Thank You Prajakta Choudhari Office firewalls, cyber cafes, college labs, don't allow you to download CHAT? Click here: http://in.messenger.yahoo.com/webmessengerpromo.php

3 3

Wiki
by Doug Hardie 21 May '07

21 May '07

I am having problems finding the way to get from the main Wiki page to the configuration information. The pages are there. When I search for something they are found. I just can't figure out how you are supposed to link to them from the main page. For example the modules page does eventually link back to the main page, but I can't figure out how to go from the main page to it.

3 4