- Freeradius-Users - lists.freeradius.org

Cisco AP Vlan assignment when proxying EAP-PEAP?
by Palmer J.D.F. 08 Nov '05

08 Nov '05

Hi, Can anyone tell me if it's possible to proxy EAP-PEAP from a Cisco Aironet to an IAS server via FreeRADIUS (I can do this bit), then, set the user's VLAN information within FreeRADIUS in the access-accept packet returned to the AP? Also, is there a way to return an access-accept with a 'dirty' VLAN ID, even if the IAS server rejects the user? The idea being that the user would be put into a dead end VLAN so they could get info on how to register to use the service. Many thanks, Jezz Palmer. **************************************** Jezz Palmer. Internet Systems Officer. Library and Information Services University of Wales, Swansea Singleton Park Swansea SA2 8PP ****************************************

2 1

Radius died, restarting
by hannibal 08 Nov '05

08 Nov '05

i use radwatch to check the status of the radiusd, but it keeps sending "Radius died, restarting" mail to me, but radiusd runs well if i donnot run radwatch. pls tell why, thanks.

1 0

ntlm_auth commandline ok, radius not ok
by Völker, Christian 08 Nov '05

08 Nov '05

Yohoo! I've a (for me) strange problem mit ntlm_auth. I want to use freeradius as an proxy for authentication against ActiveDirectory. So I've installed winbind. "wbinfo -u" and "wbinfo -g" shows me the User and Grouplists. Nice :) I've configured freeradius like Alan DeKok showed in his posting from Tue Jul 12 18:33:05 CEST 2005: -----------snip--------------- modules { ... exec win_domain { wait = yes input_pairs = request output_pairs = reply program = "ntlm_auth --username=\"%{User-Name}\" --password=\'%{User-Password}\' --domain=mydomain" } ... } Now list "win_domain" in the "authenticate" section, and add the following entry to the "users" file: DEFAULT Auth-Type = win_domain -----------snip--------------- When I start ntlm_auth on command line: server:/# /usr/bin/ntlm_auth --username='_web' --password='XXXXX!' --domain=mydomain NT_STATUS_OK: Success (0x0) All is ok. :) Trying the same with radtest: ldaptest02:/etc/raddb# radtest "_web" 'XXXXX!' localhost 10 testing123 Sending Access-Request of id 75 to 127.0.0.1:1812 User-Name = "_web" User-Password = "XXXXX!" NAS-IP-Address = ldaptest NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=75, length=20 Nothing is ok :-( Logfiles: -----------snip--------------- Nov 8 13:58:57 ldaptest radiusd: modcall: group authorize returns ok for request 8 Nov 8 13:58:57 ldaptest radiusd: rad_check_password: Found Auth-Type win_domain Nov 8 13:58:57 ldaptest radiusd: auth: type "win_domain" Nov 8 13:58:57 ldaptest radiusd: Processing the authenticate section of radiusd.conf Nov 8 13:58:57 ldaptest radiusd: modcall: entering group Auth-Type for request 8 Nov 8 13:58:57 ldaptest radiusd: radius_xlat: '/usr/bin/ntlm_auth --username='_web' --password='XXXXX!' --domain=central' Nov 8 13:58:57 ldaptest radiusd: Exec-Program: /usr/bin/ntlm_auth --username='_webman' --password='XXXXX!' --domain=central Nov 8 13:58:57 ldaptest radiusd: Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Nov 8 13:58:57 ldaptest radiusd: Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Nov 8 13:58:57 ldaptest radiusd: Exec-Program: returned: 1 Nov 8 13:58:57 ldaptest radiusd: rlm_exec (win_domain): External script failed Nov 8 13:58:57 ldaptest radiusd: modcall[authenticate]: module "win_domain" returns fail for request 8 -----------snip--------------- The line in the log is the same as I enter it at command line. Why is the answer different? Thanks for your help and/ or ideas for problem solution! Greets from Germany Christian

1 0

Ldap truncating output
by Pedro Marcolino 08 Nov '05

08 Nov '05

Hi, I've installed the latest version of freeradius(1.0.5), and when using it with LDAP i'm having some problems. Some output is being truncated( mainly in cisco-avpairs ): rlm_ldap: performing search in o=radius, with filter (uid=wy09jmru) rlm_ldap: Added password i2dhmljk in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding ispRadiusLoginLimit as Simultaneous-Use, value 1 & op=21 rlm_ldap: Adding ispRadiusAuthType as Auth-Type, value 1 & op=21 rlm_ldap: Adding ispRadiusPassword as User-Password, value password & op=21 rlm_ldap: Adding ispRadiusUserName as User-Name, value wy09jmru & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding ispRadiusCiscoAVPair as Cisco-AVPair, value lcp:interface-config & op=11 rlm_ldap: Adding ispRadiusCiscoAVPair as Cisco-AVPair, value lcp:interface-config & op=11 rlm_ldap: Adding ispRadiusFramedIPAddress as Framed-IP-Address, value 12.1.1.8 & op=11 rlm_ldap: Adding ispRadiusFramedProtocol as Framed-Protocol, value 1 & op=11 rlm_ldap: Adding ispRadiusServiceType as Service-Type, value 2 & op=11 rlm_ldap: user wy09jmru authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type 1 auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "wy09jmru" with password "password" rlm_ldap: user DN: uid=wy09jmru,ou=People,o=xxx.xxx,o=Radius rlm_ldap: (re)connect to ldap:389, authentication 1 rlm_ldap: bind as uid=wy09jmru,ou=People,o=xxx.xxx,o=Radius/i2dhmljk to ldap:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user wy09jmru authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: group Auth-Type returns ok for request 2 Processing the session section of radiusd.conf modcall: entering group session for request 2 radius_xlat: 'wy09jmru(a)xxx.xxx' rlm_sql (sql): sql_set_user escaped user --> 'wy09jmru(a)xxx.xxx' radius_xlat: 'SELECT COUNT(*) FROM radacct WHERE UserName='wy09jmru(a)xxx.xxx' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 8 rlm_sql (sql): Released sql socket id: 8 modcall[session]: module "sql" returns ok for request 2 modcall: group session returns ok for request 2 Sending Access-Accept of id 7 to 10.16.2.10:55521 Cisco-AVPair = "lcp:interface-config" Framed-IP-Address = 12.1.1.8 Framed-Protocol = PPP Service-Type = Framed-User Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... Ldapsearch show the following: (...) ispRadiusCiscoAVPair: lcp:interface-config#1=ip vrf forwarding v24:xxx ispRadiusCiscoAVPair: lcp:interface-config#2=ip unnumbered loopback14 (...) Anyone got the same problem? Thanks for the time. Best Regards, Pedro Marcolino

2 2

dialup_admin problems
by Eric Tanguy 08 Nov '05

08 Nov '05

Hello I have some problems with dialup_admin1.62. i use freeradius-1.0.1 with mysql on Fermi Linux LTS Release 3.0.1 - first, I have a problem in showing the online user in dialup_admin. in fact, when i use a telnet user to connect on NAS , it appears in online user but when it 's a ppp user, there is nothing. I think the problem is the radacct table because nothing is writing into this table when it 's a ppp user and i don't know why. - Second, I have a problem with failed logins and users statistic. dialup_admin start with sql debug. the request is ok but nothing is writing into the board. cdt -- Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message etant susceptible d'alteration, l'emetteur decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ----------------------------------- This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. As e-mails are susceptible to alteration, the issuer shall not be liable for the message if altered, changed or falsified.

1 0

mysql.sock moved and cannot be found by freeradius !
by Seferovic Edvin 08 Nov '05

08 Nov '05

Hi, and a big HEEEEEEEEEEEELP ( or should I say - save our/my soul ).... I've moved my mysql database to another partition ( databases were getting big ) and Ive corrected my mysql config so that the socket file is now located at /data/mysql/mysql.sock. Restarted MySql - and it worked.. but my freeradius ( 1.0.5 ) first crashed with seg. fault ( I suppose this happened because of an Access-Request packet while restarting the server )... and when I started it for the second time - it said that it cannot find the mysql.sock file in the "usual" place ( /var/lib/mysql/mysql.sock )... is the location of mysql.sock hard-coded in freeradius ? What can I do to get my radius connect to mysql ? Thank you very much in advance... Regards, Edvin Seferovic

6 13

Freeradius the right tool as Windows Authentication Proxy?
by Thomas Stieglitz 08 Nov '05

08 Nov '05

Hello all, I'm new on this list - and a little bit with the subject "free radius" and radius technology, too. So sry in advance, if I'm off topic ;-) or if the question was already asked, I didn't find it within the mailing list's archive. I've got a conceptional problem, and I'm woundering whether freeradius might be the aporopiate tool to solve it. We're running an apache 1.X webserver, which is located at an external provider. My problem is, that we need to authenticate webusers against our Windows 2000 Active Directory, which is located in our companies' local network. My idea is, to locate an Freeradius Server in the DMZ. This server would have the job, to accept calls from the webserver (over an IP-Tunnel), ask the AD whether username and password are o.k. and return this information to the webserver. Here are my questions in particular: 1) Is this idea a possible solution ... the right use of an radius-server? And, if yes: is freeradius the right tool for it? 2) If yes: Is it also possible, to gain group information about a user. (i. e. Is Fred Member of Group Foo? Which groups is Fred member of?) 3) if yes: how do I find an entry point for further information about this special subject? 4) Is someone out there running an simular configuration and give me an hand, hints, show me quirks etc.? I'm happy for any advice, thanks in advance for it! Tom ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

3 2

[OTAnn] Feedback
by shenanigans 07 Nov '05

07 Nov '05

I was interested in getting feedback from current mail group users. We have mirrored your mail list in a new application that provides a more aggregated and safe environment which utilizes the power of broadband. Roomity.com v 1.5 is a web 2.01 community webapp. Our newest version adds broadcast video and social networking such as favorite authors and an html editor. It?s free to join and any feedback would be appreciated. S. ---------------------------------------------------------------------------------------------------------------------------------------- Broadband interface (RIA) + mail box saftey = <a href="http://Free_Radius_Users_List.roomity.com">Free_Radius_Users_List.roomity.com</a> *Your* clubs, no sign up to read, ad supported; try broadband internet. ~~1131401587246~~ ----------------------------------------------------------------------------------------------------------------------------------------

1 0

perl and additional response attributes
by Emil Wilmanski 07 Nov '05

07 Nov '05

Hi, I'm testing freeradius 1.0.5. I want to add some additional attributes to Access-Accept response using rlm_perl module but when I put perl into "post-auth" block, when I start server it says: radiusd.conf: "perl" modules aren't allowed in 'post-auth' sections -- they have no such method. In freeradius 1.0.2 it is working... How to add additional parameters using some code? (without "radreply") -- Emilus.

2 2

Solaris 8 Make Problems
by Nicholas Thompson 07 Nov '05

07 Nov '05

>-xarch=v8 sounds like a Sun cc option. It's a good idea to work just with >one compiler, sun or gnu. Adjust the PATH that ./configure and make just >see on compiler. I dont have the sun compiler. I am using GCC version 3.3.2 and the gnu linker version 2.14 both of these are located in /usr/local/bin and that is the first directory in my path. > I am new to freeradius. I have a Solaris 8 machine with OpenSSL > version 0.9.8 and MySQL version 5.0.15 (max). Configure completes > without any problems however make fails. I have read many > suggestions on the list, and tries all of them. Such as setting the > LD_LIBRARY_PATH, I even tried to configure and make with just static > libraries. Could there be a problem with freeradius and MySQL5? > Here is a copy of the make output errors: > make[10]: Entering directory `/export/home/nicholas/freeradius-1.0. > 5/src/modules/rlm_sql/drivers/rlm_sql_mysql' > gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c > sql_mysql.c -o sql_mysql.o > gcc: language arch=v8 not recognized > gcc: sql_mysql.c: linker input file unused because linking not done -xarch=v8 sounds like a Sun cc option. It's a good idea to work just with one compiler, sun or gnu. Adjust the PATH that ./configure and make just see on compiler. > /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld - > module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o > -o rlm_sql_mysql.a > (cd . && ln -s sql_mysql.lo sql_mysql.o) > ln: cannot create sql_mysql.o: File exists > make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0