- Freeradius-Users - lists.freeradius.org

radutmp file administration
by Leonardo Reginin 09 Feb '06

09 Feb '06

Hi fellows. I am relatively newbie with freeradius. Are there problem in remove the radutmp file ( radius stop; rm; radius start of course) ? What kind of information are lost ? Are there any utility to admin the radutmp file such to remove an user entry ? Sorry for that elementary questions :-) Thanks !

2 3

MS-CHAP, LDAP, ADS
by Elizabeth Palomino 09 Feb '06

09 Feb '06

Greetings, I have poked about on google and read several how to's. Is it possible using any authentication module ( rlm_pam,rlm_ldap...) To authenticate a connection from a client using CHAP or MS-CHAP to an Active Directory Server (TM) *cough*. I can authenticate just fine with cleartext to the radius server using PAM---Winbind -->ADS Gives the same error as below LDAP -->ADS Error: User-Password is Required for authentication. Cannot use "CHAP-Password" Looking at the debug output I see the request with the CHAP-Password. I am now thoroughly confused. I had this working with a mirapoint (LDAP server), Any ideas on getting chap-pap authentication working against an ADS server. To Summarize: 1) What should the users file contain? 2) Which is a better way to authenticate? ldap,PAM-->Winbind? 3) Can I use the ntlm_auth line with the chap 4) I have read about peap and eap. Perhaps this would work? 5) Is there a good freeradius book you would recommend? Heck, I'll even volunteer to write a howto on it! (I write heaps of documentation). What I am trying to avoid is having password transmitted clear text over the network. Is there perhaps a better Solution? Thanks!

2 1

users file before ldap
by Stephane Branchoux 09 Feb '06

09 Feb '06

Hello, i use freeradius with openldap When i try to autenticate some users with users file for wifi connections (cisco bbsm captive portal) , authentication fails. user is defined like this : toto Auth-Type := Local, User-Password == "clear password" ou toto1 User-Password == "clear password" My authorize section of free radius is defined like this (files before ldap) : authorize { preprocess auth_log chap mschap suffix eap files ldap } But when i use ntradping tool, authentication succeeds with ldap and with user fille. Any idea ? Many thanks in advance. -- stephane BRANCHOUX Centre de Ressources Informatiques de l'Université de Perpignan. Systèmes/Réseaux mailto:stephane.branchoux@univ-perp.fr 04 68 66 21 24 Validation signature / Trusting signature: http://igc.cru.fr/trust.html

1 1

dictionary: override attribute type/id mapping
by Andriy Gapon 09 Feb '06

09 Feb '06

I use freeradius-1.1.0 built from FreeBSD ports on FreeBSD. There is the following comment in default raddb/dictionary.sample (this file probably comes from the FreeBSD port): # # Place additional attributes or $INCLUDEs here. They will # over-ride the definitions in the pre-defined dictionaries. # But this doesn't seem to be true or, at least, entirely true. For example, I place the following lines in my raddb/dictionary: # big all-inclusive freeradius dictionary $INCLUDE /usr/local/share/freeradius/dictionary # my local dictionary $INCLUDE /usr/local/local/dictionary.mine And dictionary.mine has this content: #try to override Digest-Response with value from # draft-ietf-radext-digest-auth-06.txt ATTRIBUTE Digest-Response 102 string Then I get the following error on radiusd startup: $ radiusd -sfxxyz -l stdout ... Errors reading dictionary: dict_init: /usr/local/local/dictionary.mine[3]: dict_addattr: Duplicate attribute name Digest-Response Errors reading radiusd.conf Shouldn't I be able to override name->number mapping for attributes ? How to work around this problem ? Is copying the "all-inclusive" dictionary and throwing out the following line the only solution ? ATTRIBUTE Digest-Response 206 string On a related note - is it a good idea in general to have digest authentication stuff defined in main dictionary file and dictionary.freeradius.internal ? Especially given that those definitions are based on the very old and expired draft and are very unlikely to become standard. I think that those definitions should be clearly separated into their own dictionary and they should also somehow be marked as based on the draft-sterman-aaa-sip-00.txt and conflicting with the subsequent drafts, including the latest one (draft-ietf-radext-digest-auth-06.txt). -- Andriy Gapon

2 5

radclient windows
by alfonso 09 Feb '06

09 Feb '06

is there a compile version fro windows ?? thanks, Alfonso Guerendiain oliver

1 0

rsa key length in EAP-TLS.
by Andrea G Forte 09 Feb '06

09 Feb '06

Hi all, as of yesterday I have updated the certificates to use a 2048 bit key. The odd thing is that when I start freeradius, I get the message: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 the length seems to be 512. (?) I would also like to know if the rsa key exchange should be enabled instead of the dh key exchange, and if so how do I enable it? I could not find anything in the config file. Thank you, Andrea

1 0

Duplicate AccSessionId + AcctUniqueId from NAS (which I don't want)
by Mark Elkins 09 Feb '06

09 Feb '06

I've got a problem where sometimes I'm getting duplicate accounting records entered into my Accounts file. The customer is on an ADSL line and the NAS is owned by the local monopoly operator. We need accurate traffic counts for each user - as thats what they are billed on. The Telco has sent multiple accounting records for the same person - due to some error on their side - and this seems to be happening more frequently. The Accounting Data is an attached TXT file - cause its wide... The IP's, Realm and UserName have been changed to protect the innocent. What I don't understand is that the AcctUniqueId sometimes changes for the same AcctSessionId. To fix the problem of getting duplicate accounting entries - I was thinking about making either AcctUniqueId or AcctSessionId a unique key in the MySQL table?... but which should I use - listening to the news that some NAS's don't always seny unique AcctUniqueId info. Does setting AcctSessionId to a unique value make more sense? Does it ever duplicate itself by accident? If I make AcctSessionId a unique key (index?) and radius tries to add a duplicate - what will happen? (I'm hoping the answer is it'll be silently ignored - and not that the whole accounting table will be corrupted as radius dies...). Still - it would seem more useful to have AcctSessionId as a unique index - as its actually used as a value for updating the accounting info when a STOP record arrives. Suggestions? Being really lazy - what would the appropriate MySQL command be? .. and wouldn't this generally be a "Good Thing" to do anyway??? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

A little problem - FR with Mysql Stored Procedure
by Saeed Ahmed 09 Feb '06

09 Feb '06

Dear Sir, I was wondering on mailing list for last 3 days and I didn't get proper response, I am really in problem. I am getting problem to use Mysql Stored procedures with Freeradius. After exploring web It came to know that, (this text I got from mysql.com forum:) the result's of SP execution are sent as result sets over the protocol. Once you call a SP you get at least 1 return code and could get many result sets. The execution of a stored procedure is very similar to execution of a multi-query. MySQL 5.0 supports the execution of multiple statements specified in a single query string. To use this capability with a given connection, you must specify the CLIENT_MULTI_STATEMENTS option in the flags parameter to mysql_real_connect() when opening the connection. You can also set this for an existing connection by calling mysql_set_server_option(MYSQL_OPTION_MULTI_STATEMENTS_ON). By default, mysql_query() and mysql_real_query() return only the first query status and the subsequent queries status can be processed using mysql_more_results() and mysql_next_result(). /* Connect to server with option CLIENT_MULTI_STATEMENTS */ mysql_real_connect(..., CLIENT_MULTI_STATEMENTS); /* Now execute multiple queries */ mysql_query(mysql,"DROP TABLE IF EXISTS test_table;\ CREATE TABLE test_table(id INT);\ INSERT INTO test_table VALUES(10);\ UPDATE test_table SET id=20 WHERE id=10;\ SELECT * FROM test_table;\ DROP TABLE test_table"); Means I need to use CLIENT_MULTI_STATEMENTS in mysql_real_connect(), so, for now, I just need this little guidance that which file should I edit to get SP working with Freeradius. I hope I'll get response this time thanking you in advance Best Regards

3 3

log files not generated!
by DilipSimha.N.M 09 Feb '06

09 Feb '06

hi, i am running freeradius 1.04 on redhat 9.0 linux. i see that log file radius.log is not getting created. but accounting(detail) files are created normally. also the radiusd.pid file doesn't contain the pid of the radius that is currently running. it contains some other pid. also.....only for the first time.....this file gets changed.... after the first time, if u restart RADIUS, then the pid file is not at all modified. Note: i have enabled logging for all possible combinations available and permissions for the log files are full. am i missing something? --DilipSimha

2 2

mschap-v2 - freeradius(proxy) -mschap-v1
by Dmitry S. Vlasov 09 Feb '06

09 Feb '06

Hello! I wanna use mschap-v2 AUTH between windoze VPN clients and NAS, but my billing system use old radius, which can use mschap-v1 ONLY. Can I proxy RADIUS packets through FreeRADIUS and convert mschap-v2 <--> mschap-v1 ? windoze --- (v2)--- freeradius ---(v1) --- billing radius Thanks. Dmitry

2 1