- Freeradius-Users - lists.freeradius.org

PLS Help I get no response for 2 monthe (missing User-name attribute)
by Assa Tal 08 May '06

08 May '06

Hello All freeradius mailinglist I would appriciate you help Description a telephony service provider is sending Radius req to my RADIUS server who proxy them to a backend server I have configured a free radius server Version 1.1.0 to act as a proxy server to proxy the request to a backend server These are the configuration file clients.conf and the proxy.conf Client.conf client 172.28.185.31/32 { secret=secretgprs1 shortname=RADIUS_GGSN Proxy.conf realm NULL { type = radius authhost=LOCAL accthost=172.31.201.98:1813 (backend server) secret=secretgprs1 } # # This realm is for ALL OTHER requests. # realm DEFAULT { type = radius authhost=LOCAL accthost=172.31.201.98:1813 secret=secretgprs The problem I have noticed that radius request are not proxied at all So I started to dig in and found that freeradius will not proxy accounting If the attribute User -Name is missing As you can see I made some logs and u can see very vividly the problem. I made my own test to emulate the problem with a radius client and as u can see it was proxies The big Q is how to I force the freeradius to pass the request and not to check these header or maybe to use some sort of INJECTION To the header . I Tia Tal assa

2 1

ldap group checking against active directory
by Chris Liles 07 May '06

07 May '06

Hello mailing list! I have tried to search the archive and the web for the answer to my question but I am unable to find the answer..... I'm sure someone here has run into this before. I am attempting to setup the good old freeradius + active directory + access point to get peap going scenario. I have freeradius setup fine to use ldap to auth the user, and it works. I am attempting to setup finer access control (well really simple) to check if the user is a member of a group before allowing access. Here are some configs: radiusd.conf ldap { server = "domaincontroller.my.domain.com" identity = "adreader" password = "test1234" basedn = "cn=users,dc=my,dc=domain,dc=com" filter = "(sAMAccountName=%u)" port = 636 start_tls = no tls_mode = no # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_attribute = "memberOf" timeout = 4 timelimit = 3 net_timeout = 1 } In my users file all I have is: DEFAULT Ldap-Group == "badgroup", Auth-Type := Reject Reply-Message = "Sorry, you are not allowed to have access" When I use NTRadPing to test with a user that is in "badgroup" I still get an Access-Accept back. I can do an ldap search using the groupmembership_filter and I get back all the groups my test user is in so I know that isn't the problem. Of course when I do my search I replace the %{Ldap-UserDn} with the actual "cn=username,<what I have for basedn>" Also I have the groupmembership_attribute defined because from what I gather from the docs, it is used if the groupmembership filter fails. Anywho, when I send an auth request while watching the debug output I don't see anything about checking for group/groupmembership/etc. If I change my filter "filter = "(sAMAccountName=%u)" to also check for the group name, everything will work, but of course I would like to use the users file. I've got TLS set to no and port set to 636 because I am using a crap-tacular windows 2000 domain, which doesn't support TLS :-( I think I am missing something or something isn't quite right. Anyone have any ideas, or has anyone gotten ldap group checking to work against active directory?? Thanks -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309

1 0

db_mysql.sql
by Monsur Mannan 06 May '06

06 May '06

Dear freeradius users, I'm new in this subject.I already install freeradius server and mysql on redhat enterprise. After installation I don't find any file named db_mysql.sql on my os. Can anyone help me? I install freeradius like with this parameter ./configure --with-mysql.Is this right? Your reply will be very appreciable. Thanks. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

cannot find db_mysql.sql
by Monsur Mannan 06 May '06

06 May '06

Dear freeradius users, I'm new in this subject.I already install freeradius server and mysql on redhat enterprise. After installation I don't find any file named db_mysql.sql on my os. Can anyone help me? I install freeradius like with this parameter ./configure --with-mysql.Is this right? Your reply will be very appreciable. Thanks. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

freeradius and IDLE time or sth like that
by Przemysław Backiel 06 May '06

06 May '06

hello, I want to kick of user when he is in idle for some time. I am using FreeRADIUS 1.1 and accounting in SQL how can I do that? I suppose that I will have to add something in radcheck or radreply table. So, what I have to add? -- Z powazaniem Przemyslaw Backiel

1 0

Missing User-Name attribute causing a segfault in attr_rewrite
by Dennis Skinner 05 May '06

05 May '06

Hello, I finally got around to upgrading our RADIUS servers to FR 1.1.1. Everything is working well except we seem to have a customer somewhere who is able to attempt to auth without sending a User-Name attribute and a blank User-Password. I'm not sure at this point if it is an attempted exploit or just a badly coded client. Here is an attempt: --- Walking the entire request list --- Cleaning up request 1 ID 88 with timestamp 44512aa3 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:21674, id=218, length=203 Framed-Protocol = PPP User-Password = "" Calling-Station-Id = "##########" Called-Station-Id = "##########" NAS-Port-Type = Async Cisco-NAS-Port = "Async172" NAS-Port = 172 Connect-Info = "28800/26400 V34+/V44/LAPM (53333/26400)" Cisco-AVPair = "v92-info=V.92 QC MOH/QC Full Train Success/0/0" Service-Type = Framed-User NAS-IP-Address = xxx.xxx.xxx.xxx Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 2 rlm_attr_rewrite: Could not find value pair for attribute Realm modcall[authorize]: module "fix_realm" returns noop for request 2 The very next line is the segfault. Here is my "fix_realm" module: attr_rewrite fix_realm { attribute = Realm searchin = packet searchfor = "blue.*$$" replacewith = "bluefrog.com" ignore_case = yes new_attribute = no max_matches = 1 append = no } (we used to use both bluefrognet.net and bluefrog.biz, so this attempts to normalize everyone since the username in the db is always user(a)bluefrog.com) I think the fact that there is no realm may be causing the segfault. Unfortunately, I have no idea how to recreate the situation myself and I have yet to try to track down the customer. I didn't see this problem listed on bugs.freeradius.org and don't recall seeing mention of it on the list. The other thing I changed in the authorize section of the config file is that I moved the suffix (and fix_realm) higher in the list (as you can probably tell from the debug output). Here is my authorize section: authorize { suffix fix_realm preprocess chap mschap eap files redundant { # slave first sql2 sql1 handled } } My old config wasn't using huntgroups, so I didn't need to fix_realm before preprocessing. I need to do that now, hence suffix and fix_realm are at the top. I will continue to dig at this problem from my end, but I thought maybe Alan or someone could modify radclient to send a packet like above and see if they can recreate the bug (or better yet, have a look at the code and go, "oh yeah, that is why that happened"). My C coding skills have all but rusted solid at this point. Let me know if you need any more information. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

3 6

freeradius + ldap
by ludovic cailleau 05 May '06

05 May '06

Good morning, I have made an authentification 802.11x with Freeradius and his user file. Now I would like to use Ldap. I have made a configuration but it does not run. Have you got a procedure of the configuration of Freeradius and Ldap? thank --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

3 11

VLAN Mapping with MS-CHAP
by robiwan＠arcor.de 05 May '06

05 May '06

Dear all, I try to put my Windows-XP-Clients in different VLANs on my Cisco Catalyst 3750 Switch, depending on their Account. And i use two differnt authentication methods: MD5-Challange and MS-CHAP. User hugo should be mapped in VLAN 50 and authenticated via MD5-Challange User roka at Domain WINLAB should be mapped in VLAN 40 and authenticated via MS-CHAP Now both authentication works (thanks to all again) but i have difficulties to map user roka in his right VLAN. Here is my users file: -----------------------snip------------------------ hugo User-Password == "hugo01" Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 50 roka Auth-Type := MS-CHAP Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 ---------------------snap-------------------------- Here is the output of my radiusd with user hugo The Cisco-Switch map user hugo in VLAN 50: Login OK: [hugo/<no User-Password attribute>] (from client M4DEMRCO0000015 port 50103 cli 00-0B-5D-84-AE-CA) Sending Access-Accept of id 210 to 10.187.0.15 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "hugo" Finished request 1 Going to the next request Here is the output with user roka The Cisco-Switch map user roka in VLAN 1, and NOT in VLAN 40, i miss the Tunnel informations: Login OK: [WINLAB\\roka/<no User-Password attribute>] (from client M4DEMRCO0000015 port 50103 cli 00-0B-AA-84-AE-CA) Sending Access-Accept of id 220 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0x70235fcdc1bc208578d0a26edb3c6d0b09f7cb712d4e9b66e7b2bea5b159c4f2 MS-MPPE-Send-Key = 0x6208fd4f8c1d2cd07a5e4597c98707dc70c94f29898eb0672e4572808efbd13d EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "WINLAB\\roka" Finished request 9 Going to the next request So, any ideas what to do, that for user roka my radiusd also say to my Switch the Tunnel things: Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "40" Thanks in advance Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

audiocodes dictionary
by Guido 04 May '06

04 May '06

Hi everybody, Im using freeradius 1.1.0 and an Audiocodes as NAS. Audiocodes is sending some parameters accounting as Vendor-4923-Attr-XX. Here an example: rad_recv: Accounting-Request packet from host 192.1.1.1:1813, id=2, length=297 Acct-Session-Id = "1288892787" NAS-IP-Address = 192.1.1. NAS-Port-Type = Async Acct-Status-Type = Start Vendor-4923-Attr-25 = 0x683332332d73657475702d74696d653d Vendor-4923-Attr-33 = 0x683332332d67772d69643d Vendor-4923-Attr-1 = 0x683332332d696e636f6d696e672d636f6e662d69643d3334333533393335203337333233363332203330333233313332203330333033303332 Vendor-4923-Attr-27 = 0x683332332d63616c6c2d747970653d564f4950 Vendor-4923-Attr-26 = 0x683332332d63616c6c2d6f726967696e3d416e73776572 Called-Station-Id = "043353612323" Calling-Station-Id = "2135866293" Vendor-4923-Attr-24 = 0x683332332d636f6e662d69643d3334333533393335203337333233363332203330333233313332203330333033303332 I suspect the problem is I don't have a dictionary for Audiocodes. If it is the problem, can somebody tell me where can I find it ? If not, can somebody give an idea? Thanks in advanced, Guido

2 1

Freeradius config rlm_sqlcounter.so missing
by Andrew Belling 04 May '06

04 May '06

I have now after a lot of reading and searching managed to configure my freeradius server to my needs(auth for wireless hotspot) however a required libary module "rlm_sqlcounter.so" has not been installed with the RPM used to install. System info: fedoracore 5 fedoracore RPM freeradius-1.0.5 fedoracore RPM freeradius_sql-1.0.5 now after modyfiyng all the config files as required to authenticate using a mysql db all test work, then after making the final config changes to use the module rlm_sqlcounter to support the time limits the folowing shows in my radiusd.log "Error: radiusd.conf[1] Failed to link to module 'rlm_sqlcounter': rlm_sqlcounter.so: cannot open shared object file: No such file or directory" So after finding the dir where radiusd looks for it's library modules rlm_sqlcounter.so was not there, all the other rlm_sql.so were so after a few mor hours googling found that i needed to make the file so i downloaded the sorce code for ver 1.0.5 from freeradius.org found the rlm_sqlcounter folder containing the files needed to make the .so file. however am having problems doing so. What i am doing is: ./configure also tryed sh configure make make install as described in a email found in the archive of this list. Here are the responses i received: # sh configure loading cache ./config.cache checking for gcc... no checking for cc... no configure: error: no acceptable cc found in $PATH Any help will be gratefully received as this is slowly moving from a fun challenge to a annoying task. Regards Andrew

2 1