- Freeradius-Users - lists.freeradius.org

Working freeradius without shared secret!
by Guido 16 Mar '06

16 Mar '06

Hi, everybode, I sent this same mesage last March 14. I NEED accept a NAS that is not sending the shared secret. Somebody can help me ? please, if not, somebody can tell me which part of source code must I modify? Thanks very much, Guido

2 1

Ldap-Group AND EAP-TTLS/Ldap Question (Again)
by Benoît Bianchi 16 Mar '06

16 Mar '06

Hi, Is there a way to use the Ldap-Group with EAP-TTLS authentication based on LDAP??? Ive set it up in my users file but It doesnt work as the group belonging is performed on the outer identity first Can I some way specify to check the group only for the tunnelled identity? Benoît Bianchi. Ingénieur Système CRI / ISTY Université de Versailles Saint Quentin en Yvelines

2 1

There are no DB handles to use
by Vasco Santos 16 Mar '06

16 Mar '06

Hi Folks, I have freebsd 4.10-RELEASE with mysql 4.1.1-alpha and freeradius 1.1.0 Radius give me this error: There are no DB handles to use! what this error means ? radiusd -X ql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1845 Listening on accounting *:1846 Listening on proxy *:1847 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.11:2919, id=83, length=57 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 192.168.1.11 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "teste", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user teste to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'teste' rlm_sql (sql): sql_set_user escaped user --> 'teste' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'teste' ORDER BY id' rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 My mysql.log show only connections but querys no. What is the min System Requerements to freeradius work, mem and processor ? Try to install a old version of radius?

1 0

Help mixing proxied and non-proxied auth mechanisms
by Geoff Silver 16 Mar '06

16 Mar '06

I'm hoping to simply my users file, and I'm hoping someone can help. Right now I have something like the following. users file: --------- user01 Auth-Type:=Accept, Huntgroup-Name=="Office", Hint==Port-1812 Connect-Info="OFFICE_NET" user01 Huntgroup-Name=="Office", Hint==Port-1645, Proxy-To-Realm := PROXY_GW Connect-Info="OFFICE_NET" hints: ----- DEFAULT User-Name =~ "^(.*)$" Hint = "Port-%{request:Packet-Dst-Port}" proxy.conf: ---------- proxy server { synchronous = no retry_delay = 5 retry_count = 1 dead_time = 300 default_fallback = yes # enable post_proxy_authorize to get our local radius instance to # send back the connect-info on successful auth post_proxy_authorize = yes } realm PROXY_GW { type = radius authhost = 10.1.2.3:1812 secret = mys3kr1t } Basically, if "user01" connects on port 1812, all we do is the authorize step. If they're in the users file, they get access. If not, they don't. If "user01" connects on port 1645, we want to proxy their authentication to another radius server, and we want to do authorization locally against this file. So, right now, for every huntgroup/connect-info pair, I have *two* entries in the users file. One is for Port-1812, the other for Port-1645. So the question of the hour is: Is there something nifty I can do to eliminate the need for *two* nearly-identical entries for each user? Thanks!

3 5

help
by mkerkoub＠free.fr 16 Mar '06

16 Mar '06

Hello, Here is my question: i would like to créate a proxy freeradius. I have 3 forests, 3 data base for storing users. I want to know how to configure: 1. proxy freeradius with IAS in each forest, how to give to freeradius server the certificat stored in active directory? 2. Is it possible to configure proxy freeradius to forward requests directly to Active Directory without IAS (3 Active directory). Thank you very much for you answer. Have a good day.

1 0

libtool.m4: error: problem compiling CXX test program
by Norbert Wegener 16 Mar '06

16 Mar '06

On a Suse9.3 I checked out ftp://ftp.freeradius.org/pub/radius/CVS-snapshots/freeradius-snapshot-20060… configure reports an error on that version: checking whether to build static libraries... yes^M configure: creating libtool^M appending configuration tag "CXX" to libtool^M checking whether the g++ linker (/usr/i586-suse-linux/bin/ld) supports shared libraries... yes^M libtool.m4: error: problem compiling CXX test program^M checking for g++ option to produce PIC... ^M Maybe this is the reason for failure, when make install comes to an end? ... chmod 644 /usr/local/libradius.a libtool: install: warning: remember to run `libtool --finish /usr/local/lib' rm -f /usr/local/lib/libradius-2.0.0-pre0.la; ln -s libradius.la /usr/local/lib/libradius-2.0.0-pre0.la ln: creating symbolic link `/usr/local/lib/libradius-2.0.0-pre0.la' to `libradius.la': No such file or directory gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/home/freeradius-snapshot-20060308/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/freeradius-snapshot-20060308/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/home/freeradius-snapshot-20060308/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/freeradius-snapshot-20060308' running libtool --finish /usr/local/lib' does not help and taking /usr/local/lib into LD_LIBRARY_PATH when starting radiusd does not either: LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib /usr/local/sbin/radiusd -AX /usr/local/sbin/radiusd: error while loading shared libraries: libradius-1.1.0-pre0.so: cannot open shared object file: No such file or directory Norbert Wegener

1 0

incorrect radacct AcctSessionTime
by Gunther 16 Mar '06

16 Mar '06

Just one observation ... >From time to time I see entries in the radacct AcctSessionTime column with over 1 billion seconds, despite that the StopTime minus StartTime is less than 5 seconds. With FR 1.0.5 it was a few times 2147483647: AcctStartTime AcctStopTime AcctSessionTime inOctets outOctets 2005-10-06 03:34:30 2005-10-06 03:34:34 2147483647 1069 4541 2005-11-09 00:13:39 2005-11-09 00:13:40 2147483647 128 124 2005-12-01 03:13:55 2005-12-01 03:13:58 2147483647 0 40 Now with 1.1.0 it is around 1142280970: 2006-03-14 00:16:29 2006-03-14 00:16:32 1142280970 100 152 2006-03-14 00:16:29 2006-03-14 00:16:32 1142280970 0 0 2006-03-14 00:16:29 2006-03-14 00:16:32 1142280969 0 0 2006-03-14 00:16:30 2006-03-14 00:16:32 1142280969 0 0 2006-03-14 03:26:54 2006-03-14 03:26:56 1142292393 0 0 While the number of transferred octes is usually less than 200 bytes. There are less than 15 users at the same time (GMT time) using the server. There is some heavy download activity before ... I presume that the NAS (wrt54g with Chillispot) is sending the incorrect information ... Is this correct? Gunther

4 6

Creating unique monthly counter entries
by Ben Plimpton 15 Mar '06

15 Mar '06

Hello I'm going to have users trying to authenticate with the same user name from different nases and would like to keep unique monthly counter entries based on what huntgroup they login from. So, what I would like to know if either of the following is possible: 1) Can I have my monthly counter run only on accounting packets received from a certain NAS? or 2) Can I run attr_rewrite only on accounting packets received from certain nases or huntgroups and leave all others untouched? If this solution is possible, I would like to change the username from whatever it comes in as to username@huntgroup but I don't know if that's possible since huntgroup is not an attribute that is contained in the accounting packets. I tried changing it using attr_rewrite using this line: replacewith = %{Stripped-User-Name}@%{NAS-Identifier} but this won't work b/c we want to limit some dialup users to 10 hrs/mo but they can dialup to many different nases so they would end up getting a different entry in the counter for each different nas that they dialed into and would not get cut off properly. I have tried to use the acct_users file to set the huntgoup but cannot figure out how to pass that information on to the counter module. Please help point me in the right direction or if there is a better way to do this, please let me know. Thank you -- "Microsoft is not the answer, it's the question. NO is the answer." Ben Plimpton Network Engineer bplimpton(a)sopris.net 970-963-SURF(7873) ext 5174 www.sopris.com

1 0

RE: Freeradius-Users Digest, Vol 11, Issue 58
by Atkins, Dwane P 15 Mar '06

15 Mar '06

Hi, > OReilly FreeRADIUS book, free online documents and help guides I am away that this book is available, and we are trying to purchase it, but it will need to be delivered. > make sure you have the mysql RPMs and the freeradius-mysql RPMs installed I did exactly what the instructions told me to do. I downloaded and extracted the tarball. Configured, make and make install. Was there more I need to do to configure it with mysql? > make sure the right calls are in it. Not sure what this means!!! > How do I enter my users in mysql? Hi, > Is there a free radius for Dummies book out there? I know that most of > the instruction probably make sense to everyone, but me. OReilly FreeRADIUS book, free online documents and help guides > I am trying to configure Freeradius 1.1 on a mysql database using fedora > 4. make sure you have the mysql RPMs and the freeradius-mysql RPMs installed > Is there something I need to do with the sql.conf file to tie all of > this together? > make sure the right calls are in it. I am not sure what you meant by this. > use mysql or use one of the myriad of front-ends to use MySQL via a web interface - mysqladmin etc. PERL scripts using the DBD system too. Where do I find these myriads of front-ends? > Users? the users should be looking at FreeRADIUS. it authenticates them and accounts them via the NAS. or do you mean system admin users? For sys admin users. > yes. in MySQL tables - then use rlm_accounting calls to make sure the dates etc are within those ranges. Where do I find these. I have been to the archives and back. I have searched countless hours for some better examples of installing this process using MySql on Fedora. Thanks Dwane

2 1

FW: Freeradius-Users Digest, Vol 11, Issue 57
by Atkins, Dwane P 15 Mar '06

15 Mar '06

Can you explain a little better what you mean? I am not stuck on loading this. The documentation is way too gray for me and I know that O'Reilly's have put out a Radius book, but it is not in any of the local stores and I am trying to get this done this week instead of the normal 3 -5 business days. I will order it, for reference. I see where is called the sql.conf, but I so not see anything more. What is it actually suppose to look like when I run the Radiusd -X? Also, is there a way that I can get this to start without doing this. Can it run in the background? Thank you for all your inputs. Dwane -----Original Message----- From: freeradius-users-bounces+atkinsd=uthscsa.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+atkinsd=uthscsa.edu@lists.freeradius.or g] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, March 15, 2006 1:35 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 11, Issue 57 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: perl scripts (debik) 2. problem with secret (Guido) 3. Re: Problems configuring Free Radius (321Admin) ---------------------------------------------------------------------- Message: 1 Date: Wed, 15 Mar 2006 19:38:15 +0100 From: "debik" <debik(a)vp.pl> Subject: Re: perl scripts To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <008001c6485f$9f46fb40$0500a8c0@laptop> Content-Type: text/plain; charset="windows-1250" Hello again. I have stuckon writing that perl script to autheticate users from onother database. How can i grep the User-Name and Password from RAD_REQUEST to my perl script as a variable. I have tried to do something like this: my $username = $RAD_REQUEST{'User-Name'} Is it anyway possibble what im trying to do ? ----- Original Message ----- From: debik To: FreeRadius users mailing list Sent: Sunday, March 12, 2006 12:28 PM Subject: Re: perl scripts I tried to add new sql1.conf. But when i trie starting te radius server he told me that the database is nit in the Attribute Value. I that onother dsatabase i have got users of my network, and i wont, that teh radius server use that logins which are in that database. Sorry for that HTML, and for my english. ----- Original Message ----- From: mnisay To: 'FreeRadius users mailing list' Sent: Sunday, March 12, 2006 10:55 AM Subject: RE: perl scripts what do you want to achieve with this perl script, freeradius can do the authentication. is this script for management of database? if it is, you can use server side php scripts as well. if its not, does the perl script manipulates user database differently? sorry i think i did not get you well. ------------------------------------------------------------------------ ---- From: freeradius-users-bounces+mnisay=aim-consultants.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+mnisay=aim-consultants.com@lists.freera dius.org] On Behalf Of debik Sent: Saturday, March 11, 2006 2:43 PM To: FreeRadius users mailing list Subject: Re: perl scripts Yes. But that onother database is not in radius format like: op, value, etc. So I have to write a perl script. ----- Original Message ----- From: mnisay To: 'FreeRadius users mailing list' Sent: Saturday, March 11, 2006 11:27 AM Subject: RE: perl scripts ------------------------------------------------------------------------ -- From: freeradius-users-bounces+mnisay=aim-consultants.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+mnisay=aim-consultants.com@lists.freera dius.org] On Behalf Of debik Sent: Friday, March 10, 2006 8:41 PM To: FreeRadius users mailing list Subject: Re: perl scripts > I have got onother mysql base and i wont to write perl script to tel the radius server to use the data in that database. do you mean use MySQL for freeradius authentication? ----- Original Message ----- From: mnisay To: 'FreeRadius users mailing list' Sent: Friday, March 10, 2006 11:26 AM Subject: RE: perl scripts > Could somebody share with some scripts that authorize users in radius. > Im trying to write my own script, but i don't find any docs. > Could somebody help me. authorize users in radius? freeradius can authorize users by default. -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/278 - Release Date: 3/9/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/278 - Release Date: 3/9/2006 ------------------------------------------------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/278 - Release Date: 3/9/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/279 - Release Date: 3/10/2006 ------------------------------------------------------------------------ -- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/279 - Release Date: 3/10/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/279 - Release Date: 3/10/2006 ------------------------------------------------------------------------ ---- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------ ------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1