- Freeradius-Users - lists.freeradius.org

Proxy replies not getting to/past proxy
by Kristina Pfaff-Harris 14 Nov '05

14 Nov '05

Hi, all. First, let me say that if the answer to this is in the lists or the docs or rlm_whatever.c, please let me know. I've been searching for a few days, but either I'm not using the right queries to find my answer, or it's not there. (Ain't that always the way?) :-) We recently upgraded from a hacked-n-patched in-house version of FR 0.8.1 to the release version 1.0.5 (which currently has almost all the hacks we needed, and we decided to do without the single one that it doesn't). All configuration files are the same with the exception that we're using the new dictionary. We also use the MegaPOP visp dialup thingy, where users dial into a MegaPOP number as "Login(a)ourdomain.com" and get proxied to our radius servers for authentication. The problem is that with FR 0.8.1, our custom Radius attributes were getting sent back to the proxy and applied to the user. As soon as we implemented 1.0.5, this does not happen and all users are assigned a generic PPP profile regardless of what we have for them here. I would have just bugged the MegaPOP folks (and, indeed, I've done so and now I'm waiting on an email from them to see if they have any ideas), but since it's pretty clearly something that changed between 0.8.1 and 1.0.5, I thought I'd see if anyone here could point me in the right direction. Anyway, any ideas or pointers to docs/code appreciated. Thanks! Kristina

2 3

RE: Newbie question re. dictionary files.
by Bohannan, Chad W 14 Nov '05

14 Nov '05

Mark, You are now able to pass authorization strings to the Netscreen successfully? Are you still using the formats <(NS-Admin-Privilege = "Read-Only-Admin") (NS-Admin-Privilege = "Read-Write-Admin")>? For some reason, all of my authentications fail once I enable remote authorization on the Netscreen. If you have a chance, please post your configuration. Thanks. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Mark Tunnell Sent: Friday, November 04, 2005 4:32 PM To: FreeRadius users mailing list Subject: Re: Newbie question re. dictionary files. I got it! It turns out that not all the dictionary files in /usr/local/share/freeradius directory are included by default. Once I added "$INCLUDE dictionary.netscreen" to the /usr/local/share/freeradius/dictionary file, everything started working. Thanks to everyone who responded, Mark - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

pb w/ accounting: wrong username (anonymous) used
by Markus Krause 14 Nov '05

14 Nov '05

hi all! my setup: radius server: freeradius v.1.0.5 on sles 9, user db in mysql clients: windows xp sp2 intel pro 2200bg * using intel pro/wireless software * using secure w2 user can connect via a foundry ironpoint 200, but accounting does not work as the username used as entry in the mysql table radacct is always "anonymous"! the table radpostauth does contain entries from both "anonymous" and "user1". how can i fix this? thanks in advance for any hints!! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 4

Re: Free Radius and Mobile IP
by jbarnell 14 Nov '05

14 Nov '05

This is a good string to start. We are likely to commit to MobileIP in the near future. I would like to better understand how to implement in a freereadius environment ---------- Original Message ---------------------------------- From: "Stefan A." <lists(a)saitc.de> Reply-To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Date: Mon, 14 Nov 2005 08:55:16 +0100 >All, > >is Mobile IP a Subject for Freeradius? >Has anybody a running Mobile IP environment to talk about the configuration >of the RADIUS server and possibly about other topics of Mobile IP? > > >Thanks. > >Stefan > > > > > ________________________________________________________________ Sent via the WebMail system at barnellts.com

1 0

memory leaks with rlm_perl? (FreeRADIUS bug #221)
by Bjørn Mork 14 Nov '05

14 Nov '05

Hello, I wonder if you were able to resolve this bug? ref http://bugs.freeradius.org/show_bug.cgi?id=221 The reason I ask is that I've just experienced a serious memory leak after upgrading from 1.0.1 to 1.0.5, and we do use rlm_perl so that is one module to suspect. It seems that a colleague of mine has had the same experience previously too, trying to upgrade to 1.0.4. We don't really _know_ that rlm_perl is the cause, though... I will attempt to track the bug down further and provide a test configuration that will demonstrate the problem. Just wondered if you had some ideas we might test first. FWIW, we've been running 1.0.5 on a test server for a couple of months without trouble at all. The problems first showed up when upgrading the heavily loaded production servers. Our configuration was not changed at all on upgrade. I will eventually provide it to aid recreating the bug, but I need som time first to remove all private data from it. Sorry about that. Feel free to ignore me until I've been able to do this work. Just wanted to give an early warning in case someone has the magic solution at hand. Bjørn

3 3

RE: Solaris 10 (SPARC 64bit) - problems installing freeradius 1.0.5
by Reiko U. 14 Nov '05

14 Nov '05

Garrett's hint : https://list.xs4all.nl/pipermail/freeradius-users/2005-November/048278.html solved this problem ... I've used: CLFAGS="-I../include -I/usr/sfw/include/openssl" ./configure --prefix=/usr/local/freeradius --localstatedir=/var/ --sysconfdir=/etc and "make && make install" finished successfully. great thanks reiko

1 0

Re: Ldap truncating output
by Nicolas Baradakis 14 Nov '05

14 Nov '05

Pedro Marcolino wrote: > Hi Nicolas, > > I'm sorry to bother you again, but even after apllying the patch i > get the same problem. Are you sure this patch will resolve this > problem? Next time please send messages to freeradius-users(a)lists.freeradius.org and not my personal e-mail address. The patch I previously sent fixes a bug in the ldap query string, which isn't the bug you actually hit. Sorry, I've mistaken the problem. After reading your debug output a second time (with more attention) I think you have the same problem as bug #261. http://bugs.freeradius.org/show_bug.cgi?id=261 The short answer is to try adding double quotes to the values inside the LDAP directory. -- Nicolas Baradakis

1 0

Re: radiusd error AFTER ok
by Drew S. Dupont 14 Nov '05

14 Nov '05

Well, it seems to have been an issue with the setuid part of the helper app. I changed it from: if (!(initsetuid(1))) exit(1); to if (!(initsetuid(0))) exit(1); and it now seems to work. Strange that it worked before switching hardware, but at least it is working now. Thanks, Drew S. Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

1 0

Re: radiusd error AFTER ok
by Drew S. Dupont 14 Nov '05

14 Nov '05

>Date: Mon, 14 Nov 2005 01:31:24 -0500 >From: "Alan DeKok" <aland(a)ox.org> >Subject: Re: radiusd error AFTER ok >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <20051114063124.AC9EE16CC1(a)mail.nitros9.org> > >"Drew S. Dupont" <dsdupont(a)alumni.indiana.edu> wrote: >> This app used to work just fine before my recent HD and MoBo crashes >> today. I had to restore the system from a backup and the app. will no >> longer work. > > Uh... make sure it works on a machine that *doesn't* have hardware problems. Yes, it is running on different hardware. But, again, when it is run from the command line it runs fine. When it runs from within the helper app. it throws the errors. Drew Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

1 0

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 14 Nov '05

14 Nov '05

Yohoo! >LDAP advantage is that you can get more information out of >the AD...which is what io believe is the desire in this case Gotcha! :) My google-searches hat driven me into the direction to use _only_ ntlm_auth for authentication vs. AD. Meanwhile I had also triggered out the needed groups-settings. Just for completeness the settings for the groups: ----snip------- /etc/raddb/radiusd.conf [...] groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(& (objectClass=top)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf [...] ----snip------- /etc/raddb/users DEFAULT Ldap-Group == "Cisco-RW" Auth-Type := LDAP DEFAULT Ldap-Group == "Cisco-RO" Auth-Type := LDAP DEFAULT Auth-Type := Reject Reply-Message = "No access." ----snip------- Works fine here. Is there the need of a short howto for the doc/ ? Greets Christian

2 1