- Freeradius-Users - lists.freeradius.org

How to modify attribute by rlm_exec
by roger 27 Jan '06

27 Jan '06

Dear All, I want to set NAS-Port=100 to proxy request packet. In my test, if the receive packet has not NAS-Port attribute, It will successful. If it have, it will fail. The value will not modify. Can anyone told me how to modify attribute by rlm_exec module? Regards, Roger

1 0

Configuring free radius to use Active directory service
by sumi thra 27 Jan '06

27 Jan '06

Hi All, I have some doubts.. 1. How to configure the freeradius1.0.5 version, to support Active directory service for user authentication. For ldap .. we have rlm_ldap module to configure it. Same kind of configuration is there for ADS also ?? 2. Assigning vlan id's to user group is possible ?? rather than configuring each user with a particular vlan id, can we give the vlan id's for the group so that the users part of that group will be assigned with the same vlan. Awaiting for your earliest reply. Thanks, Sumithra. -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

1 0

AD ldap bind works with 1.01, fails with 1.04
by Stephen Walsh 26 Jan '06

26 Jan '06

Hi Folks We're implementing freeradius with EAP/TLS for our wireless and have found a strange happening with 1.04. This will only happen when attempting to query our student domain (w2k3 AD tree), but not our staff (w2k3 AD tree). If I remove the section (below) for student, it will authenticate staff and log them on happily. At the moment, we have acu.edu.au | / \ staff student I have a test box with FC3/FreeRadius 1.01 which will search through both domains and authenticate the user. I copy the config over to the FC4/FreeRadius 1.04 box and it works on staff, but returns the following on student (the tree is laid out the same as staff); ldap_search() failed: Operations error Is this a bug (known or unknown) or have I just not allowed something like referrals to work. I don't want to have to put openldap on the radius box if I can help it, but if that's the only solution then we'll reassess 1.01 on FC3 Config is as below (some sanitisation done to protect the innocent networks involved). ldap student { server = "192.148.xxx.xxx" identity = "cn=xxxxxxxxx,cn=users,dc=student,dc=acu,dc=edu,dc=au" password = "xxxxxxxxx" basedn = "dc=student,dc=acu,dc=edu,dc=au" filter = "(samaccountname=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 } ldap staff { server = "192.148.xxx.xxx" identity = "cn=xxxxxx,cn=users,dc=staff,dc=acu,dc=edu,dc=au" password = "xxxxxx" basedn = "dc=staff,dc=acu,dc=edu,dc=au" filter = "(samaccountname=%{Stripped-User-Name:-%{User-Name}})" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 } <snip> authorize { suffix eap staff student } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { student staff } eap } many thanks Stephen Walsh Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

2 5

another mysql database
by debik 26 Jan '06

26 Jan '06

Is it possible to configure radius to connect to the two databases. If in one database user do not exist, so connect to another database and search for entry for that user. Sorry for my english if make some mistakes.

2 2

VSA Problem
by Romao Izumi Ito 26 Jan '06

26 Jan '06

Hello, I'm working with Nortel Network Passport and I'm trying to configure a new dictionary on the freeradius. In the vendors doc we have following VSA and Vendor-ID: VENDOR nortel 562 ATTRIBUTE Passport-Command-Scope 200 integer nortel ATTRIBUTE Passport-Command-Impact 201 integer nortel ATTRIBUTE Passport-Customer-Identifier 202 integer nortel ATTRIBUTE Passport-Allowed-Access 203 integer nortel ATTRIBUTE Passport-AllowedOut-Access 204 integer nortel ATTRIBUTE Passport-Login-Directory 205 string nortel ATTRIBUTE Passport-Timeout-Protocol 206 integer nortel ATTRIBUTE Passport-Role 207 string nortel ... I configure the file dictionary.nortel in /etc/raddb and include it in dictionary file. Also I tried it in /usr/share/freeradius/. I added this attributes in the users file but when I look at the radius packet I see: Vendor Specific(26), Vendor: Undefined(562) Unknown Type(200), Value: Unknown Value type What am I doing wrong? Thank you, Romao.

2 1

radkill and a small question about radwho
by Torkel Mathisen 26 Jan '06

26 Jan '06

Hi, I read about the radkill program in the FAQ. However the link doesn't work so I was wondering if anyone had a new link to that program? I'd like to kill users that are logged in twice or something. Like in the output below. If it works on 1.0.5 at all. Also I got a simple question about radwho. It doesnt seem to output the last part of the AP ip-address: # radwho Login Name What TTY When From Location tom shell S470 Thu 08:49 192.168.2 tom shell S480 Thu 10:35 192.168.2 I can always use -r so its not a big problem. Just wondered if its normal. Regards, Torkel

2 1

SNMP apparently not working with FreeRadius 1.0.1 and above on Centos 4.2
by klkbranch＠hotmail.com 26 Jan '06

26 Jan '06

Hi, I am new to this list, though I've been using FreeRadius 0.9.3 for a few years now. My present goal is to get a newer version of FreeRadius (running on Centos 4.2) to work with snmp. Though I have carefully followed the snmp setup instructions as documented in radiusd.conf and snmp.conf, I have yet to get radiusd to attempt SMUX initialization (from output of radiusd -X). Net-snmp is already working (stock Centos rpm net-snmp-5.1.2-11.EL4.6). I have tried the stock Centos freeradius rpm (freeradius-1.0.1-3.RHEL4.i386.rpm). I have also tried tarball installs of freeradius 1.0.1, 1.0.2, 1.0.5, and 1.1.0, with the "--with-snmp" option, with no success. Nothing results in any SMUX-related output from radiusd -X. After reading this thread, http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-April/04286… it appeared I needed some kind of patch. Near the end of that thread, Kevin Bonner gave this solution: You're using Net-SNMP in RHAS4. FreeRADIUS 1.0.2 doesn't have the net-snmp compatibility fix. You can find the patch at http://lists.freeradius.org/archives/freeradius-users/2004/10/frm00210.html Apply that patch, rebuild, and it should work. Unfortunately this link is now broken. However, after some more digging it appeared Kevin was probably referring to: freeradius-0.9.3-net-snmp.patch which I was able to download from another source. I was able to successfully apply this patch to FreeRadius 1.0.1, 1.0.2, 1.0.5, and 1.1.0, and the subsequent compiles were successful, but still radiusd -X makes no references to SMUX and snmp queries for freeradius OIDs fail as before. I'm at my wit's end about what to try next, and would sincerely appreciate any light you all might be able to shed on this issue. My /usr/local/etc/radiusd.conf file contains snmp = yes $INCLUDE ${confdir}/snmp.conf My /usr/local/etc/snmp.conf file contains smux_password = verysecret My /etc/snmp/snmpd.conf file contains rocommunity public smuxpeer .1.3.6.1.4.1.3317.1.3.1 verysecret But every time I run this on the server snmpwalk -v2c -cpublic 127.0.0.1 .1.3.6.1.2.1.67 I get this result SNMPv2-SMI::mib-2.67 = No Such Object available on this agent at this OID Here is an example of the output I get from radiusd -X (when using 1.0.5 in this case): Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Thanks in advace for your assistance, Kevin Branch

3 3

Can't import ldap schema provided in ldap howto
by Laura Donovan 26 Jan '06

26 Jan '06

Hello, I've been trying to configure openldap for use with radius. I'm running a RedHat ES 4 server with the following rpm's installed: openldap-2.2.13-3 freeradius-1.0.1-3.RHEL4 I've been following the instructions in ldap_howto.txt, and I created the schema.ldif file exactly as outlined in the doc. But when I run the ldapadd command it gives the following error: [root@myserver]# ldapadd -f schema.ldif -x -D "cn=root,dc=mydomain,dc=com" -w secret adding new entry "dc=mydomain,dc=com" adding new entry "ou=radius,dc=mydomain,dc=com" adding new entry "ou=profiles,ou=radius,dc=mydomain,dc=com" adding new entry "ou=users,ou=radius,dc=mydomain,dc=com" adding new entry "ou=admins,ou=radius,dc=mydomain,dc=com" adding new entry "uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com" ldap_add: Object class violation (65) additional info: no structural object class provided I do have the include statement for "RADIUS-LDAPv3.schema" configured in my slapd.conf, and I already verified that it is readable by the user ldap (and that the path is correct). Here is the entry ldapadd is erroring on: dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com objectclass: radiusprofile uid: dial radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None I've found other posts with users having the same issue, but I haven't found one detailing the resolution. I've checked to ensure that there are no extra spaces at the end of the lines. Thanks in advance for any assistance! Sincerely, -Laura Donovan

3 2

problems compiling, but works, or don't??
by pelusa vali 26 Jan '06

26 Jan '06

hi every body, well trying to use freeradius v 1.0.5 to add security to a wlan, i configured this to use with openssl and eap-tls with this command: ./configure --prefix=/usr/local/ --with-openssl-includes=/usr/local/ssl/include/ --with-experimental-modules --enable-ltdl-install when i type make, get this error: Making static dynamic in rlm_perl... make[6]: Entering directory `/usr/src/freeradius-1.0.5/src/modules/rlm_perl' /usr/src/freeradius-1.0.5/libtool --mode=link gcc -release 1.0.5 \ -module -export-dynamic \ -o rlm_perl.la -rpath /usr/local//lib rlm_perl.lo `perl -MExtUtils::Embed -e ldopts` -lssl -lcrypto -lnsl -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! rm -fr .libs/rlm_perl.la .libs/rlm_perl.* .libs/rlm_perl-1.0.5.* gcc -shared rlm_perl.lo -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lpthread -lc -lcrypt -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.0.5.so -o .libs/rlm_perl-1.0.5.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/usr/src/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/usr/src/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/usr/src/freeradius-1.0.5' make: *** [all] Error 2 i have installed libsdl-perl and in /usr/src/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_tls/Makefile i have this: TARGET = rlm_eap_tls SRCS = rlm_eap_tls.c eap_tls.c cb.c tls.c mppe_keys.c RLM_CFLAGS = $(INCLTDL) -I../.. -I/usr/local/ssl/include/ HEADERS = eap_tls.h RLM_INSTALL = RLM_LDFLAGS += -I/usr/local/ssl/lib RLM_LIBS += -lssl -lcrypto $(STATIC_OBJS): $(HEADERS) $(DYNAMIC_OBJS): $(HEADERS) RLM_DIR=../../ include ${RLM_DIR}../rules.mak well why this error occurs and how could i solve?? i just can install if don't compile with --with-experimental-modules, so what happen if i don't use those experimental modules?? could freeradius work in my wlan as i hope? thanks in advance for your time. _________________________________________________________________ Charla con tus amigos en línea mediante MSN Messenger: http://messenger.latam.msn.com/

3 2

Modifying a radreply
by Thulani Maphosa (T) 26 Jan '06

26 Jan '06

Hi all, am investigating the possibility of appending to a radreply attribute. 1. This will come from ISP * Cisco-Avpair += "ip route 10.0.1.0 255.255.255.0" 2. From our radius as per Realm * Cisco-AVpair += "ip:vrf-id=client1" * Cisco-AVpair += "ip:ip-unnumbered=Loopback11" * Cisco-Avpair += "ip:addr-pool=easyvpnpool" Modify proxy reply from ISP to look like this: * Cisco-Avpair += "ip route vrf client1 10.0.1.0 255.255.255.0" Can this be achieved on post-proxy with attr_rewrite? Kind regards Thulani Maphosa IP Networks and Services (012) 311 5494 maphost(a)telkom.co.za There are 10 types of people that can understand Binary. Those who can, and those who can't. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1