- Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 25, Issue 68
by khursheed Ahmed 16 May '07

16 May '07

1 0

None
by Александр Никулин 16 May '07

16 May '07

Hello How can I get all values of Cisco AVpair from NAS if there are multiple values, for example May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 54 "faxrelay-start-time=16:03:58.021 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 59 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 53 "faxrelay-stop-time=16:04:37.161 NSK Mon May 14 2007" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 38 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 32 "faxrelay-max-jit-buf-depth=506" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 33 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 27 "faxrelay-jit-buf-ovflow=0" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 41 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 35 "faxrelay-init-hs-mod=V.27ter/4800" May 14 16:04:38.193: RADIUS: Vendor, Cisco [26] 39 May 14 16:04:38.193: RADIUS: Cisco AVpair [1] 33 "faxrelay-mr-hs-mod=V.27ter/4800" and so on.

4 7

FreeRadius 2.0 proxy question - home_server auth and acct server?
by Brian Walters 16 May '07

16 May '07

With the new 2.0 release do we have to make 2 entries for each home server? 1 for auth packets and 1 for acct packets? -- Brian

3 4

FreeRadius 2.0 Radrelay to multiple servers?
by Brian Walters 16 May '07

16 May '07

Currently I have 3 FR 1.1.3 servers that proxy for a couple of ISP customers. Right now I have radrelay processes point from 1->3, 2->3 and 3->1, 3->2. This allows me to have reasonably matched accounting data on all 3 servers for all my ISP customers while allowing me to load balance my NAS gear across my servers. In the new 2.0 release it appears that we are using the proxy.conf to tell radiusd -n radrelay where to send those packets. Wouldn't I need to set up a separate proxy.conf with a DEFAULT entry in order to send ALL realm acct packets to my two other servers as described above otherwise it would seem the packets would try to forward to the ISP customer again instead of my own servers? How do I get it to send the data to both servers in a server_pool like I did with the old radrelay: 3->1 & 3->2. -- Brian

2 3

Support for MySQL Stored Procedures in FreeRADIUS 2.0?
by Gunther 16 May '07

16 May '07

Will there be support for MySQL Stored Procedures in 2.0? FreeRADIUS 2.0.0-pre1 does not yet support SP in MySQL. Gunther

2 1

HUP stops radiusd
by John Horne 16 May '07

16 May '07

Hello, This is a 'me too' message I'm afraid. From the list archives I saw: ====================================================== > Date: Mon, 02 Apr 2007 20:20:47 +0200 > From: Alan DeKok <aland at deployingradius.com> > Subject: Re: HUP in freeradius-1.1.5 + CVS results in process death. > To: FreeRadius users mailing list > <freeradius-users at lists.freeradius.org> > Message-ID: <4611497F.3000500 at deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Arran Cudbard-Bell wrote: > >> I know theres a bug report for this already, >> but when I HUP the process freeradius doesn't die in the same place. >> > > If it's an issue due to incorrectly free'd memory, the crashes will be > random. > > There may be a fix in 1.1.6, but I'm not sure. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > Looks more like a bug in rlm_tls . Dies every time on HUP, deffinatly not random... ====================================================== In our case, using freeradius 1.1.6, if I HUP the radiusd process it crashes/stops. Running 'radiusd -X', the tail part shows: ========================================================= security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Mon May 14 13:38:54 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon May 14 13:38:54 2007 : Error: radiusd.conf[230] Auth-Type PAP already configured - skipping Mon May 14 13:38:54 2007 : Error: radiusd.conf[234] Auth-Type MS-CHAP already configured - skipping Mon May 14 13:38:54 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon May 14 13:38:54 2007 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Mon May 14 13:38:54 2007 : Error: rlm_eap_tls: Error reading certificate file Mon May 14 13:38:54 2007 : Error: rlm_eap: Failed to initialize type tls Mon May 14 13:38:54 2007 : Error: radiusd.conf[1]: eap: Module instantiation failed. Mon May 14 13:38:54 2007 : Error: radiusd.conf[238] Unknown module "eap". Mon May 14 13:38:54 2007 : Error: radiusd.conf[229] Failed to parse authenticate section. ========================================================= This was running radiusd as the root user, running it as our usual non-root user caused the same output. Starting up radiusd normally shows no such error messages, so I'm not sure why it should now complain about the Auth-Type's or the certificate. Using the original radiusd.conf produces the same error messages, with a couple of extras (for the Auth-Types's system and CHAP). Any ideas? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

8 11

Attributes mapping between LDAP and RADIUS
by Jian Wang 16 May '07

16 May '07

Is there an RFC standardizing the attribute mapping between LDAP and RADIUS? Thanks.

2 1

Proxy + LOCAL - Is it possible?
by Apostolos Pantsiopoulos 16 May '07

16 May '07

Hi, I am about to migrate from our old radius based system (VoIP) to a new one (based on freeradius). Is it possible to use the proxy feature so that I can process the requests both locally ( acct=LOCAL, auth=LOCAL) as well as remotely (send them to the old system as well)? I would like to use both systems simultaneously until I am sure that the new one behaves as expected. Regards, -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com Support Center email: apant(a)kinetix.gr, support(a)kinetix.gr Tel. & Fax: +30 2310556134 Mobile : +30 6937069097 MSN : apant2(a)hotmail.com WWW: http://www.kinetix.gr/ -------------------------------------------

2 1

RE: help on radius, how to make password in clear text
by liRyan 16 May '07

16 May '07

Ok, thanks for reminder. [Email] wsly790104(a)hotmail.com; wsly790104(a)yahoo.com; [MSN] wsly790104(a)hotmail.com [YahooMessage]wsly790104> From: stefan.winter(a)restena.lu> To: freeradius-users(a)lists.freeradius.org> Subject: Re: help on radius, how to make password in clear text> Date: Wed, 16 May 2007 07:52:07 +0200> CC: freeradius-devel(a)lists.freeradius.org> > Hi,> > this is for the _users_ list, not developers.> > > But if other client using same radius server authticate with same username> > and pasword, the "User-Password" field is in clear text and all works.> > Could some one look this for me, many thanks. Ryan.> > 1) double-check the shared secret on NAS and FreeRADIUS - if they don't match, > decryption of User-Password results in weird characters> 2) post _useful_ debugs. Of "radiusd -X" as a whole, not just a few lines. > radiusd -X probably even tells you that it suspects a mismatched shared > secret a few lines later.> > Stefan> > -- > Stefan WINTER> > Stiftung RESTENA - Réseau Téléinformat! ique de l'Education Nationale et de > la Recherche> Ingenieur Forschung & Entwicklung> > 6, rue Richard Coudenhove-Kalergi> L-1359 Luxembourg> E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1> http://www.restena.lu Fax: +352 422473 _________________________________________________________________ 探索 Windows Vista 的世界 http://search.live.com/results.aspx?q=windows+vista&mkt=zh-cn&FORM=LIVSOP

1 0

Re: help on radius, how to make password in clear text
by Stefan Winter 16 May '07

16 May '07

Hi, this is for the _users_ list, not developers. > But if other client using same radius server authticate with same username > and pasword, the "User-Password" field is in clear text and all works. > Could some one look this for me, many thanks. Ryan. 1) double-check the shared secret on NAS and FreeRADIUS - if they don't match, decryption of User-Password results in weird characters 2) post _useful_ debugs. Of "radiusd -X" as a whole, not just a few lines. radiusd -X probably even tells you that it suspects a mismatched shared secret a few lines later. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0