- Freeradius-Users - lists.freeradius.org

Recall: help on this issue solved
by Elie Hani 23 Aug '06

23 Aug '06

Elie Hani would like to recall the message, "help on this issue solved".

1 0

PEAP LDAP confusion
by Rob Shepherd 23 Aug '06

23 Aug '06

Dear FreeRADIUS users, Firstly, I am attempting to get XP/OSX clients to connect to a 802.1x WLAN provided by a cisco wlan controller. This is currently backed by ACS and works, but i'd like to use FreeRADIUS is possible, with half my users in LDAP and half in MySQL. The setup uses PEAP, however am I correct in thinking that the RADIUS server never touches any TLS components. The TLS tunnel is between the WLAN controller and the client right? Furthermore, I know I cannot use ldap authentication (binding) as a result of the eap conversation, however can I store an NT-Hash in LDAP/MySQL for the mschapv2 module to pick up and use? I'd prefer not to store clear text at all if possible... I have everything I need compiled and installed, but I'd like to know whether or not I can achieve my goal before wasting a lot of my time. Any pointers are thus greatly appreciated. thanks Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 07776 210516

7 10

BUG! Variables and MySQL queries
by Chris Knipe 23 Aug '06

23 Aug '06

radiusd: FreeRADIUS Version 1.1.1, for host , built on May 18 2006 at 13:16:06 Copyright (C) 2000-2006 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. sql query: authorize_check_query = "SELECT `UserChecks`.EntryID, `UserChecks`.Attribute, `UserChecks`.op, `UserChecks`.Value FROM `UserChecks` LEFT JOIN `User` ON `UserChecks`.UserID=`User`.EntryID LEFT JOIN `Group` ON `User`.GroupID=`Group`.EntryID LEFT JOIN `GroupTimes` ON `GroupTimes`.GroupID=`Group`.EntryID LEFT JOIN `Realm` ON `Group`.RealmID=`Realm`.EntryID LEFT JOIN `Client` ON `Realm`.ClientID=`Client`.EntryID WHERE `User`.isActive='y' AND `Group`.isActive='y' AND `Realm`.isActive='y' AND `Client`.isActive='y' AND `GroupTimes`.DOW=DAYOFWEEK(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND)) AND `GroupTimes`.StartTime < DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '%H:%i:%S') AND `GroupTimes`.StopTime > DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '%H:%i:%S') AND `Realm`.Realmname=LOWER(SUBSTRING('%{SQL-User-Name}', (LOCATE('@', '%{SQL-User-Name}') +1))) AND `User`.Username=LOWER(LEFT('%{SQL-User-Name}', (LOCATE('@', '%{SQL-User-Name}') -1))) GROUP BY `UserChecks`.Attribute ORDER BY `UserChecks`.Attribute" Escaped query sent to the database: SELECT `UserChecks`.EntryID, `UserChecks`.Attribute, `UserChecks`.op, `UserChecks`.Value FROM `UserChecks` LEFT JOIN `Use r` ON `UserChecks`.UserID=`User`.EntryID LEFT JOIN `Group` ON `User`.GroupID=`Group`.EntryID LEFT JOIN `GroupTimes` ON `GroupTimes`.GroupID=`Group`.EntryID L EFT JOIN `Realm` ON `Group`.RealmID=`Realm`.EntryID LEFT JOIN `Client` ON `Realm`.ClientID=`Client`.EntryID WHERE `User`.isActive='y' AND `Group`.isActive='y ' AND `Realm`.isActive='y' AND `Client`.isActive='y' AND `GroupTimes`.DOW=DAYOFWEEK(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND)) AND `GroupTimes `.StartTime < DATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '12:00:01:4A:5E:86:80:2006-08-23 12:39:01') AND `GroupTimes`.StopTime > D ATE_FORMAT(DATE_ADD('1970-01-01', INTERVAL UNIX_TIMESTAMP() SECOND), '12:00:01:4A:5E:86:80:2006-08-23 12:39:01') AND `Realm`.Realmname=LOWER(SUBSTRING('user(a)domain.com', (LOCATE('@', 'user(a)domain.com') +1))) AND `User`.Username=LOWER(LEFT('user(a)domain.com', (LOCATE('@', 'user(a)domain.com') -1))) GROUP BY `UserChecks`.Attribute ORDER BY `UserChecks`.Attribute The mySQL variables %H:%i:%S is over written by FreeRadius' variables... I have filed in BugZilla as well. Any possibility to get this fixed??? Regards, Chris.

2 2

More SQL
by Chris Knipe 23 Aug '06

23 Aug '06

1 1

Re: Re: openser and AD
by Artur Hayne 23 Aug '06

23 Aug '06

Active Directory does not supply clear-text passwords to FreeRADIUS. In many cases, Active Directory doesn't *have* the clear-text passwords. Digest authentication is impossible when the passwords are in Active Directory. Sorry. > I see in some tutorials show how authenticate in a domain to use one > tool called ntlm_auth, but it seams that only work with the mschap > protocol, and the openser uses the digest. Yes. ntlm_auth will not help you. > What to do? Any ideia? Use another database, like OpenLDAP or MySQL. Active Directory is responsible for making Digest authentication impossible. > Its necessarily to do some configuration in the users or another files? No. There is NOTHING you can do except use another database. The Openser , Active Directory and FreeRadius support TLS. Can I use it for solve my problem? Or is this a bad ideia? --------------------------------- Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. Registre seu aparelho agora!

1 0

bill payment using RADIUS
by Asiful Mustafa 23 Aug '06

23 Aug '06

Hi, Is there any ways that post-paid users can pay their bill using RADIUS packet? Is there any RADIUS attribute which updates a user account by specifed amount? Thanks, Asif

3 4

Infor required to use the exec_program
by Shankar Ganesh C 23 Aug '06

23 Aug '06

Hi , I am trying to use the mod exec command to pass the request list parameters to an external program when there is a accounting request start is recived. The below steps i have followed. 1) in the Acct_users files below statement are given. DEFAULT Acct-Status-Type == Start Exec-Program = "/usr/bin/exec-program-wait" 2) In the radiusd.conf file exec exec-program-wait { wait = yes program = "exec-program-wait %{WaterCove-Bearer-Type}" input_pairs = request output_pairs = reply } 3) in the instantiate section called the below module instantiate { exec exec-program-wait 4) Ensured the script is available in /usr/bin/exec-program-wait 5) Below is the script definition # For 'acct_users': # DEFAULT Acct-Status-Type == Start Exec-Program="/home/shankarganesh/freeradius-1.1.2/scripts/exec-prog ram-wait" DEFAULT Acct-Status-Type == Stop Exec-Program="/home/shankarganesh/freeradius-1.1.2/scripts/exec-prog ram-wait" printenv > /tmp/exec-program-wait echo "Reply-Message += \"Hello, %u\"," echo "Reply-Message += \"PATH=$PATH\"," echo Framed-IP-Address = 255.255.255.255 echo "The prameter list of $* " WaterCove-Bearer-Type = WATERCOVE_BEARER_TYPE exit 0 6) When i try to run the server below error message is logged in the server , which could not find the environment variables . Ready to process requests. rad_recv: Accounting-Request packet from host 10.45.2.42:1230, id=0, length=223 User-Name = "steve" Acct-Status-Type = Start Acct-Session-Id = "0" NAS-IP-Address = 10.45.2.34 Framed-IP-Address = 10.45.2.33 Called-Station-Id = "1234" Calling-Station-Id = "4546" 3GPP-IMSI = "12345" 3GPP-NSAPI = "asdfgh" 3GPP-Charging-ID = 123 3GPP-GPRS-Negotiated-QoS-profile = "wdefefr" 3GPP-GGSN-Address = 255.255.255.255 3GPP-SGSN-Address = 255.255.255.255 WaterCove-Bearer-Type = WLAN WaterCove-HTTP-URL = "qewweqqwe" WaterCove-FlowTemplate-Name = "23453255" WaterCove-ServiceClass-Name = "sgdfsfgd" WaterCove-FlowTemplate-ID = 325454 WaterCove-ServiceClass-ID = 32534254 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = 10.45.2.42,NAS-IP-Address = 10.45.2.34,Acct-Session-Id = "0",User-Name = "steve"' rlm_acct_unique: Acct-Unique-Session-ID = "a488c9e5208ecdb9". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 acct_users: Matched entry DEFAULT at line 7 modcall[preacct]: module "files" returns ok for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/usr/local/radius/var/log/radius/radacct/10.45.2.42/detail-20060823' rlm_detail: /usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/radius/var/log/radius/radacct/10.45.2.42/detail-20060823 modcall[accounting]: module "detail" returns ok for request 0 modcall[accounting]: module "unix" returns noop for request 0 radius_xlat: '/usr/local/radius/var/log/radius/radutmp' radius_xlat: 'steve' rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! modcall[accounting]: module "radutmp" returns noop for request 0 modcall: leaving group accounting (returns ok) for request 0 radius_xlat: '/usr/bin/exec-program-wait' Exec-Program: /usr/bin/exec-program-wait /usr/bin/exec-program-wait: printenv: not found Sending Accounting-Response of id 0 to 10.45.2.42 port 1230 Finished request 0 Going to the next request Pls let me know where i am doing wrong. Thanks and rgds Shankar ganesh

2 1

Simultaneous-Use and checkrad with Cisco Router
by Faisal Butt 23 Aug '06

23 Aug '06

Dear Sir, I want to know the setup for the simultaneous logins and checkrad script with Cisco Router SNMP enabled. The settings are configured but checkrad is not returning any results from cisco snmp. Also, how can I know whether radius will block MPP attempts? I am looking for configuration and any additional documents that can help me understand it more. Best Regards, M. Faisal Butt

1 0

variables.txt
by Chris Knipe 23 Aug '06

23 Aug '06

states: %S request timestamp in SQL format %T request timestamp in database format What is SQL format? What is 'database format' A database can hold times in MANY different formats. Can someone just shed some clarity as to the format for the variables, might be a good idea to update that in the documentation as well, it's really not being helpful. Regards, Chris.

4 4

(no subject)
by Гудыно Андрей 23 Aug '06

23 Aug '06

unsubscribe privet -- --------------------------------------- Гудыно Андрей Сергеевич Могилевский филиал РО Белтелеком +375 0222 228534 +375 0222 312007 PGP http://www.mogilev.by/ash.asc ---------------------------------------

1 0