- Freeradius-Users - lists.freeradius.org

Fwd: Regular expression - Trying to rewrite User-Name
by Damian Porter 12 May '06

12 May '06

thanks for all you input so far, and i am still looking, trying to use the hint and huntgroup file for a work around so success yet. By the way i should mention the code worked perfectly well with redhat 9. [00-0423-236767-676752-6752-52] the first and the last octet works, its just {2} - {5} that acting up. additional information my auth-log file Packet-Type = Access-Request Thu May 11 18:33:02 2006 NAS-IP-Address = 1.5.1.32 User-Name = "00042367672f" User-Password = "00042367672f" Calling-Station-Id = "00042367672F" Called-Station-Id = "000B8602DD80" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 Vendor-14823-Attr-5 = 0x4e5355 Vendor-14823-Attr-6 = 0x302e302e30 Client-IP-Address = 1.5.1.3 Debug output [root@nos-wings done]# radiusd -d /etc/ciscoraddb/ -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/ciscoraddb/clients.conf Config: including file: /etc/ciscoraddb/snmp.conf Config: including file: /etc/ciscoraddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/ciscoradius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/ciscoradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1814 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/ciscoradius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/ciscoradiusd.pid" main: bind_address = 137.52.128.40 IP address [137.52.128.40] main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 0 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms There appears to be another RADIUS server running on the authentication port 1814

2 1

Cisco Command Accounting..? [Virus checked]
by thomas.pudil＠t-mobile.at 12 May '06

12 May '06

Hi, sorry if I come up with this question here, since it is not a problem of freeradius by itself, but maybe someone could help me I want to use freeradius also for authenticating our network-admins when they login to our network-devices (e.g. Cisco boxes) Authentication/Authorizsation works fine Accounting (Start/Stop of Login Session) also what I want to do in addition is to log admins activities (commands they enter on the devices) I know that this works for TACACS+, but it doesnt seem to when using Radius-Protocol I've searched already this mailing-list and the web, and it seems that Cisco does not support this feature? Has anyone experience with this or could give me a hint on how to accomplish this? thank you thomas

1 0

Wireless network: WindowsXP supplicant, EAP-TLS and computer certificates.
by Lev A. Serebryakov 12 May '06

12 May '06

I try to use FreeRADIUS for building 801.1X EAP-TLS authorization. I want to use only computer certificates (not user ones) on WinXP. such certificates contains FQDN of client in `commonName' field. But WinXP/SP2 sent `User-Name' in such case as `host/FQDN'. And checking of commonName fails. How can re-map such `User-Names'? I've tried to create realm with LOCAL mapping, but it doesn't help much :( It seems, that eap-tls `xlat' user-name before check, but xlat is not well-documented :( -- // Lev Serebryakov

1 0

No detail file created for accounting
by Axel Seguin 12 May '06

12 May '06

Hi everyone, Here is my problem, I think I configured everything but the detail file is never created for accounting. I also use a mysql data base for accounting only and nothing is appended to the table radacct either. It is like accounting does not work at all. Here are some parts of my radiusd.conf. I have been trying to make it work for quite a while now this is why I am writing to this mailing list now. If anyone has an idea it would be really appreciated. prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log log_auth = yes In the modules section : detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } and in the accounting section I put "detail". Did I forget something? I have the right to write in this directory since the auth-detail file is created in the same place. Also if i put "detail" in the Authorize section, the file is created but with far too much information than what I need and it does not solve my problem concerning the mysql database. Thank you all in advance.

1 0

h323-return-code
by Guido 11 May '06

11 May '06

Hello everybody, I'm using freeradius 1.1.0. The issue is with h323-return-code and reject as response. When response: Access Accept all works fine, I can see h323-return-code, h323-credit-time. When response: Access Reject, I can't see any h323-return-code. The question is there are some to configure in radius.conf or mssqul.conf ? (Im using authorize_check_query and authorize_reply_query, with stores procedures both) Best Regards, Guido

2 1

Fwd: Regular expression - Trying to rewrite User-Name
by Damian Porter 11 May '06

11 May '06

the user-name is coming to the radius process without any dashes and i want to add dashes to separate the octets. I have looked an that document and it does not offer a solution for the problem.

3 3

Regular expression - Trying to rewrite User-Name
by Damian Porter 11 May '06

11 May '06

I have bee struggling with problem for a few days now. I use Centos 4.3 and freeradius 1.0.1. I am trying to rewrite a username to include dashes. see my statement below in the rewrite section. searchfor = "([a-z0-9]{2})([a-z0-9]{2})([a-z0-9]{2})([a-z0-9]{2})([a-z0-9]{2})([a-z0-9]{2}) replacewith = "%{1}-%{2}-%{3}-%{4}-%{5}-%{6}" this is the output that i am getting in my radius.log file. Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Thu May 11 14:36:24 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Thu May 11 14:36:24 2006 : Info: Ready to process requests. Thu May 11 14:36:39 2006 : Auth: Login incorrect: [0e35-353afe-3afe19-fe19/NOPASSWORD] (from client$ Thu May 11 14:38:49 2006 : Auth: Login incorrect: [13ce-ce20f9-20f949-f949/NOPASSWORD] (from client$ Thu May 11 14:38:56 2006 : Auth: Login incorrect: [0e35-353ad7-3ad71b-d71b/NOPASSWORD] (from client$ PS i have even gone as far as downloading regular expression programs to check my code. If anybody has any suggestions or has encounted this problem before let me know.

3 2

Rm: Mysql 5.0 with freeradius 1.1.1
by elimachi＠entelsa.entelnet.bo 11 May '06

11 May '06

Dear list: I´m taking up again my work with freradius since two years ago. Now I´m working over a RHE AS linux distribution box and working with a Mysql 5.0. In this version the password hashing algorithm has changed and differ from Mysql 3.x or 4.x. Then I´d like to know if freeradius engine will work without problems with Mysql 5.0 or later. Refer this article: I´ll be very grateful with your comments. Thank you. Edu.

2 1

Nested groups in ldap
by Kobiske, Rob 11 May '06

11 May '06

I was wounding if there was a way for ldap to look into nested groups. I have enabled ldap groups, and I have a ldap group that contains another group, and I would like ldap to search with in that main group and nested group to see if a user belongs to either group. If anyone know how to do this with freeradius+ldap, please let me know. Thanks, Rob Kobiske

1 0

Freeradius and MySQL
by Jeremy ohara 11 May '06

11 May '06

Hi there i have free radius updated on fedora. got a mysql database. but from what i'm noticing its not being check on the database. got dialupadmin installed and using that to put the accounts into the database. and have setup freeradisu with the db Jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

2 1