- Freeradius-Users - lists.freeradius.org

compile problem on solaris express nv23 x86
by Tariq Rashid 11 Nov '05

11 Nov '05

doing a configure ./configure --prefix=/opt/freeradius-snapshot-20051110 --with-openssl-includes=/usr/sfw/include/openssl --with-openssl-libraries=/usr/sfw/lib using the 20051110 snapshot - i still don't get a compile. havong said that this is much better than 1.0.2 and 1.0.5 any ideas? solaris express x86 nv23 DOES have the appropriate libraries and tools installed - openssl, gmake etc gmake gives: hmac.c: In function `lrad_hmac_md5': hmac.c:47: error: `lrad_MD5_CTX' undeclared (first use in this function) hmac.c:47: error: (Each undeclared identifier is reported only once hmac.c:47: error: for each function it appears in.) hmac.c:47: error: syntax error before "context" hmac.c:59: error: syntax error before "tctx" hmac.c:61: warning: implicit declaration of function `lrad_MD5Init' hmac.c:61: warning: nested extern declaration of `lrad_MD5Init' hmac.c:61: error: `tctx' undeclared (first use in this function) hmac.c:62: warning: implicit declaration of function `lrad_MD5Update' hmac.c:62: warning: nested extern declaration of `lrad_MD5Update' hmac.c:63: warning: implicit declaration of function `lrad_MD5Final' hmac.c:63: warning: nested extern declaration of `lrad_MD5Final' hmac.c:95: warning: nested extern declaration of `lrad_MD5Init' hmac.c:61: warning: redundant redeclaration of 'lrad_MD5Init' hmac.c:61: warning: previous implicit declaration of 'lrad_MD5Init' was here hmac.c:95: error: `context' undeclared (first use in this function) hmac.c:97: warning: nested extern declaration of `lrad_MD5Update' hmac.c:62: warning: redundant redeclaration of 'lrad_MD5Update' hmac.c:62: warning: previous implicit declaration of 'lrad_MD5Update' was here hmac.c:99: warning: nested extern declaration of `lrad_MD5Final' hmac.c:63: warning: redundant redeclaration of 'lrad_MD5Final' hmac.c:63: warning: previous implicit declaration of 'lrad_MD5Final' was here gmake[4]: *** [hmac.lo] Error 1 gmake[4]: Leaving directory `/home/tariq/freeradius/freeradius-snapshot-20051110/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/tariq/freeradius/freeradius-snapshot-20051110/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/tariq/freeradius/freeradius-snapshot-20051110/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/tariq/freeradius/freeradius-snapshot-20051110' gmake: *** [all] Error 2

2 1

RE: VSA id's higer than 255
by Swaran S. Sethi 10 Nov '05

10 Nov '05

Thanks Alan. -Swaran -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, November 10, 2005 3:45 PM To: FreeRadius users mailing list Subject: Re: VSA id's higer than 255 "Swaran S. Sethi" <ssethi(a)kinetowireless.com> wrote: > I was writing to check if support for "VSA Id's higher than 255" has > been added in freeRadius 1.0.5. I will appreciate any feedback you guys > might have. It's not in 1.0.5, and I'm not sure it will be. It's in the CVS head, including Starent attributes, which are 16/16 bits. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: VSA id's higer than 255
by Swaran S. Sethi 10 Nov '05

10 Nov '05

I was writing to check if support for "VSA Id's higher than 255" has been added in freeRadius 1.0.5. I will appreciate any feedback you guys might have. Regards, Swaran Sethi -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 02, 2005 2:09 PM To: FreeRadius users mailing list Subject: Re: VSA id's higer than 255 Michael Lecuyer <mjl(a)theorem.com> wrote: > The format for the long tag VSA is the same as the standard > Vendor-Specific attribute (8 bit tag, 8 bit length) but the > sub-attribute tag field has been expanded to 16 bits. The sub-attribute > length field remains 8 bits. That doesn't sound too bad. > All vendor specific attributes are coded using 16-bit attribute type in > network byte order and Lucent-Vendor-Id (4846) as Vendor-Id. That makes it easier. > I believe the support for long Vendor-Specific tags was discussed here > in the past with limited interest in support. It's about 40 lines of code to support. The weirdness that I recall was Nortel, which mixed normal VSA's, and USR-style VSA's in the same vendor space. > 192.168.1.1 ... VendorLongTags=Ascend > - indicating that Ascend VSA's use long tags and all other VSA's like > Cisco) would be short. Ascend / Lucent VSA's do not always use long tag > VSAs. If it's always that the Lucent attributes use 16-bit id's, it's OK. > This introduction of long tags is a real wart for every RADIUS server. > There are probably other ways to have avoided 16 bit tags. Naturally the > offender is too big to ignore and arbitrarily forced the issue. Remember > that in the past Ascend (pre-Lucent) grabbed unassigned RADIUS > attributes (from 119 to 255) without thinking there might be a problem > with that either. Yup. I'll add something to the CVS head. Grab a snapshot in a few days, and see if it works. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Sun SSH and pam_radius_auth
by JR Mayberry 10 Nov '05

10 Nov '05

Has anyone seen an issue with Sun SSH and pam_radius_auth where it sends a RADIUS Access-Request packet appearntly during ssh-connection method none? Nov 10 23:30:06 aaa01 sshd[8702]: [ID 800047 auth.debug] debug1: userauth-request for user red service ssh-connection method none Nov 10 23:30:06 aaa01 sshd[8702]: [ID 800047 auth.debug] debug1: attempt 0 failures 0 Nov 10 23:30:06 aaa01 sshd[8702]: [ID 800047 auth.debug] debug1: Starting up PAM with username "red" Nov 10 23:30:06 aaa01 sshd[8702]: [ID 730685 auth.debug] PAM[8702]: pam_start(sshd,red,b6930:cfdc8) - debug = 1 Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:service) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:user) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:conv) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:tty) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 800047 auth.debug] debug1: userauth_banner: sent Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:conv) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 635154 auth.debug] PAM[8702]: pam_authenticate(cfdc8, 1) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 232006 auth.debug] PAM[8702]: load_modules(cfdc8, pam_sm_authenticate)=/usr/lib/security/pam_radius_auth.so.1 Nov 10 23:30:06 aaa01 sshd[8702]: [ID 971319 auth.debug] PAM[8702]: load_function: successful load of pam_sm_authenticate Nov 10 23:30:06 aaa01 sshd[8702]: [ID 232006 auth.debug] PAM[8702]: load_modules(cfdc8, pam_sm_authenticate)=/usr/lib/security/pam_unix.so.1 Nov 10 23:30:06 aaa01 sshd[8702]: [ID 971319 auth.debug] PAM[8702]: load_function: successful load of pam_sm_authenticate Nov 10 23:30:06 aaa01 sshd[8702]: [ID 338151 auth.debug] PAM[8702]: pam_get_user(cfdc8, cfdc8, NULL) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 801593 auth.debug] pam_radius_auth: Got user name red Nov 10 23:30:06 aaa01 sshd[8702]: [ID 801593 auth.debug] pam_radius_auth: Sending RADIUS request code 1 Nov 10 23:30:11 aaa01 sshd[8702]: [ID 801593 auth.error] pam_radius_auth: RADIUS server 172.24.43.230 failed to respond Nov 10 23:30:11 aaa01 sshd[8702]: [ID 801593 auth.error] pam_radius_auth: All RADIUS servers failed to respond. Nov 10 23:30:11 aaa01 sshd[8702]: [ID 801593 auth.debug] pam_radius_auth: authentication failed

1 0

RE: Couldn't open /etc/freeradius/users for reading: Permission denied
by Mitchell, Michael J 10 Nov '05

10 Nov '05

I think your problem is that the etc/raddb directory isn't readable/executable by your freerad user? If you run the server as root, it first reads the configuration files (radiusd.conf, clients.conf, proxy.conf, etc) then "setuid"'s to the configured "user" before instantiating the modules, etc. Hence, the server has no problem reading the configuration files first time round. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Friday, 11 November 2005 7:12 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Couldn't open /etc/freeradius/users for reading: > Permission denied > > > # ls -lha /etc/freeradius > total 244K > drwxr-s--- 3 root freerad 4.0K 2005-11-10 14:47 . > drwxr-xr-x 71 root root 4.0K 2005-11-10 16:29 .. > -rw-r----- 1 freerad freerad 422 2005-10-16 14:02 acct_users > -rw-r----- 1 freerad freerad 4.0K 2005-10-16 14:02 attrs > drwxr-s--- 3 freerad freerad 4.0K 2005-11-10 12:41 certs > -rw-r----- 1 freerad freerad 189 2005-10-16 14:02 clients

2 1

freeradius wont let realms based auth
by Andres Pazos 10 Nov '05

10 Nov '05

hi, im new to the mailing list. i'd be really thanked if someone could help me with the following issue: im trying to use freeradius with sql and mysql realm based (i.e.: sql when realm=dhcp and mysql when realm=wireless). i've red acct-type and tried to do the same. is that correct?, should i use acct-type?, what should i use instead?. Nevertheless, i'll add the debug of radtest, radiusd and radiusd.conf. radtest: root@andy:/var/log# radtest andy@wireless andy localhost 1812 testing123 Sending Access-Request of id 177 to 127.0.0.1:1812 User-Name = "andy@wireless" User-Password = "andy" NAS-IP-Address = andy NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=177, length=20 radiusd -X: rad_recv: Access-Request packet from host 127.0.0.1:32812, id=177, length=65 User-Name = "andy@wireless" User-Password = "andy" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "wireless" for User-Name = "andy@wireless" rlm_realm: Found realm "wireless" rlm_realm: Proxying request from user andy to realm wireless rlm_realm: Adding Realm = "wireless" rlm_realm: auth_port is not set. Proxy cancelled. modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 212 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 177 to 127.0.0.1:32812 Waking up in 4 seconds... thanks in advance!.

2 1

Running as root to authenticate against system accounts..
by Kevin Hanser 10 Nov '05

10 Nov '05

Hello, I've recently been looking into getting a FreeRADIUS server to authenticate against the system passwd file. When I was originally testing, it always seemed to reject my access, no matter what I tried. So I did some searching on the lists, and found another person that was having a similar issue. They discovered that the system only allows root to read the shadow password file, so when radius was requesting the password, it would get rejected. So I changed my setup to run the radiusd daemon as root, and tested again. Sure enough, if radiusd is run as root, I can authenticate against the system. So now my question is: What security concerns should I have if I run the radiusd as root? Is there another way to do this that doesn't require radiusd to run as root? Basically, I just want to make sure this is the best way to authenticate against system accounts, or if there's some other method that I've missed :) thx! k

2 2

Couldn't open /etc/freeradius/users for reading: Permission denied
by Dominik Benninger 10 Nov '05

10 Nov '05

hi everybody im trying to set up freeradius but i cant advance anymore because of this silly error. all information you need to know are down below. i might not see the wood for the trees, so please be easy on me! :-) # freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "shadow" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Couldn't open /etc/freeradius/users for reading: Permission denied Errors reading /etc/freeradius/users radiusd.conf[1035]: files: Module instantiation failed. # ls -lha /etc/freeradius total 244K drwxr-s--- 3 root freerad 4.0K 2005-11-10 14:47 . drwxr-xr-x 71 root root 4.0K 2005-11-10 16:29 .. -rw-r----- 1 freerad freerad 422 2005-10-16 14:02 acct_users -rw-r----- 1 freerad freerad 4.0K 2005-10-16 14:02 attrs drwxr-s--- 3 freerad freerad 4.0K 2005-11-10 12:41 certs -rw-r----- 1 freerad freerad 189 2005-10-16 14:02 clients -rw-r----- 1 freerad freerad 2.9K 2005-10-16 14:02 clients.conf -rw-r----- 1 freerad freerad 929 2005-10-16 14:02 dictionary -rw-r----- 1 freerad freerad 8.9K 2005-10-16 14:02 eap.conf -rw-r----- 1 freerad freerad 8.1K 2005-10-16 14:02 experimental.conf -rw-r----- 1 freerad freerad 2.4K 2005-10-16 14:02 hints -rw-r----- 1 freerad freerad 1.6K 2005-10-16 14:02 huntgroups -rw-r----- 1 freerad freerad 2.3K 2005-10-16 14:02 ldap.attrmap -rw-r----- 1 freerad freerad 9.2K 2005-10-16 14:02 mssql.conf -rw-r----- 1 freerad freerad 1020 2005-10-16 14:02 naslist -rw-r----- 1 freerad freerad 856 2005-10-16 14:02 naspasswd -rw-r----- 1 freerad freerad 12K 2005-10-16 14:02 oraclesql.conf -rw-r----- 1 freerad freerad 15K 2005-10-16 14:02 postgresql.conf -rw-r----- 1 freerad freerad 1.1K 2005-10-16 14:02 preproxy_users -rw-r----- 1 freerad freerad 8.7K 2005-10-16 14:02 proxy.conf -rw-r----- 1 freerad freerad 57K 2005-11-10 20:17 radiusd.conf -rw-r----- 1 freerad freerad 187 2005-10-16 14:02 realms -rw-r----- 1 freerad freerad 1.4K 2005-10-16 14:02 snmp.conf -rw-r----- 1 freerad freerad 14K 2005-10-16 14:02 sql.conf -rw-r----- 1 freerad freerad 6.8K 2005-11-10 20:03 users -rw-r----- 1 freerad freerad 7.1K 2005-10-16 14:02 x99.conf -rw-r----- 1 freerad freerad 4.1K 2005-10-16 14:02 x99passwd.sample

1 0

RE: loading files to oracle
by Eyas Sarabi 10 Nov '05

10 Nov '05

Hi Alan; I have dialup connection detail file having the information for each connected session,a hard disk was corrupted so when the radius tried to write directly to Oracle database it could because of the HD failure. Now I have file per each day including all information about the session was connected each day and want to load it to DB. Is there any tools that can be Used to write the contents of files to database directly the same way it is Automated through freeradius. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-> > > users-bounces(a)lists.freeradius.org] On Behalf Of freeradius-users-> > > > > request(a)lists.freeradius.org > Sent: Thursday, November 10, 2005 8:40 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 7, Issue 31 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > Today's Topics: > 1. Re: FreeBSD anyone? (Alan DeKok) > 2. Re: Failed attempts log (Alan DeKok) > 3. Re: Failed attempts log (Nicolas Baradakis) > 4. Re: JRadius (Raoul Demour) > 5. Re: Proxy not sending out packets (was Re: Proxying a PEAP > request to an IAS server) (Dan Newcombe) > 6. Re: Problem with loading files from free radius (Alan DeKok) > 7. Re: simultaneous use, checkrad, and MPP attempts (Alan DeKok) > 8. Re: simultaneous use, checkrad, and MPP attempts (Kevin Bonner) > 9. authenticate against bytes in and out with sqlcounter > (Martin Potgieter) > 10. Problem with loading files from free radius (Eyas Sarabi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 09 Nov 2005 13:00:27 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: FreeBSD anyone? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109180027.7F7FC16CC1(a)mail.nitros9.org> christian meutes <christian.meutes(a)de.clara.net> wrote: > Can you point me to the explanation, i cant find it? http://www.freeradius.org/cgi-bin/cvsweb.cgi/radiusd/man/man5/rlm_sql_log.5? rev=1.2&content-type=text/x-cvsweb-markup Alan DeKok. ------------------------------ Message: 2 Date: Wed, 09 Nov 2005 13:01:48 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Failed attempts log To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109180148.A5EE817122(a)mail.nitros9.org> "Thierry Hoferlin" <thierry.hoferlin(a)staff.cybernet.be> wrote: > Is there a way to log failed authentification records to SQL ? Not really, no. Alan DeKok. ------------------------------ Message: 3 Date: Wed, 9 Nov 2005 19:08:55 +0100 From: Nicolas Baradakis <nbk(a)sitadelle.com> Subject: Re: Failed attempts log To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109180855.GA18225(a)asuka.tech.sitadelle.com> Content-Type: text/plain; charset=us-ascii Thierry Hoferlin wrote: > I've configured a freeradius 1.0.5 with MSSQL authentification. > It works fine. > > Is there a way to log failed authentification records to SQL ? Please don't post HTML on the list. Search the archives for detailed instructions, but the general idea is to use the module "sql" in section "post-auth". http://freeradius.org/radiusd/doc/Post-Auth-Type -- Nicolas Baradakis ------------------------------ Message: 4 Date: Wed, 9 Nov 2005 10:12:06 -0800 (PST) From: Raoul Demour <kongo_007(a)yahoo.com> Subject: Re: JRadius To: freeradius-users(a)lists.freeradius.org Message-ID: <20051109181206.34792.qmail(a)web53211.mail.yahoo.com> Content-Type: text/plain; charset=iso-8859-1 Hello thanks for all the answers! > Regarding EAP-SIM, JRadius has no specific support > for it. What is it > you are trying to do? What I have understood: FreeRADIUS is able to authenticate using EAP-SIM. But you need to set the attributes: EAP-SIM-Rand1 EAP-SIM-SRES1 EAP-SIM-KC1 EAP-SIM-Rand2 EAP-SIM-SRES2 EAP-SIM-KC2 EAP-SIM-Rand3 EAP-SIM-SRES3 EAP-SIM-KC3 (do you really need to set all the 9 attributes? or just one rand, one SRES and one Kc is enough?) I dont have access to GSM network and I dont know Ki (share secret). But to check if the system is correctly set up, I would like to give manually the attributes (on the serveur). (In a way I cheat...). Or to reproduce the generation of Rand, SRES and Kc (using my own algorithm) and on the supplicant I simulate SIM card... With JRadius it is possible to create object like Attr_UserPassword (according to the given example of JRadius). After what, it is used to set the attribut UserPassord for FreeRADIUS. So I think it would not be too complicate to create new attribute like: Attr_EAP_SIM_Rand, Attr_EAP-SIM-SRES, Attr_EAP-SIM-KC. In a way, I would like to use JRadius to avoid writing a module which will set the nine above attributes. My explanation may be not realy clear because I still learning how the thing work (for exemple, I suppose that the algorith to generate Rand, SRES and Kc is mobil operator specific, but I'm not complitly sure of the fact) Raoul __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs ------------------------------ Message: 5 Date: Wed, 09 Nov 2005 13:16:12 -0500 From: Dan Newcombe <DanNewcombe(a)mail.clayton.edu> Subject: Re: Proxy not sending out packets (was Re: Proxying a PEAP request to an IAS server) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <43723CEC.90203(a)mail.clayton.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Alan DeKok wrote: >Dan Newcombe <DanNewcombe(a)mail.clayton.edu> wrote: > > >>One thing I've noticed is on the non-PEAP packets, the src address of >>the packet going to the IAS box is 172.28.240.73, whereas on the PEAP >>packets, it is 127.0.0.1, >> >> > > That's bad. That's the source of the problem, then. > > I have *no* idea why that would be happening. What's so magic about >PEAP packets? > > I'll take a look at the source and see if anything pops out/. >You're using 1.0.5, right? > > Yes...I'm on 1.0.5. Glad to know I'm not crazy - wonder if my wife will believe me though :) Thanks, -Dan ------------------------------ Message: 6 Date: Wed, 09 Nov 2005 16:04:30 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Problem with loading files from free radius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109210430.D390B16CC1(a)mail.nitros9.org> Eyas Sarabi <eyas.sarabi(a)atheer.net.sa> wrote: > I faced a major problem, My Hard disk was corrupted and the free radius > wasn't being able to write to database, I still have the files generated by > free radius and I want to load them to the database .Is there any tool that > can load the generated files to oracle database ? What files? Alan DeKok. ------------------------------ Message: 7 Date: Wed, 09 Nov 2005 16:06:06 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: simultaneous use, checkrad, and MPP attempts To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109210606.A121B16CC1(a)mail.nitros9.org> Christopher Carver <ccarver(a)pennswoods.net> wrote: > The proxy'ing radius servers and NAS's of the other company from whom we > lease equipment are unavailable to checkrad. By default shouldn't it be > allowing these people on? It depends what you want. The current behavior is to disallow logins, as you found out. It should really be configurable. > Any idea why this isn't behaving how I expect? Is there a more > appropriate way I can ensure that users connecting via NAS's and > proxy'ing radius servers we lease will never be rejected because of > multiple logins? No, juest edit the code. Alan DeKok. ------------------------------ Message: 8 Date: Wed, 9 Nov 2005 16:20:38 -0500 From: Kevin Bonner <keb(a)pa.net> Subject: Re: simultaneous use, checkrad, and MPP attempts To: freeradius-users(a)lists.freeradius.org Message-ID: <200511091620.41060.keb(a)pa.net> Content-Type: text/plain; charset="iso-8859-1" On Wednesday 09 November 2005 00:35, Christopher Carver wrote: > The proxy'ing radius servers and NAS's of the other company from whom we > lease equipment are unavailable to checkrad. By default shouldn't it be > allowing these people on? I looked at the code and it seemed as though > it should. I set the nastype to other in clients.conf for these entries > and I still see MPP attempts. Finally, I looked at the source of > checkrad. I modified the line for "other" nastypes to always return 0, > which should be interpreted as no multiple login. The numbers you see > to the left are line numbers Chris, Look at the code again. In session.c, the rad_check_ts function is what calls checkrad. If the nastype is empty or "other", checkrad is _never_ called, and the function returns 1 (meaning the user is logged in). We did this simult use bypass by using a nastype called visp, which returns 0 in checkrad. See freeradius bug#166 for a checkrad patch we've been using here which cleans up the code a bit and makes it easier to add new types. Any comments/problems can be posted to the bug. -Kevin

2 1

FreeRADIUS Proxy
by Chanin Luangingkasut 10 Nov '05

10 Nov '05

Hello All, I've stupid question about radius proxy configuration followed: On master(192.168.5.1 <http://192.168.5.1>) proxy.conf --- proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm suffix { format = suffix delimiter = "@" } realm mydomain.org <http://mydomain.org> { type = radius authhost = LOCAL accthost = LOCAL } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } On proxy(192.168.5.10 <http://192.168.5.10>) proxy.conf --- proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = yes } proxy_requests = yes realm suffix { format = suffix delimiter = "@" } realm mydomain.org <http://mydomain.org> { type = radius authhost = 192.168.5.1:1645 <http://192.168.5.1:1645> accthost = 192.168.5.1:1646 <http://192.168.5.1:1646> secret = vtwidyogouUp nostrip } There are not work, please let me know about how to setup proxy radius. Thank you, Chanin.

2 1