- Freeradius-Users - lists.freeradius.org

What is the real meaning and use of cache-size in ippool declaration
by Florin 23 Mar '07

23 Mar '07

Hi everyone, FreeRadius 1.0.1 here, the one which comes as standard with RHEL 4. I want to use a whole class B subnet (172.16.0.0/16) in an ippool declaration to assign IP addresses from. Now it is said that the cache-size parameter should be equal to the number of IP addresses in the pool. But if I try to set it to 65536, the server won't start (it'll crash actually). So what is the **real** meaning and use of this parameter ? You have to specify the start and end of the pool, so then why set another parameter with a value that can be trivially calculated by the server anyway ? And more importantly, what are the right guidlines on setting the value for this parameter ? Making it equal to the number of IP addresses in the pool won't work and it just doesn't make any sense to me. Finally, if I change the value of this parameter, beside restarting FreeRadius, do I have to do anything else ? Do I have to delete the related database and index files in order for the change to take place ? Thank you in advance. Best regards, Florin

1 0

freeradius unistalling
by elmalhi abdelghani 23 Mar '07

23 Mar '07

Hi, how i can uninstall freeradius, i dont found make uninstall thank´s Abdelghani ELMALHI Devesestr. 1 45897 Gelsenkirchen Deutschland Tel. 00 49 176 65 84 38 50 --------------------------------- Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses.

1 0

LDAP + groups problem
by Angel L. Mateo 23 Mar '07

23 Mar '07

Hello, We are using freeradius with a ldap backend for my users. We have a few services authenticating against the radius server that need to filter some groups of users For users we have a posix schema: Our users has the posixAccount schema whith its main group in the attribute gidNumber. Something like this: dn: uid=myuser,ou=Users,dc=domain.com objectClass: posixAccount objectClass: shadowAccount objectClass: CourierMailAccount uid: myuser uidNumber: 123456 gidNumber: 1001 loginShell: /bin/bash mail: myuser(a)domain.com ... For the group entry we have: dn: cn=groupA,ou=Groups,dc=domain.com cn: groupA gidNumber: 1001 objectClass: posixGroup objectClass: top For user's secondary groups we have: dn: cn=groupB,ou=Groups,dc=domain.com cn: groupB gidNumber: 1002 objectClass: posixGroup objectClass: top memberUid: myuser so, this user belongs to groupA (main group) and groupB (secondary group). This is similar to /etc/passwd and /etc/group files. What I want is that the below users' entry reject access to user "myuser": DEFAULT Ldap-Group == "groupB", Auth-Type := Reject Reply-Message = "groupB users are not allowed to login" I am trying varios configurations but I don't get the good one. I have try to configure as: groupname_attribute = gidNumber groupmembership_filter = "(&(objectClass=posixAccount)(uid= %{Stripped-User-Name:-%{User-Name}}))" groupmembership_attribute = uid but with this configuration I can filter just by the main group (myuser is still allowed). The configuration: groupname_attribute = cn groupmembership_filter = "(&(objectClass=posixGroup)(memberUid= %{Stripped-User-Name:-%{User-Name}}))" groupmembership_attribute = memberUid seems to look just in secondary groups. Is there any way to configure taking count of main and secondary groups with this structure? Thanks in advance -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

1 0

PEAP/MSCHAPv2 and WinXP
by Damian Davalos 23 Mar '07

23 Mar '07

Hello, I have a question I can't seem to answer with the mail archives or documentation. Let me begin by explaining what I'm trying to do: - PEAP/MSCHAPv2 authentication, no client certificates, with a WinXP supplicant. - The server certificate is self-signed. >From the FAQ, I have: - Installed the hot fix from MS KB 885453 - Included the required OID 1.3.6.1.5.5.7.3.1 in the server certificate - Followed MS requirements for server certificates in KB 814394 The only way I can get this setup to work, is if I import my root certificate onto my client machine. Otherwise, I get the typical Access-Request and Access-Challenge back and forth. My question: Is importing the root certificate onto your client necessary when self-signing your own server certificate? If not, then I guess I'm still doing something wrong, but I would like to make sure before I continue to troubleshoot. Any help is greatly appreciated. Regards, Damian Davalos

6 6

Res: Res: EAP-TTLS + Post-auth clear password
by Erico Augusto 23 Mar '07

23 Mar '07

Hi, as suggested, I'm working with exec module. radiusd.conf: ... exec { post-auth:User-Password = `%{exec:/usr/local/etc/raddb/jradius.forward}` wait = yes input_pairs = request } ... the content of /usr/local/etc/raddb/jradius.forward script is just: #!/bin/bash echo 123456 so, the user's password that I'm using is 123456(inserted at secureW2 Windows XP popup), but I'm yet receiving ciphered User-Password at destination custom app... I have changing the content of jradius.forward script to #!/bin/bash echo 123456789 just to see if the password sended is the one returned by jradius.forward script, but all entries at radiusd -X shows: ... Processing the post-auth section of radiusd.conf ... rlm_jradius: packing attribute User-Password (type: 2; len: 6) ... Conclusion: the User-Password attribute is not been changed by the external script, once the length should be 9 ... some idea about what is wrong? one more point: I'm setting user's password at etc/raddb/users file (it mey be a problem, i mean ... does it fixing the password?). thanks a lot, Erico. ----- Mensagem original ---- De: Alan DeKok <aland(a)deployingradius.com> Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Enviadas: Quinta-feira, 22 de Março de 2007 5:29:24 Assunto: Re: Res: EAP-TTLS + Post-auth clear password Erico Augusto wrote: > I'm trying to forward username and password to my own app, using > post-auth section, to perform user authentication, as described below > ... is that possible? Yes. See the "exec" module. Why do you think the pap module has anything to do with it? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

2 1

RE: New Server Build
by Scott Hughes 23 Mar '07

23 Mar '07

Alan, Thanks for the reply. I am using the 'radtest' utility. The actual command I am typing (from the command line of the server itself is: "radtest test1 test1 192.168.1.5:1812 0 testing123". I am attempting to make sure everything is okay on the server itself, before attempting to connect to the server with a client. The DB structure is: 8 tables as follows: nas, radacct, radcheck, radgroupcheck, radgroupreply, radpostauth, radreply, usergroup. Scott Scott Hughes wrote: > When I run the radtest utility that comes with FR, I get an access-reject, even though the user is in the radius database. Running FR with the -X parameter, it does appear to be check the database. > > Am I testing correctly for this type of FR & MySQL setup? Likely, yes. What's in the DB, and what kinds of packets are you sending for tests? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 1

freeradius cisco command accounting
by satish patel 23 Mar '07

23 Mar '07

Dear's is there any feature in freeradius provide cisco command accouning means users run command on cisco router and radius provide me command log ?? per users i want to replace my tacace with freeradius $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 2

IP Pool management and Re-authentication
by Thibault Le Meur 22 Mar '07

22 Mar '07

Hi, I'm using a system (openvpn) with 'radiusplugin' to let FR authenticate users and manage IP Pools. Openvpn sometimes needs to renegotiate the connections and thus sends authentication requests while the connection is still active (with an already assigned IP address): this causes FR to assign a new IP address from the pool (which seems normal since FR has no way to know this is a renegotiation). I'd like to patch the openvpn-radiusplugin so that an extra attribute is sent in the Access-Accept packets so that FR will be able to differentiate Initial and Renegociation Access-Accept requests and only assign new IP address from the pool on Initial Access-Accept requests. Do you know a standard Radius attribute that could be used for this ? As far as you know, are there other NASes using such a quirk ? Does this make sense ? Thanks in advance, Thibault

3 9

Incomplete accounting sessions and IP pool resets
by Ramm-Ericson, Johannes 22 Mar '07

22 Mar '07

Hello Freeradius users! I have a recurring problem that I'm wondering if any of you have run into. I am currently running freeradius 1.1.4 (haven't had time to upgrade yet) on Suse Linux SLES 10 together with a Myql DB engine. I am using IP pools to supply users coming from various NAS:es with IP adresses. These IP pools seem to run out of IP adresses which is surprising given that I have more IP adresses than users for each NAS. Basically, new access requests don't get anywhere because there aren't any free IPs left. Once I stop freeradius, delete the ip pools and start freeradius again everything is fine. It is annoying however.... I suspect the problem may be related to the fact that some sessions do not recieve accounting session stop packets. This happens alot so currently I'm working around the issue by way of a cron jobb that deletes the IP pools and restarts freeradius every night - but this is a workaround and I really would like a better solution. Particularly since the problem creeps up in daily operations aswell. Also; I have no control over the NAS:es but I can discuss the issue with the NAS admins if i know what to look for! Does anyone have any suggestions / ideas / experiences with this sort of problem? Thanks and Best Regards, Johannes R-E

3 2

New Server Build
by Scott Hughes 22 Mar '07

22 Mar '07

Hello All, I am attempting to build a new and different FR server than I currently use. The new one is running the latest FR release and MySql. I am also running the dialup admin software. Before I attach a bunch of logs and eat up bandwidth, I want to make sure that I am testing correctly. When I run the radtest utility that comes with FR, I get an access-reject, even though the user is in the radius database. Running FR with the -X parameter, it does appear to be check the database. Am I testing correctly for this type of FR & MySQL setup? Thanks in advance, Scott

2 1