- Freeradius-Users - lists.freeradius.org

RE: Problems System Auth with FreeRadius (/etc/shadow)
by Min Qiu 27 Jan '06

27 Jan '06

You may read the doc wrong. The group you should look for is "radiusd". When you create user "radiusd", the group "radiusd" should also be created if you use adduser command to do the job. You don't what user "radiusd" belong to group "root". Do "chgrp radiusd /etc/shadow". Min > -----Original Message----- > From: > freeradius-users-bounces+mqiu=globalinternetworking.com@lists. > freeradius.org > [mailto:freeradius-users-bounces+mqiu=globalinternetworking.co > m(a)lists.freeradius.org] On Behalf Of Nataniel Klug > Sent: Thursday, January 26, 2006 3:57 PM > To: FreeRadius users mailing list > Subject: Re: Problems System Auth with FreeRadius (/etc/shadow) > > > Alan, > > Now you have gived me a tip... At my Fedora there is no group > shadow, so I > put radius to run as group "root" so it could read > /etc/shadow only if I set > +r to group at shadow files. > > Att, > > Nataniel Klug > > ----- Original Message ----- > From: "Alan DeKok" <aland(a)ox.org> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Thursday, January 26, 2006 3:37 PM > Subject: Re: Problems System Auth with FreeRadius (/etc/shadow) > > > > "Nataniel Klug" <nata(a)cnett.psi.br> wrote: > > > I just have installed the package from Fedora Core 3, > nothing else. > > > > Then look at the configuration file. See how it's different from > > what is shipped with FreeRADIUS. > > > > And setting "a+rw" on /etc/passwd and /etc/shadow is probaby the > > single worst thing you can do to your system. EVER. Rather than > > doing that, read raddb/radiusd.conf, it talks about issues with > > reading /etc/shadow, and describes suggested fixes won't > destroy your > > system. > > > > Honestly, I don't understand why it's so hard to read the > > configuration files. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Problems System Auth with FreeRadius (/etc/shadow)
by Nataniel Klug 27 Jan '06

27 Jan '06

Hello, I am having a big problem with FreeRadius server. It doesnt authenticate my clients using /etc/shadow and /etc/passwd. When I try to use "radlogin" or "radtest" this are the messagens I get: === radlogin === [root@ns2 radius]# radlogin ($Id: radlogin.c,v 1.3 1997/12/29 23:07:25 lf Exp $) ----------------------------------------------------- Linux 2.6.13.4 (ns2.cnett.com.br) (port 0) ----------------------------------------------------- login: nata Password: RADIUS: Authentication failure local: Authentication failure [root@ns2 radius]# tail radius.log -n 2 Tue Jan 24 01:24:02 2006 : Auth: rlm_unix: [nata]: invalid password Tue Jan 24 01:24:02 2006 : Auth: Login incorrect: [nata/1234] (from client localhost port 0) === radtest === [root@ns2 radius]# radtest nata 1234 localhost:1812 0 local Sending Access-Request of id 126 to 127.0.0.1:1812 User-Name = "nata" User-Password = "1234" NAS-IP-Address = ns2.cnett.com.br NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=126, length=20 [root@ns2 radius]# tail -n 2 radius.log Tue Jan 24 01:26:41 2006 : Auth: rlm_unix: [nata]: invalid password Tue Jan 24 01:26:41 2006 : Auth: Login incorrect: [nata/1234] (from client localhost port 0) I tryed everything I know and it still not working. If I compile and install Cistron Radius it works just fine, but I dont want Cistron... freeradius-1.0.1-1 Fedora Core 3 - Kernel 2.6.13.4 (compiled from source) Waiting for help. Att, Nataniel Klug

3 15

cisco nopassword username
by xhon 27 Jan '06

27 Jan '06

hello, I'm working with Cisco 3745 router, and I'm trying to move local AAA to radius. Local username database looks like this: username user_a nopassword noescape username user_a autocommand connect hostname...... In radius I did this: user_a Auth-Type = Accept cisco-avpair = "shell:autocmd=connect hostname.....", Fall-Through = 0 But it's no good. I need the router not to ask for password at all ! Is it possible with Cisco and freeradius ? regards Kuba

1 0

SV: radkill and a small question about radwho
by Torkel Mathisen 27 Jan '06

27 Jan '06

> "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > > I read about the radkill program in the FAQ. However the link doesn't > > work so I was wondering if anyone had a new link to that program? > > google? Tried that. No luck. None of the links I found worked. Not the link in FAQ, not freshmeat.net and thats all i found. > > Also I got a simple question about radwho. It doesnt seem to output the > > last part of the AP ip-address: > > Because there's only so much room in that column. Ok. So its normal then. Just looked a bit strange to me. Couldn't see the whole ip-address. Guess I'll stick to radwho -r then. Regards, Torkel

1 0

How to modify attribute by rlm_exec
by roger 27 Jan '06

27 Jan '06

Dear All, I want to set NAS-Port=100 to proxy request packet. In my test, if the receive packet has not NAS-Port attribute, It will successful. If it have, it will fail. The value will not modify. Can anyone told me how to modify attribute by rlm_exec module? Regards, Roger

1 0

Configuring free radius to use Active directory service
by sumi thra 27 Jan '06

27 Jan '06

Hi All, I have some doubts.. 1. How to configure the freeradius1.0.5 version, to support Active directory service for user authentication. For ldap .. we have rlm_ldap module to configure it. Same kind of configuration is there for ADS also ?? 2. Assigning vlan id's to user group is possible ?? rather than configuring each user with a particular vlan id, can we give the vlan id's for the group so that the users part of that group will be assigned with the same vlan. Awaiting for your earliest reply. Thanks, Sumithra. -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

1 0

AD ldap bind works with 1.01, fails with 1.04
by Stephen Walsh 26 Jan '06

26 Jan '06

Hi Folks We're implementing freeradius with EAP/TLS for our wireless and have found a strange happening with 1.04. This will only happen when attempting to query our student domain (w2k3 AD tree), but not our staff (w2k3 AD tree). If I remove the section (below) for student, it will authenticate staff and log them on happily. At the moment, we have acu.edu.au | / \ staff student I have a test box with FC3/FreeRadius 1.01 which will search through both domains and authenticate the user. I copy the config over to the FC4/FreeRadius 1.04 box and it works on staff, but returns the following on student (the tree is laid out the same as staff); ldap_search() failed: Operations error Is this a bug (known or unknown) or have I just not allowed something like referrals to work. I don't want to have to put openldap on the radius box if I can help it, but if that's the only solution then we'll reassess 1.01 on FC3 Config is as below (some sanitisation done to protect the innocent networks involved). ldap student { server = "192.148.xxx.xxx" identity = "cn=xxxxxxxxx,cn=users,dc=student,dc=acu,dc=edu,dc=au" password = "xxxxxxxxx" basedn = "dc=student,dc=acu,dc=edu,dc=au" filter = "(samaccountname=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 } ldap staff { server = "192.148.xxx.xxx" identity = "cn=xxxxxx,cn=users,dc=staff,dc=acu,dc=edu,dc=au" password = "xxxxxx" basedn = "dc=staff,dc=acu,dc=edu,dc=au" filter = "(samaccountname=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 } <snip> authorize { suffix eap staff student } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { student staff } eap } many thanks Stephen Walsh Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

2 5

another mysql database
by debik 26 Jan '06

26 Jan '06

Is it possible to configure radius to connect to the two databases. If in one database user do not exist, so connect to another database and search for entry for that user. Sorry for my english if make some mistakes.

2 2

VSA Problem
by Romao Izumi Ito 26 Jan '06

26 Jan '06

Hello, I'm working with Nortel Network Passport and I'm trying to configure a new dictionary on the freeradius. In the vendors doc we have following VSA and Vendor-ID: VENDOR nortel 562 ATTRIBUTE Passport-Command-Scope 200 integer nortel ATTRIBUTE Passport-Command-Impact 201 integer nortel ATTRIBUTE Passport-Customer-Identifier 202 integer nortel ATTRIBUTE Passport-Allowed-Access 203 integer nortel ATTRIBUTE Passport-AllowedOut-Access 204 integer nortel ATTRIBUTE Passport-Login-Directory 205 string nortel ATTRIBUTE Passport-Timeout-Protocol 206 integer nortel ATTRIBUTE Passport-Role 207 string nortel ... I configure the file dictionary.nortel in /etc/raddb and include it in dictionary file. Also I tried it in /usr/share/freeradius/. I added this attributes in the users file but when I look at the radius packet I see: Vendor Specific(26), Vendor: Undefined(562) Unknown Type(200), Value: Unknown Value type What am I doing wrong? Thank you, Romao.

2 1

radkill and a small question about radwho
by Torkel Mathisen 26 Jan '06

26 Jan '06

Hi, I read about the radkill program in the FAQ. However the link doesn't work so I was wondering if anyone had a new link to that program? I'd like to kill users that are logged in twice or something. Like in the output below. If it works on 1.0.5 at all. Also I got a simple question about radwho. It doesnt seem to output the last part of the AP ip-address: # radwho Login Name What TTY When From Location tom shell S470 Thu 08:49 192.168.2 tom shell S480 Thu 10:35 192.168.2 I can always use -r so its not a big problem. Just wondered if its normal. Regards, Torkel

2 1