- Freeradius-Users - lists.freeradius.org

problem after upgrading
by basile 22 Nov '06

22 Nov '06

i upgrade freeradius , and now when i try to authenticate with user in an ldap directory , ldap section good passed and after i have auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. what it means thanks for help because nothing work basile

1 0

why radwho doesn t work
by basile 22 Nov '06

22 Nov '06

hi i have a radius server which authenticate users on wireless network i configure radutmp module but when i use radwho there is nobody connected my radutmp file is not empty but .... i have no idea , so if someone can help me and explain me how it works thanks basile

2 2

New CRL requiring freeradius restart?
by Stephen Bowman 22 Nov '06

22 Nov '06

I download a new CRL nightly and re-build it (/usr/bin/openssl crl -noout -hash $file) ... do I need to restart freeradius after this or does it automatically pick them up? Thanks, Stephen

2 1

new radrelay features
by Alexander Serkin 22 Nov '06

22 Nov '06

Hi, According to the docs on 2.0.0 pre-release do i understand right that to proxy accounting requests i should set up radiusd.conf to put accounting into detail file and set up radrelay.conf to proxy requests to another servers? What confuses me is that both radiusd.conf and radrelay.conf include the same files - proxy.conf and acct_users. And in many configurations acct_users for radiusd.conf and for radrelay.conf will be different. Should we keep two different files say acct_users_radiusd and acct_users_radrelay in that case? And it seems that we should have two proxy.conf files also. -- als

3 2

Re: RLM Perl cache problem? (was: Freeradius-Users Digest, Vol 19, Issue 71)
by david.suarezdelis＠telefonica.es 22 Nov '06

22 Nov '06

On Mon, 20 Nov 2006 08:22:33 -0800 Alan DeKok <aland(a)deployingradius.com> wrote: > david.suarezdelis(a)telefonica.es wrote: > > > I have observed that once I have returned a Class attribute, though, it > > keeps getting sent by FreeRadius even when my authenticate() sub is not > > assigning to it. > > I'd be a little surprised if that happens. There's no cache in the > server like that. Then some process must get hooked somehow so it keeps sending the attribute... > Can you explain in more detail, like using the output of radiusd -X, > and two packets? Yes, here we go: (some data modified to protect the innocent) This is the expected behavior, where the perl section authenticate() sub adds some values (IP, netmask and class): rad_recv: Access-Request packet from host 10.236.247.4:1366, id=182, length=91 User-Name = "test1" User-Password = "testing123" NAS-Port = 3298 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "127.0.0.5" NAS-IP-Address = 10.236.247.4 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 33 modcall[authorize]: module "preprocess" returns ok for request 33 modcall[authorize]: module "chap" returns noop for request 33 modcall[authorize]: module "mschap" returns noop for request 33 rlm_realm: No '@' in User-Name = "test1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 33 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 33 users: Matched entry DEFAULT at line 216 modcall[authorize]: module "files" returns ok for request 33 modcall: leaving group authorize (returns ok) for request 33 rad_check_password: Found Auth-Type External auth: type "External" Processing the authenticate section of radiusd.conf modcall: entering group External for request 33 perl_pool: item 0x8ded928 asigned new request. Handled so far: 12 found interpetator at address 0x8ded928 rlm_perl: Added pair Class = OU=tme; rlm_perl: Added pair Framed-IP-Address = 10.236.246.226 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = External perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x8ded928 modcall[authenticate]: module "perl" returns ok for request 33 modcall: leaving group External (returns ok) for request 33 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 33 radius_xlat: '/var/log/freeradius/radacct/10.236.247.4 /reply-detail-20061116' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/10.236.247.4/reply-detail-20061116 modcall[post-auth]: module "reply_log" returns ok for request 33 modcall: leaving group post-auth (returns ok) for request 33 Sending Access-Accept of id 182 to 10.236.247.4 port 1366 Class = 0x4f553d746d653b Framed-IP-Address = 10.236.246.226 Framed-IP-Netmask = 255.255.255.255 Finished request 33 However, changing test1 user profile on the DB so it doesn't have a class attribute to send: The traces show this (Log::Log4perl and Data::Dumper): 2006-11-22 10:49:53,068 viblde01 INFO> LDAP::Group.pm(296) get_class() - 'cn=racc_test, ou=Usuarios, dc=org' no posee información de Class, no se aplica 2006-11-22 10:49:53,141 viblde01 DEBUG> radius.pl(62) main::authenticate - $VAR1 = bless( { [...] 'RESPONSE' => bless( { 'REPLY_TIMEOUT' => 0, 'MODIFICATION_TIME' => '1164188986.423663', 'ATTR' => { 'Cisco-AVPair' => [], 'Reply-Message' => undef, 'Class' => 'OU=tme;', 'Auth-Type' => undef, 'Framed-IP-Address' => '10.235.237.66', 'Framed-IP-Netmask' => '255.255.255.255' }, 'REPLY' => 2, 'NAS-IP-Address' => '10.235.236.5', 'CREATION_TIME' => '1164188985.191276' }, 'RADIUS::Reply' ), [...] And on freeradius -X: found interpetator at address 0xa90eee8 rlm_perl: Added pair Class = OU=tme; rlm_perl: Added pair Framed-IP-Address = 10.235.237.66 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.255 rlm_perl: Added pair Auth-Type = External This is, it's remembering (somehow) that it assinged to it before... (The INFO log entry is in Spanish, it says that that RDN does not have Class info, so it's not apllied). The relevant code here is this: sub get_class { my $self = shift; my $class = $self->{GROUP}->get_value('class'); if ( defined $class and $class ne '*' ) { return $class; } else { $logger->info( "'", $self->{RACC}->dn, "' no posee información de Class, no se aplica" ); return undef; } } And it's used such as in radius.pl: my $class = $lgroup->get_class; if ( defined $class ) { $reply->class($class); } where $lgroup is an object representing the LDAP group that hosts the info (wrapped around by automagically written accessors and mutators) and $reply is an object representing the RADIUS Reply packet. In LDAP::Reply, the attributes are initialized to the ones in a 'standard' %RAD_REPLY hash (reply packet, both for Access Request and Accounting requests) The $self->{GROUP} is a Net::LDAP::Entry object created when this request was instantiated, and thus it's returning the 'undef' value as expected. > > PS- aditionally, is there an updated rlm_perl manual specifying what > > section it loads is for, and how to use the shared memory to set up db > > pools and cached results for making things easier before each forking? > > thanks! > > Nope, sorry. Ack... Anyone who knows willing to provide one example per possibility in rlm_perl? I can surely offer myself to document things once I have an idea of how to start with each thingie... Thanks! david ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

2 1

Re: freeradius on solaris 10 - next try
by Michael Messner 22 Nov '06

22 Nov '06

> On Mon, Nov 20, 2006 at 02:56:00PM +0100, Michael Messner said: >> hey @all, >> >> the next try to get freeradius with ldap support on a solaris 10: >> >> I've installed openldap from http://sunfreeware.com/indexintel10.html, so >> I find the ldap libraries: >> >> /usr/local/lib/libldap-2.3.so.0 >> /usr/local/lib/libldap-2.3.so.0.2.9 >> /usr/local/lib/libldap.a >> /usr/local/lib/libldap.la >> /usr/local/lib/libldap.so >> /usr/local/lib/libldap_r-2.3.so.0 >> /usr/local/lib/libldap_r-2.3.so.0.2.9 >> /usr/local/lib/libldap_r.a >> /usr/local/lib/libldap_r.la >> /usr/local/lib/libldap_r.so >> >> but there is no libldap_r which is searched for during configure! >> >> checking for pthread_create in -lpthread... yes >> checking for ldap_init in -lldap_r... no >> checking for ldap.h... yes >> configure: WARNING: silently not building rlm_ldap. >> configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > > Does > ./configure --with-rlm-ldap-lib-dir=/usr/local/lib/ \ > --with-rlm-ldap-include-dir=/usr/local/include/ no changes: checking for pthread_create in -lpthread... yes :configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. checking for ldap_init in -lldap_r... no checking for ldap.h... yes :-( ca mIke

1 0

unsubscribe
by Atmesh.Srivastava＠t-systems.com 22 Nov '06

22 Nov '06

1 0

automated response
by along 22 Nov '06

22 Nov '06

I will be out of town from Tue 11/21 at 5pm until the morning of Monday November 27. If this is an emergency, you may contact Chris Hart-Nova at <chartnova(a)escapewire.com>. I will have limited access via mobile phone at (716) 830-5169. Have a nice holiday.

1 0

NTLM_Auth will not work from within FreeRadius
by Neal Bullins 21 Nov '06

21 Nov '06

Hey All, I am trying to configure FreeRadius (on Debian) to authenticate against Samba. Running NTLM_Auth from the command line results in a valid login. However FreeRADIUS call to ntlm_auth results in a Logon failure. From the command line I run: /usr/bin/ntlm_auth --request-nt-key --domain=MyDom --username=radtest (MyDom is not the actual Domain but still works when I use it in place of the actual domain???) And then I enter the correct password and the result is “NT_STATUS_OK: Success (0x0)”. The debug output from freeradius is: Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=MyDom --username=radtest --challenge=3bdc9461e268b957 --ntresponse=d618ee49ab97f0ea5cc9c491904dbbbea5a56eb5c9cc0608 Exec-Program output: Logon failure (0xc000006d) I would assume that there is some sort of problem with the creation of the challenge/response but that is difficult to test. I have tried two different usernames/passwords and both combinations result in the same error. Any suggestions? Thanks

3 3

Help needed on FreeRadius SQLCounter
by sagar.patil＠bt.com 21 Nov '06

21 Nov '06

Hi All, I have got sqlcounters working with mysql database. I want to sell 15 mins, 30 mins, 1 hour, 2 hour vouchers and I want Freeradius to lock all users who even use 1 min of their voucher time every 24 hours. The vouchers are valid only for 24 hours after logging into network first time. The current options for reset= never & daily which don't work for me. Daily= Will reset midnight and allow user to login next day Never = Will allow user to use time forever until he exceeds "session-timeout" value. Thanks, Sagar

3 2