- Freeradius-Users - lists.freeradius.org

ldap groups + freeradius
by Karen R McArthur 13 Mar '07

13 Mar '07

I know this question has been asked many times before. I have searched the archives and I have tried what I've found there, but I can't seem to get this working. RedHat EL 4 (managed through RHN, so latest available versions) freeradius-1.0.1-3 openldap-2.2.13-6 I have 4 NAS-IP-Addresses. My users are split into 6 groups (some are in multiple groups): public, faculty, staff, student, vpn, and admin. I would like the users to get access to the NAS by virtue of being in a group. 192.168.1.1 admin 192.168.1.2 vpn 192.168.1.3 & 192.168.1.4 faculty, staff, student & public What steps do I need to follow to implement this? I have tried many combinations in "huntgroups", "users", and "radiusd.conf". Any directions or urls to documentation would be appreciated. Thank you. -- Karen R. McArthur <kmcarthu(a)bates.edu> Systems Administrator Information and Library Services, Bates College Lewiston, Maine 04240 USA ph:(207)786-8236 fax:(207)786-6057 *****some ldif output****** dn: uid=user1,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: staff radiusGroupName: vpn radiusGroupName: admin dn: uid=user2,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: student dn: uid=user3,ou=People,dc=example,dc=com objectClass: radiusprofile radiusGroupName: faculty radiusGroupName: vpn dn: cn=vpn,ou=ldap-auth,dc=example,dc=com objectClass: groupOfNames cn: vpn member: uid=user1,ou=People,dc=example,dc=com member: uid=user3,ou=People,dc=example,dc=com dn: cn=vpn,ou=profiles,ou=radius,ou=services,dc=example,dc=com objectClass: radiusprofile cn: vpn radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None *********** radiusd.conf ************ ldap { server = "ldap.example.com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" basedn = "ou=People,dc=example,dc=com" identity = "cn=lnxproxy,ou=LDAPauth,dc=example,dc=com" password = itsasecret start_tls = no tls_cacertfile = /usr/share/ssl/certs/ca-cert.pem tls_cacertdir = /usr/share/ssl/certs/ tls_certfile = /usr/share/ssl/certs/cert.pem tls_keyfile = /usr/share/ssl/certs/key.pem dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{ Ldap-UserDn}))" groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } ***** users ***** DEFAULT Auth-Type = LDAP Fall-Through = 1 DEFAULT Ldap-Group == "cn=vpn,ou=ldap-auth,dc=example,dc=com", Fall-Through = no ********** huntgroups ********** admin NAS-IP-Address == 192.168.1.1 Session-Timeout = 60, Idle-Timeout = 30, Ldap-Group = admin public NAS-IP-Address == 192.168.1.3 NAS-IP-Address == 192.168.1.4, Idle-Timeout = 3600, Ldap-Group = public, Ldap-Group = faculty, Ldap-Group = staff, Ldap-Group = student vpn NAS-IP-Address == 192.168.1.2

2 1

Syntax error converting datetime from character string
by satish patel 13 Mar '07

13 Mar '07

Dear all I have setup freeradius-1.1.0 with Cisco VPDN with MSSQL2000 but i got this error and my radius goes down Tue Mar 13 10:57:44 2007 : Error: rlm_sql_unixodbc: '22007 [unixODBC][FreeTDS][SQL Server]Syntax error converting datetime from character string.' Tue Mar 13 10:57:44 2007 : Error: rlm_sql (sql): Couldn't insert SQL accounting STOP record - 00000 what is this ??? is this any bug or radiusd or mssql200 can anybody explain me for this problem $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 2

Debian
by Tas Dionisakos 13 Mar '07

13 Mar '07

Hello All, I just compiled radius and tried to create the deb packages using the method mentioned on the freeradius wiki. When the process finishes the deb packages are version 1.1.3, is there a way of correcting this as apt gets confused? Tas. -- ************************************* Tas Dionisakos IT Manager St Mary’s College and Newman College The University of Melbourne T: 03 9342 1708 M: 0439 655 565 E: tas(a)newman.unimelb.edu.au C: (0o (||||)(||||) o0) *************************************

2 1

Ssl help
by Hillary Marek 12 Mar '07

12 Mar '07

I am trying to set up a Fedora Core 6 computer as a FreeRadius Server. It is currently running, and authenticating via mac address. I also want to set the same computer up as a CA using openssl. When I run the CA script, I get the following output: CA certificate filename (or enter to create) Making CA certificate ... Generating a 1024 bit RSA private key ..........................................++++++ ..++++++ writing new private key to './CAtop/private/./cakey.pem' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [US]: State or Province Name (full name) [******]: ***** []: Organization Name (eg, company) [******]: Organizational Unit Name (eg, section) [MIS]: Hillary Marek []: hmarek(a)hazen.com []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for ./CAtop/private/./cakey.pem: I am unable to access the ../../CA/newcerts directory ../../CA/newcerts: No such file or directory It seems to run finde until that last error. Any ideas? All answers are appreciated. Hazen Paper Company maintains and takes affirmative steps to protect and secure confidential, privileged, and proprietary information. If you have received such information in error, or information related to trademarks, or other confidential or proprietary information, Hazen Paper Company does not waive any claim it may have for such unintended delivery or damage arising from any use, copying, communication, transmission or failure to notify Hazen Paper Company of the error. Hazen Paper Company will exercise its rights against persons mistakenly or fraudulently communicating or receiving the above described or any other information not intended by Hazen Paper Company for transmittal by the Company. Although this email and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by the Hazen Paper Company or its affiliates either jointly or severally, for any loss or damage arising in any way from its use.

2 1

Can compile FR 1.1.5 Mysql 5.0.33 on FC4
by Jose Guevarra 12 Mar '07

12 Mar '07

Hi, I'm trying to install Freeradius 1.1.5 with MySQL 5.0.33 on fedora core 4.

2 2

Re: Compile Freeradius 1.1.5 with MySQL 5.0.33 on fedora core 4
by Jose Guevarra 12 Mar '07

12 Mar '07

I tried without the terminating slash and the same errors occur. The user i'm compiling with has access to all those directories. "./configure --help" doesnt have all the mysql switches listed. where can I find all the configure options for mysql support in FR? Thanks. On 3/12/07, A.L.M.Buxey(a)lboro.ac.uk <A.L.M.Buxey(a)lboro.ac.uk> wrote: > > Hi, > > > ./configure --prefix=/srv/freeradius115 --with-mysql-dir=/srv/mysql5033/ > > --with-mysql-include-dir=/srv/mysql5033/include/mysql/ > > --with-mysql-lib-dir=/srv/mysql5033/lib/mysql/ --with-openssl > > could you try without the terminating slash on the paths. also, are the > paths > readable by the user you are running ./configure as? > > alan >

1 0

Compile Freeradius 1.1.5 with MySQL 5.0.33 on fedora core 4
by Jose Guevarra 12 Mar '07

12 Mar '07

Hi, I'm trying to install Freeradius 1.1.5 with MySQL 5.0.33 on fedora core 4. I'm upgrading from FR1.1.1 with a standard mysql install. My MySQL installation is in a non-standard place /srv/mysql5033 So I configure FR with these options.... ./configure --prefix=/srv/freeradius115 --with-mysql-dir=/srv/mysql5033/ --with-mysql-include-dir=/srv/mysql5033/include/mysql/ --with-mysql-lib-dir=/srv/mysql5033/lib/mysql/ --with-openssl OUTPUT: config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting configure: WARNING: iodbc headers not found. Use --with-iodbc-include-dir=<path>. configure: WARNING: sql submodule 'iodbc' disabled checking for mysql_config... yes checking for mysql_init in -lmysqlclient_r (using mysql_config)... no configure: WARNING: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql.h (using mysql_config)... yes configure: WARNING: sql submodule 'mysql' disabled configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: sql submodule 'oracle' disabled configure: WARNING: unixODBC headers not found. Use --with-unixodbc-include-dir=<path>. configure: WARNING: sql submodule 'unixodbc' disabled Am I missing iodbc-dev? My last installation didn't seem to need it.

1 0

Re: [Chillispot] Correction of Reply Messages
by PD 12 Mar '07

12 Mar '07

Thx Brad... But... our FR installation is came from FBSD ports, not self compiling. How to apply yr patch ? Cheers PD On 3/10/2007, "Brad Evans" <brad(a)totalweb.net.au> wrote: >Hi, > >Check out the "FreeRadius" forum at www.chillispot.org - there is a >patch there which allows you to specify custom reply messge text. > >Cheers > >PD wrote: >> Dear all, >> >> Sorry for cross post... since I doubt about which area of this question. >> >> I just create one account call test for duration 300 second / 5 minutes. >> After the maximum time reached, I logged by the system out. When I try >> to log in again, the reply message display is "Your maximum never usage >> time has been reached" >> >> Seems that I have some correction for the message (take out never), but I >> do not know how to do it. >> >> Can some one let me know where to edit the above reply message ? >> >> TIA >> >> PD >

4 6

checkrad replace by other script
by satish patel 12 Mar '07

12 Mar '07

can i replace checkrad with another script $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

checkrad snmp + cisco VPDN problem
by satish patel 12 Mar '07

12 Mar '07

Dear alll I have problem last 2 month nobady give me solution of this error when i run checkrad manually i got this error [root@radius satishp]# checkrad cisco 192.168.1.1 1034 mlpm542 999 SNMP Error: Received SNMP response with error code error status: noSuchName index 1 (OID: 1.3.6.1.4.1.9.2.9.2.1.18.1034) SNMPv1_Session (remote host: "192.168.1.1" [192.168.1.1].161) community: "public" request ID: 2076414691 PDU bufsize: 8000 bytes timeout: 2s retries: 5 backoff: 1) at /usr/local/sbin/checkrad line 221 checkrad: No SNMP answer from cisco. what is this ??? Is this related to OID or somthing else and how do i check wheather checkrad call by radius everytime and is there nessesary to put passwd in naspass i have only define nastype = cisco and empty naspassord file and some entry in naslist nasspasswd #203.172.90.118 !root TufFseCrET #203.172.42.152 !root ToTaLCnTl #192.168.1.1 SNMP public naslist # NAS Name Short Name Type #---------------- ---------- ---- #portmaster1.isp.com pm1.NY livingston #portmaster2.isp.com pm1.LA livingston #localhost local portslave 192.168.1.1 vpdn cisco this is my configuration i want to use checkrad then how do i check my checkrad working or now $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0