- Freeradius-Users - lists.freeradius.org

problem compiling
by pelusa vali 24 Dec '05

24 Dec '05

hi everybody, well i downloaded last version of freeradius and want to use with openssl, so i tried to compile using: --with-experimental-modules --enable-ltdl-install but i get an error and is impossible to compile, i must delete these options. when i try to run server then i get this: rlm_eap:Failed to link EAP-TYPE/TLS:rlm_eap_tls.so: cannot open shared object: no such file or directory radiusd[9] my configurations point to openssl locations, so why i cann't compile and why this error?? ok, thanks for your time. _________________________________________________________________ Las mejores tiendas, los precios mas bajos, entregas en todo el mundo, YupiMSN Compras: http://latam.msn.com/compras/

2 1

MYSQL installation for interaction with freeradius
by Rafael Roldán 24 Dec '05

24 Dec '05

Hy all, I am testing freeradius 1.0.5 in a solaris 8 machine and it really satisfied me. Now I want to test freeradius with MYSQL. So first, I am going to install the MYSQL software. When I visit the download page (http://dev.mysql.com/downloads/mysql/5.0.html) I see there are three software package options (standard, max and debug). Also, reading the document "Freeradius and MYSQL" (http://www.frontios.com/freeradius.html) I read that I have to make sure to install the MYSQL development headers installed. Which of these MYSQL packages do you recommend me to interact with freeradius? Thank you very much, Rafa

2 1

Radius Configuration Helping
by Kai Geek 24 Dec '05

24 Dec '05

Hi; I setup freeradius on slackware. When i send ssh request to a router/switch in network i want radius to check on the identify control. How can I do this? I dont know raddb (radiusd.conf) configuration. Thank you, ------------------------------------------- Radius konfigurasyonunu yapmak için bir dokuman var mıdır? Saygilarimla, -- +-+-+- BEGIN PGP SIGNATURE -+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) ___ / __) Kai "Ozgur" Geek \__ \ PGP ID: B1B63B6E (___/lackware Network Engineer +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

2 1

RE: Cisco WLSE status?
by Alek Barsky 24 Dec '05

24 Dec '05

I am working with WLSE in my organization. The product has a lot of shortcomings. I do not think it is time well spent to create a workaround for Cisco LEAP authentication issue. I can recommend to use one of the Cisco AP ( I would assume that you are using them ) to be LEAP server for the WLSE instrumentation mode authentication. In this case you do not have to introduce another RADIUS server. Thanks, Alek. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeffrey C. Ollie Sent: Wednesday, December 21, 2005 12:34 AM To: FreeRadius users mailing list Subject: Cisco WLSE status? Ok, I know that the problems getting Cisco WLSE to authenticate properly with FreeRadius is a problem with the Cisco supplicant, but I'm wondering: 1) Has anyone opened up a ticket with Cisco trying to get them to fix the problem? If so, what is the status of the ticket? 2) Has anyone polished up a patch that will allow WLSE to authenticate agianst FreeRadius? It'd be nice to have a hack that could be enabled conditionally so it doesn't break other hosts but if I have to run a separate server on a different host or port that'd probably work until we can get Cisco to fix their problem. Jeff Ollie

2 1

use of pam and sql db simultaneously
by Markus Krause 23 Dec '05

23 Dec '05

hello list, i would like to authenticate users via pam and sql. part of my radiusd.conf (freeradius 1.0.5 on sles 9) is: +++++ part of radiusd.conf instantiate { } authorize { preprocess files sql shorttermaccount } authenticate { pam } preacct { preprocess acct_unique files } accounting { detail radutmp sql } ------- part of radiusd.conf if i have the following line in /etc/raddb/users: ++++++ users Auth-Type = PAM Fail-Through = Yes ------ users users known by pam get access-accept, but those in sql don't, the debug output says: ++++++ radiusd -XA Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32768, id=144, length=59 User-Name = "sqluser" User-Password = "XXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 3 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'sqluser' rlm_sql (sql): sql_set_user escaped user --> 'sqluser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'sqluser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'sqluser' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sqluser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sqluser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'sqluser' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'sqluser' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sqluser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sqluser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "shorttermaccount" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type PAM auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <sqluser>. Reason: User not known to the underlying authentication module modcall[authenticate]: module "pam" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Login incorrect: [sqluser] (from client localhost port 1) Delaying request 0 for 1 seconds Finished request 0 ----- radiusd -XA if i delete the line "DEFAULT Auth-Type = Pam" (and Fall-Through = Yes) the users in sql get an access-accept answer. what am i doing wrong here? do theses modules (rlm_pam and rlm_sql) exclude each other? how can i use them simultaneously i.e. in parallel? thanks in advance for any hints! and merry x-mas everyone! :-) regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Re: Windows WPA
by Stefan Adams 23 Dec '05

23 Dec '05

Phil, thanks for the information! "Finally you need an AD domain (not NT4) to do that." Are you saying I actually need a Microsoft Server? A Samba domain control won't suffice? Being that I have no (ZERO) Microsoft servers, are my chances of doing machine authentication nil? Stefan > Date: Thu, 22 Dec 2005 12:44:04 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Windows WPA > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <43AA9F94.5070108(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Stefan Adams wrote: > > Does anyone know how it's possible to log into a windows domain (no > > local account) from a Windows XP computer using WPA when the user has > > never logged in before (making cached credentials impossible)? > > > > I work at a high school. We have several mobile carts with laptop > > computers that do NOT have local accounts for each student. > > Therefore, each student is required to logon to the windows domain > > using wireless. This works fine using WEP. > > > > However, using WPA, with the automatically supply windows > > username/password/domain checkbox selected, a user that has never > > logged into that machine before is not able to log on. The Windows > > computer complains that the domain controller is not available. This, > > of course, is true because there are no 'up' network interfaces. > > > > But wouldn't it be logical for Windows to first supply the entered > > credentials to the access point for authorization to the WPA WLAN and > > then supply those same credentials to the domain controller? > > It would be logical. It does not do that. > > See the archives for "machine AND PEAP" - basically, you need to make > the machines authenticate themselves with their machine account first, > then those creds are used for the network login during profile download, > at which point windows will switch to the user creds. > > One point to note: apparently the inbuilt windows supplicant has to use > the *same method* for both the machine and user creds (e.g. both TLS or > both PEAP+MS-CHAP). > > Also note that in order to authenticate a machine (as opposed to user) > account, FreeRadius needs to be talking to an "ntlm_auth" which in turn > talks to a patched samba (the messages you find with the above search > should reference the location of the patch and/or the version from which > it's integrated). Finally you need an AD domain (not NT4) to do that. > > > > > Is that the way it works, is there some other way, or are people that > > have never logged on to these laptops before condemned to never logon > > at all given our new WPA infrastructure? > > No, you just have to work hard to fix microsoft's broken behaviour. As > always.

4 5

Re: [FREERADIUS] Re: patch for sqlcounter, please test!
by Damjan 23 Dec '05

23 Dec '05

> Hello. I'm also interested in this. > What Expire attribute? The attribute name is actually "Expiration". You set it in rad(group)check to something like Expiration == "24 Dec 2005 14:00:00", and if the user connects in 13:48, he'll get a 12 minutes of Session-Timeout. > Can't find any reference of that attribute in the dictionaries. It is in the dictionary, unfortunenatelly it's seems it's not documented anywhere. -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

1 0

default gateway per user basis
by Igor Smitran 23 Dec '05

23 Dec '05

Hello. I am new to this list and also to freeradius server. Can someone please help me? I have a pppoe server on freebsd. I want to setup freeradius to give different ip address block and gateway to users. I need two pools, and i have a two gateways. One gateway is more expensive than the otherone. So, users that pay less will use chiper gateway and vice versa. Is this possible? 10x in advance.

3 9

mysql account and users account using exec-program-wait
by SantaYeh 23 Dec '05

23 Dec '05

I store all user account in mysql, and freeradius works fine. And now, we have some special account that need to write a external program to do authentication. So we use the users file using DEFAULT auth-type = Accept with exec-program-wait. The problem is all mysql accounts doesn't work any more. We check with radiusd -X and find all mysql accounts will pass to users and run exec-program-wait. I just want to know how can we stop the users checking if mysql return OK. Regards, Santa Yeh

2 1

patch for sqlcounter, please test!
by Markus Krause 23 Dec '05

23 Dec '05

hi list! part of a radius-related project is to allow access to our guests and visitors at our institute to parts of our network, of course only with username and password, and do some logging. the idea is that guests get an account and a password which they can use for a period of one to seven days (according to setup). to achieve this i am using the sqlcounter module using the following query: query = "SELECT TO_DAYS(NOW()) - MIN(TO_DAYS(AcctStartTime)) FROM radacct WHERE UserName = '%{%k}' LIMIT 1"; this actually works very well, a user logs in and is allowed to access to the network until the date changes e.g. the second time if he is allowed access for two days. but as i am saving the days as "days" in the mysql database, i run into trouble with "Session-Timeout" because rlm_sqlcounter assumes that the query returns seconds and the user gets a session timeout of the remaining days as seconds (a value between 1 and 7!). putting the day limit as seconds into the database does (in my case/opinion) not make any sense here. as i posted a question about this some two months ago to the freeradius users list unfortunately nobody had a solution available, but i can remember several answers (to the list an by private mail) that this feature would be nice! so i finaly tried some coding today and now here is my proposal: add an optional parameter 'timeunit' to sqlcounter.conf that represents the time unit used in the query and the check value (in the sql db), my config then reads: +++++ /etc/raddb/sqlcounter.conf sqlcounter shorttermaccounts { counter-name = Short-Term-Account check-name = Max-Days-Passed sqlmod-inst = sql key = User-Name reset = never timeunit = days query = "SELECT TO_DAYS(NOW()) - MIN(TO_DAYS(AcctStartTime)) FROM radacct WHERE UserName = '%{%k}' LIMIT 1"; } ----- /etc/raddb/sqlcounter.conf in rlm_sqlcounter.c i added some lines which (if 'timeunit' is set) multiply the value of 'res' (i assume this is the remaining time of allowd success) by an appropriate value to get seconds. in this case Session-Timeout is returned "correctly". possible values for timeunit are minutes, hours, days, and weeks (for now). a patch to version 1.0.5 can be found as attachment to this email. i ran several tests and it is also working with different queries (like the ones in the doc), but i would appreciate others to do some testing if it really works. but as it seems that nobody has made a proposal/code for this yet, what do think about it? i put this also on bugs.freeradius.org but could not find the component "rlm_sqlcounter" so i put it in "modules", i hope i did not mess up things! hoping for many feedback! ;-) with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2