- Freeradius-Users - lists.freeradius.org

sqltrace.log
by TK Lew 05 Dec '05

05 Dec '05

hi all :: Is it adviseable to turn on the sqltrace.log file under production environment ? Thanks ! BR

2 1

further ldap problems
by Norbert Wegener 05 Dec '05

05 Dec '05

Although I can query an AD server via ldapsearch without problems, I do not get it working using freeradiusd. I do get rlm_ldap: search failed. In the logs first I see: rlm_ldap: Bind was successful later there is: ... ldap_chase_referrals^M read1msg: V2 referral chased, mark request completed, id = 3^M new result: res_errno: 1, res_error: <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, res_matched: <>^M Why can this happen? (complete log at: http://www.wegener-net.de/fr ) raidusd.conf is also there My radiusd.conf includes the section: ldap ldap1 { server = "tde002.sitest.net" identity = "testrad(a)TDE002.SITEST.NET" password = "mypass" basedn = "dc=TDE002,dc=SITEST,dc=NET" filter="(servicePrincipalName=HOST/lnxad)" # a fixed value here, just for testing. This filter works with ldapsearch. ldap_debug=0xFFFF #base_filter = "(objectclass=computer)" ldap_connections_number = 1 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap } Any hint is appreciated. Thanks Norbert Wegener

1 0

solaris 8 compilation problem of pam_radius
by Peter Bergmann 05 Dec '05

05 Dec '05

Hi, I want to use the client function of free-radius, but I've got a problem while compiling the pam_radius-1.3.16 module under solaris 8: Any ideas are welcome!!! Thanks Peter hqwww01tban{root} @: make gcc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o In file included from pam_radius_auth.h:23, from pam_radius_auth.c:63: md5.h:21: error: parse error before "u_int32_t" md5.h:21: warning: no semicolon at end of struct or union md5.h:22: warning: type defaults to `int' in declaration of `bits' md5.h:22: warning: data definition has no type or storage class md5.h:24: error: parse error before '}' token md5.h:29: error: parse error before "buf" pam_radius_auth.c: In function `ipstr2long': pam_radius_auth.c:179: warning: subscript has type `char' pam_radius_auth.c: In function `good_ipaddr': pam_radius_auth.c:215: warning: subscript has type `char' pam_radius_auth.c: In function `host2server': pam_radius_auth.c:271: warning: subscript has type `char' pam_radius_auth.c: In function `get_random_vector': pam_radius_auth.c:350: error: storage size of `my_md5' isn't known pam_radius_auth.c:350: warning: unused variable `my_md5' pam_radius_auth.c: In function `get_accounting_vector': pam_radius_auth.c:382: error: storage size of `my_md5' isn't known pam_radius_auth.c:382: warning: unused variable `my_md5' pam_radius_auth.c: In function `verify_packet': pam_radius_auth.c:400: error: storage size of `my_md5' isn't known pam_radius_auth.c:400: warning: unused variable `my_md5' pam_radius_auth.c: In function `add_password': pam_radius_auth.c:497: error: storage size of `md5_secret' isn't known pam_radius_auth.c:497: error: storage size of `my_md5' isn't known pam_radius_auth.c:497: warning: unused variable `md5_secret' pam_radius_auth.c:497: warning: unused variable `my_md5' pam_radius_auth.c: In function `rad_converse': pam_radius_auth.c:1016: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1019: warning: passing arg 2 of pointer to function from incompatible pointer type pam_radius_auth.c: In function `pam_sm_authenticate': pam_radius_auth.c:1071: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1099: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1113: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1146: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_private_session': pam_radius_auth.c:1267: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1288: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_chauthtok': pam_radius_auth.c:1374: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1395: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1404: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing arg 3 of `pam_get_item' from incompatible pointer type make: *** [pam_radius_auth.o] Error 1 hqwww01tban{root} @: -- Lust, ein paar Euro nebenbei zu verdienen? Ohne Kosten, ohne Risiko! Satte Provisionen f�r GMX Partner: http://www.gmx.net/de/go/partner

2 2

How can i change Configure file.
by Manojkumar Patel 05 Dec '05

05 Dec '05

Hi all I have one problem. I want to pass config parameters in one Config.ini My Config.ini file is like: --no-create --sysconfdir=/home/manoj/RadiusServer --with-logdir=/home/manoj/RadisuServer When I w run config file like ./configure < Config.ini But radius server was configured as default setting. But I want to change default setting. I want to pass all parameter in one file instead of Command line argument. How can I do that requirements ? Thanks & Regard Manoj Patel MBT Ltd-Pune, Next Generation Network (IN) group Phone: (020) 56018100 (Exnt: 2845) Mobile: +91-9881403519 ********************************************************* Disclaimer: The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use *********************************************************

3 2

FW: How can i change Configure file.
by Manojkumar Patel 05 Dec '05

05 Dec '05

Hi I make configuration with following syntex $ xargs ./configure < Config.ini But my FreeRadiussercer is take logfile and sysconfdir as default. Thanks Manoj -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Nicolas Baradakis Sent: Monday, December 05, 2005 5:08 PM To: FreeRadius users mailing list Subject: Re: How can i change Configure file. Manojkumar Patel wrote: > My Config.ini file is like: > --no-create > --sysconfdir=/home/manoj/RadiusServer > --with-logdir=/home/manoj/RadisuServer > When I w run config file like > ./configure < Config.ini > But radius server was configured as default setting. But I want to > change default setting. > I want to pass all parameter in one file instead of Command line > argument. How can I do that requirements ? You could try this command line: $ xargs ./configure < Config.ini And please turn HTML off when posting to a mailing list. http://freeradius.org/list/users.html -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************* Disclaimer: The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use *********************************************************

1 0

RE: Fall-through and different NAS IP Settings
by Jonathan De Graeve 05 Dec '05

05 Dec '05

>> I'm just asking this for my understanding, am I still going to want to >>use Client-IP-Address even though from what I can see here, the NAS-IP- >> Address attribute is appearing within the output of debugging? > I would suggest using Client-IP-Address, unless you know that the >NAS will always send that attribute with that value. > As for why it doesn't match, I'm not sure. Try editing the "users" >file entry to see if you can narrow down the problem. How do you explain this then? I have a NAS that DOESN'T sent NAS-IP-Address attribute to the radius server (only nas-identifier) but all my huntgroups based on NAS-IP-Address work without any problem... Is this then somewhere in the code? If (!NAS-IP-Address && Client-IP-Address) NAS-IP-Address = Client-IP-Address J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be

2 1

Basic Question
by Santy 05 Dec '05

05 Dec '05

Dear all, first of all let me say thanks to those who had make this incredible opensource :). I am new with freeradius and I hope all you guys don't mind to answer my basic question. I want to build system with only for one or 2 users. And I wonder whether : 1. I need database for it(mySQL)? first I thought I won't need it but then I think i might need it for my accounting report. Or can I have it in a simple txt file? 2. I already build the system using 2 computers, one act as NAS and server. The other as client. Is my configuration right? 3. Can I not using EAP? while for now it is enough just authenticate the user from his password. Thanks a lot before and hope you are willing to answer them. SanSar __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Installing a signed SSL certificate
by Laker Netman 05 Dec '05

05 Dec '05

I am considering use of a CA-signed SSL certificate. Comodo (instantssl.com) offers an "Intranet SSL" certificate good on a single, internal host. All of their documentation refers to set up with a web server or for email verification. Would it also work with FR? There signed certificates are returned as ".crt" files, is this the same as the cert-srv.pem referenced in the self-signed tutorial? TIA, Laker. __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

3 3

connection to netowrk problem
by debik 04 Dec '05

04 Dec '05

Hello ! I have configured the freeradius with peap authentication. Then when i try connect to the NAS with username and password the raidus server allow me to log and the connection seems to be ok. Bu when I try to ping some host on my network, theres no response. I am connected but i dont se any network. I could't even ping the NAS who says that I'am connetcetd to him. My configs are: /usr/local/radius/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. clients.conf mam nastepujacy: client 192.168.0.0/24 { secret = test shortname = Dlink } users Auth-Type :=EAP, User-Password == "password" Service-Type = Frames-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.0.21, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP Any suggestions ???

2 4

How to transfer authentication method from system to mysql?
by darkblue 04 Dec '05

04 Dec '05

Hi experts, I got a problem when using freeradius for authentication network staff to login the network device. we have two type of devices, 3com and cisco, they are have difference VSA,at the same time, the network staff are divided into two group: admin and monitor, the admin have the read/write privilige, the monitor should only have read privilige.So I use such users file: /etc/freeradius/users DEFAULT Auth-Type := System, Group == "admin", Huntgroup-Name == "cisco" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Login-Service = Telnet DEFAULT Auth-Type := System, Group == "monitor", Huntgroup-Name == "cisco" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=1", Login-Service = Telnet DEFAULT Auth-Type := System, Group == "admin", Huntgroup-Name == "3com" Login-Service = Telnet, 3Com-User-Access-Level = 3 DEFAULT Auth-Type := System, Group == "monitor", huntgroup-Name == "3com" Login-Service = Telnet, 3Com-User-Access-Level = 1 and create 4 accounts within debian linux, for example, aaa, bbb, ccc, ddd. aaa and bbb are member of admin group, ccc and ddd are member of monitor group, debian sarge linux group info /etc/group(debian linux) admin:x:1001:aaa,bbb monitor:x:1010:ccc,ddd the /etc/huntgroup: cisco NAS-IP-Address == 192.168.1.1 cisco NAS-IP-Address == 192.168.1.2 cisco NAS-IP-Address == 192.168.1.3 3com NAS-IP-Address == 192.168.1.4 3com NAS-IP-Address == 192.168.1.5 3com NAS-IP-Address == 192.168.1.6 this kind of configuration work just fine. and now, I would like to use mysql for user db backend. So I got two problem. 1. could mysql utilize the huntgroup file? 2. how to transfer this user info , group check and group reply info into mysql? -- He is nothing -- He is nothing

2 1