- Freeradius-Users - lists.freeradius.org

RE: getting Freeradius to recorde login failure, etc
by Jamal Taweel 21 May '06

21 May '06

What is the generated error through function creating?? -----Original Message----- From: freeradius-users-bounces+jamal.taweel=paltel.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jamal.taweel=paltel.net@lists.freeradiu s.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 17, 2006 4:51 PM To: FreeRadius users mailing list Subject: RE: getting Freeradius to recorde login failure, etc i have tried the sql functin you have me and it didnt work. failed to create jeremy -----Original Message----- From: "Jeremy ohara" <Admin(a)jemisp.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Thu, 18 May 2006 00:20:31 +1000 Subject: RE: getting Freeradius to recorde login failure, etc thats easy do it do it in the sql state ment or on the database ro what? just want caller id and nas ip Jeremy -----Original Message----- From: "Jamal Taweel" <jamal.taweel(a)paltel.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wed, 17 May 2006 15:13:50 +0200 Subject: RE: getting Freeradius to recorde login failure, etc Yes it is possible. But you should define a proper data type for the field. -----Original Message----- From: freeradius-users-bounces+jamal.taweel=paltel.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jamal.taweel=paltel.net@lists.freeradiu s.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 17, 2006 1:09 PM To: FreeRadius users mailing list Subject: RE: getting Freeradius to recorde login failure, etc Importance: High i wanted 2 other fields which are nasip and callerid does that sound possible? sorry i'm not very strong in the sql coding area Jeremy -----Original Message----- From: "Jamal Taweel" <jamal.taweel(a)paltel.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wed, 17 May 2006 13:36:59 +0200 Subject: RE: getting Freeradius to recorde login failure, etc You should write in PL/SQL the following: CREATE FUNCTION + the statements which they were sent. BR, -----Original Message----- From: freeradius-users-bounces+jamal.taweel=paltel.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jamal.taweel=paltel.net@lists.freeradiu s.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 17, 2006 12:17 PM To: FreeRadius users mailing list Subject: RE: getting Freeradius to recorde login failure, etc Importance: High i done all but i'm lost where you have * Create a function in the database (called "fails"). The main statements which you should write are how do i do this? Jeremy -----Original Message----- From: "Jamal Taweel" <jamal.taweel(a)paltel.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Wed, 17 May 2006 12:40:43 +0200 Subject: RE: getting Freeradius to recorde login failure, etc Hi Jeremy, In order to apply what wants, you should do the following: * Create a table in the radius schema (called "fails_log") to include three columns: trial_date, username, password. * Create a function in the database (called "fails"). The main statements which you should write are " fails ( username1 in out char, password1 in char) return char is v_user char:=''; v_password:=''; begin select username , value into v_user from radcheck where attribute='password' and username= username1 and password=password1; if v_user = '' then insert into fails_log values (sysdate,username1,password1); else return v_user; end if; end; " * Update authorize_ceck_query module in sql.conf file to be as follows: authorize_check_query = "SELECT id,Username,Attribute,Value,op FROM ${authcheck_table} WHERE Username =(select fails('%{SQL-User-Name}','%{Use r-Password}') from dual) ORDER BY id" That is all. Then you can find all failed logs inside the new created table fails_log. Best Regards, Jamal -----Original Message----- From: freeradius-users-bounces+jamal.taweel=paltel.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+jamal.taweel=paltel.net@lists.freeradiu s.org] On Behalf Of Jeremy ohara Sent: Wednesday, May 17, 2006 6:32 AM To: FreeRadius users mailing list Subject: Re: getting Freeradius to recorde login failure, etc Hi there i dont want to sound rude, etc but your not really answering my question. you only answered half of it what do i wite for the sql statement, etc Jeremy -----Original Message----- From: "Duane Cox" <duanec(a)mail.illicom.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tue, 16 May 2006 22:28:12 -0500 Subject: Re: getting Freeradius to recorde login failure, etc post-auth { # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log sql Post-Auth-Type REJECT { sql } } ----- Original Message ----- From: Jeremy ohara <mailto:Admin@jemisp.com> To: FreeRadius users mailing list <mailto:freeradius-users@lists.freeradius.org> Sent: Tuesday, May 16, 2006 9:13 PM Subject: Re: getting Freeradius to recorde login failure, etc where and how do i do it and what do i write??? jeremy -----Original Message----- From: "Duane Cox" <duanec(a)mail.illicom.net> To: "FreeRadius users mailing list" < freeradius-users(a)lists.freeradius.org <mailto:freeradius-users@lists.freeradius.org> > Date: Tue, 16 May 2006 18:17:26 -0500 Subject: Re: getting Freeradius to recorde login failure, etc yes, there is a subsection under the post_auth section for such a thing... ----- Original Message ----- From: Jeremy ohara <mailto:Admin@jemisp.com> To: FreeRadius users mailing list <mailto:freeradius-users@lists.freeradius.org> Sent: Tuesday, May 16, 2006 3:24 PM Subject: getting Freeradius to recorde login failure, etc hi there is there a way to get Freeradius 1.0.5 with Mysql to record login-failure, incorrect password or incorrect username into the mysql table? i can see its possbile. but when you login with wrong details it doesnt get to record the login failure, etc. and i dont knwo what code to use and how to make freeradius to record it Jeremy ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- _____ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- _____ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ---- ------------------------------------------------------------------------ ---- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ------------------------------------------------------------------------ ----

1 0

H323-ivr-out sending extra attribute from Cisco TCL to radius
by vignesh 20 May '06

20 May '06

Hello all I am using a cisco IP IP gw. I wish to send some extra attributes from Cisco and Radius both. I read about an attribute h323-ivr-out and h323-ivr-in. I tried using it but was unsuccesful to do so. If anyone can help me out with the use of h323 ivr out in TCL I would be very thankful. Do I have to define this attribute somewhere in the dictionary file. Vignesh

3 3

Re: getting Freeradius to recorde login failure, etc
by Jeremy ohara 20 May '06

20 May '06

Hi there i dont want to sound rude, etc but your not really answering my question. you only answered half of it what do i wite for the sql statement, etc Jeremy -----Original Message----- From: "Duane Cox" <duanec(a)mail.illicom.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tue, 16 May 2006 22:28:12 -0500 Subject: Re: getting Freeradius to recorde login failure, etc post-auth { # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log sql Post-Auth-Type REJECT { sql } } ----- Original Message ----- From: Jeremy ohara To: FreeRadius users mailing list Sent: Tuesday, May 16, 2006 9:13 PM Subject: Re: getting Freeradius to recorde login failure, etc where and how do i do it and what do i write??? jeremy -----Original Message----- From: "Duane Cox" <duanec(a)mail.illicom.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Tue, 16 May 2006 18:17:26 -0500 Subject: Re: getting Freeradius to recorde login failure, etc yes, there is a subsection under the post_auth section for such a thing... ----- Original Message ----- From: Jeremy ohara To: FreeRadius users mailing list Sent: Tuesday, May 16, 2006 3:24 PM Subject: getting Freeradius to recorde login failure, etc hi there is there a way to get Freeradius 1.0.5 with Mysql to record login-failure, incorrect password or incorrect username into the mysql table? i can see its possbile. but when you login with wrong details it doesnt get to record the login failure, etc. and i dont knwo what code to use and how to make freeradius to record it Jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ---------------------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ---------------------------------------------------------------------------- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

6 10

rlm_sqlcounter
by Devrim Seral 20 May '06

20 May '06

Hi all list members, I have a little question about rlm_sqlcounter. As you know sqlcounter have some predefined reset time attribute. This reset time to be "hourly, weekly, monthly and never". However i need another reset times like 3 mounth, 6 mounth and yearly.. My investigation show me that: if (isdigit((int) data->reset[0])){ unsigned int len=0; len = strlen(data->reset); if (len == 0) return -1; last = data->reset[len - 1]; if (!isalpha((int) last)) last = 'd'; /* num = atoi(data->reset); */ DEBUG("rlm_sqlcounter: num=%d, last=%c",num,last); } Freeradius rlm_sqlcounter module have above C codes. This code allow us to define reset time as i want. But num = atoi(data->reset); is commented.. So when i tried to define reset time "3m" rlm_sqlcounter only set 1 month reset time because of num value! I wonder that is anybody in there use other values than predefined? Or itis safe to uncomment "num = atoi(data->reset);" in find_next_reset function? Thanks for your reply.. devrim

1 0

AW: EAP TLS Computer Authentication XP the final Solution *working great after a hard fight* Solution inside
by Krämer Armin 20 May '06

20 May '06

-----Ursprüngliche Nachricht----- Von: Krämer Armin [mailto:Kraemer.Armin@web.de] Gesendet: Samstag, 20. Mai 2006 12:04 An: 'misch(a)multinet.de' Betreff: AW: EAP TLS Computer Authentication XP the final Solution *working great after a hard fight* Solution inside Hi, i read your artikel at this magazine and it was quiete helpful, the only thing didnt working was machine certificate but like I described at my last post the only thing I struggled was XP Clients needing the full DN at this place I described and the CN as Computername and how to import them correctly. The ldap setup of you were really helpful. Thanks to you. Greetings from Baden Würtemberg Armin -----Ursprüngliche Nachricht----- Von: misch(a)multinet.de [mailto:misch@multinet.de] Gesendet: Samstag, 20. Mai 2006 09:23 An: Krämer Armin Betreff: Re: EAP TLS Computer Authentication XP the final Solution *working great after a hard fight* Solution inside Am Samstag, 20. Mai 2006 09:01 schrieb Krämer Armin: > Hi, > (...) > An CA created with TinnyCA as frontend for openssl, freeradius @debian > stable with EAP-TLS Support, LDAP-Backend for Dynamik VLAN Assignment > Rules, VLAN Routing @ an Layer 3 Core Switch and finaly Clients > 200,X?,Linux duing firstly an Machine Authentication(*tricky but possible*) > pulled into and basically VLAN with the DHCP,DNS and ADS Servers in an > separate Subnet and VLAN, then Users can log onto the domain, getting their > final > User-Certifikate, thrown into their final working vlan and getting the > final Subnet from the DHCP. This workes now great put firstly only the main > problem, the machine certificates. Hi, I did this setup (LDAP, VLAN, Certs, ...) and wrote an article in the German Linux Magazin 01/05. All problems you list are more or less described there. Sorry, that I did not read the beginning of this discussion. So I could have helped you before. Greetings from Munich, Michael Schwartzkopff

1 0

Re: PEAP against Samba PDC through auth_ntlm
by Jérémy Cluzel 19 May '06

19 May '06

Well, I solved my problem by setting this: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Thanks to everybody. Jeremy Jérémy Cluzel wrote: >---------------------------------------------------------------------- > >Message: 1 >Date: Fri, 19 May 2006 16:01:38 +0200 >From: J?r?my Cluzel <j.cluzel(a)online.fr> >Subject: PEAP against Samba PDC through auth_ntlm >To: freeradius-users(a)lists.freeradius.org >Message-ID: <446DCFC2.5050805(a)online.fr> >Content-Type: text/plain; charset=ISO-8859-1; format=flowed > >Well, I search for "PEAP Machine Authentication", and I only found some >of my posts concerning how to make machine auth working against a >windows AD... nothing concerning a samba acting as PDC... >As I said, PEAP auth (both machine and user) work against an AD, the >problem only concerns the samba PDC. >I found some posts where logins like "host\mahine_name" seem to be >converted as "machine_name$" (like >http://lists.freeradius.org/pipermail/freeradius-users/2006-March/051487.ht…) >but none explains how to do this: hints file ? proxy.conf ? realms ? >ntdomain_hack ? > >Regards, > >Jeremy > >On May 19, 2006, at 2:00 AM, Michael Griego wrote: > > > Search through the list archives for "PEAP Machine Authentication" > > >

1 0

debugging mode
by Giuseppe Parlato 19 May '06

19 May '06

Hi, I want to look at Radius managing clients-database queries, however I'm quite afraid to crash my linux enabling debugging with radiusd -X command (or maybe I should do that at night). There is no other way to see Radius "actions"..not log. I want to learn more. Thanks Giuseppe

3 4

rlm_nibs
by KES 19 May '06

19 May '06

Hello, freeradius-users. Try to use http://nibs.net.ua http://sourceforge.net/projects/nibs I have use it two years and I forget all problems with mysql. NO. all problems at all. =) Only one problem there are weak billing... but this is another theme. >Ok, so I think I'm doing it wrong in the db, so I changed it to look like this: >mysql> select * from radcheck; >+----+----------+-----------+----+--------+ >| id | UserName | Attribute | op | Value | >+----+----------+-----------+----+--------+ >+----+----------+-----------+----+--------+ >1 row in set (0.00 sec) > >mysql> select * from usergroup > -> ; >+----------+-----------+----------+ >| UserName | GroupName | priority | >+----------+-----------+----------+ >| temptest | guests | 1 | >+----------+-----------+----------+ >1 row in set (0.00 sec) -- KES mailto:kes-kes@yandex.ru

1 0

Trying to configure with --prefix causes install to fail
by Glenn Swonk 19 May '06

19 May '06

I cannot configure freeradius to install into any other directory other than the default. When I configure with the following: ./configure --prefix=/Radius make all make install the 'make install' fails. When I perform the default configure, everything works fine. I am using 'freeradius-1.1.1.tar.gz' to build. Any ideas? thanks, glenn -- G Swonk a t gmail dot Com

4 3

RE: peap with mysql
by Chris Liles 19 May '06

19 May '06

Sorry- In my quest to join the office crew for a Friday lunch I didn't check before sending out my last reply. On a lighter note, after making the change as you suggested everything works now as expected. I can auth with ntlm or with mysql! Alan, truly you are the radius master :) Thanks again! -- Chris Liles -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, May 19, 2006 1:07 PM To: FreeRadius users mailing list Subject: Re: peap with mysql "Chris Liles" <Chris.Liles(a)air2web.com> wrote: > mysql> select * from radgroupreply; > +----+-----------+------------------------+----+-------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+------------------------+----+-------+ > | 1 | guests | MS-CHAP-User-NTLM-Auth | == | No | It's a check attribute, not a reply attribute. You had that right the first time. I said to correct the attribute name. You didn't. I said to correct the operator. You didn't. Please read the responses to your messages. If you don't, there's no point in posting questions. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0