- Freeradius-Users - lists.freeradius.org

multiple entries with same user name in radcheck table
by Sri 21 Nov '06

21 Nov '06

Hi List, Happy Thanks Giving, I need to add two users with same name, from different NASes/stations. I added the two groups for them in usergroup and corresponding entries in radcheck and radreply tables. So they look like this: usergroup: ----------------------------------- 1 Ronrobert dialup 2 Ronrobert conference ----------------------------------- radcheck ---------------------------------------- 1 Ronrobert Password == value 2 Ronrobert Password == value2 ---------------------------------------- radreply --------------------------------------------- 1 Ronrobert Reply-Message := value1 2 Ronrobert Reply-Message := value2 . . . ---------------------------------------------- But the authentication failed for both users as FR not able identify which user to consider? Can anybody pls tell me any way to address this problem? Thanks in advance. ____________________________________________________________________________________ Sponsored Link $200,000 mortgage for $660/ mo - 30/15 yr fixed, reduce debt - http://yahoo.ratemarketplace.com

1 0

Re: huntgroups question
by Alan DeKok 20 Nov '06

20 Nov '06

Frank Cusack wrote: ... >> dial Client-IP-Address =~ 192.168.1..* >> dsl Client-IP-Address =~ 192.168.2..* > > warning, the first of those captures 100 /24's, the second 56 /24's. dial Client-IP-Address =~ '192\.168\.1\..*' The backslashes can make a big difference. And note the single quotes, too. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Help needed on FreeRadius SQLCounter
by sagar.patil＠bt.com 20 Nov '06

20 Nov '06

Hi All, I have got sqlcounters working with mysql database. I want to sell 15 mins, 30 mins, 1 hour, 2 hour vouchers and I want Freeradius to lock all users who even use 1 min of their voucher time every 24 hours. The vouchers are valid only for 24 hours after logging into network first time. The current options for reset= never & daily which don't work for me. Daily= Will reset midnight and allow user to login next day Never = Will allow user to use time forever until he exceeds "session-timeout" value. Thanks, Sagar

3 2

huntgroups question
by Alexandru Dincov 20 Nov '06

20 Nov '06

Hello, We plan to use freeradius for authenticating remote access to more than 2000 network devices (CISCO, Nortel, etc.) and we want to do some access control based on huntgroups. Users and RADIUS profiles are stored in an LDAP backend. Following freeradius documentation, we have to define all 2000+ IP addresses in huntgroups configuration file, apparently there is no way to use IP ranges for defining huntgroups. But this solution (having one huntgroups configuration file with more than 2000 entries for each freeradius server) would be very difficult to maintain. Anyone knows if there are any limitations in huntgroups size? Are there other solutions to have huntgroups functionality (access control based on NAS-IP-Address or Client-IP-Address) using IP address ranges? Thanks, Alex

2 1

RLM Perl cache problem?
by david.suarezdelis＠telefonica.es 20 Nov '06

20 Nov '06

Greetings, I have freeradius 1.3.0 running on GNU/Linux 3.1 using rlm_perl with ithreads without problem (and it works nicely, well done!). The authenticate() sub returns a "Framed-Ip-Address" and a "Framed-Ip-Netmask" through the %RAD_REPLY hash, and, sometimes (when the NAS is adecuate, and depending on user, group and so on), a "Class" attribute as well. I have observed that once I have returned a Class attribute, though, it keeps getting sent by FreeRadius even when my authenticate() sub is not assigning to it. The behavior is like if it was cached somewhere... If I restart FreeRadius, though, the attribute is not sent, until I send one, and then it starts being sent again, even if I modify the data so it's not sent (my own traces and the rlm_perl traces: "adding AV pair..." confirm that Class is not being assigned). I have tried to delete() the %RAD_REPLY hash keys when the function gets called, so I always start with a fresh one, but it's not working either. Before doing further testing, though, undefining the keys values, and so on, I'd like to ask if anyone is having this behavior, if it's the expected one, and how can I correct it (because connections are rejected by the NAS when Class is assigned when it shouldn't). Thanks for you help, david PS- aditionally, is there an updated rlm_perl manual specifying what section it loads is for, and how to use the shared memory to set up db pools and cached results for making things easier before each forking? thanks! ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

2 1

proxy RADIUS: is fallback actived??
by Santiago Balaguer García 20 Nov '06

20 Nov '06

2 1

Blank usernames
by Marat Rysbekov 20 Nov '06

20 Nov '06

Good day, everyone. I'm trying to setup FreeRadius 1.1.3 to assing IP-addresses based on what NAS the authorization request came from, no matter what username or password was supplied. Some of my configuration: <huntgroups> ... Alpha NAS-IP-Address == 192.168.10.1 Beta NAS-IP-Address == 192.168.20.1 ... <users> ... DEFAULT Auth-Type := Accept, Huntgroup-Name == "Alpha", Pool-Name := "PoolA" DEFAULT Auth-Type := Accept, Huntgroup-Name == "Beta", Pool-Name := "PoolB" ... I specify the IP-pools in <radiusd.conf>, and it works fine, except for one thing: I get no Access-Accept reply whenever the username is left blank (any non-empty username is accepted by the server). So, my question: is there a way to make FreeRadius use the DEFAULT entries when the username is not supplied at all? Thanks.

2 3

RE: freeradius on solaris 10 - next try
by Ramm-Ericson, Johannes 20 Nov '06

20 Nov '06

On Mon, 20 Nov 2006 14:56:00 +0100 (CET), Michael Messner wrote: > hey @all, > > the next try to get freeradius with ldap support on a solaris 10: > > I've installed openldap from > http://sunfreeware.com/indexintel10.html, so > I find the ldap libraries: > > /usr/local/lib/libldap-2.3.so.0 > /usr/local/lib/libldap-2.3.so.0.2.9 > /usr/local/lib/libldap.a > /usr/local/lib/libldap.la > /usr/local/lib/libldap.so > /usr/local/lib/libldap_r-2.3.so.0 > /usr/local/lib/libldap_r-2.3.so.0.2.9 > /usr/local/lib/libldap_r.a > /usr/local/lib/libldap_r.la > /usr/local/lib/libldap_r.so > > but there is no libldap_r which is searched for during configure! > > checking for pthread_create in -lpthread... yes > checking for ldap_init in -lldap_r... no > checking for ldap.h... yes > configure: WARNING: silently not building rlm_ldap. > configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > > any ideas? > > ca mIke Try ./configure --with-rlm-ldap-lib-dir=/usr/local/lib (and include all your other configure options aswell of course...) /johannes

1 0

freeradius on solaris 10 - next try
by Michael Messner 20 Nov '06

20 Nov '06

hey @all, the next try to get freeradius with ldap support on a solaris 10: I've installed openldap from http://sunfreeware.com/indexintel10.html, so I find the ldap libraries: /usr/local/lib/libldap-2.3.so.0 /usr/local/lib/libldap-2.3.so.0.2.9 /usr/local/lib/libldap.a /usr/local/lib/libldap.la /usr/local/lib/libldap.so /usr/local/lib/libldap_r-2.3.so.0 /usr/local/lib/libldap_r-2.3.so.0.2.9 /usr/local/lib/libldap_r.a /usr/local/lib/libldap_r.la /usr/local/lib/libldap_r.so but there is no libldap_r which is searched for during configure! checking for pthread_create in -lpthread... yes checking for ldap_init in -lldap_r... no checking for ldap.h... yes configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. any ideas? ca mIke

2 1

RE: configuration problem in Freeradius.
by John Longland 20 Nov '06

20 Nov '06

Also, what does your cleints.conf file look like. Is "johndoe" a user on your system? John -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius.org] On Behalf Of Hernan Antolini Sent: 20 November 2006 15:07 To: FreeRadius users mailing list Subject: Re: configuration problem in Freeradius. What's your "radiusd -X" say about it ?, you should start there. Hernan Antolini freeradius-users-bounces+antolini=ar.ibm.com(a)lists.freeradius.org wrote on 11/15/2006 08:02:26 AM: > > hi ! > i got howto of freeradius. I am configuring it on suse 10.1 n i have > performed all steps but getting error. I tried alot to troubleshoot it but > didnt get any success. So i am pasting me error here . Plz help me . > > myserver:~ # radtest johndoe hello localhost 1812 password > Sending Access-Request of id 151 to 127.0.0.1 port 1812 > > > User-Name = "johndoe" > User-Password = "hello" > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 1812 > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=151, length=20 > myserver:~ # > > > ------------------------------------------------------------ > > myserver:~ # radiusd -X > Module: Instantiated radutmp (radutmp) > > > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > > rad_recv: Access-Request packet from host 127.0.0.1:1025, id=151, length=59 > User-Name = "johndoe" > > User-Password = "hello" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL > > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 157 > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type System > > auth: type "System" > > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > > modcall[authenticate]: module "unix" returns notfound for request 0 > > modcall: leaving group authenticate (returns notfound) for request 0 > > auth: Failed to validate the user. > rad_lowerpair: User-Name now 'johndoe' > > rad_lowerpair: User-Password now 'hello' > rad_rmspace_pair: User-Name now 'johndoe' > > rad_rmspace_pair: User-Password now 'hello' > > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 157 > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns ok) for request 0 > > rad_check_password: Found Auth-Type System > auth: type "System" > > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > > modcall[authenticate]: module "unix" returns notfound for request 0 > > modcall: leaving group authenticate (returns notfound) for request 0 > auth: Failed to validate the user. > > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > > --- Walking the entire request list --- > Waking up in 1 seconds... > > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > > Sending Access-Reject of id 151 to 127.0.0.1 port 1025 > Waking up in 4 seconds... > --- > Walking the entire request list --- > Cleaning up request 0 ID 151 with timestamp 455743f6 > Nothing to do. > Sleeping until we see a request. > -- > View this message in context: http://www.nabble.com/configuration- > problem-in-Freeradius.-tf2627693.html#a7355750 > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0