- Freeradius-Users - lists.freeradius.org

FreeRadius Project PEAP/MS-CHAP
by Evan Vittitow 11 Jan '07

11 Jan '07

Do you know why my pppd would launch inappropriately in CHAP Mode rather than MS-CHAP.

1 0

FreeRadius Project PEAP/MS-CHAP
by Evan Vittitow 11 Jan '07

11 Jan '07

Do you know why my pppd would launch inappropriately in CHAP Mode rather than pppd.

1 0

Authentication accept/deny based on realm
by Lisa Casey 11 Jan '07

11 Jan '07

Hi, I am using freeradius. I currently have two realms setup in mu users file with fallthrough=yes for both of them since the usernames/passwords are also in the users file and I need to be able to match on those. Currently, if username johndoe logs in as johndoe(a)realm1.com he gets accepted. If he then logs in as johndoe(a)realm2.com he will also get accepted since freeradius looks at the users file (and the realms file) finds the realm is valid, then goes on down the users file, finds the username/password valid, thus accepting the login. I'ld like to have it so that if johndoe logs in as johndoe(a)realm1.com he gets authenticated, but if he logs in as johndoe(a)realm2.com he does not. I'm not sure how to do that. I've googled a bit but didn't come up with anything that looked helpful. If someone could point me in the right direction, I'ld appreciate it. Lisa Casey

2 1

doc/rlm_sql is wrong?
by Phil Mayers 11 Jan '07

11 Jan '07

I've been looking at using rlm_sql to replace a fairly complex set of Autz-Type and rlm_passwd maps. Primarily this is to speed up updates when e.g. blocking systems and not have to HUP the server. The doc/rlm_sql file states that processing is done with pairs of check/reply items at a time - that is, first the user check items are compared and if matches the reply items added; then for each group (in order of priority) the group check items are compared and if match the reply items added. The code in rlm_sql.c definitely does not do that, at least in 1.1.3 as far as I can understand the code? Instead it appears to smoosh the user and all the group check items together, compares them, and if they *all* match adds *all* the reply items. This seems to make groups pretty useless except for using the SQL-Group construct in the users file. Comments?

4 4

Re: ldap { fail=1}
by jerrrry＠voila.fr 11 Jan '07

11 Jan '07

> Message du 10/01/07 à 15h38 > De : "Alan DeKok" > A : jerrrry(a)voila.fr, "FreeRadius users mailing list" > Copie à : > Objet : Re: ldap { fail=1} > > jerrrry(a)voila.fr wrote: > > > > i'm using freeradius 1.0.1 from Red Hat entreprise 4. > > You SHOULD upgrade: > > http://freeradius.org/security.html does not Red Hat supply any security patch with the OS support ? > > > I want the radius server to authenticate users thanks to the "users" > > file even if the ldap directory is not reachable and the radius server > > to start even if the DB is not reachable > > That's probably the way the server should work. Those issues probably > weren't though of when the server was written, as the SQL module works > the same way. > > > I tried with ldap { fail =1} in the authorize section and sql { fail > > = 1 } in the instantiate section without any success. > > > > "fail" doen't seem to be know. > > No, it doesn't work in the "instantiate" section. It could, though. > It's a good idea, and one I hadn't thought of. and "fail = 1" should work for ldap in the authorize section ? > > An alternative would be to update the LDAP module to NOT bind at > startup, and do it only when a request came in. That would help, too. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > >

3 2

Re: Freeradius-Users Digest, Vol 21, Issue 26 (Vacation)
by Michael Castillo 11 Jan '07

11 Jan '07

I will be out of the office from Thursday January 11th thru Monday January 15th, 2007. I will be returning to the office on Tuesday the 16th. Please contact Steve Fouchek at 463.2216 if you have any issues or question that require an immediate response. Michael

1 0

Bogus default attrs file?
by Tomas Hoger 10 Jan '07

10 Jan '07

Hi all! Default attrs file used by rlm_attr_filter contains following DEFAULT section: DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, [ ... ] Framed-Protocol == PPP, Framed-Protocol == SLIP, [ ... ] This syntax, accompanied with tisp realm example, suggests that the attribute e.g. Framed-Protocol will be preserved in proxy reply if it's value is either PPP or SLIP. However, it does not seem to be true. Framed-Protocol will not pass this filter at all. Documentation quite clearly states: "an attribute must pass *all* the rules which affect it in order to make it past the filter". Hence using == rule twice with different values for same attribute should be the same as using !*. Or am I missing anything? Proposal for fix: check_pair function after comparison always increments either fail or pass counter for given attribute. It may be modified to not increment fail for '==' operator (and also '=~') when compare fails. This should be consistent with final " fail == 0 && pass > 0 " check and default attrs file should work as expected. Untested patch: For released code: --- rlm_attr_filter.c 2005-08-11 23:06:38.000000000 +0200 +++ rlm_attr_filter.c.new 2007-01-10 13:32:55.000000000 +0100 @@ -68,8 +68,6 @@ case T_OP_CMP_EQ: if (comp == 0) { ++*(pa); - } else { - ++*(fa); } break; @@ -120,8 +118,6 @@ regfree(&reg); if (comp == 0) { ++*(pa); - } else { - ++*(fa); } break; For CVS code (some #ifdef HAVE_REGEX_H should probably appear here): --- rlm_attr_filter.c 2006-11-22 22:44:19.000000000 +0100 +++ rlm_attr_filter.c.new 2007-01-10 13:37:05.000000000 +0100 @@ -68,7 +68,8 @@ compare = paircmp(check_item, reply_item); if (compare == 1) { ++*(pass); - } else { + } else if (check_item->operator != T_OP_CMP_EQ && + check_item->operator != T_OP_REG_EQ) { ++*(fail); } Ideas? th.

2 2

1.1.4 and rlm_sql_mysql.so
by Jeffrey Sewell 10 Jan '07

10 Jan '07

I'm installing freeRADIUS on a CentOS 4.0 system. When I used the RPM on a different box it worked fine, but the RPM is out of date and I want this new box to be more up-to-date than RPMs will allow. 1.1.4 compiles fine and works w/o MySQL (5.0). However, when I run it with the SQL lines in radiusd.conf uncommented, I get this: rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1844] Unknown module "sql". radiusd.conf[1773] Failed to parse authorize section. that library is on my other (RPM-installed) system, but is not anywhere on the file system of the new box (including the source dir--it isn't in the tarball). Where is that file stored for 1.1.4? Are there other libraries that I will need that should be with that one and are also missing? Jeffrey

2 2

ldap { fail=1}
by jerrrry＠voila.fr 10 Jan '07

10 Jan '07

Hi, i'm using freeradius 1.0.1 from Red Hat entreprise 4. my radius server is connected to a ldap directory to store users and to a mysql database to store NAS I want the radius server to authenticate users thanks to the "users" file even if the ldap directory is not reachable and the radius server to start even if the DB is not reachable I tried with ldap { fail =1} in the authorize section and sql { fail = 1 } in the instantiate section without any success. "fail" doen't seem to be know. Thank you for your help Thomas

2 1

freeRADIUS 1.1.3 and Cisco WLSE LEAP Authentication
by Mark Hollenbeck 10 Jan '07

10 Jan '07

Hallo, there has been a problem with Cisco WLSE LEAP authentication for WDS with an older version of freeRADIUS. Is this problem still there, or has it been fixed in the meantime? Thanks a lot Mark

3 2