- Freeradius-Users - lists.freeradius.org

RE: Newbie question re. dictionary files.
by Bohannan, Chad W 14 Nov '05

14 Nov '05

Mark, You are now able to pass authorization strings to the Netscreen successfully? Are you still using the formats <(NS-Admin-Privilege = "Read-Only-Admin") (NS-Admin-Privilege = "Read-Write-Admin")>? For some reason, all of my authentications fail once I enable remote authorization on the Netscreen. If you have a chance, please post your configuration. Thanks. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Mark Tunnell Sent: Friday, November 04, 2005 4:32 PM To: FreeRadius users mailing list Subject: Re: Newbie question re. dictionary files. I got it! It turns out that not all the dictionary files in /usr/local/share/freeradius directory are included by default. Once I added "$INCLUDE dictionary.netscreen" to the /usr/local/share/freeradius/dictionary file, everything started working. Thanks to everyone who responded, Mark - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

pb w/ accounting: wrong username (anonymous) used
by Markus Krause 14 Nov '05

14 Nov '05

hi all! my setup: radius server: freeradius v.1.0.5 on sles 9, user db in mysql clients: windows xp sp2 intel pro 2200bg * using intel pro/wireless software * using secure w2 user can connect via a foundry ironpoint 200, but accounting does not work as the username used as entry in the mysql table radacct is always "anonymous"! the table radpostauth does contain entries from both "anonymous" and "user1". how can i fix this? thanks in advance for any hints!! with best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 4

Re: Free Radius and Mobile IP
by jbarnell 14 Nov '05

14 Nov '05

This is a good string to start. We are likely to commit to MobileIP in the near future. I would like to better understand how to implement in a freereadius environment ---------- Original Message ---------------------------------- From: "Stefan A." <lists(a)saitc.de> Reply-To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Date: Mon, 14 Nov 2005 08:55:16 +0100 >All, > >is Mobile IP a Subject for Freeradius? >Has anybody a running Mobile IP environment to talk about the configuration >of the RADIUS server and possibly about other topics of Mobile IP? > > >Thanks. > >Stefan > > > > > ________________________________________________________________ Sent via the WebMail system at barnellts.com

1 0

memory leaks with rlm_perl? (FreeRADIUS bug #221)
by Bjørn Mork 14 Nov '05

14 Nov '05

Hello, I wonder if you were able to resolve this bug? ref http://bugs.freeradius.org/show_bug.cgi?id=221 The reason I ask is that I've just experienced a serious memory leak after upgrading from 1.0.1 to 1.0.5, and we do use rlm_perl so that is one module to suspect. It seems that a colleague of mine has had the same experience previously too, trying to upgrade to 1.0.4. We don't really _know_ that rlm_perl is the cause, though... I will attempt to track the bug down further and provide a test configuration that will demonstrate the problem. Just wondered if you had some ideas we might test first. FWIW, we've been running 1.0.5 on a test server for a couple of months without trouble at all. The problems first showed up when upgrading the heavily loaded production servers. Our configuration was not changed at all on upgrade. I will eventually provide it to aid recreating the bug, but I need som time first to remove all private data from it. Sorry about that. Feel free to ignore me until I've been able to do this work. Just wanted to give an early warning in case someone has the magic solution at hand. Bjørn

3 3

RE: Solaris 10 (SPARC 64bit) - problems installing freeradius 1.0.5
by Reiko U. 14 Nov '05

14 Nov '05

Garrett's hint : https://list.xs4all.nl/pipermail/freeradius-users/2005-November/048278.html solved this problem ... I've used: CLFAGS="-I../include -I/usr/sfw/include/openssl" ./configure --prefix=/usr/local/freeradius --localstatedir=/var/ --sysconfdir=/etc and "make && make install" finished successfully. great thanks reiko

1 0

Re: Ldap truncating output
by Nicolas Baradakis 14 Nov '05

14 Nov '05

Pedro Marcolino wrote: > Hi Nicolas, > > I'm sorry to bother you again, but even after apllying the patch i > get the same problem. Are you sure this patch will resolve this > problem? Next time please send messages to freeradius-users(a)lists.freeradius.org and not my personal e-mail address. The patch I previously sent fixes a bug in the ldap query string, which isn't the bug you actually hit. Sorry, I've mistaken the problem. After reading your debug output a second time (with more attention) I think you have the same problem as bug #261. http://bugs.freeradius.org/show_bug.cgi?id=261 The short answer is to try adding double quotes to the values inside the LDAP directory. -- Nicolas Baradakis

1 0

Re: radiusd error AFTER ok
by Drew S. Dupont 14 Nov '05

14 Nov '05

Well, it seems to have been an issue with the setuid part of the helper app. I changed it from: if (!(initsetuid(1))) exit(1); to if (!(initsetuid(0))) exit(1); and it now seems to work. Strange that it worked before switching hardware, but at least it is working now. Thanks, Drew S. Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

1 0

Re: radiusd error AFTER ok
by Drew S. Dupont 14 Nov '05

14 Nov '05

>Date: Mon, 14 Nov 2005 01:31:24 -0500 >From: "Alan DeKok" <aland(a)ox.org> >Subject: Re: radiusd error AFTER ok >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <20051114063124.AC9EE16CC1(a)mail.nitros9.org> > >"Drew S. Dupont" <dsdupont(a)alumni.indiana.edu> wrote: >> This app used to work just fine before my recent HD and MoBo crashes >> today. I had to restore the system from a backup and the app. will no >> longer work. > > Uh... make sure it works on a machine that *doesn't* have hardware problems. Yes, it is running on different hardware. But, again, when it is run from the command line it runs fine. When it runs from within the helper app. it throws the errors. Drew Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

1 0

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 14 Nov '05

14 Nov '05

Yohoo! >LDAP advantage is that you can get more information out of >the AD...which is what io believe is the desire in this case Gotcha! :) My google-searches hat driven me into the direction to use _only_ ntlm_auth for authentication vs. AD. Meanwhile I had also triggered out the needed groups-settings. Just for completeness the settings for the groups: ----snip------- /etc/raddb/radiusd.conf [...] groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=group)(member=%{Ldap-UserDn}))(& (objectClass=top)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf [...] ----snip------- /etc/raddb/users DEFAULT Ldap-Group == "Cisco-RW" Auth-Type := LDAP DEFAULT Ldap-Group == "Cisco-RO" Auth-Type := LDAP DEFAULT Auth-Type := Reject Reply-Message = "No access." ----snip------- Works fine here. Is there the need of a short howto for the doc/ ? Greets Christian

2 1

RE: Failed attempts log
by Thierry Hoferlin 14 Nov '05

14 Nov '05

Thanks Nicolas, It works fine. Just for info, the attributes to use in the mssql.conf file are "postauth_table" and "postauth_query" With the following radius configuration : post-auth { Post-Auth-Type REJECT { sql } } Regards, Thierry. >Thierry Hoferlin wrote: > >> I've configured a freeradius 1.0.5 with MSSQL authentification. >> It works fine. >> >> Is there a way to log failed authentification records to SQL ? > >Please don't post HTML on the list. > >Search the archives for detailed instructions, but the general idea is to use the module "sql" in section "post-auth". > >http://freeradius.org/radiusd/doc/Post-Auth-Type > >-- >Nicolas Baradakis > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0