- Freeradius-Users - lists.freeradius.org

user-password + MAC authentication need HELP
by Jókai András 21 May '06

21 May '06

Hi All! I have a FreeRadius with MySql Backend. Users authenticate with user and password from Mysql. Everithing works fine, but I want to users authentucate user and pass + MAC address what I store in MySql table (eg:radcheck). My question is: possible to make this trio ? I try to modify sql.conf, but don't work... :( sql.conf: authorize_check_query = "SELECT id,UserName,Attribute,Value,op,callid FROM ${authcheck_table} WHERE Username = '%{SQL-User-Name}' AND callid = '%{Calling-Station-Id}' ORDER BY id" //-- Server console rad_recv: Access-Request packet from host 10.0.0.100:2296, id=0, length=169 User-Name = "myuser" NAS-IP-Address = 10.0.0.100 Called-Station-Id = "0014bfcc7f8f" Calling-Station-Id = "0014a50ae338" NAS-Identifier = "0014bfcc7f8f" NAS-Port = 17 Framed-MTU = 1400 State = 0x369116a4a0579462fc1d07aeaa8daf3b NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800261900170301001bf06e498f40ea4d8a93036e8a03c57158849b98c09874bd79aec61f Message-Authenticator = 0xa2d9ed3f5729d700d8908ad4d97ccfbc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "myuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 radius_xlat: 'myuser' rlm_sql (sql): sql_set_user escaped user --> 'myuser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op,callid FROM radcheck WHERE Username = 'myuser' AND callid = '0014a50ae338' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'myuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'myuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'myuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: group authenticate returns invalid for request 8 auth: Failed to validate the user. Login incorrect: [myuser/<no User-Password attribute>] (from client home port 17 cli 0014a50ae338) Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 6 seconds... //--! Server console Please help me to solve this problem. Thanks, Golyo

2 1

Trouble with Freeradius 1.1.1 built with FreeBSD ports on 4.11
by Mark Hennessy 21 May '06

21 May '06

I have just built Freeradius 1.1.1 with ports on a FreeBSD machine that was previously running 0.9.3. I had to get rid of the old ltdl libs and headers before Freeradius 1.1.1 was able to built fully (it would die at rlm_eap before I did that). Now, whenever I try to start it, I get as far as the below attached debug output and end with a "Bus Error". Is there anything else I can do to provide more info as to what could be causing this issue? What should I check next? The machine is running FreeBSD 4.11 with MySQL 5.0.20a built with Jeremy Zawodny's script for LinuxThreads. -- Mark Hennessy Here is the debug output using "radiusd -sfxxyz -l stdout" : Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.1.3 IP address [192.168.1.3] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "after" main: lower_pass = "no" main: nospace_user = "after" main: nospace_pass = "after" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "freeradius" sql: password = "bogus" sql: radius_db = "freeradius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/var/log/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 50 sql: sql_user_name = "%{Stripped-User-Name:-%{User-Name:-none}}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupchec k.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprepl y.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time} WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime = 0" sql: accounting_update_query_alt = "" sql: accounting_start_query = "INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info} %{USR-Connect-Speed} %{USR-Modulation-Type} %{USR-Chassis-Call-Slot} %{USR-Chassis-Call-Span} %{USR-Modem-Training-Time}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info} %{USR-Connect-Speed} %{USR-Modulation-Type} %{USR-Chassis-Call-Slot} %{USR-Chassis-Call-Span} %{USR-Modem-Training-Time}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info} %{Session_Error_Msg} %{USR-Connect-Speed} %{USR-Modulation-Type} %{USR-Chassis-Call-Slot} %{USR-Chassis-Call-Span} %{USR-Modem-Training-Time}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" sql: accounting_stop_query_alt = "INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '0', '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info} %{Session_Error_Msg} %{USR-Connect-Speed} %{USR-Modulation-Type} %{USR-Chassis-Call-Slot} %{USR-Chassis-Call-Span} %{USR-Modem-Training-Time}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CalledStationId FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Bus error

3 2

Re: Trouble with Freeradius 1.1.1 built with FreeBSD ports on 4.11
by Mark Hennessy 21 May '06

21 May '06

>Hi Mark, > >> sql: postauth_table = "radpostauth" >> sql: postauth_query = "" >> sql: safe-characters = >> "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" >> Bus error > >I went through the same thing not to long ago. > >Compile FreeRadius without thread support (--without-threads), and make sure >Perl does not have threads support either... That solved my issues. > >It would seem that there are *still* threading issues with FreeRadius on >FreeBSD... > >-- >Chris. Thanks! I wonder if the ports collection people should perhaps make a rule in the Makefile to catch that for any remaining 4.x users. -- Mark Hennessy

1 0

make - error message
by Kartthik Raghunathan 21 May '06

21 May '06

Hi All, Am trying to install Freeradius on a RHEL 3 and when i run the make command am getting this below message which blocks me from using TLS auth. Can someone help me to resolve this error message, i know its easy to solve this. But am newbie to both linux and freeradius. [root@adminlinux freeradius-1.1.1]# make > makefrmay21-1.log In file included from eap_peap.h:25, from rlm_eap_peap.c:24: ../../libeap/eap_tls.h:138: syntax error before "SSL" ../../libeap/eap_tls.h:138: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:141: syntax error before '*' token ../../libeap/eap_tls.h:141: warning: type defaults to `int' in declaration of `into_ssl' ../../libeap/eap_tls.h:141: warning: data definition has no type or storage class ../../libeap/eap_tls.h:142: syntax error before '*' token ../../libeap/eap_tls.h:142: warning: type defaults to `int' in declaration of `from_ssl' ../../libeap/eap_tls.h:142: warning: data definition has no type or storage class ../../libeap/eap_tls.h:172: syntax error before '}' token ../../libeap/eap_tls.h:172: warning: type defaults to `int' in declaration of `tls_session_t' ../../libeap/eap_tls.h:172: warning: data definition has no type or storage class ../../libeap/eap_tls.h:182: syntax error before "tls_session_t" ../../libeap/eap_tls.h:186: syntax error before "SSL" ../../libeap/eap_tls.h:188: syntax error before '*' token ../../libeap/eap_tls.h:371: syntax error before "SSL_CTX" ../../libeap/eap_tls.h:371: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:372: warning: type defaults to `int' in declaration of `eap_tls_t' ../../libeap/eap_tls.h:372: warning: data definition has no type or storage class ../../libeap/eap_tls.h:383: warning: type defaults to `int' in declaration of `SSL' ../../libeap/eap_tls.h:383: syntax error before '*' token ../../libeap/eap_tls.h:384: syntax error before "X509_STORE_CTX" ../../libeap/eap_tls.h:386: syntax error before "SSL" ../../libeap/eap_tls.h:387: syntax error before '*' token ../../libeap/eap_tls.h:387: syntax error before '*' token ../../libeap/eap_tls.h:387: warning: type defaults to `int' in declaration of `cbtls_rsa' ../../libeap/eap_tls.h:387: warning: data definition has no type or storage class ../../libeap/eap_tls.h:390: syntax error before '*' token ../../libeap/eap_tls.h:390: syntax error before '*' token ../../libeap/eap_tls.h:390: warning: type defaults to `int' in declaration of `eaptls_new_session' ../../libeap/eap_tls.h:390: warning: data definition has no type or storage class ../../libeap/eap_tls.h:391: syntax error before '*' token ../../libeap/eap_tls.h:392: syntax error before '*' token ../../libeap/eap_tls.h:393: syntax error before '*' token ../../libeap/eap_tls.h:397: syntax error before '*' token ../../libeap/eap_tls.h:398: syntax error before '*' token In file included from rlm_eap_peap.c:24: eap_peap.h:52: syntax error before "tls_session_t" rlm_eap_peap.c: In function `eappeap_authenticate': rlm_eap_peap.c:165: `tls_session' undeclared (first use in this function) rlm_eap_peap.c:165: (Each undeclared identifier is reported only once rlm_eap_peap.c:165: for each function it appears in.) rlm_eap_peap.c:165: syntax error before ')' token gmake[9]: *** [rlm_eap_peap.lo] Error 1 gmake[8]: *** [common] Error 2 gmake[7]: *** [all] Error 2 gmake[6]: *** [common] Error 2 gmake[5]: *** [common] Error 2 gmake[4]: *** [all] Error 2 gmake[3]: *** [common] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [common] Error 2 make: *** [all] Error 2 Thanks, Kartthik -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

RE: getting Freeradius to recorde login failure, etc
by Jamal Taweel 21 May '06

21 May '06

What is the generated error through function creating?? -----Original Message----- From: freeradius-users-bounces+jamal.taweel=paltel.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jamal.taweel=paltel.net@lists.freeradiu s.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 17, 2006 4:51 PM To: FreeRadius users mailing list Subject: RE: getting Freeradius to recorde login failure, etc i have tried the sql functin you have me and it didnt work. failed to create jeremy -----Original Message----- From: "Jeremy ohara" <Admin(a)jemisp.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thu, 18 May 2006 00:20:31 +1000 Subject: RE: getting Freeradius to recorde login failure, etc thats easy do it do it in the sql state ment or on the database ro what? just want caller id and nas ip Jeremy -----Original Message----- From: "Jamal Taweel" <jamal.taweel(a)paltel.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wed, 17 May 2006 15:13:50 +0200 Subject: RE: getting Freeradius to recorde login failure, etc Yes it is possible. But you should define a proper data type for the field. -----Original Message----- From: freeradius-users-bounces+jamal.taweel=paltel.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jamal.taweel=paltel.net@lists.freeradiu s.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 17, 2006 1:09 PM To: FreeRadius users mailing list Subject: RE: getting Freeradius to recorde login failure, etc Importance: High i wanted 2 other fields which are nasip and callerid does that sound possible? sorry i'm not very strong in the sql coding area Jeremy -----Original Message----- From: "Jamal Taweel" <jamal.taweel(a)paltel.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wed, 17 May 2006 13:36:59 +0200 Subject: RE: getting Freeradius to recorde login failure, etc You should write in PL/SQL the following: CREATE FUNCTION + the statements which they were sent. BR, -----Original Message----- From: freeradius-users-bounces+jamal.taweel=paltel.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jamal.taweel=paltel.net@lists.freeradiu s.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 17, 2006 12:17 PM To: FreeRadius users mailing list Subject: RE: getting Freeradius to recorde login failure, etc Importance: High i done all but i'm lost where you have * Create a function in the database (called "fails"). The main statements which you should write are how do i do this? Jeremy -----Original Message----- From: "Jamal Taweel" <jamal.taweel(a)paltel.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wed, 17 May 2006 12:40:43 +0200 Subject: RE: getting Freeradius to recorde login failure, etc Hi Jeremy, In order to apply what wants, you should do the following: * Create a table in the radius schema (called "fails_log") to include three columns: trial_date, username, password. * Create a function in the database (called "fails"). The main statements which you should write are " fails ( username1 in out char, password1 in char) return char is v_user char:=''; v_password:=''; begin select username , value into v_user from radcheck where attribute='password' and username= username1 and password=password1; if v_user = '' then insert into fails_log values (sysdate,username1,password1); else return v_user; end if; end; " * Update authorize_ceck_query module in sql.conf file to be as follows: authorize_check_query = "SELECT id,Username,Attribute,Value,op FROM ${authcheck_table} WHERE Username =(select fails('%{SQL-User-Name}','%{Use r-Password}') from dual) ORDER BY id" That is all. Then you can find all failed logs inside the new created table fails_log. Best Regards, Jamal -----Original Message----- From: freeradius-users-bounces+jamal.taweel=paltel.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jamal.taweel=paltel.net@lists.freeradiu s.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 17, 2006 6:32 AM To: FreeRadius users mailing list Subject: Re: getting Freeradius to recorde login failure, etc Hi there i dont want to sound rude, etc but your not really answering my question. you only answered half of it what do i wite for the sql statement, etc Jeremy -----Original Message----- From: "Duane Cox" <duanec(a)mail.illicom.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tue, 16 May 2006 22:28:12 -0500 Subject: Re: getting Freeradius to recorde login failure, etc post-auth { # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log sql Post-Auth-Type REJECT { sql } } ----- Original Message ----- From: Jeremy ohara <mailto:Admin@jemisp.com> To: FreeRadius users mailing list <mailto:freeradius-users@lists.freeradius.org> Sent: Tuesday, May 16, 2006 9:13 PM Subject: Re: getting Freeradius to recorde login failure, etc where and how do i do it and what do i write??? jeremy -----Original Message----- From: "Duane Cox" <duanec(a)mail.illicom.net> To: "FreeRadius users mailing list" < freeradius-users(a)lists.freeradius.org <mailto:freeradius-users@lists.freeradius.org> > Date: Tue, 16 May 2006 18:17:26 -0500 Subject: Re: getting Freeradius to recorde login failure, etc yes, there is a subsection under the post_auth section for such a thing... ----- Original Message ----- From: Jeremy ohara <mailto:Admin@jemisp.com> To: FreeRadius users mailing list <mailto:freeradius-users@lists.freeradius.org> Sent: Tuesday, May 16, 2006 3:24 PM Subject: getting Freeradius to recorde login failure, etc hi there is there a way to get Freeradius 1.0.5 with Mysql to record login-failure, incorrect password or incorrect username into the mysql table? i can see its possbile. but when you login with wrong details it doesnt get to record the login failure, etc. and i dont knwo what code to use and how to make freeradius to record it Jeremy ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- _____ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- _____ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ----

1 0

H323-ivr-out sending extra attribute from Cisco TCL to radius
by vignesh 20 May '06

20 May '06

Hello all I am using a cisco IP IP gw. I wish to send some extra attributes from Cisco and Radius both. I read about an attribute h323-ivr-out and h323-ivr-in. I tried using it but was unsuccesful to do so. If anyone can help me out with the use of h323 ivr out in TCL I would be very thankful. Do I have to define this attribute somewhere in the dictionary file. Vignesh

3 3

Re: getting Freeradius to recorde login failure, etc
by Jeremy ohara 20 May '06

20 May '06

Hi there i dont want to sound rude, etc but your not really answering my question. you only answered half of it what do i wite for the sql statement, etc Jeremy -----Original Message----- From: "Duane Cox" <duanec(a)mail.illicom.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tue, 16 May 2006 22:28:12 -0500 Subject: Re: getting Freeradius to recorde login failure, etc post-auth { # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log sql Post-Auth-Type REJECT { sql } } ----- Original Message ----- From: Jeremy ohara To: FreeRadius users mailing list Sent: Tuesday, May 16, 2006 9:13 PM Subject: Re: getting Freeradius to recorde login failure, etc where and how do i do it and what do i write??? jeremy -----Original Message----- From: "Duane Cox" <duanec(a)mail.illicom.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tue, 16 May 2006 18:17:26 -0500 Subject: Re: getting Freeradius to recorde login failure, etc yes, there is a subsection under the post_auth section for such a thing... ----- Original Message ----- From: Jeremy ohara To: FreeRadius users mailing list Sent: Tuesday, May 16, 2006 3:24 PM Subject: getting Freeradius to recorde login failure, etc hi there is there a way to get Freeradius 1.0.5 with Mysql to record login-failure, incorrect password or incorrect username into the mysql table? i can see its possbile. but when you login with wrong details it doesnt get to record the login failure, etc. and i dont knwo what code to use and how to make freeradius to record it Jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ---------------------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ---------------------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

6 10

rlm_sqlcounter
by Devrim Seral 20 May '06

20 May '06

Hi all list members, I have a little question about rlm_sqlcounter. As you know sqlcounter have some predefined reset time attribute. This reset time to be "hourly, weekly, monthly and never". However i need another reset times like 3 mounth, 6 mounth and yearly.. My investigation show me that: if (isdigit((int) data->reset[0])){ unsigned int len=0; len = strlen(data->reset); if (len == 0) return -1; last = data->reset[len - 1]; if (!isalpha((int) last)) last = 'd'; /* num = atoi(data->reset); */ DEBUG("rlm_sqlcounter: num=%d, last=%c",num,last); } Freeradius rlm_sqlcounter module have above C codes. This code allow us to define reset time as i want. But num = atoi(data->reset); is commented.. So when i tried to define reset time "3m" rlm_sqlcounter only set 1 month reset time because of num value! I wonder that is anybody in there use other values than predefined? Or itis safe to uncomment "num = atoi(data->reset);" in find_next_reset function? Thanks for your reply.. devrim

1 0

AW: EAP TLS Computer Authentication XP the final Solution *working great after a hard fight* Solution inside
by Krämer Armin 20 May '06

20 May '06

-----Ursprüngliche Nachricht----- Von: Krämer Armin [mailto:Kraemer.Armin@web.de] Gesendet: Samstag, 20. Mai 2006 12:04 An: 'misch(a)multinet.de' Betreff: AW: EAP TLS Computer Authentication XP the final Solution *working great after a hard fight* Solution inside Hi, i read your artikel at this magazine and it was quiete helpful, the only thing didnt working was machine certificate but like I described at my last post the only thing I struggled was XP Clients needing the full DN at this place I described and the CN as Computername and how to import them correctly. The ldap setup of you were really helpful. Thanks to you. Greetings from Baden Würtemberg Armin -----Ursprüngliche Nachricht----- Von: misch(a)multinet.de [mailto:misch@multinet.de] Gesendet: Samstag, 20. Mai 2006 09:23 An: Krämer Armin Betreff: Re: EAP TLS Computer Authentication XP the final Solution *working great after a hard fight* Solution inside Am Samstag, 20. Mai 2006 09:01 schrieb Krämer Armin: > Hi, > (...) > An CA created with TinnyCA as frontend for openssl, freeradius @debian > stable with EAP-TLS Support, LDAP-Backend for Dynamik VLAN Assignment > Rules, VLAN Routing @ an Layer 3 Core Switch and finaly Clients > 200,X?,Linux duing firstly an Machine Authentication(*tricky but possible*) > pulled into and basically VLAN with the DHCP,DNS and ADS Servers in an > separate Subnet and VLAN, then Users can log onto the domain, getting their > final > User-Certifikate, thrown into their final working vlan and getting the > final Subnet from the DHCP. This workes now great put firstly only the main > problem, the machine certificates. Hi, I did this setup (LDAP, VLAN, Certs, ...) and wrote an article in the German Linux Magazin 01/05. All problems you list are more or less described there. Sorry, that I did not read the beginning of this discussion. So I could have helped you before. Greetings from Munich, Michael Schwartzkopff

1 0

Re: PEAP against Samba PDC through auth_ntlm
by Jérémy Cluzel 19 May '06

19 May '06

Well, I solved my problem by setting this: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Thanks to everybody. Jeremy Jérémy Cluzel wrote: >---------------------------------------------------------------------- > >Message: 1 >Date: Fri, 19 May 2006 16:01:38 +0200 >From: J?r?my Cluzel <j.cluzel(a)online.fr> >Subject: PEAP against Samba PDC through auth_ntlm >To: freeradius-users(a)lists.freeradius.org >Message-ID: <446DCFC2.5050805(a)online.fr> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Well, I search for "PEAP Machine Authentication", and I only found some >of my posts concerning how to make machine auth working against a >windows AD... nothing concerning a samba acting as PDC... >As I said, PEAP auth (both machine and user) work against an AD, the >problem only concerns the samba PDC. >I found some posts where logins like "host\mahine_name" seem to be >converted as "machine_name$" (like >http://lists.freeradius.org/pipermail/freeradius-users/2006-March/051487.ht…) >but none explains how to do this: hints file ? proxy.conf ? realms ? >ntdomain_hack ? > >Regards, > >Jeremy > >On May 19, 2006, at 2:00 AM, Michael Griego wrote: > > > Search through the list archives for "PEAP Machine Authentication" > > >

1 0