- Freeradius-Users - lists.freeradius.org

Framed-Route and proxying
by Jason Frisvold 08 Nov '05

08 Nov '05

Hi there, I'm looking for a way to force certain users through a proxy. I *think* Framed-Routes are the way to go. Can someone help me out a little? Our users either dial in via a Patton RAS unit, or a Redback SMS-500. Any help would be appreciated. Thanks! -- Jason 'XenoPhage' Frisvold XenoPhage0(a)gmail.com

3 4

Strange issue.
by shadur＠systemec.nl 08 Nov '05

08 Nov '05

A while ago I upgraded our freeradius server to 1.0.2 from a 0.9.x version, and ever since our ISDN dial-up users can not gain access when their login type in radcheck is Crypt-Password. If I change them to a User-Password attribute and the cleartext password, it works. I've compiled a debug log at http://tenchi.systemec.nl/~shadur/radlog.txt with the SQL query outputs added below the queries where they are made. This exact setup worked with 0.9.x ; I've ru -- Rens Houben | opinions are mine Resident linux guru and sysadmin | if my employers have one Systemec Internet Services. |they'll tell you themselves PGP key at http://marduk.systemec.nl/~shadur/shadur.key.asc

2 1

RE: Solaris Make Problems
by Nicholas Thompson 08 Nov '05

08 Nov '05

I finally got freeradius to make without errors. However to do this I had to manually change the Makefile (in src/modules/rlm_sql/drivers/rlm_sql_mysql)and take out these options -x03 -mt and -xarch=v8, but I am not sure if this will affect the stability or useage of freeradius. >-xarch=v8 sounds like a Sun cc option. It's a good idea to work just with >one compiler, sun or gnu. Adjust the PATH that ./configure and make just >see on compiler. >I dont have the sun compiler. I am using GCC version 3.3.2 and the gnu linker version 2.14 >both of these are located in /usr/local/bin and that is the first directory in my path. > I am new to freeradius. I have a Solaris 8 machine with OpenSSL > version 0.9.8 and MySQL version 5.0.15 (max). Configure completes > without any problems however make fails. I have read many > suggestions on the list, and tries all of them. Such as setting the > LD_LIBRARY_PATH, I even tried to configure and make with just static > libraries. Could there be a problem with freeradius and MySQL5? > Here is a copy of the make output errors: > make[10]: Entering directory `/export/home/nicholas/freeradius-1.0. > 5/src/modules/rlm_sql/drivers/rlm_sql_mysql' > gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c > sql_mysql.c -o sql_mysql.o > gcc: language arch=v8 not recognized > gcc: sql_mysql.c: linker input file unused because linking not done -xarch=v8 sounds like a Sun cc option. It's a good idea to work just with one compiler, sun or gnu. Adjust the PATH that ./configure and make just see on compiler. > /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld - > module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o > -o rlm_sql_mysql.a > (cd . && ln -s sql_mysql.lo sql_mysql.o) > ln: cannot create sql_mysql.o: File exists > make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

2 1

Re: Freeradius the right tool as Windows Authentication Proxy?
by Thomas Stieglitz 08 Nov '05

08 Nov '05

Hello Helen, thank you for your informative answer! > It's possible, but I don't think RADIUS is the right tool. Which one or which technics do you think ist the right solution for my problem? Greetings, Tom Stieglitz FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 07.11.05 18:38:23: > > Thomas Stieglitz <Starglider7(a)web.de> wrote: > > We're running an apache 1.X webserver, which is located at an > > external provider. My problem is, that we need to authenticate > > webusers against our Windows 2000 Active Directory, which is located > > in our companies' local network. > > I would recommend using an Apache module for this task. Maybe > mod_ntlm, or mod_smb would be appropriate. > > > 1) Is this idea a possible solution ... the right use of an radius-server? And, if yes: is freeradius the right tool for it? > > It's possible, but I don't think RADIUS is the right tool. > > > 2) If yes: Is it also possible, to gain group information about a user. (i. e. Is Fred Member of Group Foo? Which groups is Fred member of?) > > Yes, but you can't use RADIUS to send that information to Apache. > > > 3) if yes: how do I find an entry point for further information about this special subject? > > If the documentation doesn't already contain the information you > need, use google to search mailing list archives. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

3 2

Cisco AP Vlan assignment when proxying EAP-PEAP?
by Palmer J.D.F. 08 Nov '05

08 Nov '05

Hi, Can anyone tell me if it's possible to proxy EAP-PEAP from a Cisco Aironet to an IAS server via FreeRADIUS (I can do this bit), then, set the user's VLAN information within FreeRADIUS in the access-accept packet returned to the AP? Also, is there a way to return an access-accept with a 'dirty' VLAN ID, even if the IAS server rejects the user? The idea being that the user would be put into a dead end VLAN so they could get info on how to register to use the service. Many thanks, Jezz Palmer. **************************************** Jezz Palmer. Internet Systems Officer. Library and Information Services University of Wales, Swansea Singleton Park Swansea SA2 8PP ****************************************

2 1

Radius died, restarting
by hannibal 08 Nov '05

08 Nov '05

i use radwatch to check the status of the radiusd, but it keeps sending "Radius died, restarting" mail to me, but radiusd runs well if i donnot run radwatch. pls tell why, thanks.

1 0

ntlm_auth commandline ok, radius not ok
by Völker, Christian 08 Nov '05

08 Nov '05

Yohoo! I've a (for me) strange problem mit ntlm_auth. I want to use freeradius as an proxy for authentication against ActiveDirectory. So I've installed winbind. "wbinfo -u" and "wbinfo -g" shows me the User and Grouplists. Nice :) I've configured freeradius like Alan DeKok showed in his posting from Tue Jul 12 18:33:05 CEST 2005: -----------snip--------------- modules { ... exec win_domain { wait = yes input_pairs = request output_pairs = reply program = "ntlm_auth --username=\"%{User-Name}\" --password=\'%{User-Password}\' --domain=mydomain" } ... } Now list "win_domain" in the "authenticate" section, and add the following entry to the "users" file: DEFAULT Auth-Type = win_domain -----------snip--------------- When I start ntlm_auth on command line: server:/# /usr/bin/ntlm_auth --username='_web' --password='XXXXX!' --domain=mydomain NT_STATUS_OK: Success (0x0) All is ok. :) Trying the same with radtest: ldaptest02:/etc/raddb# radtest "_web" 'XXXXX!' localhost 10 testing123 Sending Access-Request of id 75 to 127.0.0.1:1812 User-Name = "_web" User-Password = "XXXXX!" NAS-IP-Address = ldaptest NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=75, length=20 Nothing is ok :-( Logfiles: -----------snip--------------- Nov 8 13:58:57 ldaptest radiusd: modcall: group authorize returns ok for request 8 Nov 8 13:58:57 ldaptest radiusd: rad_check_password: Found Auth-Type win_domain Nov 8 13:58:57 ldaptest radiusd: auth: type "win_domain" Nov 8 13:58:57 ldaptest radiusd: Processing the authenticate section of radiusd.conf Nov 8 13:58:57 ldaptest radiusd: modcall: entering group Auth-Type for request 8 Nov 8 13:58:57 ldaptest radiusd: radius_xlat: '/usr/bin/ntlm_auth --username='_web' --password='XXXXX!' --domain=central' Nov 8 13:58:57 ldaptest radiusd: Exec-Program: /usr/bin/ntlm_auth --username='_webman' --password='XXXXX!' --domain=central Nov 8 13:58:57 ldaptest radiusd: Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Nov 8 13:58:57 ldaptest radiusd: Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Nov 8 13:58:57 ldaptest radiusd: Exec-Program: returned: 1 Nov 8 13:58:57 ldaptest radiusd: rlm_exec (win_domain): External script failed Nov 8 13:58:57 ldaptest radiusd: modcall[authenticate]: module "win_domain" returns fail for request 8 -----------snip--------------- The line in the log is the same as I enter it at command line. Why is the answer different? Thanks for your help and/ or ideas for problem solution! Greets from Germany Christian

1 0

Ldap truncating output
by Pedro Marcolino 08 Nov '05

08 Nov '05

Hi, I've installed the latest version of freeradius(1.0.5), and when using it with LDAP i'm having some problems. Some output is being truncated( mainly in cisco-avpairs ): rlm_ldap: performing search in o=radius, with filter (uid=wy09jmru) rlm_ldap: Added password i2dhmljk in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding ispRadiusLoginLimit as Simultaneous-Use, value 1 & op=21 rlm_ldap: Adding ispRadiusAuthType as Auth-Type, value 1 & op=21 rlm_ldap: Adding ispRadiusPassword as User-Password, value password & op=21 rlm_ldap: Adding ispRadiusUserName as User-Name, value wy09jmru & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding ispRadiusCiscoAVPair as Cisco-AVPair, value lcp:interface-config & op=11 rlm_ldap: Adding ispRadiusCiscoAVPair as Cisco-AVPair, value lcp:interface-config & op=11 rlm_ldap: Adding ispRadiusFramedIPAddress as Framed-IP-Address, value 12.1.1.8 & op=11 rlm_ldap: Adding ispRadiusFramedProtocol as Framed-Protocol, value 1 & op=11 rlm_ldap: Adding ispRadiusServiceType as Service-Type, value 2 & op=11 rlm_ldap: user wy09jmru authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type 1 auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "wy09jmru" with password "password" rlm_ldap: user DN: uid=wy09jmru,ou=People,o=xxx.xxx,o=Radius rlm_ldap: (re)connect to ldap:389, authentication 1 rlm_ldap: bind as uid=wy09jmru,ou=People,o=xxx.xxx,o=Radius/i2dhmljk to ldap:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user wy09jmru authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: group Auth-Type returns ok for request 2 Processing the session section of radiusd.conf modcall: entering group session for request 2 radius_xlat: 'wy09jmru(a)xxx.xxx' rlm_sql (sql): sql_set_user escaped user --> 'wy09jmru(a)xxx.xxx' radius_xlat: 'SELECT COUNT(*) FROM radacct WHERE UserName='wy09jmru(a)xxx.xxx' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 8 rlm_sql (sql): Released sql socket id: 8 modcall[session]: module "sql" returns ok for request 2 modcall: group session returns ok for request 2 Sending Access-Accept of id 7 to 10.16.2.10:55521 Cisco-AVPair = "lcp:interface-config" Framed-IP-Address = 12.1.1.8 Framed-Protocol = PPP Service-Type = Framed-User Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... Ldapsearch show the following: (...) ispRadiusCiscoAVPair: lcp:interface-config#1=ip vrf forwarding v24:xxx ispRadiusCiscoAVPair: lcp:interface-config#2=ip unnumbered loopback14 (...) Anyone got the same problem? Thanks for the time. Best Regards, Pedro Marcolino

2 2

dialup_admin problems
by Eric Tanguy 08 Nov '05

08 Nov '05

Hello I have some problems with dialup_admin1.62. i use freeradius-1.0.1 with mysql on Fermi Linux LTS Release 3.0.1 - first, I have a problem in showing the online user in dialup_admin. in fact, when i use a telnet user to connect on NAS , it appears in online user but when it 's a ppp user, there is nothing. I think the problem is the radacct table because nothing is writing into this table when it 's a ppp user and i don't know why. - Second, I have a problem with failed logins and users statistic. dialup_admin start with sql debug. the request is ok but nothing is writing into the board. cdt -- Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message etant susceptible d'alteration, l'emetteur decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ----------------------------------- This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. As e-mails are susceptible to alteration, the issuer shall not be liable for the message if altered, changed or falsified.

1 0

mysql.sock moved and cannot be found by freeradius !
by Seferovic Edvin 08 Nov '05

08 Nov '05

Hi, and a big HEEEEEEEEEEEELP ( or should I say - save our/my soul ).... I've moved my mysql database to another partition ( databases were getting big ) and Ive corrected my mysql config so that the socket file is now located at /data/mysql/mysql.sock. Restarted MySql - and it worked.. but my freeradius ( 1.0.5 ) first crashed with seg. fault ( I suppose this happened because of an Access-Request packet while restarting the server )... and when I started it for the second time - it said that it cannot find the mysql.sock file in the "usual" place ( /var/lib/mysql/mysql.sock )... is the location of mysql.sock hard-coded in freeradius ? What can I do to get my radius connect to mysql ? Thank you very much in advance... Regards, Edvin Seferovic

6 13