- Freeradius-Users - lists.freeradius.org

rlm_perl
by freeradius＠singularity.co.za 16 Feb '06

16 Feb '06

Hi All, I'm keen to start using the rlm_perl module now that it has been made stable. However I find that the documentation relating to the module is sparse. Is there any official documentation on this module that anyone knows of? I would also like to know whether the perl module loaded is persistent. Thanks Philip

2 3

flat file user
by Priscilla B 16 Feb '06

16 Feb '06

Hi everyone, I have a question, have anyone of you using flat file for user database? If so, Can we use some script to update the content? If so do you guys have some examples? For example if i limited user A to use only 4 hours. and after he use 2 hours, and log out, I want to update the detail file, so user A data will become only 2 hours now. I know we can do that with sql and others . but how about flat file. Need a light here. thanks a lot Priscilla --------------------------------- What are the most popular cars? Find out at Yahoo! Autos

1 0

pam_radius and Cisco ACS
by Tom 16 Feb '06

16 Feb '06

I have been tasked with having all non windows devices on our network to authenticate against our Active Directory, which is the reason we are using Cisco ACS. ACS currently authenticates for all cisco devices against our AD, via the external windows database option. I am now trying to get pam_radius to do the same with ACS's radius. I have compiled pam_radius and it appears to be working as intended, however Cisco ACS reports "External DB User Invalid or bad password" anytime I try to use the same credentials that properly authenticate with ACS's tacacs on a linux or freebsd server. The username shows up properly on the ACS server, so I am assuming that the NAS is sending the proper username, but it appears that the password is not being sent correctly. I know the ACS server is trying to authenticate against AD because after so many tries the account get's locked out. Has anyone been able to accomplish what I am trying to do here? Any suggestions besides "lose ACS" to get this to work? Is there something I can pass to the pam_radius module to have it transmit the password the way the ACS server is expecting to see it? I appreciate any help or suggestions anyone can provide in advance. Thank you, Tom

2 3

Re: (Cannot assign requested address) bind() failed
by Sean 16 Feb '06

16 Feb '06

On Mon, 2006-02-13 at 12:08 +0100, freeradius-users-request(a)lists.freeradius.org wrote: > Re: (Cannot assign requested address) bind() failed Hi Tommy, If you are using DD-WRT you might be making a common mistake. It won't accept a Web name for re-direction. You have to use an IP address. EG 123.123.123.123/hotspotlogin.cgi/ It is also vital to put a / at the end of the address. I've written a tutorial that might help you at http://swarmhotspots.com/faq.html and I also provide free FreeRadius testing for Chillispot at http://swarmhotspots.com/Chilli-Test-Area Regards, Sean Bracken http://swarmhotspots.com

2 1

Multiple LDAP Search Bases - Per NAS
by Ben Plimpton 15 Feb '06

15 Feb '06

Hello all Is it possible to setup FreeRadius so that requests coming from a certain NAS will use a different search base than the default? For example: We have an ou=radius,dc=test,dc=com and we stick dsl users records in there. These user records have attributes that would be dsl specific like static IP addressing. We would like to be able to provide users with a backup dialup in case anything goes really wrong with our dsl service. Could we configure FreeRadius to look in a different ou, say ou=dialup,ou=radius,dc=test,dc=com, when it received an authentication request from the dialup NASes? Is this possible? We have also considered running two instances of FreeRadius, one on the higher ports and one on the lower, and then pointing the DSL customers to one and the dialup to another, but I would like to avoid this if there is a cleaner solution that I am not aware of. Our FreeRadius server is running Fedora Core 4 and FreeRadius 1.0.4 OpenLDAP is our LDAP backend. Thanks for any replies. -- "Microsoft is not the answer, it's the question. NO is the answer." Ben Plimpton Network Engineer bplimpton(a)sopris.net 970-963-SURF(7873) ext 5174 www.sopris.com

2 1

Cisco aaa authorization network
by Stefan Winter 15 Feb '06

15 Feb '06

Hello, while migrating a NAS (Cisco AS5300) from TACACS+ to RADIUS I stumbled over some peculiarities of the equipment. When configuring with aaa authentication network default group radius aaa authorization network default group radius and having a user logging in with PPP, it seems that the NAS expects some of the Cisco-AVPairs, but I don't exactly know what to send him. Since I send the wrong things, I'm in the situation that authentication succeeds (Access-Accept), but subsequent authorization fails. I know this is slightly off-topic for the list, sorry, but I'm really at the end of my knowledge here, maybe someone has a clue. The old TACACS+ config was group = DialupUser { maxsess = 2 service = ppp protocol = ip {} service = ppp protocol = multilink {} } which I thought I could convert into the following entry in the users file DEFAULT NAS-IP-Address == 158.64.2.6 Framed-Protocol := PPP, Cisco-AVPair += "ppp:protocol=ip", Cisco-AVPair += "ppp:protocol=multilink" but either that was not sufficient and I need more Cisco-AVPairs or it's plain wrong (the attributes get sent alright, it's just not what the NAS likes). Instead of "ppp:" I also tried "lcp:" "ipcp:" and "network:". None of this impresses the AS5300, and turning on debugging didn't reveal what he would expect instead. Can someone help out? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

(no subject)
by Herman Swensson 15 Feb '06

15 Feb '06

Hi, I have installed Radius and get the next eror radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "(null)" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain 20360:error:0200100E:system library:fopen:Bad address:bss_file.c:259:fopen('','r') 20360:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:261: 20360:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:758: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1902] Unknown module "eap". radiusd.conf[1849] Failed to parse authenticate section. What have I to change Greeting Herman -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 267.15.8/260 - Release Date: 14-2-2006

2 2

silently drop packet (access-request)
by Andriy Gapon 15 Feb '06

15 Feb '06

Is there a way to force a silent drop of a packet instead of sending Access-Reject ? I am interested in both doing this through configuration file(s) and doing this from a module (e.g. with some special return code or attribute). On a somewhat related note: is there way to make FreeRADIUS server drop/reject all incoming packets without Message-Authenticator the same way it does this for packets with invalid/incorrect value in that attribute ? Preferably through configuration, without changes in code. -- Andriy Gapon

2 6

PAP credentials against AD?
by Josh Howlett 15 Feb '06

15 Feb '06

Is it possible to authenticate PAP credentials from the NAS against a Windows domain using NTLM? I've tried using the mschap module, but it expects to see a Challenge that the NAS doesn't provide. thanks, josh.

3 3

Tagged VSA
by Klier, Martin 15 Feb '06

15 Feb '06

We are using tagged VSA (i.e. SIP-From). I think, it isn't standard. without the has_tag entry, behind the regarding attribute in the dictionary file, i see in Debug Mode: SIP-From = "\001sip:abcd@xyz:5060" SIP-From = "\002sip:abcd@xyz:5060" With "has_tag" entry SIP-From:1 = "sip:abcd@xyz:5060" SIP-From:2 = "sip:abcd@uvw:5060" Is it possible, to write the the two tagged attributes (with has_tag entry) in a mysql- database at all ? If it is, how the variable ( %{SIP-From} ) in the sql.conf has to look like Used version 1.0.2-5 regards, Martin

2 1