- Freeradius-Users - lists.freeradius.org

Accounting proxy to multiple hosts
by Deon van der Merwe 05 Dec '05

05 Dec '05

Hi, I have successfully been running freeradius as an accounting proxy. Next step is to be able to proxy to multiple hosts... actually it will be a proxy to the real RADIUS server and then (what I can only describe as...) replication of the accounting messages to at least 2 other servers. - I only want the response from the real RADIUS server to be sent back to the originator - the responses from the other (replication) servers can be dropped/ignored Is this possible to do? Is there some better options that you might know of?

3 3

FreeRadius and Interim Packets
by Matt 05 Dec '05

05 Dec '05

Does anyone have experience with FreeRadius and Interim packets? Does it work ok? Any problems? How do you enable it?

7 22

SQL Call-Check Authentication (again :( )
by florian broder 05 Dec '05

05 Dec '05

Hi. I'm still having a hard time of implementing the Calling-Station-Id Authentication. Basis is a Cisco Catalyst with "Mac-Authentication-Bypass" turned on. Alan DeKok told me, that I can use sql.conf: # Use Stripped-User-Name, if it's there. # Else use User-Name, if it's there, -->># Else use hard-coded string "DEFAULT" as the user name.<<-- sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" To tell freeradius, that there is no user-name. Ok, I've done that, but It gives me this error: rad_recv: Access-Request packet from host 192.168.1.222:1038, id=13, length=45 Service-Type = Call-Check Calling-Station-Id = "11-22-33-44-55-66" -->> rlm_sql (sql): zero length username not permitted <<-- That's basically the same packet, the Cisco Switch sends as Auth-Request. Notice, that there is NO user-name in here at all. The fact is also mentioned in the sql Source-Code: /* * They MUST have a user name to do SQL authorization. */ if ((request->username == NULL) || (request->username->length == 0)) { radlog(L_ERR, "rlm_sql (%s): zero length username not permitted\n", inst->config->xlat_name); return RLM_MODULE_INVALID; } Switching to "file-based-Authentication" (in radiusd.conf) it works immediately: rad_recv: Access-Request packet from host 192.168.1.222:1044, id=19, length=45 Service-Type = Call-Check Calling-Station-Id = "11-22-33-44-55-66" Sending Access-Accept of id 19 to 192.168.1.222:1044 Reply-Message = "Hello" So, it's really a limitation in sql, rather that a misconfiguration? Would be nice, if anyone can confirm this! Bye Flo

3 3

(no subject)
by debik 05 Dec '05

05 Dec '05

When i try to authenticate on my Xp client this message is in the log and the Acces-Reject is send modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: group authenticate returns invalid for request 5 auth: Failed to validate the user. Somebody knows what this means ??

1 0

sqltrace.log
by TK Lew 05 Dec '05

05 Dec '05

hi all :: Is it adviseable to turn on the sqltrace.log file under production environment ? Thanks ! BR

2 1

further ldap problems
by Norbert Wegener 05 Dec '05

05 Dec '05

Although I can query an AD server via ldapsearch without problems, I do not get it working using freeradiusd. I do get rlm_ldap: search failed. In the logs first I see: rlm_ldap: Bind was successful later there is: ... ldap_chase_referrals^M read1msg: V2 referral chased, mark request completed, id = 3^M new result: res_errno: 1, res_error: <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, res_matched: <>^M Why can this happen? (complete log at: http://www.wegener-net.de/fr ) raidusd.conf is also there My radiusd.conf includes the section: ldap ldap1 { server = "tde002.sitest.net" identity = "testrad(a)TDE002.SITEST.NET" password = "mypass" basedn = "dc=TDE002,dc=SITEST,dc=NET" filter="(servicePrincipalName=HOST/lnxad)" # a fixed value here, just for testing. This filter works with ldapsearch. ldap_debug=0xFFFF #base_filter = "(objectclass=computer)" ldap_connections_number = 1 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap } Any hint is appreciated. Thanks Norbert Wegener

1 0

solaris 8 compilation problem of pam_radius
by Peter Bergmann 05 Dec '05

05 Dec '05

Hi, I want to use the client function of free-radius, but I've got a problem while compiling the pam_radius-1.3.16 module under solaris 8: Any ideas are welcome!!! Thanks Peter hqwww01tban{root} @: make gcc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o In file included from pam_radius_auth.h:23, from pam_radius_auth.c:63: md5.h:21: error: parse error before "u_int32_t" md5.h:21: warning: no semicolon at end of struct or union md5.h:22: warning: type defaults to `int' in declaration of `bits' md5.h:22: warning: data definition has no type or storage class md5.h:24: error: parse error before '}' token md5.h:29: error: parse error before "buf" pam_radius_auth.c: In function `ipstr2long': pam_radius_auth.c:179: warning: subscript has type `char' pam_radius_auth.c: In function `good_ipaddr': pam_radius_auth.c:215: warning: subscript has type `char' pam_radius_auth.c: In function `host2server': pam_radius_auth.c:271: warning: subscript has type `char' pam_radius_auth.c: In function `get_random_vector': pam_radius_auth.c:350: error: storage size of `my_md5' isn't known pam_radius_auth.c:350: warning: unused variable `my_md5' pam_radius_auth.c: In function `get_accounting_vector': pam_radius_auth.c:382: error: storage size of `my_md5' isn't known pam_radius_auth.c:382: warning: unused variable `my_md5' pam_radius_auth.c: In function `verify_packet': pam_radius_auth.c:400: error: storage size of `my_md5' isn't known pam_radius_auth.c:400: warning: unused variable `my_md5' pam_radius_auth.c: In function `add_password': pam_radius_auth.c:497: error: storage size of `md5_secret' isn't known pam_radius_auth.c:497: error: storage size of `my_md5' isn't known pam_radius_auth.c:497: warning: unused variable `md5_secret' pam_radius_auth.c:497: warning: unused variable `my_md5' pam_radius_auth.c: In function `rad_converse': pam_radius_auth.c:1016: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1019: warning: passing arg 2 of pointer to function from incompatible pointer type pam_radius_auth.c: In function `pam_sm_authenticate': pam_radius_auth.c:1071: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1099: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1113: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1146: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_private_session': pam_radius_auth.c:1267: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1288: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_chauthtok': pam_radius_auth.c:1374: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1395: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1404: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing arg 3 of `pam_get_item' from incompatible pointer type make: *** [pam_radius_auth.o] Error 1 hqwww01tban{root} @: -- Lust, ein paar Euro nebenbei zu verdienen? Ohne Kosten, ohne Risiko! Satte Provisionen f�r GMX Partner: http://www.gmx.net/de/go/partner

2 2

How can i change Configure file.
by Manojkumar Patel 05 Dec '05

05 Dec '05

Hi all I have one problem. I want to pass config parameters in one Config.ini My Config.ini file is like: --no-create --sysconfdir=/home/manoj/RadiusServer --with-logdir=/home/manoj/RadisuServer When I w run config file like ./configure < Config.ini But radius server was configured as default setting. But I want to change default setting. I want to pass all parameter in one file instead of Command line argument. How can I do that requirements ? Thanks & Regard Manoj Patel MBT Ltd-Pune, Next Generation Network (IN) group Phone: (020) 56018100 (Exnt: 2845) Mobile: +91-9881403519 ********************************************************* Disclaimer: The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use *********************************************************

3 2

FW: How can i change Configure file.
by Manojkumar Patel 05 Dec '05

05 Dec '05

Hi I make configuration with following syntex $ xargs ./configure < Config.ini But my FreeRadiussercer is take logfile and sysconfdir as default. Thanks Manoj -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Nicolas Baradakis Sent: Monday, December 05, 2005 5:08 PM To: FreeRadius users mailing list Subject: Re: How can i change Configure file. Manojkumar Patel wrote: > My Config.ini file is like: > --no-create > --sysconfdir=/home/manoj/RadiusServer > --with-logdir=/home/manoj/RadisuServer > When I w run config file like > ./configure < Config.ini > But radius server was configured as default setting. But I want to > change default setting. > I want to pass all parameter in one file instead of Command line > argument. How can I do that requirements ? You could try this command line: $ xargs ./configure < Config.ini And please turn HTML off when posting to a mailing list. http://freeradius.org/list/users.html -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************* Disclaimer: The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use *********************************************************

1 0

RE: Fall-through and different NAS IP Settings
by Jonathan De Graeve 05 Dec '05

05 Dec '05

>> I'm just asking this for my understanding, am I still going to want to >>use Client-IP-Address even though from what I can see here, the NAS-IP- >> Address attribute is appearing within the output of debugging? > I would suggest using Client-IP-Address, unless you know that the >NAS will always send that attribute with that value. > As for why it doesn't match, I'm not sure. Try editing the "users" >file entry to see if you can narrow down the problem. How do you explain this then? I have a NAS that DOESN'T sent NAS-IP-Address attribute to the radius server (only nas-identifier) but all my huntgroups based on NAS-IP-Address work without any problem... Is this then somewhere in the code? If (!NAS-IP-Address && Client-IP-Address) NAS-IP-Address = Client-IP-Address J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be

2 1