- Freeradius-Users - lists.freeradius.org

Proxy + LOCAL - Is it possible?
by Apostolos Pantsiopoulos 16 May '07

16 May '07

Hi, I am about to migrate from our old radius based system (VoIP) to a new one (based on freeradius). Is it possible to use the proxy feature so that I can process the requests both locally ( acct=LOCAL, auth=LOCAL) as well as remotely (send them to the old system as well)? I would like to use both systems simultaneously until I am sure that the new one behaves as expected. Regards, -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com Support Center email: apant(a)kinetix.gr, support(a)kinetix.gr Tel. & Fax: +30 2310556134 Mobile : +30 6937069097 MSN : apant2(a)hotmail.com WWW: http://www.kinetix.gr/ -------------------------------------------

2 1

RE: help on radius, how to make password in clear text
by liRyan 16 May '07

16 May '07

Ok, thanks for reminder. [Email] wsly790104(a)hotmail.com; wsly790104(a)yahoo.com; [MSN] wsly790104(a)hotmail.com [YahooMessage]wsly790104> From: stefan.winter(a)restena.lu> To: freeradius-users(a)lists.freeradius.org> Subject: Re: help on radius, how to make password in clear text> Date: Wed, 16 May 2007 07:52:07 +0200> CC: freeradius-devel(a)lists.freeradius.org> > Hi,> > this is for the _users_ list, not developers.> > > But if other client using same radius server authticate with same username> > and pasword, the "User-Password" field is in clear text and all works.> > Could some one look this for me, many thanks. Ryan.> > 1) double-check the shared secret on NAS and FreeRADIUS - if they don't match, > decryption of User-Password results in weird characters> 2) post _useful_ debugs. Of "radiusd -X" as a whole, not just a few lines. > radiusd -X probably even tells you that it suspects a mismatched shared > secret a few lines later.> > Stefan> > -- > Stefan WINTER> > Stiftung RESTENA - Réseau Téléinformat! ique de l'Education Nationale et de > la Recherche> Ingenieur Forschung & Entwicklung> > 6, rue Richard Coudenhove-Kalergi> L-1359 Luxembourg> E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1> http://www.restena.lu Fax: +352 422473 _________________________________________________________________ 探索 Windows Vista 的世界 http://search.live.com/results.aspx?q=windows+vista&mkt=zh-cn&FORM=LIVSOP

1 0

Re: help on radius, how to make password in clear text
by Stefan Winter 16 May '07

16 May '07

Hi, this is for the _users_ list, not developers. > But if other client using same radius server authticate with same username > and pasword, the "User-Password" field is in clear text and all works. > Could some one look this for me, many thanks. Ryan. 1) double-check the shared secret on NAS and FreeRADIUS - if they don't match, decryption of User-Password results in weird characters 2) post _useful_ debugs. Of "radiusd -X" as a whole, not just a few lines. radiusd -X probably even tells you that it suspects a mismatched shared secret a few lines later. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

Server IP changed and "FreeRADIUS+MySQL" does not work
by yao guoxian 16 May '07

16 May '07

I have installed FreeRADIUS and MySQL on the same machine. "FreeRADIUS + MySQL" had worked well before Server IP changed. For some reason the server had to be carried to a new place and its IP must be changed. After the server IP changed, "FreeRADIUS + MySQL" does not work. I have edited sql.conf and changed IP to the new correct IP . I also edited the table "user" in the database "mysql" and altered the Host field from the old IP to the new correct IP. However these mendings do not work. The following is part of the result to the command "radiusd -X": rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@202.117.54.251:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server root@202.117.54.251:radius rlm_sql_mysql: Mysql error 'Access denied for user 'root'@'202.117.54.251' (using password: YES)' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Instantiated sql (sql) I have not compile and install FreeRADIUS and just edited the related files. What should I do to make FreeRADIUS and MySQL work well again ? Thanks in advance. Regards Guoxian

4 4

RE: Pool-Name from Called-Station-Id
by Hugh Messenger 15 May '07

15 May '07

Ala DeKok said: > DEFAULT Called-Station-Id =~ "^(\w+_pppoe_\d+)$", Pool-Name := `%{1}` > > \w && \d may not be supported by the regex library on your system. You > may have to use [a-fA-F] etc. explictely. I don't seem to be able to get this to work. This is my DEFAULT entry: DEFAULT Called-Station-Id =~ "^([A-z0-9]+_pppoe_[0-9]+)$", Pool-Name := `%{1}` Framed-IP-Netmask = 255.255.0.0, Fall-Through = 1 ... and it seems to be matching on authentication requests, as per this -X fragment: users: Matched entry DEFAULT at line 162 ... where line 162 is the above DEFAULT. And I've triple checked my regexp using my IDE's RX toolkit. But sqlippool isn't picking up that pattern match as the pool name: rlm_sql_mysql: query: SELECT FramedIPAddress FROM radippool WHERE pool_name = '' AND expiry_time < NOW() ORDER BY pool_name, (UserName <> 'radiustest'), (CallingStationId <> '00:60:B3:45:6A:98'), expiry_time LIMIT 1 FOR UPDATE sqlippool_query1: SQL query did not return any results If I replace the regexp version with a specific one, like ... DEFAULT Called-Station-Id == "brantley_pppoe_141", Pool-Name := "brantley_pppoe_141" ... it all works fine. > > Alan DeKok. -- hugh

1 0

MySQL Authentication
by Joseph Sullivan 15 May '07

15 May '07

Hello Group, I am running OSX 10.4.9 Server, with Free Radius 1.1.6. I have FreeRadius setup to connect to my MySQL Server for authentication. That server is running MySQL 4.1 When I try loading radiusd -X I get a mysql link error. rlm_sql (sql): Could not link driver rlm_sql_mysql: dlopen(/usr/local/lib/rlm_sql_mysql-1.1.6.so, 9): no suitable image found. Did find: ?/usr/local/lib/rlm_sql_mysql-1.1.6.so: no matching architecture in universal wrapper ?/usr/local/lib/rlm_sql_mysql-1.1.6.so: no matching architecture in universal wrapper rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. >From what I read on the FAQ this is a library error on my system and has nothing to do with Freeradius. But my error differs slightly from what the FAQ says I could be seeing. I did run a ./configure | grep mysql_config and it came out saying MySQL = yes. Can someone help me resolve this? I greatly appreciate it. Joseph Sullivan

2 4

FreeRADIUS 2.0.0-pre1 has been released
by Alan T. DeKok 15 May '07

15 May '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The FreeRADIUS team is pleased to announce the release of FreeRADIUS 2.0.0-pre1. This is the first "pre" release in the process to release a full 2.0.0. It has been almost three years since 1.0.0 was released, and it's high time for the release of the next major version of the server. The notable changes between 1.x and 2.x are: * Debugging mode is much clearer and easier to read. * EAP-TLS and OpenSSL certificates "just work". See raddb/certs/README for details. * Proxying works much better than in 1.x. We mean *MUCH* better. See proxy.conf for details. * rlm_unix no longer has an "authenticate" section. See "man rlm_unix" for details. * The server has full support for IPv6. * The server has much more complete support for SNMP MIBs. * radiusd.conf has limited support for "if/then/else". See doc/configurable_failover for details. * "listen" sections can have per-socket clients. * Replaced "radrelay" and "radsqlrelay". See "man radrelay.conf" for details. * Post-Proxy-Type "Fail" section is executed when a home server fails to respond to a request. See "radiusd.conf" for details. * Configuration files CANNOT be copied directly from 1.x Some may work, most will require careful porting. There are a few known issues with 2.0.0-pre1 that will be fixed before the final 2.0.0 release. These issues are: * HUP handling still isn't correct. Almost anything may happen on HUP. * The "radrelay" integration into the server is not yet finalized Reading the detail files will work, mostly. We ask that everyone download and test 2.0.0-pre1, in order to validate it before the final release. Thanks to the people who spent time testing it over the last few months. They have contributed greatly to the stability of this release. As an additional note, this release is called "-pre1", because many sites had been using the CVS head for many years, which was called "-pre0". Giving this release a different name highlights the fact that this is an official release, rather than a snapshot from CVS. Alan DeKok. Chief Architect The FreeRADIUS Project -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGSbmaybq9jdZp9zURAmIqAJ9YOo7cNYiy+1xbTzsd9fG7Jv8URgCePTro 6gu5dyYohRgV8vWGcvIdAB4= =1kb2 -----END PGP SIGNATURE-----

1 0

SIP UAC authentication using Digest-HA1 and Ldap
by Stadler Karel 15 May '07

15 May '07

Hello We have a setup with Active Directory and there we used a field for the Digest-HA1 hash (testpurpose). This field contains a md5-hashed value of "username:realm:password". FreeRadius is configured to do a Ldap query to the AD and pullout this value, which works very well. I've configured the ldap.attrmap for "checkItem Digest-HA1 ADFIELD" and commented out the "password_attribute=" in modules{} as described on a FreeRadius Wiki. Now the problem is that FreeRadius produces this error. "rlm_digest: Configuration item "User-Password" is required for authentication." How can this be solved and please don't say "tell the server what the password is". I need to know how it can be configured. We're using FreeRadius Version 1.0.1. best rgds -Karel Stadler ------------------------------------------------------------------------ --------------- rad_recv: Access-Request packet from host 127.0.0.1:33040, id=237, length=196 User-Name = "mueller(a)foo.net" Digest-Attributes = 0x0a09737461646c6572 Digest-Attributes = 0x01087073692e6368 Digest-Attributes = 0x022a343634343735353636376136383965393834373832373930303739653336346331 31396365346630 Digest-Attributes = 0x04147369703a3132392e3132392e3139322e3234 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "2f9bcef76be40b7a3a2c78367ae24e8b" Service-Type = IAPP-Register Sip-URI-User = "mueller" NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 hints: Matched DEFAULT at 37 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "mueller" Digest-Realm = "foo.net" Digest-Nonce = "4644755667a689e984782790079e364c119ce4f0" Digest-URI = "sip:10.10.10.24" Digest-Method = "REGISTER" rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 8 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for mueller radius_xlat: '(sAMAccountName=mueller)' radius_xlat: 'ou=users,ou=foo,dc=m,dc=foo,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 129.129.193.110:389, authentication 0 rlm_ldap: bind as cn=mueller,ou=users,ou=foo,dc=m,dc=foo,dc=net/PaSw0R$D to 10.10.10.110:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=foo,dc=m,dc=foo,dc=net, with filter (sAMAccountName=mueller) rlm_ldap: looking for check items in directory... rlm_ldap: Adding title as Digest-HA1, value 8e041f49c9e4a473d58c0f7700e7049d & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user mueller authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_digest: Configuration item "User-Password" is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... ----------------------------------- Karel Stadler Network Technician Paul Scherrer Institute CH-5332 Villigen Switzerland ----------------------------------- PGP KeyId:0x1B740D81

3 3

How can I get all values of Cisco AVpair from NAS if there are multiple values
by Александр Никулин 15 May '07

15 May '07

Hello How can I get all values of Cisco AVpair from NAS if there are multiple values, for example May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 54 "faxrelay-start-time=16:03:58.021 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 59 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 53 "faxrelay-stop-time=16:04:37.161 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 38 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 32 "faxrelay-max-jit-buf-depth=506" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 33 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 27 "faxrelay-jit-buf-ovflow=0" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 41 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 35 "faxrelay-init-hs-mod=V.27ter/4800" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 39 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 33 "faxrelay-mr-hs-mod=V.27ter/4800" and so on.

1 0

freeradius+mysql
by Hermidio A. Rodrguez Chavez 15 May '07

15 May '07

Hellow friends I'm new user in freeradius, and I've installed in my server freeradius with mysql support,but i like to add ras user or test the server with someone user inside the Mysql DB , because in the docs i not see any info about it. i add the mysql server conf to the sql.conf file, import all tables into a new bd and my version is 1.1.3-3 Thanks Hermidio

4 7