- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 16, Issue 18
by Phil Thompson 07 Aug '06

07 Aug '06

> Subject: > Re: Password Problem > From: "Alan DeKok" <aland(a)deployingradius.com> > Date: Fri, 04 Aug 2006 13:04:15 -0400 > PhilT <phil(a)yarwell.demon.co.uk> wrote: >> 1. In the MySQL database do you have the Attribute set to Password and not >> something else, for example "11 usernamehere PASSWORD == passwordhere" >> 2. In Freeradius users file DEFAULT Auth-Type := Local > > NO. Do NOT SET THAT. It's NOT NECESSARY. > > That point has been repeated again and again on this list. no doubt, however it is interesting that many people come to a point where they make such a setting, don't you find. If you could clarify why that is and fix it you wouldn't have to shout in mailing lists. I have just verified it is not necessary by commenting it out, thanks. I think you're saying at http://deployingradius.com/documents/configuration/auth_type.html that a default auth-type is not necessary and should not be set. Is that so ? In which case having DEFAULT Auth-Type = System in the users file in the FreeRADIUS tarball helps to get us off on the wrong foot :-) Phil

5 5

Question about RADIUS proxy
by Ali Majdzadeh 07 Aug '06

07 Aug '06

Hi I am new to freeRADIUS. I have a question about RADIUS proxies. Is it possible to configure a forwarding RADIUS server to broadcast a request to all remote RADIUS servers? (I mean, without paying attention to athentication realms) Best Regards Ali

2 2

Freeradius on connection / disconnect run commands
by Michael da Silva Pereira 07 Aug '06

07 Aug '06

Hi, I have currently got freeradius setup using a SQL database for authentication and accouting. Is there any way I can get freeradius to run a system command every time a new client connects and disconnects, also bearing in mind to pass information like username and clients ip address as arguments to my program. Thanks Michael

1 0

pam client ->password change packet problem
by 나종현 07 Aug '06

07 Aug '06

1 0

Need radius.log as SQL
by Gregory J. Marsh 07 Aug '06

07 Aug '06

I need to completely replace the radius.log file with SQL. I need this because I'm running multiple servers and I need the logs in a single location that can be watched by one helpdesk staffer. The current post auth logs only handle accept and reject - I need the complete log. For instance, when a shared secret is wrong, I need to know! My C programming skills are very rusty so I hope someone has this already so don't have to do it myself. I'm currently using Version 1.1.2. Greg.

1 0

Missing Attributes
by Graham Beneke 06 Aug '06

06 Aug '06

I have FreeRadius 1.1 installed on a Ubuntu 6.06 Server Edition. I have integrated it with MySQL and a PHP admin application called phpMyPrepaid It is serving requests for a ChilliSpot daemon at my hotspot. I've added the additional Chillispot dictionary that has attributes for data volume limiting - but it does not appear to be working. I did a test radius request from a little win app called RadiusTest and it appears that the custom attributes are not been sent in the rad-reply packet by the radius server... As this is my first experience with radius - i have no idea where to start looking for where the problem may be. regards Graham Beneke Apolix Internet Services E-Mail: graham(a)apolix.co.za <mailto:graham@apolix.co.za> WEB: www.apolix.co.za <http://www.apolix.co.za/> Cell: 082-432-1873 <skype:+27824321873?call> Skype: grbeneke <skype:grbeneke?call>

2 3

sqlcounter measuring weird times
by Olivier Cant 06 Aug '06

06 Aug '06

Hi all, I'm new to freeradius configuration, but I have read trough the documentation and ggogled quite a lot about freeradius configuration. I'm using freeradius with chillispot to implement an hourly prepaid card WiFi service. Chillispot talks to the radius server with no problem and accoutning is properly written into the mysql table radacct. The problem is that chillispot says to the user that he can still connect for 4531 hours even when the Max-All-Session attribute for that login says 3600 (the total od the corresponding entries in radacct for AcctSessionTime gives 5056. The user can still connect trough the captive portal. Here is my sqlcounter.conf file : sqlcounter noresetcounter{ counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } noresetcounter and sql are in the authorize section and sql is in the accounting section Has anyone run into this issue ? Thanks a lot, sorry if this is a newbie question Oli

1 0

ntlm_auth with special characters
by Nathan L. Cable 06 Aug '06

06 Aug '06

Hi all, I am trying to set up FreeRadius (1.09.5-1.2, bundled with Redhat FC5) to authenticate off of a Win2k3 server. I have tested the setup, and everything works fine. However, we run quite a large domain, and I would like to restrict access to users in appropriate groups. I can do that if I use the SID for the group, but not if I want to use the regular group name. For example, the following will work when put in the MSCHAP module: ntlm_auth = "/usr/bin/ntlm_auth --require-membership-of=S-1-2-3-4 --request-nt-key --domain=MYDOMAIN.COM --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00)" However, when I use a Windows group, such as the following... ntlm_auth = "/usr/bin/ntlm_auth --require-membership-of='WKGRP/Wireless Users' --request-nt-key --domain=MYDOMAIN.COM --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00)" ...FreeRadius spits out the following error message: utils/ntlm_auth.c:get_require_membership_sid(237) Winbindd lookupname failed to resolve 'WKGRP\Wireless into a SID! What appears to be happening is that when Radius gets to the space in the group name, it jumps to the next argument in the line, disregarding the " Users'" part of the group. I've tried several different variations on escape characters, with no success. Just as further info, I have also been able to successfully run the ntlm_atuh program outside of radius with the offending command, and it works fine. What is the appropriate syntax to use when using long group names in the radiusd.conf file, or will I need to stick to using Windows SID numbers? Thanks for your time (and thought), Nathan Cable

1 0

PHP + radius
by raviprakash sunkara 05 Aug '06

05 Aug '06

Hi Guys.... Happy friend ship day........... ! I'm Working on Linux. box.. I want How to integrate the PHP with RADIUS.... Ccan any one tell the Doccumetation Help me ........! -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology Kondapur, Hi-tech city, Hyderabad. www.hyperion-tech.com +91-9985077535

2 1

Re: Regarding adding a module
by Mitchell, Michael J 05 Aug '06

05 Aug '06

Hi Ravi, If you're even remotely proficient in C, you'll find it is not a difficult task to add a new module. Use the "example" module, or one of the other modules (including Makefile) as a basis. Start with an "empty" module that just returns RLM_MODULE_OK from each function, get it to compile and run, then you can start adding your specific functionality. The module definition at the end of the ".c" file defines the functions that are called for initialization and destruction of your module, and for each stage of request processing. Don't forget to change the module name in the module definition, and also in the Makefile. Its easiest to start with a static Makefile, but you can add your module into the auto configure system if required - a little extra configuration is then required in the modules configure files. To get your module to compile when you run make in the top level directory, you can do two things: 1) Add your module name to the "stable" file in src/modules before you run "./configure", or 2) Add your module name to the "MODULES" definition in Make.inc after you've run configure. Once you get your module to compile and install, add its configuration to radiusd.conf and it will be automagically linked into the server at run time. It really is not difficult, so give it a go and you'll soon see what else is required as you reach each stage. If you run into trouble you can ask specific questions on this list. And as always, search the list archives, as chances are other people have come across similar hurdles to what you will encounter. cheers, Mike ------------------------------------------------------------------------ -------- From: freeradius-users-bounces+mitchell.michael=bigpond.com(a)lists.freeradius.o rg [mailto:freeradius-users-bounces+mitchell.michael=bigpond.com@lists.free radius.org] On Behalf Of Ravi S M Sent: Saturday, 5 August 2006 6:25 PM To: freeradius-users(a)lists.freeradius.org Subject: Regarding adding a module Hi I wanted to add our own module for free radius code on Solaris box. So please through some light on this. With best regards Ravi

1 0