- Freeradius-Users - lists.freeradius.org

Script to auth. users and control the remote phone number used
by Luis 23 Nov '06

23 Nov '06

Hi again, Can anyone tell me if it is possible to control the authentication process using the remote telephone number used by the user? Thanks again :D -- Luis infotech(a)tryoutlinux.com

2 2

RE: Script to auth. users and control the remote phone number used
by Cihan DEMİR 23 Nov '06

23 Nov '06

Hi, Yes it is possible. Try to add "Calling-Station-Id" parameter. Cihan. -----Original Message----- From: freeradius-users-bounces+cihan.demir=omsan.com.tr(a)lists.freeradius.org [mailto:freeradius-users-bounces+cihan.demir=omsan.com.tr@lists.freeradius.org] On Behalf Of Luis Sent: Thursday, November 23, 2006 1:32 PM To: freeradius-users(a)lists.freeradius.org Subject: Script to auth. users and control the remote phone number used Hi again, Can anyone tell me if it is possible to control the authentication process using the remote telephone number used by the user? Thanks again :D -- Luis infotech(a)tryoutlinux.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------------------------------------------------------------- Omsan'in sundugu hizmetleri nasil degerlendiriyorsunuz? Görüsleriniz bizim için degerli. Aldiginiz hizmetin beklentilerinizi ve ihtiyaçlarinizi ne ölçüde karsiladigi konusunda benimle irtibata geçebilir veya pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr veya innovate(a)omsan.com.tr adreslerine e-mail gönderebilirsiniz. How do you evaluate the services of Omsan? Your opinions are valuable for us. You can contact me or send an e-mail to , pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr or innovate(a)omsan.com.tr to inform us about the extent to which the services provided fulfill your expectations and needs. -------------------------------------------------------------------------------- Bu e-posta mesaji kisiye özel olup, gizli bilgiler içeriyor olabilir. Eger bu e-posta mesaji size yanlislikla ulasmissa, içerigini hiç bir sekilde kullanmayiniz ve ekli dosyalari açmayiniz. Bu durumda lütfen e-posta mesajini kullaniciya hemen geri gönderiniz ve tüm kopyalarini mesaj kutunuzdan siliniz. Bu e-posta mesaji, hiç bir sekilde, herhangi bir amaç için çogaltilamaz, yayinlanamaz ve para karsiligi satilamaz. Bu e-posta mesaji virüslere karsi anti-virüs sistemleri tarafindan taranmistir. Ancak yollayici, bu e-posta mesajinin - virüs koruma sistemleri ile kontrol ediliyor olsa bile - virüs içermedigini garanti etmez ve meydana gelebilecek zararlardan dogacak hiçbir sorumlulugu kabul etmez. This message is intended solely for the use of the individual or entity to whom it is addressed, and may contain confidential information. If you are not the intended recipient of this message or you receive this mail in error, you should refrain from making any use of the contents and from opening any attachment. In that case, please notify the sender immediately and return the message to the sender, then, delete and destroy all copies. This e-mail message, can not be copied, published or sold for any reason. This e-mail message has been swept by anti-virus systems for the presence of computer viruses. In doing so, however, sender cannot warrant that virus or other forms of data corruption may not be present and do not take any responsibility in any occurrence.

1 0

problem with starting radiusd
by Herman Swensson 23 Nov '06

23 Nov '06

I am using freeradius version 1.1.0 When I start radiusd –X then it works , I can log in ps aux | grep radiusd radius 24504 0.4 0.5 6712 2968 pts/1 S 21:50 0:00 radiusd -X root 24508 0.0 0.1 3872 728 pts/0 S 21:50 0:00 grep radiusd When I start it as radiusd Wed Nov 22 21:49:34 2006 : Info: Starting - reading configuration files ... But I can not log in ps aux | grep radiusd root 24512 0.0 0.1 3736 708 pts/0 R 21:51 0:00 grep radiusd what do I wrong regards, Herman -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.430 / Virus Database: 268.14.12/544 - Release Date: 21-11-2006 16:59

2 1

mysql driver compile problem
by Christopher Carver 22 Nov '06

22 Nov '06

Platform is Ubuntu Linux 6.06 server i386 with kernel version 2.6.15-23. Software is Freeradius 1.1.3 and MySQL 4.1.21. The problem is that the Freeradius configure script will not detect the existance of the mysqlclient_r library and subsequently fails to build the rlm_sql_mysql driver despite my use of the --with-mysql-lib-dir directive. The configure line: ./configure --prefix=/usr/local/pw/freeradius-1.1.3 --with-mysql-lib-dir=/usr/local/lib/mysql >From the configure output: checking for mysql_init in -lmysqlclient_r (using mysql_config)... no checking for mysql_init in -lmysqlclient_r... no configure: WARNING: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql.h (using mysql_config)... yes configure: WARNING: sql submodule 'mysql' disabled configure: creating ./config.status A listing of the lib dir: # ls -l /usr/local/lib/mysql/libmysqlclient_r* -rw-r--r-- 1 root root 1462324 2006-11-14 02:23 /usr/local/lib/mysql/libmysqlclient_r.a -rw-r--r-- 1 root root 1395548 2006-11-13 22:44 /usr/local/lib/mysql/libmysqlclient_r.so.15 -rw-r--r-- 1 root root 1395548 2006-11-13 22:44 /usr/local/lib/mysql/libmysqlclient_r.so.15.0.0 Some evidence of the existance of the referenced function in that library: # file /usr/local/lib/mysql/libmysqlclient_r.so.15 /usr/local/lib/mysql/libmysqlclient_r.so.15: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), stripped # strings /usr/local/lib/mysql/libmysqlclient_r.so.15 | grep mysql_init mysql_init Any ideas? Thanks, Chris Carver Network Engineer

2 1

problem after upgrading
by basile 22 Nov '06

22 Nov '06

i upgrade freeradius , and now when i try to authenticate with user in an ldap directory , ldap section good passed and after i have auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. what it means thanks for help because nothing work basile

1 0

why radwho doesn t work
by basile 22 Nov '06

22 Nov '06

hi i have a radius server which authenticate users on wireless network i configure radutmp module but when i use radwho there is nobody connected my radutmp file is not empty but .... i have no idea , so if someone can help me and explain me how it works thanks basile

2 2

New CRL requiring freeradius restart?
by Stephen Bowman 22 Nov '06

22 Nov '06

I download a new CRL nightly and re-build it (/usr/bin/openssl crl -noout -hash $file) ... do I need to restart freeradius after this or does it automatically pick them up? Thanks, Stephen

2 1

new radrelay features
by Alexander Serkin 22 Nov '06

22 Nov '06

Hi, According to the docs on 2.0.0 pre-release do i understand right that to proxy accounting requests i should set up radiusd.conf to put accounting into detail file and set up radrelay.conf to proxy requests to another servers? What confuses me is that both radiusd.conf and radrelay.conf include the same files - proxy.conf and acct_users. And in many configurations acct_users for radiusd.conf and for radrelay.conf will be different. Should we keep two different files say acct_users_radiusd and acct_users_radrelay in that case? And it seems that we should have two proxy.conf files also. -- als

3 2

Re: RLM Perl cache problem? (was: Freeradius-Users Digest, Vol 19, Issue 71)
by david.suarezdelis＠telefonica.es 22 Nov '06

22 Nov '06

On Mon, 20 Nov 2006 08:22:33 -0800 Alan DeKok <aland(a)deployingradius.com> wrote: > david.suarezdelis(a)telefonica.es wrote: > > > I have observed that once I have returned a Class attribute, though, it > > keeps getting sent by FreeRadius even when my authenticate() sub is not > > assigning to it. > > I'd be a little surprised if that happens. There's no cache in the > server like that. Then some process must get hooked somehow so it keeps sending the attribute... > Can you explain in more detail, like using the output of radiusd -X, > and two packets? Yes, here we go: (some data modified to protect the innocent) This is the expected behavior, where the perl section authenticate() sub adds some values (IP, netmask and class): rad_recv: Access-Request packet from host 10.236.247.4:1366, id=182, length=91 User-Name = "test1" User-Password = "testing123" NAS-Port = 3298 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "127.0.0.5" NAS-IP-Address = 10.236.247.4 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 33 modcall[authorize]: module "preprocess" returns ok for request 33 modcall[authorize]: module "chap" returns noop for request 33 modcall[authorize]: module "mschap" returns noop for request 33 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 33 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 33 users: Matched entry DEFAULT at line 216 modcall[authorize]: module "files" returns ok for request 33 modcall: leaving group authorize (returns ok) for request 33 rad_check_password: Found Auth-Type External auth: type "External" Processing the authenticate section of radiusd.conf modcall: entering group External for request 33 perl_pool: item 0x8ded928 asigned new request. Handled so far: 12 found interpetator at address 0x8ded928 rlm_perl: Added pair Class = OU=tme; rlm_perl: Added pair Framed-IP-Address = 10.236.246.226 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = External perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x8ded928 modcall[authenticate]: module "perl" returns ok for request 33 modcall: leaving group External (returns ok) for request 33 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 33 radius_xlat: '/var/log/freeradius/radacct/10.236.247.4 /reply-detail-20061116' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.236.247.4/reply-detail-20061116 modcall[post-auth]: module "reply_log" returns ok for request 33 modcall: leaving group post-auth (returns ok) for request 33 Sending Access-Accept of id 182 to 10.236.247.4 port 1366 Class = 0x4f553d746d653b Framed-IP-Address = 10.236.246.226 Framed-IP-Netmask = 255.255.255.255 Finished request 33 However, changing test1 user profile on the DB so it doesn't have a class attribute to send: The traces show this (Log::Log4perl and Data::Dumper): 2006-11-22 10:49:53,068 viblde01 INFO> LDAP::Group.pm(296) get_class() - 'cn=racc_test, ou=Usuarios, dc=org' no posee información de Class, no se aplica 2006-11-22 10:49:53,141 viblde01 DEBUG> radius.pl(62) main::authenticate - $VAR1 = bless( { [...] 'RESPONSE' => bless( { 'REPLY_TIMEOUT' => 0, 'MODIFICATION_TIME' => '1164188986.423663', 'ATTR' => { 'Cisco-AVPair' => [], 'Reply-Message' => undef, 'Class' => 'OU=tme;', 'Auth-Type' => undef, 'Framed-IP-Address' => '10.235.237.66', 'Framed-IP-Netmask' => '255.255.255.255' }, 'REPLY' => 2, 'NAS-IP-Address' => '10.235.236.5', 'CREATION_TIME' => '1164188985.191276' }, 'RADIUS::Reply' ), [...] And on freeradius -X: found interpetator at address 0xa90eee8 rlm_perl: Added pair Class = OU=tme; rlm_perl: Added pair Framed-IP-Address = 10.235.237.66 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = External This is, it's remembering (somehow) that it assinged to it before... (The INFO log entry is in Spanish, it says that that RDN does not have Class info, so it's not apllied). The relevant code here is this: sub get_class { my $self = shift; my $class = $self->{GROUP}->get_value('class'); if ( defined $class and $class ne '*' ) { return $class; } else { $logger->info( "'", $self->{RACC}->dn, "' no posee información de Class, no se aplica" ); return undef; } } And it's used such as in radius.pl: my $class = $lgroup->get_class; if ( defined $class ) { $reply->class($class); } where $lgroup is an object representing the LDAP group that hosts the info (wrapped around by automagically written accessors and mutators) and $reply is an object representing the RADIUS Reply packet. In LDAP::Reply, the attributes are initialized to the ones in a 'standard' %RAD_REPLY hash (reply packet, both for Access Request and Accounting requests) The $self->{GROUP} is a Net::LDAP::Entry object created when this request was instantiated, and thus it's returning the 'undef' value as expected. > > PS- aditionally, is there an updated rlm_perl manual specifying what > > section it loads is for, and how to use the shared memory to set up db > > pools and cached results for making things easier before each forking? > > thanks! > > Nope, sorry. Ack... Anyone who knows willing to provide one example per possibility in rlm_perl? I can surely offer myself to document things once I have an idea of how to start with each thingie... Thanks! david ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

2 1

Re: freeradius on solaris 10 - next try
by Michael Messner 22 Nov '06

22 Nov '06

> On Mon, Nov 20, 2006 at 02:56:00PM +0100, Michael Messner said: >> hey @all, >> >> the next try to get freeradius with ldap support on a solaris 10: >> >> I've installed openldap from http://sunfreeware.com/indexintel10.html, so >> I find the ldap libraries: >> >> /usr/local/lib/libldap-2.3.so.0 >> /usr/local/lib/libldap-2.3.so.0.2.9 >> /usr/local/lib/libldap.a >> /usr/local/lib/libldap.la >> /usr/local/lib/libldap.so >> /usr/local/lib/libldap_r-2.3.so.0 >> /usr/local/lib/libldap_r-2.3.so.0.2.9 >> /usr/local/lib/libldap_r.a >> /usr/local/lib/libldap_r.la >> /usr/local/lib/libldap_r.so >> >> but there is no libldap_r which is searched for during configure! >> >> checking for pthread_create in -lpthread... yes >> checking for ldap_init in -lldap_r... no >> checking for ldap.h... yes >> configure: WARNING: silently not building rlm_ldap. >> configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > > Does > ./configure --with-rlm-ldap-lib-dir=/usr/local/lib/ \ > --with-rlm-ldap-include-dir=/usr/local/include/ no changes: checking for pthread_create in -lpthread... yes :configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. checking for ldap_init in -lldap_r... no checking for ldap.h... yes :-( ca mIke

1 0