- Freeradius-Users - lists.freeradius.org

freeradius password caching problem
by tech13＠netaxis.ca 01 Nov '05

01 Nov '05

Hi, I am using freeradius version 1.0.5 for authenticating users with Lucent Portmaster 3. I am trying since a few weeks to get the thing straight. People are able to authenticate correctly, but I have a few minor problems. 1- the radiusd.pid file is not created 2- the passwd file (which I believe is from the users file) is not refreshed. I would prefer to use the /etc/passwd file and have it cached, but even if I activate it with cache = yes, it doesn't seem to work. I also use the cache refresh setting. If I use cache = no, it still seem to use the same users file. 3- I want to send all the logs to syslog, but this also doesn't seem to work, unless it's sent to a file. I tried syslog_facility = daemon, but still doesn't work. Any help will be well appreciated. Thanks, Pierre Forget

3 2

RE: appending to a proxy reply attribute
by Tariq Rashid 01 Nov '05

01 Nov '05

if anyone is interested - we did it like this: attr_filter file adds an attribuet because it can distinguish realms attr_rewrite macthes and rewrites in post_proxy seems to work fine. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Joe Maimon Sent: 01 November 2005 12:53 To: FreeRadius users mailing list Subject: Re: appending to a proxy reply attribute Tariq Rashid wrote: > hi - i would like to achieve the following: > > * inspect the reply packet from a proxy target radius > > * if the reply contains "Framed-Route", for example > Framed-Route = 195.40.42.96/30 83.67.214.162 1 > then append a string to the value: > Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-ABC-001 > > * NOTE that the appended string depends on the realm/domain so possibilities are: > for username a(a)ABC.com > Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-ABC-001 > > for username b(a)XYZ.com > Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-XYZ-001 > > how is this possible with freeradius 1.0.2? > > tariq > Well one possible way that occurs to me would be to use an external program with the exec module. attr_rewrite would do it except it seems that you need to check other attributes. rlm_policy would do it, except I dont know about its ability to APPEND to an existing attribute.... Were I you I would also check rlm_perl, something I have never actually done. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

appending to a proxy reply attribute
by Tariq Rashid 01 Nov '05

01 Nov '05

hi - i would like to achieve the following: * inspect the reply packet from a proxy target radius * if the reply contains "Framed-Route", for example Framed-Route = 195.40.42.96/30 83.67.214.162 1 then append a string to the value: Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-ABC-001 * NOTE that the appended string depends on the realm/domain so possibilities are: for username a(a)ABC.com Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-ABC-001 for username b(a)XYZ.com Framed-Route = 195.40.42.96/30 83.67.214.162 1 n n 60 uk-XYZ-001 how is this possible with freeradius 1.0.2? tariq

2 1

can dialup_admin 1.62 work with freeradius 1.02+mysql4.0.25 on debian?
by chen rui 01 Nov '05

01 Nov '05

I find a tool to manage freeradius's user databases: dialup_admin 1.62, but the author didn't update it anymore since 2003, does anybody successfully use this php package to manage freeradius 1.02+mysql4.0.25 located on debian?

2 2

Bandwith controll
by Alex M 31 Oct '05

31 Oct '05

I'm a newbie here, please tell me where I can find info on controlling user bandwidth and allowed TCP/IP ports!! Appreciate your help!!!!!!!

2 3

help with config files for wireless EAP-TTLS
by Michael Wang 31 Oct '05

31 Oct '05

Hi, I am trying to set up my FreeRadius 1.0.4 to do wireless EAP-TTLS. I got it working for EAP-TLS and EAP-PEAP, so I know my config is basically correct. The problem I am having is that I would like to use the same userid for the "outer" and "inner" EAP identity string. So in my user's file, I have a line that looks like: "qa" Auth-Type := EAP, User-Password == "qa" Now when my client tries to authenticate, the TLS tunnel is set up OK, but when we get to the inner MSCHAP protocol, FreeRadius still thinks we are doing EAP and rejects the authentication attempt. Here is a snippet from the output of radiusd -A -X (other): SSL negotiation finished successfully <--- (so far so good) SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 3 to 10.222.0.18:1025<http://10.222.0.18:1025/> EAP-Message = 0x0104004515800000003b140301000 10116030100303e6bb07c9ba8bcdd94b7f0ee66d43b439d87b89b99025c1310aa4dc9bf7491555d4d0888ef91a0c7f628b79868ced090 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d987f832d6f6ed2f7e42b0fe6b2d77b Finished request 3 Going to the next request Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.222.0.18:1025<http://10.222.0.18:1025/>, id=4, length=353 Message-Authenticator = 0x1d82927ff8e036beeb0aca3ee45c1608 Service-Type = Framed-User User-Name = "qa" Framed-MTU = 1488 State = 0x3d987f832d6f6ed2f7e42b0fe6b2d77b Called-Station-Id = "00-03-7F-04-03-F6:TomAP48" Calling-Station-Id = "00-03-7D-00-06-32" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400b015001703010020fb074fcc5e5f2df2d24fcee30e4d18a4638a526f045e84651467daae520e2f4417030100809d045521172337970b871775afd53193cae98494128c873dd3786f75c340f7c4992c0f7aa2c4fdecdf595ec0ec65a9692e448c5f7df7b9bff4d975bd7fb112a1cec89c01ea8aba0c328d087ffee23a6637970e1dab1fc959838cbf8e42dae0832c35f409b77a61229991f6ee238292239bec74fc6d5f09a16979aa6f5af4a3c9 NAS-IP-Address = 10.222.0.18 <http://10.222.0.18/> NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "qa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 176 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry qa at line 104 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' <--- (At this point, freeradius correctly sets auth-type MSCHAP) modcall[authorize]: module "mschap" returns ok for request 4 rlm_realm: No '@' in User-Name = "qa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry qa at line 104 <---- (Uh, oh, we matched that qa line again, and now.....) modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns ok for request 4 rad_check_password: Found Auth-Type EAP <----- (auth-type is set to EAP again, which is not what I want.) auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message modcall[authenticate]: module "eap" returns fail for request 4 modcall: group authenticate returns fail for request 4 auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select I can get around the problem by putting two lines in my users file: "outerqa" Auth-Type := EAP, User-Password == "qa" "innerqa" Auth-Type := MS-CHAP, User-Password == "qa" But I would like to avoid the complexity of setting up two user identities, one for the outter and one for the inner. Is there any way to configure FreeRadius so that a single EAP identity can be used for EAP-TTLS? Thanks in advance for any help you can give. Michael

2 1

radwtmp
by King, Michael 31 Oct '05

31 Oct '05

So what is the radwtmp and what is it's purpose? Mine's at 500 megs, and growing. I'm wondering if I should get concerned, since I might have misconfigured something.

2 1

Installation of freeradius on cobalt raq3
by Shaun Krok [MTNNS - Durban] 31 Oct '05

31 Oct '05

Hi there, I am trying to install freeradius-0.9.1 using a tar on a Cobalt Raq 3 box. Some reading I have done it says their should be no issue. It keeps on failing at the end of the make and make install .... Is their anything special I should be doing ... <<< ls.c: In function `load_dh_params': tls.c:38: too many arguments to function `PEM_read_bio_DHparams' tls.c: In function `init_tls_ctx': tls.c:111: warning: implicit declaration of function `SSL_CTX_set_default_passwd_cb_userdata' tls.c:112: warning: passing arg 2 of `SSL_CTX_set_default_passwd_cb' from incompatible pointer type tls.c:179: warning: implicit declaration of function `RAND_load_file' tls.c: In function `new_tls_session': tls.c:220: warning: implicit declaration of function `SSL_set_msg_callback' tls.c:221: warning: implicit declaration of function `SSL_set_msg_callback_arg' gmake[10]: *** [tls.o] Error 1 Shaun Krok -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.12.6/151 - Release Date: 10/28/2005

1 0

Freeradius 1.0.5 installation on Suse 64 biut platform
by Ashwin Gobind 31 Oct '05

31 Oct '05

Good day. I am having a problem installing freeradius on Suse Linux. I am using a 64 bit AMD dual core platform. Please see the log below : -module -export-dynamic \ -o rlm_counter.la -rpath /usr/local/lib rlm_counter.lo -lgdbm -lssl -lcrypto -lnsl -lresolv -lpthread rm -fr .libs/rlm_counter.la .libs/rlm_counter.* .libs/rlm_counter-1.0.5.* gcc -shared rlm_counter.lo /usr/lib/libgdbm.so -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,-soname -Wl,rlm_counter-1.0.5.so -o .libs/rlm_counter-1.0.5.so /usr/lib/libgdbm.so: could not read symbols: Invalid operation collect2: ld returned 1 exit status gmake[6]: *** [rlm_counter.la] Error 1 gmake[6]: Leaving directory `/usr/software/freeradius-1.0.5/src/modules/rlm_counter' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/software/freeradius-1.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/software/freeradius-1.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/software/freeradius-1.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/software/freeradius-1.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/software/freeradius-1.0.5' make: *** [all] Error 2 �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

Proxy Forwarding on User-Name attribute
by Christian Meutes 31 Oct '05

31 Oct '05

Hello, i have the demand to forward some auth-requests to some further radius servers, but only in the case when a specific User-Name is for authorization requested. The User-Name attributes look like this "+493265352354(a)realm.com" and the userpart is always changing but the realm is always the same. How can i accomplish this without defining every user which is to forward in "proxy.conf"? Is there no way to do this in the authorization backend(sql) for a more dynamic procedure? I have thousands of users which are to forward and others which are not, i think this wont scale inside of proxy.conf and further more i think that there is no part of the User-Name which could be match in proxy.conf to proxy some user requests to different radius servers. I would be happy if anybody could point me to an option to realize this. regards, -christian

4 4