- Freeradius-Users - lists.freeradius.org

Multiple search contexts in LDAP
by Peter Param 13 Nov '06

13 Nov '06

hey all, I would like to have multiple search contexts to get around ambiguous search results due to duplicate object names found in branches under the same basedn = "ou=darlinghurst,ou=nsw,o=myorg,c=au" For instance, I would like to search ou=people,ou=darlinghurst,ou=nsw,o=myorg,c=au & ou=roles,ou=darlinghurst,ou=nsw,o=myorg,c=au only and not all other branches under the ou=darlinghurst branch. Is this possible? currently I've got set in radiusd.conf for LDAP searches: ldap { server = myldap identity = "cn=superuser,o=myorg,c=au" password = <mypassword> filter = "(cn=%u)" basedn = "ou=darlinghurst,ou=nsw,o=myorg,c=au" #basedn = "ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au" - - } cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Accounting : server and port 1813
by Bruno Costacurta 12 Nov '06

12 Nov '06

Hello, I already had a working Freeradius configuration and intend now to install accounting. As far I undestand accounting is a server using port 1813 (as a default value). But where is this value setup on the client ? (ie. 1812 port for autorization is setup and used on the NAS) More generally is there any good doc or sample about accounting configuration or best practices ? Thanks. Bye, Bruno -- Register Linux User 353844 http://counter.li.org/ --

3 5

Choice database
by Marilene Lima 11 Nov '06

11 Nov '06

Hi, I am setting up my first radius server, and I have two databases. Someone could tell me if there is a file in freeradius where I can choice what database I will to use? Thanks a lot, Marilene

3 2

RE: sync hungroups, clients files, users across multiple servers
by Charles Tompkins 11 Nov '06

11 Nov '06

That is exactly what I want to do! I just started using subversion with RANCID and am not very knowledgeable about svn. How can I get a 'diff' spread around like that? I am thinking about what you have said and it could be completely wrong, 1. A change is commited on a watched file like 'huntgroups.' 2. A local script diffs it against a remote subversion repo copy (or a local copy?) via a cron job 3. The diff gets checked in to svn. 4. The scripts on the other RADIUS servers then notice the diff in the repo copy and apply it to their own files? Sounds like I need to build up my script writing skills... Regards, -Charles ------------ Master timed out! Holding election... I am declaring myself the master! -----Original Message----- From: freeradius-users-bounces+crt=thig.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+crt=thig.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: Friday, November 10, 2006 3:20 PM To: FreeRadius users mailing list Subject: Re: sync hungroups, clients files, users across multiple servers Hi, > Greets! > > What is a good way or considered best practice for folks to sync changes to > critical files in use by radius like huntgroups and clients.conf and users > across multiple RADIUS servers. I am not using MySQL backend, but rather > relaying requests for auth off to PAM which checks against a > samba/NT-Domain, thus the user account existing locally on the server. With > several servers it becomes a PIA and can lead to misconfiguration errors due > to human data entry when you have to enter everything into each server. > > Does anyone want to share a script they have written to do this? you could use rsync, http://samba.anu.edu.au/rsync/ or subversion, http://subversion.tigris.org/ and actually keep your configurations all held on such a central repository. you can then actually update the configuration from any one of your servers and get them all to autometically get the latest version... be that with a frequent cronjob that checks for changes (and if there have been any, download them!) or from a forced update. this way you also have a centralised way of seeing what changed, when and who by. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

2 1

How to handle EAP/LDAP or files with same server
by Keith Moores 10 Nov '06

10 Nov '06

I'm trying to finally rid myself of Cisco ACS with FR 1.1.3 and mostly having great success (performance is so much better!) but can't seem to figure out how to handle two different types of wireless authentication in separate non-overlapping ways. Case 1 is EAP/TLS where user ID (email address from cleint cert) is also looked up via LDAP. Case 2 is MAC authentication using the users file. I have both of these working with one issuse, MACs that are not in the users file are being sent to LDAP server adding unnecessary load. authorize { preprocess files ldap { notfound = return } eap } The solution I can think of is to only send user name's that are email addresses to ldap. Is this something that can be done with a proxy conf and realms? I'm having trouble understanding if/how those can influence the authorize section. Thanks, -Keith ------------------------------------------------------------------------ Keith Moores <mailto:kmm6b@virginia.edu> Network Systems ITC-Communications and Systems Division University of Virginia, ITC-2015 Ivy Rd Phone (434) 924-0621 Box 400324, Charlottesville, VA 22904-4324 Fax (434) 982-4715

2 1

limiting sessions
by Andrew Long 10 Nov '06

10 Nov '06

I need to boot users at one property after a specified time period. We have adjusted the "max-daily-session" to "1800" (30 minutes), but users still seem to be staying on. Can someone point me in the right direction. The NAS is a Colubris cn3000. The other attribute we have that may apply is "max-acct-age". I am pretty new to this, so any detail is most appreciated. -- Regards, Andrew Long EscapeWire Solutions, LLC 617 Dingens Street Buffalo, NY 14206 Office: (716) 893-4984 Mobile: (716) 830-5169 Fax: (716) 891-4288 Web: http://www.escapewire.com E-mail: along(a)escapewire.com

5 14

Discarding new rquests and CPU eats 99.9%
by Cihan DEMİR 10 Nov '06

10 Nov '06

Hi all, We're using 0.9.3 version on RedHat. I start radius in normal mode then it start to eat 99.9% of CPU and produce error messages : ..... Thu Nov 9 14:52:16 2006 : Error: Discarding new request from client turkcell:4166 - ID: 14 due to live request 26387 Thu Nov 9 14:52:16 2006 : Error: Discarding new request from client turkcell:4166 - ID: 55 due to live request 26386 ..... But, when i start in debug mode with -X parameter, it doesn't eat 99.9% of CPU and runs normally. Any comment? Thanks in advance. Cihan. -------------------------------------------------------------------------------- Omsan'in sundugu hizmetleri nasil degerlendiriyorsunuz? Görüsleriniz bizim için degerli. Aldiginiz hizmetin beklentilerinizi ve ihtiyaçlarinizi ne ölçüde karsiladigi konusunda benimle irtibata geçebilir veya pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr veya innovate(a)omsan.com.tr adreslerine e-mail gönderebilirsiniz. How do you evaluate the services of Omsan? Your opinions are valuable for us. You can contact me or send an e-mail to , pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr or innovate(a)omsan.com.tr to inform us about the extent to which the services provided fulfill your expectations and needs. -------------------------------------------------------------------------------- Bu e-posta mesaji kisiye özel olup, gizli bilgiler içeriyor olabilir. Eger bu e-posta mesaji size yanlislikla ulasmissa, içerigini hiç bir sekilde kullanmayiniz ve ekli dosyalari açmayiniz. Bu durumda lütfen e-posta mesajini kullaniciya hemen geri gönderiniz ve tüm kopyalarini mesaj kutunuzdan siliniz. Bu e-posta mesaji, hiç bir sekilde, herhangi bir amaç için çogaltilamaz, yayinlanamaz ve para karsiligi satilamaz. Bu e-posta mesaji virüslere karsi anti-virüs sistemleri tarafindan taranmistir. Ancak yollayici, bu e-posta mesajinin - virüs koruma sistemleri ile kontrol ediliyor olsa bile - virüs içermedigini garanti etmez ve meydana gelebilecek zararlardan dogacak hiçbir sorumlulugu kabul etmez. This message is intended solely for the use of the individual or entity to whom it is addressed, and may contain confidential information. If you are not the intended recipient of this message or you receive this mail in error, you should refrain from making any use of the contents and from opening any attachment. In that case, please notify the sender immediately and return the message to the sender, then, delete and destroy all copies. This e-mail message, can not be copied, published or sold for any reason. This e-mail message has been swept by anti-virus systems for the presence of computer viruses. In doing so, however, sender cannot warrant that virus or other forms of data corruption may not be present and do not take any responsibility in any occurrence.

3 2

sync hungroups, clients files, users across multiple servers
by Charles Tompkins 10 Nov '06

10 Nov '06

Greets! What is a good way or considered best practice for folks to sync changes to critical files in use by radius like huntgroups and clients.conf and users across multiple RADIUS servers. I am not using MySQL backend, but rather relaying requests for auth off to PAM which checks against a samba/NT-Domain, thus the user account existing locally on the server. With several servers it becomes a PIA and can lead to misconfiguration errors due to human data entry when you have to enter everything into each server. Does anyone want to share a script they have written to do this? Thanks! -Charles ------------ Master timed out! Holding election... I am declaring myself the master! CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

2 1

help configureing a proxium Tsunami MP.11 5054-R and free radius
by Cameron Cowie 10 Nov '06

10 Nov '06

Hi: really simple question here... in my user file I have 0020A666B9E6 Auth-Type := local, User-Password :="qwerty1" in my clients.conf file I have client 172.16.20.18 { secret = qwerty1 shortname = base } my show system on the Tsunami is System Name :base System Mode :bridge Descriptor :Tsunami MP.11 5054-R v2.3.0(169) SN-06UT30570483 Location :<BLANKED OUT by ME> Contact Name :xxxxxx Contact Email :info@xxx.xx Contact Number :+xxx xx xxxx Up Time (DD:HH:MM:SS) :0:0:46:6 System OID :1.3.6.1.4.1.11898.2.4.9 Ethernet MAC Address :00:20:A6:66:B9:E6 Country :ZA System Flash Backup Interval :120 Device HW Type :Outdoor now when I reboot the modem I get the following error when I do a radius -XX Waking up in 31 seconds... Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) User-Name = "0020a6-66b9e6" User-Password = "qwerty1" NAS-IP-Address = 172.16.20.18 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "0020a6-66b9e6", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [0020a6-66b9e6/qwerty1] (from client base port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 172.16.20.18:6001, id=1, length=65 Sending Access-Reject of id 1 to 172.16.20.18 port 6001 --- Walking the entire request list --- Cleaning up request 0 ID 1 with timestamp 455489dd Nothing to do. Sleeping until we see a request. Now what am I doing wrong? Please any and all help is greatly appreciated Cameron

2 1

Reject reason
by Jørn Kostøl Gundersen 10 Nov '06

10 Nov '06

I am authenticating users based on Calling-Station-Id in addition to password. All accepts and rejects are logged to the postauth table in my database. But I cannot see why the user got rejected, if it was wrong Calling-Station-Id or wrong password. Any ideas? Cheers, Jørn

2 1