- Freeradius-Users - lists.freeradius.org

New to List - First Time Set-up
by Mark Sarria 01 Nov '05

01 Nov '05

Hello List, I have been reading about freeradius and would like to set it up in my sandbox environment for testing. Can you point me to the right direction on how to go about setting this service up. Also can you give me a brief list down of the items I will need on my server. At the moment I have been working with Fedora Core 3 running as my Samba-LDAP server, on my sandbox environment. Thanks for your help --mark

1 0

Re: freeradius password caching problem
by tech13＠netaxis.ca 01 Nov '05

01 Nov '05

> -- Original Message ---- > Date: Tue, 01 Nov 2005 17:05:23 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: freeradius password caching problem > ------------------ > tech13(a)netaxis.ca wrote: > > Permissions for /var/run and /var/run/radiusd are: > > > > drwxr-xr-x > > <sigh> That's nice. The question was for *you* to figure out if the > permissions let the server write the pid file. Now that I run it in daemon mode (the -s option also prevents to run in daemon mode), the pid file is created. I included the permissions, even though I had figured it out myself, because sometimes I look and I don't see the typo... As the users file is running and updating correctly with kill -HUP, I will keep it that way. syslog problem is solved with tail -f. Thanks a lot, you have been very helpful! Pierre Forget > > > Yes, I am running it as a daemon with the command: > > > > /usr/local/sbin/radiusd -s -f 2>>/tmp/radius.err >>/tmp/radius.out & > > No, you're not running it as a daemon. See the "man" page. "-f" > says to NOT run as a daemon. > > > Is there any possibility to use the Unix /etc/passwd instead of users? > > Yes. See the default configuration. There's a "unix" module. You > might want to look at it. > > > Do I need to deactivate users somewhere? > > If you want users to be deactivated, probably. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Scripts before 'authenticate', re-writing Attributes items ...
by Roberto Gonzalez Azevedo 01 Nov '05

01 Nov '05

Hi, How can I run scripts in 'authorize' phase, and modify a Attribute item? Something like this : (after 'authorize') Auth-Type = Crypt-Local (after script, BEFORE 'authenticate') Auth-Type = MS-CHAP Thanks. Roberto Gonzalez Azevedo rgonzalez(a)censanet.com.br

1 0

Re: freeradius password caching problem
by tech13＠netaxis.ca 01 Nov '05

01 Nov '05

Hi, First, thanks for the reply. See the comments. Pierre Forget > -- Original Message ---- > Date: Tue, 01 Nov 2005 13:10:30 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: freeradius password caching problem > ------------------ > tech13(a)netaxis.ca wrote: > > 1- the radiusd.pid file is not created > > Have you checked file permissions? Are you running it as a daemon? > Permissions for /var/run and /var/run/radiusd are: drwxr-xr-x Yes, I am running it as a daemon with the command: /usr/local/sbin/radiusd -s -f 2>>/tmp/radius.err >>/tmp/radius.out & > > 2- the passwd file (which I believe is from the users file) is not refreshed. > > The passwd file has nothing to do with the users file. > Is there any possibility to use the Unix /etc/passwd instead of users? With caching and auto refresh? Do I need to deactivate users somewhere? > > I would prefer to use the /etc/passwd file and have it cached, but > > even if I activate it with cache = yes, it doesn't seem to work. I > > also use the cache refresh setting. If I use cache = no, it still > > seem to use the same users file. > > There is no "cache" setting for the "files" module, which is the > one that implements the "users" file. > > To re-read /etc/raddb/users, you have to send a HUP signal to the server. > > > 3- I want to send all the logs to syslog, but this also doesn't seem to work, unless it's sent to a file. I tried syslog_facility = daemon, > > but still doesn't work. > > That doesn't work in 1.0.x. I have a fix for syslog: I use tail -f on the detail file and send it to the logs. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Using the same EAP userid on multiple devices?
by Michael Wang 01 Nov '05

01 Nov '05

Hi, I am trying to set up an environment where I have multiple wireless devices that need to authenticate to an Access Point that uses FreeRadius as its backend authentication server. I am wondering if I can use the same EAP userid and password for all of these devices? Will the FreeRadius server get confused if two or more devices are authenticating at the same time to the FreeRadius server? Or is there something in the radius protocol or in the FreeRadius implementation that keeps track of authentication sessions independently and therefore does not care if multiple sessions are using the same EAP userid? Thanks again for your helpful responses..... Michael

2 2

mysql_ippool
by Mark Novitzkas 01 Nov '05

01 Nov '05

Hi all Finally have ippool working but it seems my setting are messed-up somewhere Radiusd.conf ------------- ippool main_pool { range-start = x.x.x.x range-stop = x.x.x.x netmask = 255.255.255.0 cache-size = 800 session-db = /home/radius/db.ippool ip-index = /home/radius/db.ipindex override = yes Radius Db ---------- Radcheck mysql> select * from radcheck; +----+----------+---------------+----+---------------------------------- --+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+---------------------------------- --+ | 1 | tester | Pool-Name | == | main_pool | I get an access-reject message when sending a radtest? radtest tester <pass> 127.0.0.1 0 <secret> Does radcheck need the Pool-Name attribute? Where do you place the password for user tester in the sql DB? Thanks Notice This email is intended for the addressee only and may contain legally privileged and/or confidential information. If you have received this email in error and are not the intended recipient, you are hereby informed that you are not entitled to read, broadcast, distribute or in any manner whatsoever use the contents of this email or any attachments thereto. You are requested to please notify Psitek that you have received the email and then delete it. Unless clearly stated otherwise, the content and sentiments expressed in this email or any attachments thereto are those of the sender and not of Psitek (Proprietary) Limited. Psitek does not accept liability for any damages, loss or expense of any nature whatsoever arising (a) out of or in connection with the email or any attachments thereto and/or (b) from any act or omission by the recipient relying upon the content of the email or attachments. Psitek further disclaims liability for any damages caused by computer and/or software viruses. Should this email contain the terms of a contract, no binding agreement will result until such time as a written (hardcopy) document is signed on behalf of Psitek.

2 1

freeradius password caching problem
by tech13＠netaxis.ca 01 Nov '05

01 Nov '05

Hi, I am using freeradius version 1.0.5 for authenticating users with Lucent Portmaster 3. I am trying since a few weeks to get the thing straight. People are able to authenticate correctly, but I have a few minor problems. 1- the radiusd.pid file is not created 2- the passwd file (which I believe is from the users file) is not refreshed. I would prefer to use the /etc/passwd file and have it cached, but even if I activate it with cache = yes, it doesn't seem to work. I also use the cache refresh setting. If I use cache = no, it still seem to use the same users file. 3- I want to send all the logs to syslog, but this also doesn't seem to work, unless it's sent to a file. I tried syslog_facility = daemon, but still doesn't work. Any help will be well appreciated. Thanks, Pierre Forget

3 2

RE: appending to a proxy reply attribute
by Tariq Rashid 01 Nov '05

01 Nov '05

if anyone is interested - we did it like this: attr_filter file adds an attribuet because it can distinguish realms attr_rewrite macthes and rewrites in post_proxy seems to work fine. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Joe Maimon Sent: 01 November 2005 12:53 To: FreeRadius users mailing list Subject: Re: appending to a proxy reply attribute Tariq Rashid wrote: > hi - i would like to achieve the following: > > * inspect the reply packet from a proxy target radius > > * if the reply contains "Framed-Route", for example > Framed-Route = 195.40.42.96/30 83.67.214.162 1 > then append a string to the value: > Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-ABC-001 > > * NOTE that the appended string depends on the realm/domain so possibilities are: > for username a(a)ABC.com > Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-ABC-001 > > for username b(a)XYZ.com > Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-XYZ-001 > > how is this possible with freeradius 1.0.2? > > tariq > Well one possible way that occurs to me would be to use an external program with the exec module. attr_rewrite would do it except it seems that you need to check other attributes. rlm_policy would do it, except I dont know about its ability to APPEND to an existing attribute.... Were I you I would also check rlm_perl, something I have never actually done. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

appending to a proxy reply attribute
by Tariq Rashid 01 Nov '05

01 Nov '05

hi - i would like to achieve the following: * inspect the reply packet from a proxy target radius * if the reply contains "Framed-Route", for example Framed-Route = 195.40.42.96/30 83.67.214.162 1 then append a string to the value: Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-ABC-001 * NOTE that the appended string depends on the realm/domain so possibilities are: for username a(a)ABC.com Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-ABC-001 for username b(a)XYZ.com Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-XYZ-001 how is this possible with freeradius 1.0.2? tariq

2 1

can dialup_admin 1.62 work with freeradius 1.02+mysql4.0.25 on debian?
by chen rui 01 Nov '05

01 Nov '05

I find a tool to manage freeradius's user databases: dialup_admin 1.62, but the author didn't update it anymore since 2003, does anybody successfully use this php package to manage freeradius 1.02+mysql4.0.25 located on debian?

2 2