- Freeradius-Users - lists.freeradius.org

Auth from LDAP, then add reply via SQL
by Robert Myers 21 Feb '06

21 Feb '06

I must be missing this in the documentation. If I authenticate via the users file/LDAP/SQL , is there a way to add replies from the radcheck table in sql? -Bob

1 2

Bug #86?
by Stefan Winter 20 Feb '06

20 Feb '06

Hi, it seems like bug #86 didn't make it into 1.1. Any chance of seeing this somewhen in the 1.1 branch? I'd work on it myself, but the path Alan describes in the bug comment sounds somewhat like spanish to me (and the patch I provided in #203 seems not clean enough, even to myself in retrospective) :-) Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Log file format
by Walter Reynolds 20 Feb '06

20 Feb '06

We have some tools that currently run some statistics on the radius accounting file. Well, we currently use a different radius server. With that in mind the log format is different. Is there a way to modify the format of the accounting log format? -- Walter Reynolds University of Michigan

2 1

cisco pptp+mppe problems on ios 12.3T and later
by jakobp 20 Feb '06

20 Feb '06

hi, maybe one of the cisco users here on the list can help me. I want to run dialin vpdn on a cisco 1712, using pptp tunnels with mppe encryption and authenticate against freeradius 1.1.0 The strange thing is, my setup used to work just fine, until i tried to upgrade IOS from 12.2 to 12.3T or 12.4. in both trains (> 12.2) mppe suddenly fails to work. a normal, unencrypted pptp works. "debug" shows that cisco gets a radius reply with ms-chap mppe attributes, but seems to miss/misunderstand something. "debug mppe" says: MPPE: keying material missing from radius the relevant parts of my cisco config: aaa authentication login vpnauth group radius aaa authentication ppp default group radius local aaa authorization network default if-authenticated aaa authorization network vpnauth group radius vpdn enable vpdn multihop vpdn source-ip 217.196.69.198 vpdn logging vpdn logging user vpdn logging tunnel-drop vpdn session-limit 10 vpdn search-order multihop-hostname vpdn-group pptp ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 lcp renegotiation on-mismatch interface Virtual-Template1 ip unnumbered FastEthernet0 no ip redirects no ip unreachables no ip proxy-arp ip nat inside ip virtual-reassembly peer default ip address pool vpnpool compress mppc ppp encrypt mppe auto ppp authentication ms-chap ms-chap-v2 ppp eap refuse callin radius-server host x.x.x.x auth-port 1812 acct-port 1813 key xxx radius-server authorization default Framed-Protocol ppp radius-server vsa send accounting radius-server vsa send authentication ... and from radiusd.conf: mschap { authtype = MS-CHAP use_mppe = yes require_encryption = no require_strong = no } i already tried to find information or to change some of the config settings, but no luck :( thanks in advance, jakob

1 0

Migration. Please Help
by Marta Lajas 20 Feb '06

20 Feb '06

Hy all, Sorry for the stupid question but I dont have any C/Unix knowledge. We have a FreeRadius Server running in a machine. It is using a custom module (in order to authenticate to an ldap server) developed two years ago called rlm_ldap2. Now I am going to install FreeRadius in another machine and I want to use that custom module. Is it neccesary to install OpenLdap before? or is it enough to copy my rlm_ldap2.so in the directory with the other rlm_* libraries compiled during the FreeRadius installation? Thank you very much Regards, Marta --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

1 0

attribute Password in an Access-Reject packet
by Susana Macias 20 Feb '06

20 Feb '06

Hy all, I am trying to include two pairs attribute/value in my Radius Response Packet. This is my code: ... pairadd(&request->reply->vps, pairmake("Password", "***\n", T_OP_EQ)); pairadd (&request->reply->vps, pairmake("Reply-Message", "TID-2002", T_OP_EQ)); ... When I do some tests, I observe this: 1) If my radius Response Packet is an Access-Accept, the FreeRadius server sends: Received response ID 255, code 2, length = 71 User-Password = "***\n" Reply-Message = "TID-2002" 2) If my radius Response Packet is an Access-Reject, the FreeRadius server sends: Received response ID 252, code 3, length = 30 Reply-Message = "TID-2002" ---------------------------- * Why the Password attribute does not appear in the Access-Reject packet? * Why does the Password attribute (in the Access-Accept packet) appear like User-Password? Thank you very much Susana ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

4 6

RE: free realm
by Bart van Daal 20 Feb '06

20 Feb '06

thanks! -----Original Message----- From: freeradius-users-bounces+b.vandaal=edpnet.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+b.vandaal=edpnet.net@lists.freeradius.org] On Behalf Of Dusty Doris Sent: maandag 20 februari 2006 6:27 To: FreeRadius users mailing list Subject: Re: free realm > I'm looking for a solution to add a 'free' realm to my conf. > The object is to always send an access-accept if freeradius receives a > request from a NAS with username e.g. 'free/nonexistinguser/password' > > Is this possible with freeradius? > > thanks and have a nice week-end, > Bart Sure. Read the users manpage (man 5 users) and the comments in the users file. Here are some hints. DEFAULT Realm == "somerealm", Auth-Type := Accept or DEFAULT User-Name =~ "^[^@]@somedomain$", Auth-Type := Accept or someusername Auth-Type := Accept etc... - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Thanks Alan
by Shane Hart 20 Feb '06

20 Feb '06

Or buy the coders a beer :-) -----Original Message----- From: freeradius-users-bounces+shane=sme-solutions.com.au(a)lists.freeradius.org [mailto:freeradius-users-bounces+shane=sme-solutions.com.au@lists.freera dius.org] On Behalf Of Sean Sent: Tuesday, 14 February 2006 5:13 AM To: freeradius-users(a)lists.freeradius.org Subject: Thanks Alan On Mon, 2006-02-13 at 19:58 +0100, freeradius-users-request(a)lists.freeradius.org wrote: > Phil Mayers <p.mayers(a)imperial.ac.uk> wrote: > > Alan, in case anyone hasn't said it recently - you do an excellent > job > > maintaining this project under difficult conditions. You have my and > I > > suspect many other peoples sincere gratitude, and I can only hope > it's > > as rewarding for you as it is helpful for us. > > Thanks. > > FreeRADIUS is being used as part of the core product in at least 3 > startups I know of, and possibly as many as 5. It's at the point now > where it's getting me more professional attention than my other work > activities. > > Alan DeKok. Alan, I'd like to add my thanks also. FreeRadius is at the core of swarmhotspots.com and I'm amazed at the help and support that is available from you and the open source community. The best way to show your appreciation is to contribute something back. Regards, Sean http://swarmhotspots.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

free realm
by Bart van Daal 20 Feb '06

20 Feb '06

Hi, I'm looking for a solution to add a 'free' realm to my conf. The object is to always send an access-accept if freeradius receives a request from a NAS with username e.g. 'free/nonexistinguser/password' Is this possible with freeradius? thanks and have a nice week-end, Bart

2 1

Re: Re: how to disconnect user after quota given to him finishes ?
by Rupesh Amatya 19 Feb '06

19 Feb '06

Dear Alan, As you have suggested to check rlm_counter, I looked and found two files /usr/lib/rlm_counter.so /usr/lib/rlm_counter-1.0.1.so But both the files are binary files. Can you give me a little more hint on how I can do that. I am trying to create packages like 2hrs/day,4hrs/day. I am using freeradius(with Mysql) with Mikrotik as NAS. Hope to hear from you. Thanking you Rupesh -------- Original Message -------- ==> From: "Alan DeKok" <aland(a)ox.org> ==> Date: Thu, 16 Feb 2006 11:21:38 -0500 "Rupesh Amatya" <rupesh.amatya(a)info.com.np> wrote: > If I put 4hours in Session time and after using 3 hours , if he > disconnects and then reconnects, he can again use 4 hours. > Is there a way that he can no more log in after he uses 4 hours/day ? rlm_counter. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1