- Freeradius-Users - lists.freeradius.org

Open Authentication for a realm
by John Oxley 27 Feb '06

27 Feb '06

Hi, I am still quite new to radius so please forgive me if I make invalid assumptions or this question has been answered somewhere. I want to have open authentication on a realm and setup an IP pool for that realm. So if your username is anything@foo, you will be authenticated, no matter what your password is and you will be given an IP from the pool 10.0.0.0/24. Where in the config files do I have to put this? I'm running FreeRadius 1.0.4 on FreeBSD 4.11-STABLE. Regards, -John

2 2

Re: Freeradius + Microsoft Active Directory
by Sandworm 27 Feb '06

27 Feb '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 "Natalia Escalera" <nescalera(a)gmail.com> wrote: >I have another question, how can we avoid referrals coming from AD >Ldap server? How can we specify those settings? >From the list archives: See http://lists.freeradius.org/pipermail/freeradius-users/2004- October/037218.html -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkQCP0sACgkQmw4BJyaatJ0v0wCfVh0g2C1mTgdDxuV6qzBqg8FxTnsA nilt8+Zkbe4sXvs8HCpieRZ7kZQd =B4JO -----END PGP SIGNATURE-----

2 1

RE: Adding Ascend-Data-Filter to MySQL
by Jonathan De Graeve 27 Feb '06

27 Feb '06

> But when I add the same Ascend-Data-Filter information above into mysql > database file (radgroupcheck table), although authenticates fine, I don't > get "Ascend-VSA-Data-Filter=\0x01\0x01\0x01 ...." in attribute dump. > Below is what is added to the table: > > GroupName Attribute op Value > -------------------------------------------- > Dialup Auth-Type := LOCAL > Dialup Service-Type = Framed-User > Dialup Framed-Protocol = PPP > Dialup Framed-Compression = Van-Jacobsen-TCP-IP > Dialup Ascend-Data-Filter += "ip in forward tcp est" > Dialup Ascend-Data-Filter += "ip in forward dstip a.b.c.0/20" > Dialup Ascend-Data-Filter += "ip in forward tcp dstport = 25" > Dialup Ascend-Data-Filter += "ip in forward" > It should be in radgroupreply table J.

2 1

TNC Compliance
by Robert Myers 26 Feb '06

26 Feb '06

Is FreeRadius TNC compliant? -Bob

2 1

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 26 Feb '06

26 Feb '06

Exactly as I suggested in original post...

1 0

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 26 Feb '06

26 Feb '06

Please ignore... Found the answer already...

2 1

rtl8186 + radius
by Norbert Grochal 26 Feb '06

26 Feb '06

Hi, I try to secure wireless network with freeradius (on linux PC). Access Points on rtl8186, WPA2(mixed), clients cards edimax on ralink rt2500 and ralink rt2400, PEAP. Firmware on AP: (newest versions) Planet 4035, Planet wrt414, Edimax ew-7206, Edimax ew-7209, OvisLink Airlive... Problems (all need reset AP, after reboot all is work ok 1-4 hours...): 1. wds disconnects every 3-4 hours. 2. If count of peoples > 4 then after 1-4 hours AP stops talk with freeradius 3. and sometimes freezes and peoples can't connect at all I have connect the AP to COM on my PC and see, that there are no error messages in builtin linux, there is anough memory and ramdisc space. I think this may be problem with driver for radio (RF, RTL8180/RTL8185). Anyone succesfully 'run' freeradius with PEAP + AP on rtl8186 with WPA2(mixed) + about 10-15 users?? Norbert

2 1

freeradius 1.1.0 and mysql5
by Seferovic Edvin 26 Feb '06

26 Feb '06

Hello, are there any known issues when installing freeradius with mysql support? I have Suse 9.1 with mysql5 ( from RPMs ) and after compiling freeradius - rlm_sql module is not able to link rlm_sql_myql because I do NOT have libmysqlclient.so.12 !! Sun Feb 26 17:36:24 2006 : Error: rlm_sql (sql): Could not link driver rlm_sql_mysql: libmysqlclient.so.12: cannot open shared objey Sun Feb 26 17:36:24 2006 : Error: rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your sys. Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[14]: sql: Module instantiation failed. Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[1257] Unknown module "sql". Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[1243] Failed to parse accounting section. YES - I have tried to compile with -disable-shared, but then I get a lot of other error messages about DynaLoader and rlm_smb??? extracting global C symbols from `../modules/rlm_sql/drivers/rlm_sql_mysql/.libs/rlm_sql_mysql.a' (cd .libs && gcc -c -fno-builtin -fno-rtti -fno-exceptions "radiusdS.c") cc1: warning: "-fno-rtti" is valid for C++ but not for C/ObjC rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../include -DHt ../modules/rlm_perl/.libs/rlm_perl.a(rlm_perl.o)(.text+0x26fb): In function `xs_init': /root/software/freeradius-1.1.0/src/modules/rlm_perl/rlm_perl.c:613: undefined reference to `boot_DynaLoader' ../modules/rlm_smb/.libs/rlm_smb.a(smbencrypt.o)(.text+0x172): In function `E_md4hash': /root/software/freeradius-1.1.0/src/modules/rlm_smb/smbencrypt.c:107: undefined reference to `mdfour' collect2: ld returned 1 exit status rm -f .libs/radiusdS.o gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/root/software/freeradius-1.1.0/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/software/freeradius-1.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/software/freeradius-1.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/software/freeradius-1.1.0' make: *** [all] Error 2 Is there any way I can disable those modules I do not need ( or plan to use )? Any ideas how I can solve those problems? Thank you in advance. Regards, Edvin Seferovic

2 1

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 26 Feb '06

26 Feb '06

Hi, Alan! Thanks for answering... First of all I never intended to use CRYPT passwords for MS-CHAPv2. C'mon, I know that much about MS-CHAP. ;-) Not all my users need access to new services, as I wrote, I was planning to expose the cleartext password for those who need (perhaps NT-Password in the future) and to continue using CRYPT for those who do not need the new services. If you say SQL doesn't like having two passwords in radcheck and only grabs the first one - let it be... What I wrote about hacking the code was about trying to fix this perhaps, shouldn't SQL take all check records found?... Actually I've found my around the problem... I've made a second instance of pap using clear text passwords in radiusd and I'll only change password attributes to clear text in radcheck to those who use MS-CHAP as well (placing them into group which does Auth-Type := papplain). This however leaves me without NT-Password (which is NT-Hash). An ideal situation for me would be something like this in radcheck: username | att | op | val --------------+-------------------------+----+----------- btest | NT-Password | == | NT-hashbla-bla-bla^&&@0-3443 btest | Crypt-Password | == | $1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1 This however will not work because PAP burps on Crypt-Password this way. Here is the dump of having both, it was stupid of me not to include one, I admit: btest User-Password == Master1 btest Crypt-Password == "$1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1" Authentication PAP Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.8:1248, id=5, length=45 User-Name = "btest" User-Password = "Master1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "btest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry btest at line 69 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'btest' rlm_sql (sql): sql_set_user escaped user --> 'btest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'btest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User btest not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User btest not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [btest] (from client rasdata port 0) Sending Access-Accept of id 5 to 192.168.0.8:1248 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --------------------------------------------------------------------------------------------------------- Authentication CHAP rad_recv: Access-Request packet from host 192.168.0.8:1271, id=11, length=46 User-Name = "btest" CHAP-Password = 0xd2bf262017f2f6812bc00cbd077aed9b55 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "btest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry btest at line 69 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'btest' rlm_sql (sql): sql_set_user escaped user --> 'btest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'btest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User btest not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User btest not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied CHAP-Password matches local User-Password Login OK: [btest] (from client rasdata port 0) Sending Access-Accept of id 11 to 192.168.0.8:1271 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds...

2 1

RE: FreeBSD 6.0 and mysql
by Rob Parker 26 Feb '06

26 Feb '06

Not sure if this is any use, but the last time I saw an error like that was with a box which had conflicting threading libraries on it... in the end I just pulled the box down and reinstalled freebsd (box was not in production, thankfully!), but this might be useful to you (it's from a KDE mailing list, but the problem/solution should be the same): http://freebsd.kde.org/pipermail/kde-freebsd/2004-August/008692.html Maybe FreeRADIUS is linked against one library and MySQL is linked to another. Cheers, Rob. -----Original Message----- From: Alan Craig [mailto:alan@mexcom.co.za] Sent: 24 February 2006 10:03 To: freeradius-users(a)lists.freeradius.org Subject: RE: FreeBSD 6.0 and mysql Nope this doesn't help. I have a suspicion it is a threading problem, but I haven't a clue on where to look to sort that out. -- View this message in context: http://www.nabble.com/FreeBSD-6.0-and-mysql-t1168311.html#a3105556 Sent from the FreeRadius - User forum at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1