- Freeradius-Users - lists.freeradius.org

Debian + Exec-Program = Zombie process
by George Chelidze 27 Jan '06

27 Jan '06

Hello, I am using Debian GNU/Linux 3.1, libc6 2.3.2.ds1-22. I have compiled freeradius 0.93, 1.0.1, 1.0.5, 1.1.0 in turn with the following options: ./configure --prefix=/usr/local/freeradius --without-threads compilation/installation went fine, radius started up fine. /usr/local/freeradius/etc/raddb/acct_users content: DEFAULT Acct-Status-Type == Stop Exec-Program = "/usr/local/bin/test.pl" /usr/local/bin/test.pl content: #-------------------------------------- #!/usr/bin/perl exit(0); #-------------------------------------- as soon as I send accounting stop packet to radius, test.pl executes and becomes a zombie. (I tried bash script, c program with the same result.) 3890 ? Ss 0:00 /usr/local/freeradius/sbin/radiusd 3893 ? Z 0:00 \_ [test.pl] <defunct> As far as I know, this should have been fixed in 1.0.3 and I doubt it's debian specific, as I know 0.93 works on another RH 7.3 without a problem (In fact zombie is listed there as well but disappears after several seconds). Any ideas/suggestions? Thanks in advance, George

4 5

Freeradius and Subversion ???
by Frank Reiss 27 Jan '06

27 Jan '06

Hi I would like to setup subversion and tortoiseSVN to use freeradius and am wondering ho to do this. I currently have Subversion setup with apache for authentication. Thank You, Frank Reiss

2 1

RLM_LDAP INSTALL
by Susana Macias 27 Jan '06

27 Jan '06

Hy all I am going to install the rlm_ldap module in order to make some easy and simple tests. I am using: FreeRadius 1.0.5 Solaris 9 ** Which version of openldap do you recommend me to install? ** Is it necessary to install OpenSSL in order to do simple tests (not SSL connections)? ** And Cyrus SASL? Thanks in advance, Susana ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

1 0

RES: VSA Problem
by Romao Izumi Ito 27 Jan '06

27 Jan '06

Thanks Guy, it was my mistake. I update the dictionary and i see the correct parameters. Romao. -----Mensagem original----- De: freeradius-users-bounces+romao.ito=gvt.com.br(a)lists.freeradius.org [mailto:freeradius-users-bounces+romao.ito=gvt.com.br@lists.freeradius.org]Em nome de Guy Davies Enviada em: quinta-feira, 26 de janeiro de 2006 17:59 Para: FreeRadius users mailing list Assunto: Re: VSA Problem Hi Romao, What are you using to view the packet? Many packet analysis and RADIUS check tools require their own dictionary (e.g. NTRadPing). If this is the case and you've not updated the dictionary for that tool, then that's exactly what I'd expect you to see. Rgds, Guy On 26/01/06, Romao Izumi Ito < romao.ito(a)gvt.com.br> wrote: Hello, I'm working with Nortel Network Passport and I'm trying to configure a new dictionary on the freeradius. In the vendors doc we have following VSA and Vendor-ID: VENDOR nortel 562 ATTRIBUTE Passport-Command-Scope 200 integer nortel ATTRIBUTE Passport-Command-Impact 201 integer nortel ATTRIBUTE Passport-Customer-Identifier 202 integer nortel ATTRIBUTE Passport-Allowed-Access 203 integer nortel ATTRIBUTE Passport-AllowedOut-Access 204 integer nortel ATTRIBUTE Passport-Login-Directory 205 string nortel ATTRIBUTE Passport-Timeout-Protocol 206 integer nortel ATTRIBUTE Passport-Role 207 string nortel ... I configure the file dictionary.nortel in /etc/raddb and include it in dictionary file. Also I tried it in /usr/share/freeradius/. I added this attributes in the users file but when I look at the radius packet I see: Vendor Specific(26), Vendor: Undefined(562) Unknown Type(200), Value: Unknown Value type What am I doing wrong? Thank you, Romao. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Configuring free radius to use Active directory service
by Stephen Walsh 27 Jan '06

27 Jan '06

>1. How to configure the freeradius1.0.5 version, to support Active >directory service for user authentication. > For ldap .. we have rlm_ldap module to configure it. Same kind of >configuration is there for ADS also ?? Sumithra; that part is quite easy. Here's what I've just done; ldap { server = "<serverip>" identity = "<full LDAP path to user who will perform initial bind" password = "<their password" basedn = "highest part of tree to start searching from" filter = "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 } authorize { preprocess suffix auth_log ldap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } If you're wanting to search multiple trees, that's another matter, but that should get you started. See my earlier post about problems with W2k3 trees and their behaviour with searches. VLAN's I'll leave to someone who understands that part of FR better. Regards Stephen Walsh s.walsh(a)signadou.acu.edu.au Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

1 0

How to start a session
by San 27 Jan '06

27 Jan '06

Dear All, I have implemented freeradius-1.0.5 in Redhat box. And I have some questions about it. It have searched the web but still can't find a clue or i just missed it :(. Also my questions are: 1. How do we start the session? I have send the request to the server and got access_accepted. And as I know the session is start after we send the accounting_request and get response from the server. The problem is how to do that using command prompt? My Nas is Suse box (that should be fine right?). I use this command to send acct_request echo "User-Name= Anna"| radclient 10.1.0.76 acct -x testing123 Is that right? or is there any place I can refer to use the radclient command? 2. Do I need to write external script to run the command? Because I want to use the session time out but seems still not working.(because I don't know how to start the session) 3. Where should I put the acc_type. Is it in server side or nas side? I really hope someone can help me (please...) Thanks a lot in advance Best Regards, Santy __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 4

RE: Problems System Auth with FreeRadius (/etc/shadow)
by Min Qiu 27 Jan '06

27 Jan '06

You may read the doc wrong. The group you should look for is "radiusd". When you create user "radiusd", the group "radiusd" should also be created if you use adduser command to do the job. You don't what user "radiusd" belong to group "root". Do "chgrp radiusd /etc/shadow". Min > -----Original Message----- > From: > freeradius-users-bounces+mqiu=globalinternetworking.com@lists. > freeradius.org > [mailto:freeradius-users-bounces+mqiu=globalinternetworking.co > m(a)lists.freeradius.org] On Behalf Of Nataniel Klug > Sent: Thursday, January 26, 2006 3:57 PM > To: FreeRadius users mailing list > Subject: Re: Problems System Auth with FreeRadius (/etc/shadow) > > > Alan, > > Now you have gived me a tip... At my Fedora there is no group > shadow, so I > put radius to run as group "root" so it could read > /etc/shadow only if I set > +r to group at shadow files. > > Att, > > Nataniel Klug > > ----- Original Message ----- > From: "Alan DeKok" <aland(a)ox.org> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Thursday, January 26, 2006 3:37 PM > Subject: Re: Problems System Auth with FreeRadius (/etc/shadow) > > > > "Nataniel Klug" <nata(a)cnett.psi.br> wrote: > > > I just have installed the package from Fedora Core 3, > nothing else. > > > > Then look at the configuration file. See how it's different from > > what is shipped with FreeRADIUS. > > > > And setting "a+rw" on /etc/passwd and /etc/shadow is probaby the > > single worst thing you can do to your system. EVER. Rather than > > doing that, read raddb/radiusd.conf, it talks about issues with > > reading /etc/shadow, and describes suggested fixes won't > destroy your > > system. > > > > Honestly, I don't understand why it's so hard to read the > > configuration files. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Problems System Auth with FreeRadius (/etc/shadow)
by Nataniel Klug 27 Jan '06

27 Jan '06

Hello, I am having a big problem with FreeRadius server. It doesnt authenticate my clients using /etc/shadow and /etc/passwd. When I try to use "radlogin" or "radtest" this are the messagens I get: === radlogin === [root@ns2 radius]# radlogin ($Id: radlogin.c,v 1.3 1997/12/29 23:07:25 lf Exp $) ----------------------------------------------------- Linux 2.6.13.4 (ns2.cnett.com.br) (port 0) ----------------------------------------------------- login: nata Password: RADIUS: Authentication failure local: Authentication failure [root@ns2 radius]# tail radius.log -n 2 Tue Jan 24 01:24:02 2006 : Auth: rlm_unix: [nata]: invalid password Tue Jan 24 01:24:02 2006 : Auth: Login incorrect: [nata/1234] (from client localhost port 0) === radtest === [root@ns2 radius]# radtest nata 1234 localhost:1812 0 local Sending Access-Request of id 126 to 127.0.0.1:1812 User-Name = "nata" User-Password = "1234" NAS-IP-Address = ns2.cnett.com.br NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=126, length=20 [root@ns2 radius]# tail -n 2 radius.log Tue Jan 24 01:26:41 2006 : Auth: rlm_unix: [nata]: invalid password Tue Jan 24 01:26:41 2006 : Auth: Login incorrect: [nata/1234] (from client localhost port 0) I tryed everything I know and it still not working. If I compile and install Cistron Radius it works just fine, but I dont want Cistron... freeradius-1.0.1-1 Fedora Core 3 - Kernel 2.6.13.4 (compiled from source) Waiting for help. Att, Nataniel Klug

3 15

cisco nopassword username
by xhon 27 Jan '06

27 Jan '06

hello, I'm working with Cisco 3745 router, and I'm trying to move local AAA to radius. Local username database looks like this: username user_a nopassword noescape username user_a autocommand connect hostname...... In radius I did this: user_a Auth-Type = Accept cisco-avpair = "shell:autocmd=connect hostname.....", Fall-Through = 0 But it's no good. I need the router not to ask for password at all ! Is it possible with Cisco and freeradius ? regards Kuba

1 0

SV: radkill and a small question about radwho
by Torkel Mathisen 27 Jan '06

27 Jan '06

> "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > > I read about the radkill program in the FAQ. However the link doesn't > > work so I was wondering if anyone had a new link to that program? > > google? Tried that. No luck. None of the links I found worked. Not the link in FAQ, not freshmeat.net and thats all i found. > > Also I got a simple question about radwho. It doesnt seem to output the > > last part of the AP ip-address: > > Because there's only so much room in that column. Ok. So its normal then. Just looked a bit strange to me. Couldn't see the whole ip-address. Guess I'll stick to radwho -r then. Regards, Torkel

1 0