- Freeradius-Users - lists.freeradius.org

help with undocumented attributes
by Andrew Long 02 Oct '06

02 Oct '06

Hello freeradius-users, I am working with an inherited system (freeradius 0.9.0 on RH). The system is running but as a new user/admin I am having trouble getting info on the actual setup. I do 'rpm -qv freeradius' and it returns freeradius is not installed, yet it IS. /usr/local/etc/raddb is populated, as is /usr/local/share/freeradius. How can I get info on the running version? Also, I am having trouble finding info on attributes that do not seem to be documented which limit some of our user's sessions. Examples are 'Max-Acct-Age', 'Max-Daily-Session', and 'Check-Login-Day'. I need to get a better understanding of how this session management is done. Good documentation on the web seems hard to come by. Any help most appreciated. -- Regards, Andrew Long

4 5

prevent roaming configuration question
by isidoros 02 Oct '06

02 Oct '06

Hello everybody, I have a configuration question. How would I have to set up the following configuration NAS1 with users X,Y,Z NAS2 with users A,B,C one central radius server Goal: users X,Y,Z should only be authenticated on NAS1 and not on NAS2 or any other nas users A,B,C should only be authenticated on NAS2 and not on NAS1 or any other nas etc My best guess would be tho tweak the auth_query in the sql.conf any idea's thanks

2 7

RE: rlm_perl behaviour
by Garber, Neal 02 Oct '06

02 Oct '06

> This is fixed in CVS HEAD. Great. By the way, thanks for sharing rlm_perl with the community. It is fantastic and it has helped me immensely.

1 0

rlm_perl behaviour
by Garber, Neal 02 Oct '06

02 Oct '06

When I call a perl module via rlm_perl and don't undef %RAD_CHECK and %RAD_REPLY before exiting, rlm_perl duplicates some attributes contained within the hashes. For instance: At entry to rlm_perl instance: $RAD_CHECK{'Ldap-Group'} is an ARRAY: (GroupA, GroupB) After exiting the script, "Added pair Ldap-Group..." messages appear in debug output. If I call another perl script to dump the %RAD_CHECK hash, it shows: $RAD_CHECK{'Ldap-Group' } is an ARRAY: (GroupA, GroupB, GroupA, GroupB) If I "undef %RAD_CHECK" before exiting from the first perl module, the values are not duplicated. I did some analysis of the sequence of events and I believe this is what's happening: - rlm_ldap creates the Ldap-Group attributes on the check list with operator T_OP_CMP_EQ during authorize (Ldap-Group is a checkItem in my ldap.attrmap) - upon return from the perl script, rlm_perl calls pairmove to move the attributes from the RAD_CHECK, RAD_REPLY and RAD_PROXY_REPLY hashes back to the respective pairlist. - pairmove adds attributes to the destination list for operator T_OP_CMP_EQ (takes default case) which creates duplicates Is this expected behaviour of rlm_perl? If so, can it be put on the "to do" list for rlm_perl documentation updates (or is it there already and I missed it)? Also, this seems to imply that it's not possible to change or remove, at least, some types of check or reply attributes from within rlm_perl? Also, the wiki for rlm_perl states that it passes configuration pairs in %RAD_CONFIG. I don't believe this is true (the hash is empty and I checked the source for 1.1.2, 1.1.3 and the latest snapshot and it doesn't create that hash). Is this a feature that is "in the works" or is the wiki incorrect? I can supply debug output, radiusd.conf and scripts if necessary.. Thanks.

2 1

mysql and nt password..
by Collen Blijenberg 02 Oct '06

02 Oct '06

is there a good howto on using nt-passwords with freeradius and mysql as password backend ?? thx Collen

1 0

only work with 5 users or clients
by Tom Miller 01 Oct '06

01 Oct '06

I have a 7204 (12.0(22)S1) terminating DSL L2TP VPDN and freeradius ( 1.0.4) I am having problem when number of users (clients) increase from 6 and up. It worked fine when I have only 5 users (clients) using the system. I found the max_requests was set at 1024 in radiusd.conf and have inscrease the number up to 50 clients (50x256=12800) max_requests = 12800 However, It doesn't seem to have any effect. What am I doing wrong. One things I noticed. The two users that can not connect will sent incomplete information to the radius server from NAS (7204) such as: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.17.1:1645, id=200, length=95 NAS-IP-Address = 192.168.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen(a)abc.net" CHAP-Password = 7482c25ab08ffsddfddc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 192.168.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 209.101.222.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request *********** This is a log when it connected. It included the Tunnel server and client end point ********* rad_recv: Accounting-Request packet from host 192.168.17.1:1646, id=199, length=232 NAS-IP-Address = 192.168.17.1 NAS-Port = 6 NAS-Port-Type = ISDN User-Name = "knguyen(a)abc.net" Acct-Status-Type = Stop Acct-Authentic = RADIUS Service-Type = Framed-User Acct-Session-Id = "00000CD8" Framed-Protocol = PPP Tunnel-Server-Endpoint:0 = "10.10.6.5" Tunnel-Client-Endpoint:0 = "10.10.6.6" Tunnel-Type:0 = L2TP Tunnel-Client-Auth-Id:0 = "12345678" Tunnel-Server-Auth-Id:0 = "sfldse26rr.wi.AADS" Acct-Tunnel-Connection = "13441125" Framed-IP-Address = 209.101.222.12 Acct-Terminate-Cause = Admin-Reset Acct-Input-Octets = 281672 Acct-Output-Octets = 266074 Acct-Input-Packets = 4390 Acct-Output-Packets = 4154 Acct-Session-Time = 1967 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.17.17.1:1645, id=200, length=95 NAS-IP-Address = 172.17.17.1 NAS-Port = 3 NAS-Port-Type = ISDN User-Name = "knguyen(a)eintegration.net" CHAP-Password = 0xcc3aeb78c7482c25ab08dc0625fcb4007e Service-Type = Framed-User Framed-Protocol = PPP auth: user supplied CHAP-Password matches local User-Password Sending Access-Accept of id 200 to 172.17.17.1:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 38.101.172.12 Framed-IP-Netmask = 255.255.255.128 Framed-MTU = 1492 Finished request 16 Going to the next request What am I missing here? thanks much, Tom

2 1

Problem with Installation
by Abel Monzon 01 Oct '06

01 Oct '06

Hi list, I have trying install Freeradius on Debian Sytem, but when I try whit ./configure, that respond.. server:~/freeradius-1.1.3# ./configure configure: WARNING: you should use --build, --host, --target checking for CC-gcc... no checking for gcc... no checking for CC-cc... no checking for cc... no checking for cc... no checking for CC-cl... no checking for cl... no configure: error: no acceptable C compiler found in $PATH See `config.log' for more details. server:~/freeradius-1.1.3# ./configure CXX configure: WARNING: you should use --build, --host, --target checking for CXX-gcc... no checking for gcc... no checking for CXX-cc... no checking for cc... no checking for cc... no checking for CXX-cl... no checking for cl... no configure: error: no acceptable C compiler found in $PATH See `config.log' for more details. I can't see whit ./configure --help any solution, Please.. i need help.. Greatting.. Abel

2 1

repeat until success?
by Proft, Michael 30 Sep '06

30 Sep '06

Hi, is it possible to configure freeradius to do something like "repeat until success". Im trying to authenticate local users at the same system freeradius is running on and I proxy requests to another radius server. I want to do this _without_ using realms. So if asking for local user and no success I want to continue proxying requests to another radius server. Is this possible in some way? Thanks for any advice Michael

4 6

Re:Re: Questions about latest CVS
by 高嵩 30 Sep '06

30 Sep '06

Hi,all >> Does the radiusd server listen on IPv6 address by default? >No. You have to configure it. Could you tell me how to configure it listen on IPv6 address? >> How to use the radclient in Ipv6 ? >Send the request to an IPv6 address? Yes,send the request to the Radius server listening on IPv6 address. Thank you very much.

2 1

Small Linux- Minimal Instalation
by opaniagu＠yahoo.com.ar 30 Sep '06

30 Sep '06

Hi, some body know same samall linux distro, for instante, one that a keep and start on usb pendrive only with freeradius? I want to use it, like as router distros (they are very small). Thanks __________________________________________________ Preguntá. Respondé. Descubrí. Todo lo que querías saber, y lo que ni imaginabas, está en Yahoo! Respuestas (Beta). ¡Probalo ya! http://www.yahoo.com.ar/respuestas

1 0