- Freeradius-Users - lists.freeradius.org

Kerberos 5
by John Metcalfe 13 Feb '06

13 Feb '06

Hello: We are having trouble compiling freeRADIUS version 1.1.0 rlm_krb5 module. Is this required for RADIUS with TLS and PEAP? Thank you John Metcalfe, Jr. IT Specialist - AIS IBM Business Consulting Services, Public Sector Telephone: 240-396-5305 email: metcalfej(a)us.ibm.com

7 11

Source file MySQL
by Radius User 13 Feb '06

13 Feb '06

hi members, can anyone inform me that what is the source file in freeradius-1.1.0, in where the mysql quiries for authentication and accounting is executed. thanks and regards...

1 0

Realm proxy HOW-TO??
by Danai Chudthong 12 Feb '06

12 Feb '06

Dear all I setup freeradius for my EAP-TLS with realm configuration and everything is fine. But I have some problem about database. The realm name is shown in table raddpostauth but it's not shown in table radacct which is more important. I checked in debug mode and found that freeradius send username with out realm to AP during post-auth process then AP send only username to freeradius for accounting. How to set freeradius to send user@realm to AP in post-auth? I'm not sure what I miss.. Any idea please? For more information, please review in sql query below. Thanks Danai mysql> select username, Realm, NASIPAddress, AcctStartTime, AcctStopTime from radacct where AcctStartTime >= 20060212; +----------+-------+--------------+---------------------+---------------------+ | username | Realm | NASIPAddress | AcctStartTime | AcctStopTime | +----------+-------+--------------+---------------------+---------------------+ | danai | | 192.168.1.2 | 2006-02-12 12:29:47 | 2006-02-12 12:44:32 | | danai | | 192.168.1.2 | 2006-02-12 12:44:34 | 2006-02-12 12:52:33 | | danai | | 192.168.1.2 | 2006-02-12 12:52:35 | 2006-02-12 16:23:09 | | danai | | 192.168.1.2 | 2006-02-12 16:23:10 | 2006-02-12 17:27:56 | | danai | | 192.168.1.2 | 2006-02-12 17:28:01 | 2006-02-12 17:30:48 | | danai | | 192.168.1.2 | 2006-02-12 17:30:52 | 2006-02-12 17:32:58 | | danai | | 192.168.1.2 | 2006-02-12 17:35:39 | 2006-02-12 17:35:45 | | danai | | 192.168.1.2 | 2006-02-12 17:35:46 | 2006-02-12 17:36:58 | | danai | | 192.168.1.2 | 2006-02-12 17:37:33 | 2006-02-12 21:56:37 | | danai | | 192.168.1.2 | 2006-02-12 17:53:49 | 2006-02-12 17:54:09 | | danai | | 192.168.1.2 | 2006-02-12 17:54:16 | 2006-02-12 18:03:05 | | danai | | 192.168.1.2 | 2006-02-12 18:03:09 | 0000-00-00 00:00:00 | | danai | | 192.168.1.2 | 2006-02-12 21:54:47 | 2006-02-12 21:55:06 | | danai | | 192.168.1.2 | 2006-02-12 21:55:39 | 2006-02-12 21:56:10 | | danai | | 192.168.1.2 | 2006-02-12 21:56:39 | 2006-02-12 22:25:04 | | danai | | 192.168.1.2 | 2006-02-12 22:12:11 | 2006-02-12 22:18:44 | | danai | | 192.168.1.2 | 2006-02-12 22:19:01 | 2006-02-12 22:19:23 | | danai | | 192.168.1.2 | 2006-02-12 22:20:01 | 0000-00-00 00:00:00 | | danai | | 192.168.1.2 | 2006-02-12 22:26:12 | 2006-02-12 22:26:34 | | danai | | 192.168.1.2 | 2006-02-12 22:26:35 | 0000-00-00 00:00:00 | +----------+-------+--------------+---------------------+---------------------+ 20 rows in set (0.00 sec) mysql> select user, NASIPAddress, date from radpostauth where date >= 20060212; +--------------------+--------------+---------------------+ | user | NASIPAddress | date | +--------------------+--------------+---------------------+ | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:29:47 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:44:33 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 12:52:34 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 16:23:10 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:28:01 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:30:51 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:35:39 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:35:46 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 17:37:33 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 17:53:49 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 17:54:15 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 18:03:09 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 21:54:47 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 21:55:39 | | danai(a)kmitnb.ac.th | 192.168.1.2 | 2006-02-12 21:56:39 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:12:11 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:19:01 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:20:01 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:26:12 | | danai(a)kmitt.ac.th | 192.168.1.2 | 2006-02-12 22:26:35 | +--------------------+--------------+---------------------+ 20 rows in set (0.00 sec) __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

problem with checkrad
by Fazal Ahmed Malik 12 Feb '06

12 Feb '06

Hi, I am facing problem with checkrad in icradius. I am sorry for mailing this question on this mailing list because i could not find solution any where.We have recently added ascend MAX TNT in list of NAS, before that simultenous use was working fine, now with Max simultenous use is not working, in checkrad logs i have found that session id is 8 digits long but in NAS session id is 9 digits long so it get the user login. If any body has solution for this please help. Thanks, fam

1 0

RE: multiple huntgroup, same NAS-IP
by Jonathan De Graeve 12 Feb '06

12 Feb '06

> regexps huh!! > > care you post an example please? > > Thanks, =~ ^(huntgroup1|huntgroup2)$ Kind Regards Jonathan

1 0

Problem with freeradius on SuSE 9.2
by Neil Muller 12 Feb '06

12 Feb '06

I'm trying to install run freeradius on SuSE 9.2 Pro but when I try running using /usr/sbin/radiusd -sfxxyz I get the following error message: radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': rlm_exec.a: cannot open shared object file: No such file or directory however ls shows: callisto:/etc # ls -la /usr/lib/freeradius/rlm_exec* lrwxrwxrwx 1 root root 11 Feb 12 08:32 /usr/lib/freeradius/rlm_exec-1.0.0.la -> rlm_exec.la -rw-r--r-- 1 root root 7002 Oct 5 2004 /usr/lib/freeradius/rlm_exec.a -rw-r--r-- 1 root root 701 Oct 5 2004 /usr/lib/freeradius/rlm_exec.la I have the following rpms installed: freeradius-1.0.0-5 radiusclient-0.3.2-142 freeradius-devel-1.0.0-5 pam_radius-1.3.16-67 and radiusd.conf is jsut the SuSE 9.2 default at the moment The full output from radiusd startup is below. Can anyone help me track down where I have gone wrong. Thanks, Neil ***** radiusd -sfxxyg output ***** callisto:/etc # /usr/sbin/radiusd -sfxxyz Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': rlm_exec.a: cannot open shared object file: No such file or directory

1 0

RE: multiple huntgroup, same NAS-IP
by Jonathan De Graeve 12 Feb '06

12 Feb '06

> -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Agent > Smith > Verzonden: zaterdag 11 februari 2006 18:08 > Aan: FreeRadius users mailing list > Onderwerp: Re: multiple huntgroup, same NAS-IP > > > I have 100s of users but here is an example. > goal: > user u1: has access from NAS-IP 192.168.50.5 > user u2: has access from NAS-IP 192.168.5 and 6 > > currently I have huntgroup defination such as, > hu1 NAS-IP-Address 192.168.50.5 > hu2 NAS-IP-Adderss 192.168.50.6 > > Then in the users file, (sorry if the syntax is not > exactly correct here) > u1 Auth-by: Local, huntgroup: hu1 > u2 Auth-by: Local, hungrroup: hu2 > #then also, > u1 Auth-by: Local, huntgroup: hu2 Using regexp you can match both, that's how I do it

2 1

Re:problem with simultanous use...any idea (tommy garsia)
by Sean 12 Feb '06

12 Feb '06

> > Thanks sean....it works great!! > > > > is there any way to limit user's bandwidth?? > > can i specify how many user's content/total bandwidth which can be downloaded? > > e.g....i give only 10 MB to user A... > > > > regards, > > > > > > Sean <sean(a)swarmhotspots.com> wrote: On Fri, 2006-02-10 at 11:15 +0100, > > freeradius-users-request(a)lists.freeradius.org wrote: > > > problem with simultanous use...any idea???tommy garsia > > > > > > > Hi guys... > > > > > > I've finished compile and install freeradius v1.1.0 with mysql...and > > > work great... > > > and i'm happy with it... > > > now i have a problem during the accounting.... > > > what should i do if i want to limit only one connection per one > > > user..?? > > > what should i do with my freeradius configuration? > > > > > > best regards, > > > > > > > > > tommy > > > > > Set simultaneous-use :=1 in radcheck > > and enable simultaneous use checking in sql.conf > > Hi Tommy, Glad I could help. I'm working on MySQL commands to limit total usage using AccInputOctets and AccOutputOctets in Radacct. I'll let you know when I have it finished and tested. Regards, Sean Bracken http://swarmhotspots.com

2 1

rlm_ldap problem
by Norbert Wegener 12 Feb '06

12 Feb '06

For an 802.1x authentication radius first asks an ad server to get information about a specific machine account. If this account belongs to a certain group, the users file is consulted to check, which vlan the account gets assigned. In radiusd.conf I set the groupname_attribute in the the ldap section: groupname_attribute = "primaryGroupID" This works with a user file and entries like this without problems: DEFAULT Ldap-Group == "515", Auth-Type := Accept Framed-Type = Framed, Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = Core1 For some reason I want the operator here not to be ==, but >= and change the entry to: DEFAULT Ldap-Group >= "500", Auth-Type := Accept Framed-Type = Framed, Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = Core1, Fall-Through = no In this case I get: rlm_ldap::groupcmp: Group 500 not found ????or user not a member Further digging in radiusd -AX's output unveiles the reason: rlm_ldap: performing search in dc=MYDOM,dc=NET, with filter (&(primaryGroupID=500)(|(&(objectClass=GroupOfNames)(member=CN=MC The search here is done with "=": primaryGroupID=500 Is there any way to honor the operator >= in the users file in this case without modifying the source code? Thanks Norbert Wegener

2 1

RE: multiple huntgroup, same NAS-IP
by Jonathan De Graeve 11 Feb '06

11 Feb '06

> > Is it possible for same NAS-IP to be in multiple > > huntgroups? > > I'm not sure. No, it will match the first huntgroup it reaches in the huntgroups file. I tried that to. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be

2 1