- Freeradius-Users - lists.freeradius.org

disconnect users from radius
by satish patel 01 Mar '07

01 Mar '07

Dear all I have installed freeradius on RHEL with MSSQL server and it is working fine but now i have facing problem regarding disconnecting of users my NAS is cisco Router it is l2tp so what i do for this ??? problem ?? and i want to connect my dialupadmin with mssql ????? so it is possible?/ Satish Patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

4 4

How to remove accounting files in the Windows port of FreeRadius?
by Foo JH 01 Mar '07

01 Mar '07

Hi all, I've gotten FreeRadius on Windows (via the FreeRadius.net distro) up and running fine (thanks to all who helped with the setup details). Now I'm trying to purge old accounting records off the directory. Then I realise the files just cannot be deleted... Does anyone have this problem? I suspect it's to do with the 0666 permissions, which I have reset everything to 0777. But that does not seem to make any difference. Please help...thanks.

2 3

specify ip range in huntgroups (or similar functionality).
by Jason Murray 28 Feb '07

28 Feb '07

Is it possible to specify a range of IP addresses in a huntgroups file? What I am trying to accomplish is: 1) AAA authentication to our Cisco devices using radius 2) Only allow people in a specific group to access the devices 3) Reject everyone else. I am using the following: huntgroups: ------------------- netgear NAS-IP-Address == 172.20.120.75 users: ---------- test1@net Auth-Type := Local, User-Password == "testing", Huntgroup-Name == "netgear" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" DEFAULT Auth-Type := Reject, Huntgroup-Name == "netgear" Reply-Message = "Not Authorized to access this gear" This works just fine, but we have well over 600 devices. If at all possible I would like to specify network ranges instead of individual IP addresses in the huntgroups file (similar to what I can do in the clients.conf file). Is this possible? If it is not possible in the huntgroups is there a better way to do what I want to accomplish? Thanks in advance! -- Jason E. Murray jemurray(a)zweck.net http://unixhosts.us/

2 1

alternating authentication LDAP/mini Token
by Jochen Schäfer 28 Feb '07

28 Feb '07

Hi List, I want to accomplish following task with freeradius: Users have two possibilities to authenticate 1. Authentication via username ldap password 2. Authentication via username mini Token What would be a possible solution? Do the normal authentication with username and password against ldap. If it succeeds everythink is fine. This was a ldap auth. If not there has to be a second check via an external script (e.g. perl Net::Simple::RADIUS) which hands over the User-Name, User-Password to the Token Server to check if the possible token is valid. If both attempts fail either the ldap username/password pair or the username/token pair were wrong. I'm wondering which could be the right way to call the script when the first auth failed. I'm looking for a way of reauthentication. Is this possible at all. Can I call the external script somehow in the REJECT sub-section to recall the authentication process? Is there another or a recommended solution to accomplish the above task? Thanks, Jochen

1 0

FreeRadius 1.1.4 and rlm_krb5 and Active Directory
by Kozlov Artem 28 Feb '07

28 Feb '07

Hi! I'm trying to configure freeradius with rlm_krb5 using mini howto from Enrik Berkhan http://archives.free.net.ph/message/20060104.153134.68c5be76.en.html , but i have some troubles. when i type radtest user(a)office.ru userpass localhost 10 testing123 i got: Sending Access-Request of id 145 to 127.0.0.1 port 1812 User-Name = "user(a)office.ru" User-Password = "userpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=145, length=20 and radius log: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:53441, id=145, length=105 User-Name = "user(a)office.ru" User-Password = "userpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: Looking up realm "office.ru" for User-Name = "user(a)office.ru" rlm_realm: No such realm "office.ru" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type krb auth: type "krb" Processing the authenticate section of radiusd.conf modcall: entering group krb for request 3 rlm_krb5: Parsed name is: user(a)office.ru rlm_krb5: failed verify_user: Unknown error -1765328343 (user(a)office.ru ) modcall[authenticate]: module "krb5" returns reject for request 3 modcall: leaving group krb (returns reject) for request 3 auth: Failed to validate the user. Login incorrect: [user(a)office.ru/userpass] (from client localhost port 10) Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 145 to 127.0.0.1 port 53441 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 145 with timestamp 45e576ce Somebody has experience of such adjustment?

1 0

sql set up - Fall-Through agains read_groups in sql.conf
by tzieleniewski 28 Feb '07

28 Feb '07

Hi! How can I configure radius to always check the group table for a user without utilizing the Fall-Through parameter in the radreply table for a particular user?? I tried to use read_groups=yes in the sql.conf but it didn't help. Thanks in advanced -tomasz

1 0

Radius says client is unknown.
by M. Onur ERGiN 28 Feb '07

28 Feb '07

Hello, I have configured freeRadius server and a Cisco AP350. When I run the server in debug mode, it prints 'unknown client', although the client is explicitely defined in clients.conf. Output is: rad_recv: Access-Request packet from host 10.2.8.150:1058, id=31, length=143 Ignoring request from unknown client 10.2.8.150:1058 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. clients.conf entity is: client 10.2.8.150 { secret = testing123 shortname = tnl2-network } Any idea on what's wrong? Regards, Onur. --------------------------------- Cheap Talk? Check out Yahoo! Messenger's low PC-to-Phone call rates.

7 11

On IEEE 802.1x roaming
by Josh Shamir 28 Feb '07

28 Feb '07

Hello, I'm using FreeRADIUS with Coova Chilli in proxy mode with IEEE 802.1Xauthentication (PEAP auth. method to be more specific). In my network there are 6 Access Point that use TKIP as security protocol. Now I need that the Supplicants can do "roaming" between the Access Points. The IEEE 802.1X asserts that can be used two mechanisms to obtain roaming : - PMK Caching - Pre Authentication I would to know how I could implement this mechanisms in my system. Are requested special configuration of FreeRADIUS or to implement roaming I must only configure the Access Point (If so, how I can do this)? Note that Access Point are all on the same subnet. Thanks for all Josh

2 1

Add+cnadge attributes to proxy-reply with condition
by Victor 28 Feb '07

28 Feb '07

Hello, I need to modify proxy-reply auth packet with condition. All i need - if proxy user enter UserName like 'username#554466' send UserName like 'username' to proxy (its already work) and check proxy-reply - if it consist av-pair Ascend-CBCP-Mode=CBCP-Any-Or-No changer this pair value to CBCP-Profile-Callback and add new attribute - Ascend-Dial-Number with value after # in original UserName and send modified packet to NAS. Now it work unconditional and stupid Lucent MAX trying dial-out to users who dont have permition for it. My current settings: preproxy_users: DEFAULT User-Name =~ "^([a-z0-9_\-]+)#([0-9]+)$" User-Name := "%{1}" proxy.conf: post_proxy_authorize = yes users: DEFAULT Stripped-User-Name =~ "#([0-9]+)$" Ascend-Dial-Number = "%{1}", Ascend-CBCP-Mode := CBCP-Profile-Callback I need something like in users: DEFAULT Stripped-User-Name =~ "#([0-9]+)$", %{proxy-reply:Ascend-CBCP-Mode} == CBCP-Any-Or-No Ascend-Dial-Number = "%{1}", Ascend-CBCP-Mode := CBCP-Profile-Callback Thanx! -- Best regards, Victor mailto:kha0s@ukr.net

2 1

group question
by Matt Ashfield 28 Feb '07

28 Feb '07

Hi, I'm trying to set up a restricted users group to deny access to users so I don't have to create an entry for each one in the users file. Based on the WIKI FAQ, I found: The following entry denies access to a group of users. The same restrictions as above on location in the raddb/users file also apply: DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "Your account has been disabled" But where do I specify that group disabled? Is that a group on my linux system or is that group defined within Radius, and if so, where? Thanks Matt mda(a)unb.ca

2 1