- Freeradius-Users - lists.freeradius.org

Authenticate users for a hotel through webpage?
by mfred 14 Dec '05

14 Dec '05

Hi, maybe someone can point me to the right direction as it seems I use wrong keywords for my search in the list and on google. I am trying to use freeradius with wlan to authenticate hotel guests that need i-net access. They would prefer that the customer could visit a webpage entering the username / password combination they got at hotel-reception. Would this be a authentication methode which freeradius can handle or do I have to use other authentication modules for such a purpose? The most important thing is: Easy to use for the hotel staff at registering / deleting guests and easy to use for the guests at login. TIA and br, mfred

6 6

rlm_ldap.so not found, Freeradius 1.0.5
by Christophe Gravier 14 Dec '05

14 Dec '05

First, Hello to the mailing ! ;-) I installed freeradius on a fresh debian etch (testing) machine. ( FreeRADIUS Version 1.0.5 as it is package in debian etch tree ). I want my radius being able to authenticate users against an external LDAP source. So I think I've made the right changes (in particular, I modified the /etc/freeradius/radiusd.conf), but when I launch the freeradius server, I received: Wed Dec 14 14:23:36 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Dec 14 14:23:36 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Dec 14 14:23:36 2005 : Error: radiusd.conf[724] Failed to link to module 'rlm_ldap': rlm_ldap.so: cannot open shared object file: No such file or directory Hummm, I don't think it'll work as it is :) I have search for rlm_ldap.so, I have no such library in my /usr/lib/freeradius/ directory (there I've got stuff for mysql and so on). I have try the achieve mailing list and googling, but there's just questions and so few answers .... Does anyone could enventually point me a clue please ? Or a link to the howto he followed for freeradius using ldap ? Best regards, -- Christophe Gravier Laboratoire DIOM, groupe SATIn - Doctorant ISTASE - Ingénieur d'études Perso: http://perso.univ-st-etienne.fr/gravchri/ SATIn: http://www.istase.com/satin Tel : 04 7748 5034 A mediter: http://www.fsffrance.org/news/article2005-11-25.fr.html

2 2

rlm_ldap.so not found, Freeradius 1.0.5
by Christophe Gravier 14 Dec '05

14 Dec '05

First, Hello to the mailing ! ;-) I installed freeradius on a fresh debian etch (testing) machine. ( FreeRADIUS Version 1.0.5 as it is package in debian etch tree ). I want my radius being able to authenticate users against an external LDAP source. So I think I've made the right changes (in particular, I modified the /etc/freeradius/radiusd.conf), but when I launch the freeradius server, I received: Wed Dec 14 14:23:36 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Dec 14 14:23:36 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Dec 14 14:23:36 2005 : Error: radiusd.conf[724] Failed to link to module 'rlm_ldap': rlm_ldap.so: cannot open shared object file: No such file or directory Hummm, I don't think it'll work as it is :) I have search for rlm_ldap.so, I have no such library in my /usr/lib/freeradius/ directory (there I've got stuff for mysql and so on). I have try the achieve mailing list and googling, but there's just questions and so few answers .... Does anyone could enventually point me a clue please ? Or a link to the howto he followed for freeradius using ldap ? Best regards, -- Christophe Gravier Laboratoire DIOM, groupe SATIn - Doctorant ISTASE - Ingénieur d'études Perso: http://perso.univ-st-etienne.fr/gravchri/ SATIn: http://www.istase.com/satin Tel : 04 7748 5034 A mediter: http://www.fsffrance.org/news/article2005-11-25.fr.html

1 0

RE: Two routers using the same Radius server?
by Jonathan De Graeve 14 Dec '05

14 Dec '05

Client ip adres in combination with huntgroups if you work with a mysql db and usergroups -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Mark Tunnell Verzonden: woensdag 14 december 2005 1:59 Aan: FreeRadius users mailing list Onderwerp: Re: Two routers using the same Radius server? Nice! That gets me almost all the way there. I'm able to authenticate using Auth-Type := Local. Now I just need to figure out how to authenticate that type of user name (user@realm) using Auth-Type := System. Any ideas how to go about that? Thanks, Mark Lewis Bergman wrote: > Mark Tunnell wrote: > >> Suppose I have two Cisco routers both configured to authenticate to >> the same radius server. How do I allow a particular user access to >> one router but not the other? Is there a place in the clients.conf or >> users file to configure this? >> > Oh yea, Alan gave me a trick with the hints file that adds a realm to a > client if one is not present that could also help. > DEFAULT User-Name !~ ".*@", NAS-IP-Address == "ip of client" > User-Name := "%{User-name}(a)realmtoadd.com" > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

anybody installed freeradius-1.0.5 on Solaris 8 successfully?
by Qin Zhen 14 Dec '05

14 Dec '05

Hello All, seems solaris 8 and freeradius-1.0.5 dont like each other.. after i installed it, it gave segmentation fault when i tried to run it. anybody has installed and run it successfully on solaris 8? cheers, QZ

2 1

Memory big problem
by Dmitry V. Pleganoff 14 Dec '05

14 Dec '05

And to you thanks. Can i offer small patch for realization of comparison (!~) in rlm_checkval? --- rlm_checkval.c 2005-12-14 03:38:08.000000000 +1000 +++ rlm_checkval.c.patched 2005-12-14 10:15:59.000000000 +1000 @@ -208,6 +208,7 @@ VALUE_PAIR *chk_vp, *item_vp; VALUE_PAIR *tmp; char found = 0; + int opflag = T_OP_REG_EQ; /* quiet the compiler */ instance = instance; @@ -244,6 +245,9 @@ * Check if item != check */ found = 1; + + opflag = chk_vp->operator; + if (data->dat_type == PW_TYPE_STRING || data->dat_type == PW_TYPE_OCTETS) { if (item_vp->length != chk_vp->length) @@ -266,12 +270,18 @@ } #ifdef HAVE_REGEX_H if (ret == RLM_MODULE_REJECT && - chk_vp->operator == T_OP_REG_EQ) { + (chk_vp->operator == T_OP_REG_EQ || + chk_vp->operator == T_OP_REG_NE)) { regex_t reg; int err; char err_msg[MAX_STRING_LEN]; - DEBUG("rlm_checkval: Doing regex"); + if (opflag == T_OP_REG_EQ) { + DEBUG("rlm_checkval: Doing regex (=~)"); + } else { + DEBUG("rlm_checkval: Doing regex (!~)"); + } + err = regcomp(&reg, (char *)chk_vp->vp_strvalue, REG_EXTENDED|REG_NOSUB); if (err){ regerror(err, &reg,err_msg, MAX_STRING_LEN); @@ -289,6 +299,14 @@ } while (ret == RLM_MODULE_REJECT && tmp != NULL); + if (opflag == T_OP_REG_NE) { + if (ret == RLM_MODULE_OK) + ret = RLM_MODULE_REJECT; + else + if (ret == RLM_MODULE_REJECT) + ret = RLM_MODULE_OK; + } + if (ret == RLM_MODULE_REJECT) { if (!item_vp && data->notfound_reject){ char module_fmsg[MAX_STRING_LEN];

1 0

Two routers using the same Radius server?
by Mark Tunnell 14 Dec '05

14 Dec '05

Suppose I have two Cisco routers both configured to authenticate to the same radius server. How do I allow a particular user access to one router but not the other? Is there a place in the clients.conf or users file to configure this? Thanks, Mark

3 7

Framed-Route ignored
by Arthur Sigel 14 Dec '05

14 Dec '05

I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so Radius will authenticate with my users fine, but I can't seem to get the Framed-Route option to do anything. I am trying to set a route for a mask and not just the single IP to device ppp connection. Does ppp just ignore the route and this option just doesn't work with ppp or pptp? Is there a workaround? Thank you, Arthur I am also using a SQL connection so the information will be left in that format. radius=# select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+--------- 1 | static | Auth-Type | := | MS-CHAP radius=# select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+--------------------+----+--------------------- 1 | static | Framed-Protocol | := | PPP 2 | static | Service-Type | := | Framed-user 3 | static | Framed-Compression | := | Van-Jacobsen-TCP-IP id | username | attribute | op | value ----+----------+-------------------+----+----------------------- 1 | arthur | Framed-IP-Address | := | 10.0.0.4 3 | arthur | Framed-Routing | := | None 2 | arthur | Framed-IP-Netmask | := | 255.255.255.0 4 | arthur | Framed-Route | := | 10.0.0.0/24 0.0.0.0 1 The options file contains: plugin radius.so lock mtu 1490 mru 1490 multilink #proxyarp auth ipcp-accept-remote lcp-echo-failure 30 lcp-echo-interval 5 deflate 0 +mschap-v2 mppe required nopcomp noaccomp pptpd.conf localip 191.168.4.1 ----------------------------- VERSIONS OF THINGS pptpd-1.2.3 pppd version 2.4.3 FreeRadius 1.05 RADIUS output snippet Framed-IP-Address := 10.0.0.4 Framed-IP-Netmask := 255.255.255.0 Framed-Routing := None Framed-Route := "10.0.0.0/24 0.0.0.0 1" Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP MS-CHAP2-Success = ***** MS-MPPE-Recv-Key = ***** MS-MPPE-Send-Key = ***** MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 rad_recv: Accounting-Request packet from host 127.0.0.1:32798, id=114, length=112 Acct-Session-Id = "439E72E33A2C00" User-Name = "arthur" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "**.**.**.**" Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.4 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 Routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.4 * 255.255.255.255 UH 0 0 0 ppp0 192.168.3.0 * 255.255.255.0 U 0 0 0 eth2 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0

2 2

accounting & lost trafic
by Andreas＠j8.com.ru 13 Dec '05

13 Dec '05

Hi, freeradius-users. TEll me please : when i use standart config - my accounting save ONLY AFTER SESSION CLOSE. If user have session 19 hours and server hang up or some thing else - i lost users trafic! I try use Acct-Interim-Interval like http://lists.cistron.nl/pipermail/freeradius-users/2005-April/042710.html but in to my sql table i do not see any changes. (i use freeradius-mysql) PLEASE HELP -- Best Regards, Andreas Wednesday, December 14, 2005 1:05:05 AM "Do not hesitate to ask me" ICQ UIN 177624 http://ServersLease.net - Offshore Dedicated Servers, Offshore Collocation http://HOST-LUX.RU - Offshore Virtual Hosting, Web Hosting, as low as 5$ per 1Gb HDD/month http://Reg-Master.net - Register`s Master of Domains http://Web-Media.Ru - Web Design studio. http://VEHICLE.RU - автомобили на заказ из США

2 1

Framed-Route ignored (repost in TXT)
by Arthur Sigel 13 Dec '05

13 Dec '05

I have been trying to get this to work for a few days now with no success. I have set up poptop (PPTP) and it uses the /etc/ppp/options.pptp file which has a plugin for radius. plugin radius.so Radius will authenticate with my users fine, but I can't seem to get the Framed-Route option to do anything. I am trying to set a route for a mask and not just the single IP to device ppp connection. Does ppp just ignore the route and this option just doesn't work with ppp or pptp? Is there a workaround? Thank you, Arthur I am also using a SQL connection so the information will be left in that format. radius=# select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+--------- 1 | static | Auth-Type | := | MS-CHAP radius=# select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+--------------------+----+--------------------- 1 | static | Framed-Protocol | := | PPP 2 | static | Service-Type | := | Framed-user 3 | static | Framed-Compression | := | Van-Jacobsen-TCP-IP radius=# select * from radreply; id | username | attribute | op | value ----+----------+-------------------+----+----------------------- 1 | arthur | Framed-IP-Address | := | 10.0.0.4 3 | arthur | Framed-Routing | := | None 2 | arthur | Framed-IP-Netmask | := | 255.255.255.0 4 | arthur | Framed-Route | := | 10.0.0.0/24 0.0.0.0 1 The options file contains: plugin radius.so lock mtu 1490 mru 1490 multilink #proxyarp auth ipcp-accept-remote lcp-echo-failure 30 lcp-echo-interval 5 deflate 0 +mschap-v2 mppe required nopcomp noaccomp pptpd.conf localip 191.168.4.1 ----------------------------- VERSIONS OF THINGS pptpd-1.2.3 pppd version 2.4.3 FreeRadius 1.05 RADIUS output snippet Framed-IP-Address := 10.0.0.4 Framed-IP-Netmask := 255.255.255.0 Framed-Routing := None Framed-Route := "10.0.0.0/24 0.0.0.0 1" Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP MS-CHAP2-Success = ***** MS-MPPE-Recv-Key = ***** MS-MPPE-Send-Key = ***** MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 rad_recv: Accounting-Request packet from host 127.0.0.1:32798, id=114, length=112 Acct-Session-Id = "439E72E33A2C00" User-Name = "arthur" Acct-Status-Type = Start Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "**.**.**.**" Acct-Authentic = RADIUS NAS-Port-Type = Async Framed-IP-Address = 10.0.0.4 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Acct-Delay-Time = 0 Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 10.0.0.4 * 255.255.255.255 UH 0 0 0 ppp0 192.168.3.0 * 255.255.255.0 U 0 0 0 eth2 192.168.2.0 * 255.255.255.0 U 0 0 0 eth0 192.168.1.0 * 255.255.255.0 U 0 0 0 eth1 loopback * 255.0.0.0 U 0 0 0 lo default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0

1 0