- Freeradius-Users - lists.freeradius.org

Re: freeradius -peap ad/ldap
by Sam Schultz 15 Mar '07

15 Mar '07

On Thu, 15 Mar 2007 10:57:29 -0500 joe vieira <jvieira(a)clarku.edu> wrote: >Alan DeKok wrote: >> joe vieira wrote: >> >>> i have eap-peap authentication working against our ad domain. >peachy >>> keen. what i would like to be able to do is, in our openldap >>> environment, store attributes for retrieval by radius, cisco >stuff/ >>> etc... i assume the way to do this would be to use the >authorization >>> sections, but if you add ldap to that then it automatically >adds ldap >>> authentication...which i don't want.. >>> >> >> Upgrade to a newer version of the server, which doesn't do >that. >> >which versions would that be? OK, I think I understand what you're asking. If you want to use LDAP for authorization ONLY, and something else for authentication, you could put an entry like this in your 'users' file: DEFAULT <check_items (ex: Realm == 'your_domain')> Autz-Type := <your_ldap_instance (ex: ldap)>, Auth-Type := <module_instance_for_authentication> Setting Autz-Type forces a certain type of authorization. Setting Auth-Type forces a certain type of authentication. Doing this in a DEFAULT entry causes ALL users that have Fall-Through set to yes to be passed through the specified authorization & authentication method. This could also be set on a per-user basis by changing DEFAULT to the a given user's username. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click here for free information on nursing jobs, up to $150/hour http://tagline.hushmail.com/fc/CAaCXv1Rz1mAIkYFfrrMgKeHIMrG3Yzo/

2 1

Compile problems on Solaris 10
by Paul Goodman 15 Mar '07

15 Mar '07

I am trying to compile the pam_radius-1.3.16 modules on a Solaris 10 system, but when I run make, I get the following error: gcc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o In file included from pam_radius_auth.h:23, from pam_radius_auth.c:63: md5.h:21: error: syntax error before 'u_int32_t' md5.h:21: warning: no semicolon at end of struct or union md5.h:22: warning: type defaults to 'int' in declaration of 'bits' md5.h:22: warning: data definition has no type or storage class md5.h:24: error: syntax error before '}' token md5.h:29: error: syntax error before 'buf' pam_radius_auth.c: In function 'get_random_vector': pam_radius_auth.c:350: error: storage size of 'my_md5' isn't known pam_radius_auth.c:350: warning: unused variable 'my_md5' pam_radius_auth.c: In function 'get_accounting_vector': pam_radius_auth.c:382: error: storage size of 'my_md5' isn't known pam_radius_auth.c:382: warning: unused variable 'my_md5' pam_radius_auth.c: In function 'verify_packet': pam_radius_auth.c:400: error: storage size of 'my_md5' isn't known pam_radius_auth.c:400: warning: unused variable 'my_md5' pam_radius_auth.c: In function 'add_password': pam_radius_auth.c:497: error: storage size of 'md5_secret' isn't known pam_radius_auth.c:497: error: storage size of 'my_md5' isn't known pam_radius_auth.c:497: warning: unused variable 'my_md5' pam_radius_auth.c:497: warning: unused variable 'md5_secret' pam_radius_auth.c: In function 'rad_converse': pam_radius_auth.c:1016: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1019: warning: passing argument 2 of 'conv->conv' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_authenticate': pam_radius_auth.c:1071: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1099: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1113: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1146: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c: In function 'pam_private_session': pam_radius_auth.c:1267: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1288: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_chauthtok': pam_radius_auth.c:1374: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1395: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1404: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type gmake: *** [pam_radius_auth.o] Error 1 The same is true when I use the Sun cc (Studio 11 compiler). I am using gcc 4.0.2 (the most recent version I could get to run on Solaris). Output of uname -a is: SunOS xxxx 5.10 Generic_118833-36 sun4u sparc SUNW,A70 Does anyone have a suggestion as to how to modify the header file to make it work or know where I can find pre-compiled modules for Solaris?

2 2

Re: Fedora RPM build issue
by Sam Schultz 15 Mar '07

15 Mar '07

On Thu, 15 Mar 2007 12:17:11 -0500 Chris Moody <Chris.Moody@axiom- tech.net> wrote: >Greetings all, > >I am trying to create an RPM of Freeradius 1.1.5 for a Fedora Core >6 >install, and following the instructions in the Wiki, the build >process >dies with this at the end: > >c/include -Ilibeap -c rlm_eap.c -fPIC -DPIC -o .libs/rlm_eap.o In >file >included from rlm_eap.c:26: >rlm_eap.h:26:18: error: ltdl.h: No such file or directory In file Your problem is you don't have libtdl-devel installed, and maybe not even libtdl. The errors that come up after this point are probably just the compiler's laments about not having the libtdl includes (There could be errors, too. I stopped looking after the line above) >included from rlm_eap.c:26: >rlm_eap.h:36: error: expected specifier-qualifier-list before >'lt_dlhandle' >rlm_eap.c: In function 'eap_authenticate': >rlm_eap.c:285: warning: passing argument 5 of 'request_data_add' >from >incompatible pointer type >rlm_eap.c:308: warning: passing argument 5 of 'request_data_add' >from >incompatible pointer type >rlm_eap.c:388: warning: pointer targets in passing argument 2 of >'pairmake' differ in signedness >rlm_eap.c: In function 'eap_post_proxy': >rlm_eap.c:547: warning: pointer targets in passing argument 2 of >'pairmake' differ in signedness >rlm_eap.c:580: warning: pointer targets in passing argument 1 of >'strncasecmp' differ in signedness >rlm_eap.c:605: warning: pointer targets in passing argument 4 of >'rad_tunnel_pwdecode' differ in signedness >rlm_eap.c:616: warning: pointer targets in passing argument 1 of >'rad_tunnel_pwencode' differ in signedness >rlm_eap.c:616: warning: pointer targets in passing argument 4 of >'rad_tunnel_pwencode' differ in signedness >gmake[6]: *** [rlm_eap.lo] Error 1 >gmake[6]: Leaving directory >`/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules/rlm_eap' >gmake[5]: *** [common] Error 2 >gmake[5]: Leaving directory >`/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules' >gmake[4]: *** [all] Error 2 >gmake[4]: Leaving directory >`/root/rpmbuild/BUILD/freeradius-1.1.5/src/modules' >gmake[3]: *** [common] Error 2 >gmake[3]: Leaving directory `/root/rpmbuild/BUILD/freeradius- >1.1.5/src' >gmake[2]: *** [all] Error 2 >gmake[2]: Leaving directory `/root/rpmbuild/BUILD/freeradius- >1.1.5/src' >gmake[1]: *** [common] Error 2 >gmake[1]: Leaving directory `/root/rpmbuild/BUILD/freeradius- >1.1.5' >make: *** [all] Error 2 >error: Bad exit status from /var/tmp/rpm-tmp.72903 (%build) > > >RPM build errors: > Bad exit status from /var/tmp/rpm-tmp.72903 (%build) > >Not being a wiz at this, I'm at a dead end. Any help? > >Thanks! > >-C > > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online masters degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S74nxrxmtHSCjwCfRWR2eI8wV/

1 0

Re: RE : EAP-TTLS outer identity & accounting
by Sam Schultz 15 Mar '07

15 Mar '07

On Thu, 15 Mar 2007 10:51:17 -0500 Alan DeKok <aland(a)deployingradius.com> wrote: >Sam Schultz wrote: >> An entry like: >> >> DEFAULT Realm == "test", Autz-Type := sql-test >> User-Name = "%{User-Name}" > > Please read "man users" for the definition and meaning of >operators. > > You want: > >DEFAULT ... > User-Name := ... Actually, the example above was a typo. The 'User-Name =' line was 'User-Name :=' during testing, which is the part that is confusing, since the documentation states: Attribute := Value Always matches as a check item, and replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added. As a reply item, it has an identical meaning, but for the reply items, instead of the request items. According to this passage from the operators web page (http://wiki.freeradius.org/Operators) I would expect the original 'anonymous@test' entry to be replaced by 'test@test', and not be appended to the list like what is apparently happening. >... >> Followed by Accounting-Requests that still contain the anonymous > >> entry, >> so it is still using the oldest (first?) User-Name attribute. Is > >> there any way at all to REMOVE already set attributes so they >aren't >> re-sent to the NAS? > > The documentation helps in these matters. The documentation helps ONLY if the documentation is consistent with the application's design, and ONLY if the NASes at the other end adhere to the RADIUS standard. Of course, I would chalk this up to a mistake in my configuration before asserting the former. The output of fr's output seems to rule out the latter. > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online masters degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S74oLy1CA3gAXs15s3QyaHS8N/

1 0

freeradius -peap ad/ldap
by joe vieira 15 Mar '07

15 Mar '07

Hi all, I'm using the RHEL build of freeradius 1.0.1. I'm trying to do something that might seem totally stupid, so let me know if i am (no need to flame). I'm new to freeradius so bear with me a bit. i have eap-peap authentication working against our ad domain. peachy keen. what i would like to be able to do is, in our openldap environment, store attributes for retrieval by radius, cisco stuff/ etc... i assume the way to do this would be to use the authorization sections, but if you add ldap to that then it automatically adds ldap authentication...which i don't want.. ideas? Joe Vieira UNIX Systems Administrator Clark University

2 2

Re: RE : EAP-TTLS outer identity & accounting
by Sam Schultz 15 Mar '07

15 Mar '07

An entry like: DEFAULT Realm == "test", Autz-Type := sql-test User-Name = "%{User-Name}" does add a new User-Name attribute with the proper value, but I need a way to delete the anonymous@ entry still, because I Access-Accepts like this: Sending Access-Accept of id 134 to 192.168.0.5 port 5190 User-Name := "anonymous@test" User-Name := "test@test" Followed by Accounting-Requests that still contain the anonymous entry, so it is still using the oldest (first?) User-Name attribute. Is there any way at all to REMOVE already set attributes so they aren't re-sent to the NAS? For that matter, shouldn't the "use_tunneled_reply = yes" in the ttls module configuration have kept me from having this problem? I also have copy_request_to_tunnel set to yes, but I doubt that should be causing a problem like this. On Wed, 14 Mar 2007 13:03:21 -0500 Sam Schultz <segfault90(a)hushmail.com> wrote: >On Wed, 14 Mar 2007 11:25:20 -0500 Thibault Le Meur ><Thibault.LeMeur(a)supelec.fr> wrote: >>> -----Message d'origine----- >>> De : >>> freeradius-users-bounces+thibault.lemeur=supelec.fr(a)lists.free >>> radius.org >>> [mailto:freeradius-users-bounces+thibault.lemeur=supelec.fr@li >>> sts.freeradius.org] De la part de Sam Schultz >>> Envoyé : mercredi 14 mars 2007 17:13 >>> À : freeradius-users(a)lists.freeradius.org >>> Objet : Re: EAP-TTLS outer identity & accounting >>> >>> >>> >>> >>> On Tue, 13 Mar 2007 13:15:52 -0500 Alan DeKok >>> <aland(a)deployingradius.com> wrote: >>> >Sam Schultz wrote: >>> >> >>> >> This should be solvable by adding something like >>> >> 'User-Name = %{User-Name}' to the DEFAULT entries in the >>users >>> >file, >>> >> correct? >>> > >>> > Yes. >>> >>> One of my users file DEFAULT entries look like this: >>> >>> DEFAULT Realm == "test", Autz-Type := sql-test, User- >>Name = >>> "%u" >>> >>> However, FreeRADIUS tells me this: >>> >>> Error: Invalid operator for item User-Name: reverting to '==' >>> >>> I assume I'm not supposed to forcibly change User-Name, so what >>> attribute would I set to return the correct username to the >NAS? >> >>> I know there is a run-time variable %(reply:User-Name}, would I >>> need to somehow update it with the correct value for User-Name >>> instead? >> >>Yes, by simply adding the User-Name = XXX to the reply items >(that >>is to say >>not on the first line). Try something like this: > >This didn't make much sense at first, but I think I understand it >now. >What you're saying is that the first line is only for check items, >which is why I couldn't set User-Name there. The second line and >beyond >then are for, what? Reply items ONLY, or check & reply items? Is >this >documented anywhere? I just did a quick check through the >freeradius >doc directory, and only found a rlm_fastusers document which didn't >have anything to say about format restrictions. > >> >>DEFAULT Realm == "test", Autz-Type := sql-test >> User-Name=`%{User-Name}` >> >>HTH, >>Thibault >> >> >> >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html > >-- >Click for free info on online degrees and make $150K/ year >http://tagline.hushmail.com/fc/CAaCXv1S7YfNF4AEzCH38YxSm8GfpqO2/ > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on getting an MBA and make $200K/ year http://tagline.hushmail.com/fc/CAaCXv1I825CIGoNlzaFbOgSCtxLP6kM/

2 1

Re: freeradius -peap ad/ldap
by Sam Schultz 15 Mar '07

15 Mar '07

On Thu, 15 Mar 2007 10:16:14 -0500 joe vieira <jvieira(a)clarku.edu> wrote: >Hi all, > >I'm using the RHEL build of freeradius 1.0.1. I'm trying to do You really should upgrade that. If I recall correctly, there were some nasty bugs in the early 1.0.x builds. >something that might seem totally stupid, so let me know if i am >(no >need to flame). I'm new to freeradius so bear with me a bit. > We were all new at some point, some people just forget that :) >i have eap-peap authentication working against our ad domain. >peachy >keen. what i would like to be able to do is, in our openldap >environment, store attributes for retrieval by radius, cisco >stuff/ >etc... i assume the way to do this would be to use the >authorization >sections, but if you add ldap to that then it automatically adds >ldap >authentication...which i don't want.. > >ideas? You could try using one of the SQL modules. Unlike ldap, the sql modules only retrieve attributes from an sql table, and sets the attributes for use by later modules (or freeradius, if the 'Auth-Type := Local' has been set) > >Joe Vieira >UNIX Systems Administrator >Clark University >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on online doctorate degrees and make $250k/ year http://tagline.hushmail.com/fc/CAaCXv1ZYZztVZng17ISIErfsWIIfBi9/

1 0

checkrad problem solved & get solution
by satish patel 15 Mar '07

15 Mar '07

Dear guys I have solve the problem of checkrad for simultenous login i have face many problem first time but finaly i got solution and i have modifiy my script for my nas i have freeradius-1.1.0 with MSSQL2000 with cisco 3700 NAS i want to share my solution with all freeradius guys those are faceing this problem I am useing checkrad with SNMP and i have change some thing in my script. checkrad script take input from radius when user try for login like suse:/ # checkrad Usage: checkrad nas_type nas_ip nas_port login session_id suse:/ # checkrad get input nas_type from client.conf nas_type and nas_ip then user name and port take from login time whn user try for login ... but i dont user port and id_session caz my cisco nas MIB not support port and session thats why i am useing only login name first check manualy through this method #checkrad -d cisco 71.5.250.199 43 satish 0004F09 return 0 ( Login OK ) this script just run snmpwalk command and fetch user all user name and gerp specific name which is store in login name veriable in per script ( checkrad ) and compare against of snmpwalk out put if user match then give u error code 1 ( dobule 1 Login ) this is the login of script ***** Just change in this line of perl script and test your login Note :- i am useing cisco nas type so the perl excute cisco_snmp subrutine so please find this code in cisco_snmp subrutine this is testing perpose after testing replave $login = satish; with this line my $login = $ARGV[3]; ________________my change in checkrad.pl________________ $login = satish; if($login eq $ARGV[3]) { return 1; }else{ $out=snmpwalk($ARGV[1],$pass,"1.3.6.1.4.1.9.10.24.1.3.2.1.2.3.45"); if($out=~/\"$ARGV[3]\"/){ return 1; }else{ return 0; you can see the login here $login store satish veriable then this script check $ARGV[3] veriable this veriable we can get on login time whn will try to satish login then snmpwalk run this command with MIB now point is you have to find MIB for online users u can find mib through the software or something else i have also find MIB and put it there with snmpwalk command then second if($out=~/\"$ARGV[3]\"/){ this will check user if it get in snmpwalk out put then u got doble login error if not match the u got single login means no one login this time with user name satish ...... and put Simultenouse-use := 1 attributes in user file my entry is satish Auth-Type := Local, User-Password == "testing", Simultaneous-Use := 1 Service-Type = Framed-user, Framed-Protocal = PPP, Fall-Through = Yes Contact : - me if you have any problem regarding Simultenouse login problem . $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

(no subject)
by markcapelle＠pcmc.com 15 Mar '07

15 Mar '07

I have a situation where I have a wireless controller that services multiple wireless networks (vlans). When the controller contacts the RADIUS server with an authentication request, it does so with the IP address of the controller as the client address. The problem is I have a guest network that has lower security than my other wireless networks. The guest network has it’s own user/password database stored in the controller, but the way authentication occurs is that it checks RADIUS for the user first and assumes it will fail, then will use the internal database. The issue with this is that if one of my users jumps on the guest network, they are authenticated which is not what I want to happen. Looking at the logs, I noticed that all the guest network users have the IP address of the client in the “cli” field. My guest network is a totally different VLAN and IP subnet. Is there a way to key off of the “cli” field and then make it so that all requests from clients with a specific subnet in this field are not authenticated? This would stop my internal users from connecting, but allow the correct users (those in the internal DB) to still get connected. Thanks. CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of this message in whole or in part is strictly prohibited. Please inform the sender immediately and destroy the original transmittal. Thank you for your cooperation.

2 1

new query verification in sql.conf
by Jean Carlos Oliveira Guandalini 15 Mar '07

15 Mar '07

I use freeradius for authentication of pppoe wifi. I need to make new sql query in a table with a list of mac-address, if the CallingStationId will be equal to the some mac-adress of the table then will not have to be connected. A system of mac-adress blacklist. I tried to make adding one query in sql.conf but it does not function. I find that it would have to add a new function in rlm_sql.c, but am not habil C programmer. Somebody can help me? Sorry for my english Thanks Jean

3 3