- Freeradius-Users - lists.freeradius.org

lookingfor some information to test a dictonary rules
by Cameron Cowie 13 Jan '07

13 Jan '07

Hi all: I am running freeradius on ubuntu I was looking for a way to limit bandwith, I thought I found it buy createing a dictionary rule set for the wireless kit I am use. heres is a snip of what I am doing I created the proxim.dictionary in /usr/share/freeradius # Proxim dictionary # VENDOR Proxim 841 BEGIN-VENDOR Proxim ATTRIBUTE Proxim-Input-Limit 1 integer ATTRIBUTE Proxim-Uplink-Limit 1 integer ATTRIBUTE Proxim-Output-Limit 2 integer ATTRIBUTE Proxim-Downlink-Limit 2 integer END-VENDOR Proxim and put the limits in with the user files. --------------------------------------------------------------------------------- 0012cf-016942 Auth-Type := Accept Proxim-Input-Limit = 128, Proxim-Output-Limit = 64 --------------------------------------------------------------------------------- for what I can tell it all works. when running tests from a proxim subsubscriber unit it looks like the bandwidth restrictions don't take place. Now do I have to tell it 128k instead of just useing 128? Both types work. Or do I have to use the uplink and downlink instead or with the input/output? Or are my setting right and I need to look elsewhere for an answer? Any help would be greatly appreciated. Cameron

3 2

FreeRadius IRC...
by Evan Vittitow 13 Jan '07

13 Jan '07

Do you folks ever show up on Freenode's #FreeRadius channel?

3 3

CHAP with crypt
by Evan Vittitow 13 Jan '07

13 Jan '07

When using OpenLDAP, is there a way to make CHAP work without storing passwords as clear text/

2 1

Re: freeradius-1.1.3 + snmp...
by adreas Polyxronopoulos 12 Jan '07

12 Jan '07

Hi Kevin and thanks for your time, - "In your snmpd.conf file, do you have a line that looks like the following? smuxpeer .1.3.6.1.4.1.3317.1.3.1 public " + No i hadn't in my snmpd.conf a line like the follwing : smuxpeer .1.3.6.1.4.1.3317.1.3.1 public However when i add the line in my snmpd.conf at a random place in the file i got the same output. Do i have to write it in a specific place in the snmpd.conf ? - "Are there any errors in your log files that might indicate a problem with your snmpd config? " + I checked the radiusd.log but nothing useful. - "Does freeradius exit without error or do you press Ctrl-C to kill it? " + No my freeradius exits without error and i don't press Ctrl-C to kill it. Adreas Polyxronopoulos ----- Original Message ---- From: Kevin Bonner <keb(a)pa.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Friday, 12 January, 2007 6:43:04 PM Subject: Re: freeradius-1.1.3 + snmp... On Friday 12 January 2007 11:13, adreas Polyxronopoulos wrote: > I have configured the radiusd.conf to support snmp > and in snmp.conf i have set the community string to public as it is in > snmpd.conf. In your snmpd.conf file, do you have a line that looks like the following? smuxpeer .1.3.6.1.4.1.3317.1.3.1 public Are there any errors in your log files that might indicate a problem with your snmpd config? > However when i am running freeradius in debugging mode : > radiusd -X , i get the following output and the freeradius does not start. > Why is that happening ? When i configured the radiusd.conf without snmp > everything works perfect. Does freeradius exit without error or do you press Ctrl-C to kill it? Kevin Bonner - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________ New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes. http://uk.rd.yahoo.com/evt=44106/*http://mail.yahoo.net/uk

2 1

RE: MySql and calling-station-id help please
by Ackbar Joolia 12 Jan '07

12 Jan '07

Kevin, Password is working fine. I have tried almost all the operators and none is doing the job for me. I wonder whether the logic I am using is good or not? Al -----Original Message----- From: freeradius-users-bounces+ackbar.joolia=bglobalmetering.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ackbar.joolia=bglobalmetering.com@lists.freeradius.org] On Behalf Of Kevin Bonner Sent: 12 January 2007 16:29 To: FreeRadius users mailing list Subject: Re: MySql and calling-station-id help please On Friday 12 January 2007 10:19, Ackbar Joolia wrote: > > See the FAQ about "it doesn't work". > > > > Also, try posting pieces of your current config. What you want isn't > > hard to do, but we have no idea what your configuration is, so it's > > impossible to say what is going wrong. > > > > Alan DeKok > > Alan, > > Where is the “it doesn’t work” faq? http://wiki.freeradius.org/FAQ#It_still_doesn.27t_work.21 > Radcheck table > -------------------------- > UserName | Attribute | op | Value > User1 | Password | == | pass1 Operator should be :=. Attribute should be User-Password (or Cleartext-Password depending on your freeradius version), but Password should be fine for your tests. > Radgroupcheck > -------------------------------- > GroupName | Attribute | op | Value > Group1 | Calling-Station-Id | := | 123456 > Group2 | Calling-Station-Id | := | 345677 The operator is incorrect. := sets the attribute to that value. See the Operators page in the wiki or "man 5 users" for more info on operator behavior. Kevin Bonner *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

1 0

freeradius-1.1.3 + snmp...
by adreas Polyxronopoulos 12 Jan '07

12 Jan '07

Hi list, I have ubuntu 6.10 and i have set-up my freeradius-1.1.3 for peap-eap/mschapv2. I have got this packages for snmp : libsnmp9 , libsnmp9-dev , libsnmp-base , libsnmp-perl , libsnmp-session-perl , php5-snmp , snmp ,snmpd I have configured the radiusd.conf to support snmp and in snmp.conf i have set the community string to public as it is in snmpd.conf. However when i am running freeradius in debugging mode : radiusd -X , i get the following output and the freeradius does not start. Why is that happening ? When i configured the radiusd.conf without snmp everything works perfect. root@apolyxrono2:/usr/local/etc/raddb# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.0.15 IP address [10.0.0.15] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) main: smux_password = "public" main: snmp_write_access = no SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: public SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 root@apolyxrono2:/usr/local/etc/raddb# thanks for help... Adreas Polyxronopoulos ___________________________________________________________ All New Yahoo! Mail – Tired of unwanted email come-ons? Let our SpamGuard protect you. http://uk.docs.yahoo.com/nowyoucan.html

2 1

re:MySql and calling-station-id help please
by Ackbar Joolia 12 Jan '07

12 Jan '07

> I cannot get the above to work at all, can anyone please give me an idea > of how to do the above? See the FAQ about "it doesn't work". Also, try posting pieces of your current config. What you want isn't hard to do, but we have no idea what your configuration is, so it's impossible to say what is going wrong. Alan DeKok Alan, Where is the “it doesn’t work” faq? This is the logic I am following. In my usergroup table, I have got the same username with different groupnames: Usergroup Table --------------------------------------- UserName | GroupName User1 | group1 User1 | group2 User1 | group3 Then in the radcheck table, I have the correct password for that user: Radcheck table -------------------------- UserName | Attribute | op | Value User1 | Password | == | pass1 I am then having the calling-station-id s inside the radgroupcheck table. Bearing in mind that Radius will match all the attributes from the request with the values inside the radgroupcheck table Radgroupcheck -------------------------------- GroupName | Attribute | op | Value Group1 | Calling-Station-Id | := | 123456 Group2 | Calling-Station-Id | := | 345677 In the radgroupreply, I am assigning the different Framed-Ip-Address to the different groups. Radgroupreply ---------------------------------------------------- GroupName | Attribute | op | Value | prio Group1 | Framed-IP-Address | := | xxx | 0 Group2 | Framed-IP-Address | := | yyy | 0 However, every time a request is coming in, the same IP address is being assigned. Radius is not differentiating at all between the different Calling-Station-Id. I know this should be a simple thing to do, but its not working for me. Please help and advise. Al -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.432 / Virus Database: 268.16.10/624 - Release Date: 12/01/2007 14:04

2 1

user/group and permissions CentOS 4.4
by Andrew Long 12 Jan '07

12 Jan '07

In process of building 1.4 on CentOS 4.4. When started (as root) in debug mode, all goes well. When using default user/group nobody I get > Info: Starting - reading configuration files ... > radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied > (rlm_exec: Wait=yes but no output defined. Did you mean output=none?) > radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied > (Failed creating PID file /usr/local/var/run/radiusd/radiusd.pid: Permission denied) Can someone give me a little guidance with the permissions and user/group setup for Cent. --Andrew Long

2 1

IPPool with MySQL
by Umar Draz 12 Jan '07

12 Jan '07

Dear Members!! Is it possible to use ip pool with freeradius + mysql? main_pool works well with unix shadow files but i don't know how i can do with mysql. Any ideas? Regards, Umar Draz _________________________________________________________________ Dave vs. Carl: The Insignificant Championship Series. Who will win? http://clk.atdmt.com/MSN/go/msnnkwsp0070000001msn/direct/01/?href=http://da…

1 0

FreeRadius-package on ubuntu6.10
by adreas Polyxronopoulos 12 Jan '07

12 Jan '07

I have noticed a problem when downloading freeradius package for ubuntu6.10. After downloading freeradius package and configuring freeradius for peap-eap/mschapv2 and running freeradius -X i got the following ouput: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 10.0.0.15 IP address [10.0.0.15] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = no mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1939] Unknown module "eap". radiusd.conf[1886] Failed to parse authenticate section. In the same machine i have downloaded the source of freeradius-1.1.3 and compiled it. I have done the same configuration in radiusd.conf , clients.conf , user , eap.conf as in the freeradius-package and everything works fine .Why from the freeradius-package this configuration does not work? Adreas Polyxronopoulos ___________________________________________________________ What kind of emailer are you? Find out today - get a free analysis of your email personality. Take the quiz at the Yahoo! Mail Championship. http://uk.rd.yahoo.com/evt=44106/*http://mail.yahoo.net/uk

2 1