- Freeradius-Users - lists.freeradius.org

SQUID---radius
by ego seek 19 Sep '06

19 Sep '06

Does anybody know how I can make squid (transparent web proxy) work with radius? thank you.

2 1

DOC
by Abel Monzon 19 Sep '06

19 Sep '06

Hello, some time is so hard to understand the mean of everything, but I can't find the mean and why is so important, example: The doc toll about how config NAS, Proxy, etc, but I can't understand what is that and why I must config that...Please... exist any reference? Thanks any way...

1 0

FEERADIUS and SUN Directory server groups
by "Petr \"Qaxi\" Klíma" 19 Sep '06

19 Sep '06

Hello I am using freeradius (1.0.1) with SUN directory server (5.2) Authentication (username:password) works well but I do not know how to use LDAP for group mapping (to Ldap-Group). The problem: in SUN DS there are groups defined in two ways (If you use SUN JES system) =================================================== "subscribe group" $ ldapsearch cn=gprs_subscr dn: cn=gprs_subscr,ou=Groups,dc=myorg cn: gprs_subscr objectClass: groupofurls objectClass: groupofuniquenames objectClass: top objectClass: iplanet-am-managed-assignable-group objectClass: iplanet-am-managed-group memberURL: ldap:///dc=myorg??sub?memberof=cn=gprs_subscr,ou=Groups,dc=myorg iplanet-am-group-subscribable: false =================================================== or "filteredgroup" =================================================== $ ldapsearch cn=gprs_filter dn: cn=gprs_filter,ou=Groups,dc=myorg cn: gprs_filter objectClass: groupofurls objectClass: groupofuniquenames objectClass: top objectClass: iplanet-am-managed-filtered-group objectClass: iplanet-am-managed-group memberURL: ldap:///dc=myorg??sub?(&(uid=k*)(o=mysuborg)) =================================================== How should I set groupmembership_filter or how should I use do_xlat (I probably misunderstand the feature) Thanks for any help -- Petr Klíma e-mail: qaxi(a)seznam.cz

2 3

No matching entry in the database
by Federico Wenner 18 Sep '06

18 Sep '06

Dear friends, I have a problem activating users in the freeRadius server (with PCLinuxOS, MySQL Database): Username monkey Passwd quikec Getting the following radius.log : ********************************** Mon Sep 18 16:35:56 2006 : Info: rlm_sql (sql): No matching entry in the database for request from user [monkey] Mon Sep 18 16:35:56 2006 : Auth: Login incorrect: [monkey/quikec] (from client PortMaster-1 port 47 cli 22252956) ********************************** I would appreciate very much your hints. Thanks and regards Federico.

1 0

Proxy.conf
by Cliff Hayes 18 Sep '06

18 Sep '06

Hello, --1-- I am running FreeRADIUS 1.1.2 with MySQL database support. When I comment out the include line for proxy.conf, my users can no longer authenticate. The logs show their entire username + realm instead of just the username. I figure it is because it can't strip the realm anymore because it doesn't know what the realm is. There are REALM sections in the proxy.conf, with type, authhost, and accthost statements. I have entries there for each of my realms. I have not found an equivalent to the REALMS section of proxy.conf in MySQL. Do I use the radgroupcheck table? If so, do I add the authost and accthost lines? --2-- Does auth-type=local have to be in both radgroupcheck and radgroupreply? Cliff

2 3

sqlippool not working
by Guilherme Franco 18 Sep '06

18 Sep '06

Hi Peter, Like you told me before, you did some cleanups in the sqlippool.conf. Well, I've tried to install todays freeradius CVS, and it installed without the sqlippool module, don't know why. So, I've compiled it manually from freeradius-snapshot-20060918/src/modules/rlm_sqlippool/ OK, but when I run radiusd -X, I got this in the end, regardless of my configuration in sqlippool.conf and radiusd.conf: Module: Loaded SQL IP Pool sqlippool: sql-instance-name = "sql" sqlippool: lease-duration = 86400 sqlippool: pool-name = "" sqlippool: allocate-begin = "BEGIN" sqlippool: allocate-clear = "" sqlippool: allocate-find = "" sqlippool: allocate-update = "" sqlippool: allocate-commit = "COMMIT" sqlippool: allocate-rollback = "ROLLBACK" sqlippool: start-begin = "BEGIN" sqlippool: start-update = "" sqlippool: start-commit = "COMMIT" sqlippool: start-rollback = "ROLLBACK" sqlippool: alive-begin = "BEGIN" sqlippool: alive-update = "" sqlippool: alive-commit = "COMMIT" sqlippool: alive-rollback = "ROLLBACK" sqlippool: stop-begin = "BEGIN" sqlippool: stop-clear = "" sqlippool: stop-commit = "COMMIT" sqlippool: stop-rollback = "ROLLBACK" sqlippool: on-begin = "BEGIN" sqlippool: on-clear = "" sqlippool: on-commit = "COMMIT" sqlippool: on-rollback = "ROLLBACK" sqlippool: off-begin = "BEGIN" sqlippool: off-clear = "" sqlippool: off-commit = "COMMIT" sqlippool: off-rollback = "ROLLBACK" rlm_sqlippool: the 'allocate-clear' statement must be set. It's not even trying to access the Oracle server. What can it be? Thanks!

1 0

ERROR! Proxy listen.c error
by Guilherme Franco 18 Sep '06

18 Sep '06

Hello, Using Proxy, when user mistypes the password, radiusd -X crashes with Assertion failed in listen.c, line 558!!!!!!!! Line 558 = rad_assert(request->listener == listener); Thanks.

2 3

VSA does not work when using PROXY
by Guilherme Franco 18 Sep '06

18 Sep '06

Hello, Please Help! Using latest CVS - Proxy-Radius does not pass the VSA, as below (in users): DEFAULT Pool-Name := test X-Ascend-Client-Primary-DNS = x.x.x.x, X-Ascend-Client-Assign-DNS = 1, ERX-Virtual-Router-Name = "default", Framed-Routing == None, Framed-Protocol = PPP, Service-Type = Framed-User note: those vsa works correctly when I try with local users (no proxy): In attrs file: realm Service-Type == Framed-User, Framed-Protocol == PPP, X-Ascend-Client-Primary-DNS == x.x.x.x, X-Ascend-Client-Assign-DNS == 1, ERX-Virtual-Router-Name == "default", Idle-Timeout <= 600, Session-Timeout <= 28800 Output: rad_recv: Access-Request packet from host x.x.x.x port 50000, id=55, length=251 User-Password = "xxx" User-Name = "xxx@realm" Acct-Session-Id = "erx atm 3/2.42:100.221:0009437817" Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 12:34:56:78:9a:bc" Calling-Station-Id = "#BRAS-01#this is a description#100#221" Connect-Info = "speed:UBR:12000" NAS-Port-Type = xDSL NAS-Port = 845414621 NAS-Port-Id = "atm 3/2.42:100.221" NAS-IP-Address = x.x.x.x NAS-Identifier = "BRAS-01" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_realm: Looking up realm "realm" for User-Name = "xxx" rlm_realm: Found realm "realm" rlm_realm: Adding Stripped-User-Name = "xxx" rlm_realm: Proxying request from user xxx to realm realm rlm_realm: Adding Realm = "realm" rlm_realm: Preparing to proxy authentication request to realm "realm" rlm_eap: No EAP-Message, not doing EAP users: Matched entry DEFAULT at line 194 modcall: group authorize returns noop for request 0 Sending Access-Request of id 155 to x.x.x.x port 1645 User-Password = "xxx" User-Name = "xxx" Acct-Session-Id = "erx atm 3/2.42:100.221:0009437817" Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 12:34:56:78:9a:bc" Calling-Station-Id = "#BRAS-01#this is a description#100#221" Connect-Info = "speed:UBR:12000" NAS-Port-Type = xDSL NAS-Port = 845414621 NAS-Port-Id = "atm 3/2.42:100.221" NAS-IP-Address = x.x.x.x NAS-Identifier = "BRAS-01" Proxy-State = 0x3535 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Accept packet from host x.x.x.x port 1645, id=155, length=60 Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Proxy-State = 0x3535 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 attr_filter: Matched entry realm at line 52 modcall: group post-proxy returns noop for request 0 authorize: Skipping authorize in post-proxy stage rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: 'x.x.x.x 845414621' rlm_ippool: MD5 on 'key' directive maps to: 6e4d4f13b0396f83e15609738a3bc036 rlm_ippool: Searching for an entry for key: '6e4d4f13b0396f83e15609738a3bc036' rlm_ippool: Allocating ip to key: '6e4d4f13b0396f83e15609738a3bc036' rlm_ippool: num: 1 rlm_ippool: Allocated ip x.x.x.x to client key: 6e4d4f13b0396f83e15609738a3bc036 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 55 to x.x.x.x port 50000 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x Framed-IP-Netmask = 255.255.255.255 Finished request 0 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 55 with timestamp 450b0ba9 Nothing to do. Sleeping until we see a request. As you can see, The VSA was not included in the Access-Accept response. Please HELP! THANKS!

1 1

RE: Pattern Matching in users file
by Garber, Neal 18 Sep '06

18 Sep '06

> Which says you *can* use them. It doesn't say you *can'*t > use anything else. Thanks Alan. As always, I appreciate you taking the time to offer your insight. Currently, the Wiki, README and sample file only mention the example of testing username using prefix/suffix. If a more generic statement of purpose for hints existed, then I would have taken the information about username testing in the Wiki, the README and the sample file as just an example. I haven't found anything, other than your enlightening response to my question that describes the overall purpose of hints (i.e., that it can add request attributes based upon the value of an existing request attribute). Did I miss something?

2 1

Create-users.pl
by Nico Gazzano 18 Sep '06

18 Sep '06

I've used this script to generate a list of users, the script creates about 7 different files. What do I do with these now? I assume that the contents of radius.user will have to be added to the users file, but what of the other 6 files? Nico Gazzano Network & Systems Admin MIS Choice Inc. 1699 Wall ST Suite 602 Mount Prospect, IL 60056 Phone 847-690-1900 ext206 Fax 847-690-1350 nicog(a)mischoice.com

2 2