- Freeradius-Users - lists.freeradius.org

Messenger
by sami aa 26 Apr '06

26 Apr '06

Dear all, I am using freeradius 1.1.1 to authenticate SIP users. Using Windows Messenger as SIP phone is very important for me. I tested my servers(Sip proxy and freeradius) with free SIP phones and everything is OK. But with windows messenger I face some problems. I think the Function that Windows uses for Digest encription has some differences with FreeRadius functions (perhaps, I guess). Let me Know if anyone has tested the FreeRadius with windows messenger. "Is it possible or not?" I appericiate any help. Best wishes Saman --------------------------------- Celebrate Earth Day everyday! Discover 10 things you can do to help slow climate change. Yahoo! Earth Day

2 1

RE: Re: Create and Send attributes
by Carlos Peñafiel 26 Apr '06

26 Apr '06

>Carlos Peñafiel wrote: > > Hello!!! > > > > I want to send from my radius server several attributes to the client, > > but I've been looking at the documenation. I can do that if my > > attribute-ID is between 1 and 100 (I guess, maybe is it 256), but also > > the documentation says that a new attribute has to have an ID greater > > than 3000. > > > > So, are not "the attributes between 100 (256) and 3000" sent to the > > client radius? (I guess, they could be used for local management) If it > > is not, how can I create an attribute with id grater that 3000 and send > > to the radius client? > >If you are creating your own attributes, get an IANA enterprise number >(either apply for one or re-use one if AND ONLY IF you're certainly it >will only be used internally) and use a vendor-specific attribute space. >See the dictionary.$vendor files for examples. > >Alternatively, have a dig in the dictionary files and/or RFCs for an >existing attribute that closely matches the purpose. What are you trying >to do? > >Obviously you'll have to have control over the radius client to make it >actually use the new attribute. Most will only use attributes they >already know about. > > Hello and thank you to answer so soon. I am trying to do something like "amount of quality of service" that a user have. I have the control over the radius client because I am using a HostAP, but looking at the documentation and on Google, I cant find a way to solve this. can you help me a little but more? Thank you in advance.

3 3

Re: freeradius, deb (sid)
by Gabor Szelei 26 Apr '06

26 Apr '06

Hi, >You might download FreeRADIUS 1.1.1 and build a Debian package >from sources. I've tried, but faild to collect all the needed modules. Which version of libcrypt is need? Which version of openlls is needed? Can I find ldap headers from deb ? Is there some page about dependency requirments? Thanks. br, Gabor Szelei

2 1

Re: Freeradius + ldap
by Phil Mayers 26 Apr '06

26 Apr '06

ludovic cailleau wrote: > Good morning, > > I send this email because I don't found my error about freeradius + ldap. > I thinhk, I have an error of the userPassword at the request 7. Please don't send mails directly to me. I'm not a personal helpline. The mailing list is the appropriate place. Looking below, you see: > rlm_ldap: user VoisinC authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > modcall[authenticate]: module "unix" returns notfound for request 0 > modcall: group authenticate returns notfound for request 0 > auth: Failed to validate the user. Something is setting Auth-Type to System. It's probably this, higher up: > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 Fix your config and it will work. > > You can see the output of radiusd -X : > > Can you help me? > Thanks a lot > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/raddb/clients.conf > Config: including file: /etc/raddb/snmp.conf > Config: including file: /etc/raddb/eap.conf > Config: including file: /etc/raddb/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/radius" > main: libdir = "/usr/lib" > main: radacctdir = "/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = yes > main: log_file = "/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = yes > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "radiusd" > main: group = "radiusd" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "/etc/shadow" > unix: group = "(null)" > unix: radwtmp = "/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded LDAP > ldap: server = "10.49.0.101" > ldap: port = 389 > ldap: net_timeout = 1 > ldap: timeout = 4 > ldap: timelimit = 3 > ldap: identity = "cn=adminlp,o=crt" > ldap: tls_mode = no > ldap: start_tls = no > ldap: tls_cacertfile = "(null)" > ldap: tls_cacertdir = "(null)" > ldap: tls_certfile = "(null)" > ldap: tls_keyfile = "(null)" > ldap: tls_randfile = "(null)" > ldap: tls_require_cert = "allow" > ldap: password = "azerty" > ldap: basedn = "o=crt" > ldap: filter = > "(&(objectclass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" > ldap: base_filter = "(objectclass=radiusprofile)" > ldap: default_profile = "(null)" > ldap: profile_attribute = "(null)" > ldap: password_header = "(null)" > ldap: password_attribute = "userPassword" > ldap: access_attr = "(null)" > ldap: groupname_attribute = "cn" > ldap: groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > ldap: groupmembership_attribute = "(null)" > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > ldap: ldap_debug = 0 > ldap: ldap_connections_number = 5 > ldap: compare_check_items = no > ldap: access_attr_used_for_allow = yes > ldap: do_xlat = yes > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id > rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP userPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > rlm_ldap: LDAP radiusVSA mapped to RADIUS Symbol-SSID > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > Framed-AppleTalk-Link > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > Framed-AppleTalk-Network > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > Framed-AppleTalk-Zone > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > conns: 0x8d07af0 > Module: Instantiated ldap (ldap) > Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = yes > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/etc/raddb/certs/dh" > tls: random_file = "/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = yes > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/etc/raddb/huntgroups" > preprocess: hints = "/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded detail > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (auth_log) > Module: Loaded attr_filter > attr_filter: attrsfile = "/etc/raddb/attrs" > rlm_attr_filter: Authorize method will be deprecated. > Module: Instantiated attr_filter (attr_filter) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/etc/raddb/users" > files: acctusersfile = "/etc/raddb/acct_users" > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (reply_log) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32825, id=234, length=59 > User-Name = "VoisinC" > User-Password = "password" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20060426' > rlm_detail: > /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands > to /var/log/radius/radacct/127.0.0.1/auth-detail-20060426 > modcall[authorize]: module "auth_log" returns ok for request 0 > modcall[authorize]: module "attr_filter" returns noop for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "VoisinC", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for VoisinC > radius_xlat: '(&(objectclass=posixAccount)(uid=VoisinC))' > radius_xlat: 'o=crt' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to 10.49.0.101:389, authentication 0 > rlm_ldap: bind as cn=adminlp,o=crt/azerty to 10.49.0.101:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in o=crt, with filter > (&(objectclass=posixAccount)(uid=VoisinC)) > rlm_ldap: Added password password in check items > rlm_ldap: looking for check items in directory... > rlm_ldap: Adding radiusVSA as Symbol-SSID, value CRTguest & op=21 > rlm_ldap: Adding userPassword as NT-Password, value password & op=21 > rlm_ldap: looking for reply items in directory... > rlm_ldap: user VoisinC authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > modcall[authenticate]: module "unix" returns notfound for request 0 > modcall: group authenticate returns notfound for request 0 > auth: Failed to validate the user. > Login incorrect: [VoisinC/password] (from client localhost port 1812) > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 234 to 127.0.0.1:32825 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 234 with timestamp 444f82d2 > Nothing to do. Sleeping until we see a request. > > ------------------------------------------------------------------------ > *Faites de Yahoo! votre page d'accueil sur le web* pour retrouver > directement vos services préférés : vérifiez vos nouveaux mails, lancez > vos recherches et suivez l'actualité en temps réel. Cliquez ici > <http://us.rd.yahoo.com/mail/mail_taglines/yahoofr/*http://fr.yahoo.com/set>. > > ------------------------------------------------------------------------ > *Faites de Yahoo! votre page d'accueil sur le web* pour retrouver > directement vos services préférés : vérifiez vos nouveaux mails, lancez > vos recherches et suivez l'actualité en temps réel. Cliquez ici > <http://us.rd.yahoo.com/mail/mail_taglines/yahoofr/*http://fr.yahoo.com/set>. >

1 0

RE: Re: Use of Service type attribute
by Carlos Peñafiel 26 Apr '06

26 Apr '06

>=?iso-8859-1?B?Q2FybG9zIFBl8WFmaWVs?= <carpeher(a)hotmail.com> wrote: > > I am trying to do something like "amount of quality of service" that a >user > > have. > > What does that mean? Im sorry for my English. I want to have a variable (attribute) saying that for each user who has authorization using the network, I want to offer a QoS going outside (to the internet) for him/her. > > > I have the control over the radius client because I am using a HostAP, >but > > looking at the documentation and on Google, I cant find a way to solve >this. > > can you help me a little but more? > > Edit the source code to the client to look for, and interpret, the >new attribute. Re-use an attribute of a similar name, or invent a new >one. If the attribure is used only in your local deployment, it >doesn't really matter what number you pick. It just has to be a >number that goes into a RADIUS packet. > > Alan DeKok. > Ok. Thank you for your time.

1 0

Réf. : Freeradius-Users Digest, Vol 12, Issue 98
by JVUVANT Yahoo 26 Apr '06

26 Apr '06

Hi I am using actually freeradius wich work fine for linux box with one if (eth0). I've added another if (eth1) for some applications else. But whe I run radiusd -X -A, freeradius doesn't start correctly, ie. log stop reading at clients file. so My question is how to start freeradius en specific interface (for example eth0). Thanks for any answer. Jacques

2 1

freeradius, deb (sid)
by Gabor Szelei 26 Apr '06

26 Apr '06

Hiall, I'd like to use freeradius with PEAP. from freeradius -X: rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory rlm_eap_tls.so seems to be missing. Does anyone know some debian source to get it with it? Is there some guide about how to build it and what dependencied are needed for that? br, gabor

3 2

Use of Service type attribute
by Chandra mohan 26 Apr '06

26 Apr '06

Hi, I am developing a RADIUS client for our embedded product. I would like the Radius client implementation to support the association of privilege level with individual accounts, e.g. the account "normal_user" has a privilege that allows read-only access while account "admin_user" has a privilege that allows read-write access(can changes our system configuration). Is it possible to use "Service-Type" attribute for this purpose, with "Login" value for normal_user and "Administrative" for admin_user. Please clarify. Thanks -Chandra __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

freeradius request to DHCP
by Philippe Bacquaert 26 Apr '06

26 Apr '06

Hello, I'm working on a project. I'm searching how to make freeradius (when receiving a request from a radius client) request itself a dynamic IP address to a dhcp server and write it in the attribute Framed-IP-Address. Any advice is welcome. Philippe B. Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34 /mn) ; tél : 08 92 68 13 50 (0,34/mn)

3 2

Create and Send attributes
by Carlos Peñafiel 26 Apr '06

26 Apr '06

Hello!!! I want to send from my radius server several attributes to the client, but I've been looking at the documenation. I can do that if my attribute-ID is between 1 and 100 (I guess, maybe is it 256), but also the documentation says that a new attribute has to have an ID greater than 3000. So, are not "the attributes between 100 (256) and 3000" sent to the client radius? (I guess, they could be used for local management) If it is not, how can I create an attribute with id grater that 3000 and send to the radius client? Thank in advance.

2 1