- Freeradius-Users - lists.freeradius.org

auth to LDAP via two mechanisms
by Rob Shepherd 21 Aug '06

21 Aug '06

Dear FreeRadius-users, I have a cisco VPN concentrator, which uses radius (Currently ACS) also a WLAN controller, again using radius, again currently ACS. I'll use PAP (ldap auth) from the VPN concentrator but mschapv2 from the wireless, as it'll go through a peap or eap-tls tunnel. I have NT and LM hashes already in the LDAP, I just need to extract them... Could I get a pointers on how I command the right auth type for the right device. And how I get the nt/lm hashes from ldap and do mschapv2.. Cheers Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 07776 210516

4 4

RE: No memory
by Hasan Ovuc 21 Aug '06

21 Aug '06

FC5 kernel-smp-2.6.15-1.2054_FC5 Additional info: Sybase ODBC-12_5 odbc drivers Which db connection type do you suggest to connect SYBASE database ? Rlm_unixodbc, rlm_iodbc or rlm_perl > -----Original Message----- > From: Peter Nixon [mailto:listuser@peternixon.net] > Sent: Friday, August 18, 2006 3:22 PM > To: freeradius-users(a)lists.freeradius.org > Cc: Hasan Ovuc > Subject: Re: No memory > > On Fri 18 Aug 2006 14:39, Hasan Ovuc wrote: > > Dear Members, > > > > I am trying to use > > freeradius-snapshot-20060817 > > unixODBC-2.2.11 > > ODBC-12_5 > > > > Radiusd successfully started, after first sql query it dies with no > > memory error. > > Which Linux version? > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

2 1

radiusd.sh
by KES 21 Aug '06

21 Aug '06

Hello, freeradius-users. Patch for radiusd.sh #!/bin/sh # PROVIDE: radiusd -# REQUIRE: NETWORKING SERVERS -# BEFORE: DAEMON +# REQUIRE: NETWORKING SERVERS mysql # KEYWORD: shutdown radiusd must start after DBServers(mysql) do because of some problems with some rlm_sql* modules (rlm_nibs - can't connect to MySQL) so I have added # REQUIRE: NETWORKING SERVERS mysql adding mysql is case for loop dependency of 'rcorder' so I have removed -# BEFORE: DAEMON Does any have such problems? -- KES mailto:kes-kes@yandex.ru

3 5

Changing the RAD_REPLY with rlm_perl
by Pshem Kowalczyk 21 Aug '06

21 Aug '06

Hi, I'm using freeradius 1.1.0 (this version comes with ubuntu). I'm trying to build a radius proxy using freeradius and rlm_perl, but I struck a problem. The proxy will be responsible for rewriting the auth packets: adding IPs, rewriting certain attributes and changing values of some others. All that to give a nice abstract access to all device to external companies. Because of the complex rewrites required I decided to use rlm_perl. I found the patch to modify existing attributes, but I can't find a way of removing some of them (when customer is not entilted to get certain services) Am I missing something obvious, or is this ATM simply not possible with rlm_perl? I'm not afraid of patching the source if required, I just don't have the skills to write the patch myself :-) kind regards pshemko

1 0

openser and AD
by Artur Hayne 21 Aug '06

21 Aug '06

HI, I have a big problem that seams dont have solution. I have a openser server that should autenticated the users from Active Directory trough the FreeRadius. The session of FreeRadius and Active Directory is stablished, but when the user try autenticate, its dont work. See the debug of Radius: radius_xlat: 'ou=bli,dc=blo,dc=blu,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=bli,dc=blo,dc=blu,dc=br, with filter (uid=jab) rlm_ldap: object not found or got ambiguous search result <---------- rlm_ldap: search failed <----------! rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 47 <---------- modcall: leaving group authorize (returns ok) for request 47 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 47 rlm_digest: Configuration item "User-Password" or MD5-Password is required for authentication. <---------- essa linha!!! modcall[authenticate]: module "digest" returns invalid for request 47 <---------- modcall: leaving group authenticate (returns invalid) for request 47 auth: Failed to validate the user. <---------- I see in some tutorials show how authenticate in a domain to use one tool called ntlm_auth, but it seams that only work with the mschap protocol, and the openser uses the digest. What to do? Any ideia? Its necessarily to do some configuration in the users or another files? Thanks.. --------------------------------- Você quer respostas para suas perguntas? Ou você sabe muito e quer compartilhar seu conhecimento? Experimente o Yahoo! Respostas!

2 1

Scripts.
by Keith Woodworth 20 Aug '06

20 Aug '06

Just a note to anyone moving from ICRadius to FreeRadius, the radacct table, while having a 4 extra fields in the structure in FR than IC, Ive been able to use the perl scripts I wrote to massage and pull data out of them with no modification to the scripts. Kind of nice to say the least. Also in my last message re: Auth-Type and setting it to PAP in radgroupcheck to read Crypt-Password from radcheck, was that the right way to do that? Thanks, Keith

1 0

Help required in gathering information regarding EAP protocols.
by muralidhar.gangaraju＠wipro.com 19 Aug '06

19 Aug '06

Hi, Could any body help me to know where can I get a detailed operation info about EAP-TLS, EAP-TTLS:MD5, EAP-TTLS:MSCHAPV2 and EAP-PEAP other than RFCs. Can I get in the internet any sequence flow diagrams with each step explained in detail for all the EAP protocols. It would be very helpful for me if any body of u could send me any docs which u already possess and u feel are very good. Thanks in advance. Cheers and Regards, G MURALIDHAR RAJU, The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

3 2

doubt in Radius and openser fro accounting...
by raviprakash sunkara 19 Aug '06

19 Aug '06

Hi Users, For Me, in Openser + radius Authorize and Acthentication is Succeed Very Good and Nice, But When some to Account, I'm little sucking here When Uac1 dials to Uac2 , ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ radacctID | AcctSessionID | AcctuniqueID | UserName | AcctStartTime | ActStopTime | calledID | callingID | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 1 12h34yy 2334juuw45 Uac1 13:10:00 00:00:00 Uac2 uac1 2 12h34yy ko34ji899 Uac2 13:11:11 13:11:11 Uac1 Uac2 --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- In accountting with openser + radius in should insert only one insert for every call made . But I think it insert only two records only. and AcctuniqueD should me same for each call makes then only the AcctStopTime will properly ..... in openser... -------------------- loose record----------------------------------- if(method=="BYE" || method=="CANCEL") { acc_rad_request("Stop"); unforce_rtp_proxy(); } ---------------------------- record route section------------ if( method=="INVITE" || method=="ACK") { acc_rad_request("Start"); forcr_rtp_proxy(); } plz help me in that .. sorry in my english ....... -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology Kondapur, Hi-tech city, Hyderabad. www.hyperion-tech.com +91-9985077535

2 1

Reply Access-Accept message in TTLS-MSCHAPV2
by sumi thra 19 Aug '06

19 Aug '06

Hi All, I am using freeradius-1.1.1, The access-accept packet does not send any VSA or session timeout when the authentication is TTLS-MSCHPAV2. Please let me know if there is any patch for this or the configuration issue. But the same configuration with other methods are sending the reply message properly. Awaiting for your reply. Thanks.

1 0

Apple announces FreeRADIUS in Mac OSX Leopard
by Alan DeKok 18 Aug '06

18 Aug '06

http://www.apple.com/server/macosx/leopard/more.html What they don't say on that page is that FreeRADIUS is the server of choice. This means that in 2007, there will probably be 10's of 1000's of additional installations of FreeRADIUS. Once Leopard comes out, I think I'll update the main web page to say that FreeRADIUS is the #1 RADIUS server on the planet. I'm not sure of any other server with an install base of 100k individual sites... Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

6 11