- Freeradius-Users - lists.freeradius.org

Strange error
by Jeremy ohara 11 May '06

11 May '06

Hi there i just setup freeradius with mysql when i try to use a test radius program to test the radius to see if it works i geot error: warning bad radius packet form host x.x.x.x: unknown packet code 100 does anyone know what th is means? jeremy ---------------------------------------------------------------------------- This email has been scanned for Virus by MDaemon AntiVirus part of MDaemon. Updated daily to keep up-to-date with all new and old viruses. ----------------------------------------------------------------------------

5 8

Re: radius filters for ldap searching
by Terry J Fike Jr 11 May '06

11 May '06

The only way i got this to work, was seperate trees in ldap for each group. and then in your default line in your users file put the tree you want it to search for the group and nas definition. > > Message: 2 > Date: Thu, 11 May 2006 12:52:47 +0300 > From: Mircea Harapu <mircea.harapu(a)rcs-rds.ro> > Subject: radius filters for ldap searching > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4463096F.3010605(a)rcs-rds.ro> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hello, > > I'm using freeradius 1.0.4 with openldap 2.2.24 to authenticate users on > cisco switches. > Every switch belongs to a specific group and for every user I'm setting > the groups he can access. I also use cisco avpairs for level privilege. > So far , so good! > The problems occured when I tried to make a user to have different level > privileges on different switches . > This is the profile I'm using : > > # test, radius, isp.ro > dn: uid=test,ou=radius,dc=isp,dc=ro > uid: test > objectClass: radiusprofile > cn: test > userPassword:: xxx > radiusGroupName: bucuresti > radiusGroupName: valcea > radiusServiceType: NAS-Prompt-User > > # bucuresti, test, radius, isp.ro > dn: cn=bucuresti,uid=test,ou=radius,dc=isp,dc=ro > uid: test > objectClass: radiusprofile > userPassword:: xxx > radiusGroupName: bucuresti > radiusServiceType: NAS-Prompt-User > radiusCiscoLevel: "shell:priv-lvl=15" > cn: bucuresti > > # valcea, test, radius, isp.ro > dn: cn=valcea,uid=test,ou=radius,dc=isp,dc=ro > uid: test > objectClass: radiusprofile > userPassword:: xxx > radiusGroupName: valcea > radiusServiceType: NAS-Prompt-User > radiusCiscoLevel: "shell:priv-lvl=7" > cn: valcea > > raddb/users > # Switch 192.168.50.202 > # Descriere test > DEFAULT NAS-IP-Address == 192.168.50.202, Ldap-Group == bucuresti > Fall-Through = no > DEFAULT Auth-Type := Reject > > what I need is to filter the ldap search in authorize section based on > GroupName and I don't know how. -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

1 0

Re: Solaris 8/SPARC - MySQL 5.0 NDB Cluster - Freeradius 1.1.1 with rlm_sqlippool module: 'radiusd' segmentation fault
by Robles Rodriguez,Alejandro 11 May '06

11 May '06

"Alan DeKok" <aland(a)nitros9.org> wrote: >> I have for the past 4 weeks been trying to evaluate if FreeRadius >> can be used as a AAA in an UMTS network with a large amount of >> subscribers for the GPRS Data services. > I believe others are doing this today. > FreeRADIUS scales very well. 10 million subscribers shouldn't be a >problem in a carefully designed system. Well, I'm wondering if this is in a clustered configuration i.e. multiple nodes handling the load and cooperating (sharing data such as IP pools). If this is the case I'd be interested to know a few accounts to find out more about their architecture (behind freeradius such as database servers, etc). Any clues? I'd really like o create some sort of standard architecture for freeradius that can scale and is reliable and have it in a "real" environment for a while for others to have confidence when making this same decision that I'm about to make. >> I'm done for now more details will come later meanwhile I have a >> question: is the rlm_sqlippool module going to be part of a >> freeradius release in the near future and if not, what would it be >> the procedure to follow for it to happen? > An uopdated version of the module is in CVS head. If there's >interest, it could be back-ported to 1.1.x. I have compared my version with that of the CVS root and apart form some small differences that I'll investigate further I noticed that it has the same bug that I found. The problem is that I don't know how to report it. Can you help? Also I think it'd be a good idea to back-port it to 1.1.x. Who decides this and how do I express my interest? Thank you! Cheers, Alejandro Robles.

2 1

FreeRADIUS, MySQL and usergroups again
by Michael Schwartzkopff 11 May '06

11 May '06

Hi, I want to authorize users according to the membership in a group. With Auth-Type=System it is easy: DEFAULT Auth-Type = System, Group == "RASUser" Is there any analogy to this setup in the sql module? Thanks for any help, I am quite desparate already ... -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

2 2

MySQL: Group membership test
by Michael Schwartzkopff 11 May '06

11 May '06

Hi, As a backend database to RADIUS I use MySQL. No I have a special problem: I want to autorize a user for a specific service only if the user is member of a specific group, say "RAS_User". This configuration is nescessary because this database is used also for other authentication/autorization. The documentation says, that the authcheck_table is beeing searched for the user and the reply items in the authrepl_table are returned for the user. I did not find any hint how to configure my freeradius that way, that the user is autorized to use the service only if he is member of a specific group. The groupcheck is only adds further attributes. In the ldap module f.i. I can use the "groupmembership_filter". Is there anything similar in the sql module? How can I configure freeradius or the sql module to test the group membership? Thanks for any help. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

2 2

MS-CHAP: what password backends can be used?
by Alain Fauconnet 11 May '06

11 May '06

Hello readers, I've browsed the FAQs, the mailing list archives but I have failed to find a definite, clear answer to this: what kind of user/password back-end can work if one is to support MS-CHAP? is anything storing crypt or MD5 passwords (/etc/passwd+shadow, NIS, LDAP) hopeless? (I suspect it is) I'm setting up a VPDN server on a Cisco AS5300 for Windows clients. It works fine if I use PAP and no encryption. If I want to use encryption, I need MS-CHAP, right? Right now my FreeRADIUS server is configured to use PAM. It runs on a box that is a NIS master, as well as a LDAP server with a directory built from NIS data using the well-known migration scripts (but FreeRADIUS doesn't talk to LDAP now). The master source of authentication is /etc/passwd and /etc/shadow, so passwords are in MD5 format. Is there any way I can get FreeRADIUS to handle MS-CHAP authentication requests from the Cisco box in this context? (i'm kind of expecting a big "no" here, but I want to be sure) If I'm not using Samba or a domain controller, do I need cleartext passwords to achieve this? where? in the "users" file only? In radiusd.conf, the "mschap" module has parameters for a Samba smpasswd format file or invoking ntlm_auth. If neither is set, where does it try to get the password from? I'm confused. Thanks for any reply, pointers etc. Greets, _Alain_

2 3

Re: Accounting - FramedIPAddress - DHCP/IPPOOL
by Walter Reynolds 11 May '06

11 May '06

So even though the AP must know the information, we are unable to get it into the radius accounting? We have to script the coordination between the DHCP server? ============================ Message: 4 Date: Wed, 10 May 2006 12:52:36 -0400 From: "Alan DeKok" <aland(a)nitros9.org> Subject: Re: Accounting - FramedIPAddress - DHCP/IPPOOL To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20060510165236.00C2F16CC1(a)mail.nitros9.org> mad <psymad(a)gmail.com> wrote: > I have a problem with the ip address ... because it's dhcpd who give an ip > address at the client, so freeradius can't have this information. Exactly. > I have try ippool in freeradius (freeradius want to give an ip address but > the client don't receive). Also I have read that it's impossible to use > ippool with eap and when there are access point and/or swith between client > and server ... it's true ? It's impossible to use ippool with EAP. > I have also try other solutions (with syslog-ng who get the ip address in > the log and insert in acct table ..., a scripts with omshell who permit to > freeradius to indicate at dhcpd what ip address give at this client ...) BUT > I think this solution are very unstable ... A well written DHCP server should be as flexible as FreeRADIUS, and allow you to write the IP to an SQL table. Unfortunately, there is no such DHCP server. Alan DeKok. -- Walter Reynolds University of Michigan

3 2

Accounting - FramedIPAddress - DHCP/IPPOOL
by mad 11 May '06

11 May '06

Hello, I have a freeradius server, I use an eap/ttls authentication with 802.1x and ldap. I want to save the username, the ip adress, the MAC address, the start time and the stop time of the connection with the accounting function (with mysql). I have a problem with the ip address ... because it's dhcpd who give an ip address at the client, so freeradius can't have this information. I have try ippool in freeradius (freeradius want to give an ip address but the client don't receive). Also I have read that it's impossible to use ippool with eap and when there are access point and/or swith between client and server ... it's true ? I have also try other solutions (with syslog-ng who get the ip address in the log and insert in acct table ..., a scripts with omshell who permit to freeradius to indicate at dhcpd what ip address give at this client ...) BUT I think this solution are very unstable ... What do you think about this ? Have you an other solution ? Sorry my english is rusty ... and thanks for your answers Regards, Psymad

4 5

Privileged Login on CISCO using freeradius and MySQL [Virus checked]
by thomas.pudil＠t-mobile.at 11 May '06

11 May '06

3 4

radius filters for ldap searching
by Mircea Harapu 11 May '06

11 May '06

Hello, I'm using freeradius 1.0.4 with openldap 2.2.24 to authenticate users on cisco switches. Every switch belongs to a specific group and for every user I'm setting the groups he can access. I also use cisco avpairs for level privilege. So far , so good! The problems occured when I tried to make a user to have different level privileges on different switches . This is the profile I'm using : # test, radius, isp.ro dn: uid=test,ou=radius,dc=isp,dc=ro uid: test objectClass: radiusprofile cn: test userPassword:: xxx radiusGroupName: bucuresti radiusGroupName: valcea radiusServiceType: NAS-Prompt-User # bucuresti, test, radius, isp.ro dn: cn=bucuresti,uid=test,ou=radius,dc=isp,dc=ro uid: test objectClass: radiusprofile userPassword:: xxx radiusGroupName: bucuresti radiusServiceType: NAS-Prompt-User radiusCiscoLevel: "shell:priv-lvl=15" cn: bucuresti # valcea, test, radius, isp.ro dn: cn=valcea,uid=test,ou=radius,dc=isp,dc=ro uid: test objectClass: radiusprofile userPassword:: xxx radiusGroupName: valcea radiusServiceType: NAS-Prompt-User radiusCiscoLevel: "shell:priv-lvl=7" cn: valcea raddb/users # Switch 192.168.50.202 # Descriere test DEFAULT NAS-IP-Address == 192.168.50.202, Ldap-Group == bucuresti Fall-Through = no DEFAULT Auth-Type := Reject what I need is to filter the ldap search in authorize section based on GroupName and I don't know how. -- ................................................................ Mircea Harapu Abuse Engineer, RDS NOC in Bucharest t: 021-301.08.50 f: 021-301.08.51 e: mircea.harapu(a)rcs-rds.ro w: www.rdslink.ro ................................................................ Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail.

1 0