- Freeradius-Users - lists.freeradius.org

PAM radius client usage
by nagaraj 20 Oct '05

20 Oct '05

Hi, Does PAM radius client need shared library support to be able to work ? I could port successfully PAM radius client to Router platform which has shared library support. However I need to port the same PAM radius client to other router platforms which do not have shared library support. Has anybody had any experience using PAM radius client in an environment with no shared library support ? Please reply. Regards, Nagaraj

1 0

RE: Vendor Specific Attributes
by Guy Davies 20 Oct '05

20 Oct '05

Which VSAs are you sending in the accounting packet? Are they correctly enumerated in a dictionary file? Is the dictionary file referenced in the main dictionary file? Can you send us the accounting packet you're seeing? Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Daniel Corbe Sent: 20 October 2005 15:52 To: FreeRadius users mailing list Subject: Vendor Specific Attributes Hello, How do you get FreeRADIUS to stop ingoring VSAs? I have a box that's sending them and FreeRADIUS is simply ignoring them in rad_recv rad_recv: Accounting-Request packet from host 10.10.0.90:1068, id=0, length=58 NAS-Identifier = "acme-sd" Acct-Status-Type = Accounting-On NAS-IP-Address = 10.10.0.90 NAS-Port = 0 Acct-Session-Id = "sd1#28249" I know there are more attributes being sent than that because I can see them in the RADIUS packet. Any help/advice is appriciated. Thanks. -Daniel - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Many thanks
by Iandc Davies 20 Oct '05

20 Oct '05

To all, Well, after months of trying to get this working and integrated into our system, guess what ...... I've managed it with the help of you lovely people to finally get this working with the aide also of lots and lots of full strength coffee and severe lack of excercise. Many thanks to the likes of Alan, Emile, Nicolas and Michael to name a few. Nearly had a close call though with management thinking of dropping the project after months of work because they thought they had the original design wrong and only causing a slip of 5 weeks. I'll keep monitoring the site and boards and drop a line now and again. Seeya :-)~ Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

1 0

ntlm_auth and machine authentication (workaround)
by Roy Hooper 20 Oct '05

20 Oct '05

After spending a fair bit of time searching list archives and google results, I've managed to make ntlm_auth work for both users and machine accounts. This fix requires patching of Samba (thanks go to Mike McCauley of OSC/Radiator for the howto on the fix and to Matthew Alexander for pointing it out in samba's lists). This patch may break Samba for other purposes, as I have only tested it to verify ntlm_auth can do both user and account challenge/response authentication for MSCHAPv2 for PEAP. The second part to the fix is an ntlm_auth wrapper that deals with DOMAIN\\user format usernames and translates WinXP "host/" machine names to NT machine usernames. ---BEGIN /usr/local/bin/ntlm_auth_hack--- #!/usr/bin/perl my $ARGS = join(" ",@ARGV); if ($ARGS =~ m{--username=host/\S+}) { $ARGS =~ s{--username=host/([^\s.]+)\S+}{--username $1\$}; } else { $ARGS =~ s{--username=([^\\]+)\\\\}{--domain=$1 --username=}; } system("/usr/local/bin/ntlm_auth", split(" ", $ARGS)); ---END /usr/local/bin/ntlm_auth_hack--- And so the example is somewhere other than my head, The following returns the appropriate attributes to a Cisco AP to assign a particular vlan, in this case, vlan-266, when doing EAP. # Assign a VLAN to any user from this station DEFAULT Calling-Station-Id == "1234.1234.1234" Framed-Type = Framed, Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802, Tunnel-Private-Group-ID:1 = 100 And another fun one: # Assign a particular VLAN to a user from a particular station DOMAIN\\user Calling-Station-Id == "1234.1234.1234" Framed-Type = Framed, Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802, Tunnel-Private-Group-ID:1 = 200 Naturally the DEFAULT should come after the specific user match. begin 644 cli_netlogon.c.patch M+2TM(&]R:6<O<V%M8F$M,RXP+C(P8B]S;W5R8V4O<G!C7V-L:65N="]C;&E? M;F5T;&]G;VXN8PE7960(a)3V-T(#$R(#$W.C`S.C(S(#(P,#4**RLK('!A=&-H M960O<V%M8F$M,RXP+C(P8B]S;W5R8V4O<G!C7V-L:65N="]C;&E?;F5T;&]G M;VXN8PE4:'4@3V-T(#(P(#`R.C,Y.C(W(#(P,#4*0$`@+38Y.2PW("LV.3DL M-R!`0`H@("`@("`@("`@("`@("`@(%--0DY496YC<GEP="AP87-S=V]R9"P@ M8VAA;"P@;&]C86Q?;G1?<F5S<&]N<V4I.PH@"B`@("`@("`@("`@("`@("`@ M:6YI=%]I9%]I;F9O,B@F8W1R+F%U=&@N:60R+"!L<%]W;W)K9W)O=7`H*2P@ M"BT@("`@("`@("`@("`@("`@("`@("`@("`@("`@("`P+"`O*B!P87)A;5]C M=')L("HO"BL@("`@("`@("`@("`@("`@("`@("`@("`@("`@("`P>#@P,"P@ M+RH@<&%R86U?8W1R;"`J+PH@("`@("`@("`@("`@("`@("`@("`@("`@("`@ M("`@,'AD96%D+"`P>&)E968L("\J($Q5240_("HO"B`@("`@("`@("`@("`@ M("`@("`@("`@("`@("`@("!U<V5R;F%M92P@8VQI+3YC;&YT7VYA;65?<VQA M<V@L(&-H86PL"B`@("`@("`@("`@("`@("`@("`@("`@("`@("`@("!L;V-A M;%]L;5]R97-P;VYS92P@,C0L(&QO8V%L7VYT7W)E<W!O;G-E+"`R-"D["D!` M("TX,#`L-R`K.#`P+#<@0$`*("`@("`@("`@8W1R+G-W:71C:%]V86QU92`] M($Y%5%],3T=/3E]465!%.PH@"B`):6YI=%]I9%]I;F9O,B@F8W1R+F%U=&@N M:60R+"!D;VUA:6XL"BT)"2`@("`@(#`L("\J('!A<F%M7V-T<FP@*B\**PD) M("`@("`@,'@X,#`L("\J('!A<F%M7V-T<FP@*B\*(`D)("`@("`@,'AD96%D M+"`P>&)E968L("\J($Q5240_("HO"B`)"2`@("`@('5S97)N86UE+"!W;W)K M<W1A=&EO;E]N86UE7W-L87-H+"`H8V]N<W0@=6-H87(J*6-H86PL"B`)"2`@ M("`@(&QM7W)E<W!O;G-E+F1A=&$L(&QM7W)E<W!O;G-E+FQE;F=T:"P@;G1? D<F5S<&]N<V4N9&%T82P@;G1?<F5S<&]N<V4N;&5N9W1H*3L* ` end

3 2

DB Server Advice
by Abdul Lateef 20 Oct '05

20 Oct '05

Hi all, We have very big voip traffic, and currently we were using mysql DB with the following server configurations, But we are getting lot of problems some time the devise are failed, some time the database is slow. Etc. The current configuration is: OS: Red Hat Enterprise Linux ES 3 PROCESSOR: Dual 3.2 GHz Intel Xeon MEMORY : 2GB DDR RAM Hard Drive: 2 x 36.4GB SCA Ultra 160 SCSI Hard Drive (RAID 1) RAID CONTROLLER CHASSIS: 2U BACKUP AGENT: Legato Managed Backup Agent NETWRK: Aggregate Bandwidth 100GB per Month (included) Now we want to re-configure our servers, some one suggest me about SUN. But i need your suggestions, which will driver our database server without any problem. -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/

3 2

+ in Usernames?
by Christian Meutes 20 Oct '05

20 Oct '05

Hello, i want that an incoming request is always authenticated and should reply with some attributes. i have the following entry in my sql database in radcheck: --- id UserName Attribute op Value | 18 | +496925738971(a)sip.claranet.de | Auth-Type | := | Accept --- The incoming request looks like this: --- Packet-Type = Access-Request Wed Oct 19 14:42:17 2005 User-Name = "+496925738971(a)sip.claranet.de" Service-Type = Call-Check NAS-IP-Address = 172.20.23.232 NAS-Port = 0 Client-IP-Address = 172.20.23.232 --- I dont know where the problem exists exactly, but the the radius.log says: --- Wed Oct 19 14:36:16 2005 : Auth: Login incorrect: [+496925738971(a)sip.claranet.de/<no User-Password attribute>] (from client test port 0) --- radiusd -X output: --- rad_recv: Access-Request packet from host 172.20.23.232:33352, id=212, length=69 User-Name = "+496925738971(a)sip.claranet.de" Service-Type = Call-Check NAS-IP-Address = 172.20.23.232 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radacct/172.20.23.232/auth-detail-20051019' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/172.20.23.232/auth-detail-20051019 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '%' in User-Name = "+496925738971(a)sip.claranet.de", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmpercent" returns noop for request 0 rlm_realm: Looking up realm "sip.claranet.de" for User-Name = "+496925738971(a)sip.claranet.de" rlm_realm: Found realm "sip.claranet.de" rlm_realm: Adding Stripped-User-Name = "+496925738971" rlm_realm: Proxying request from user +496925738971 to realm sip.claranet.de rlm_realm: Adding Realm = "sip.claranet.de" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "realmat" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "realmraute" returns noop for request 0 radius_xlat: '+496925738971(a)sip.claranet.de' rlm_sql (sql): sql_set_user escaped user --> '+496925738971(a)sip.claranet.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '=2B496925738971(a)sip.claranet.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 255 rlm_sql (sql): User +496925738971(a)sip.claranet.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '=2B496925738971(a)sip.claranet.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '=2B496925738971(a)sip.claranet.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User +496925738971(a)sip.claranet.de not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 255 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [+496925738971(a)sip.claranet.de/<no User-Password attribute>] (from client test port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.20.23.232:33353, id=213, length=69 User-Name = "+496925738971(a)sip.claranet.de" Service-Type = Call-Check NAS-IP-Address = 172.20.23.232 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radacct/172.20.23.232/auth-detail-20051019' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/172.20.23.232/auth-detail-20051019 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "digest" returns noop for request 1 rlm_realm: No '%' in User-Name = "+496925738971(a)sip.claranet.de", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmpercent" returns noop for request 1 rlm_realm: Looking up realm "sip.claranet.de" for User-Name = "+496925738971(a)sip.claranet.de" rlm_realm: Found realm "sip.claranet.de" rlm_realm: Adding Stripped-User-Name = "+496925738971" rlm_realm: Proxying request from user +496925738971 to realm sip.claranet.de rlm_realm: Adding Realm = "sip.claranet.de" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "realmat" returns noop for request 1 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "realmraute" returns noop for request 1 radius_xlat: '+496925738971(a)sip.claranet.de' rlm_sql (sql): sql_set_user escaped user --> '+496925738971(a)sip.claranet.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '=2B496925738971(a)sip.claranet.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 254 rlm_sql (sql): User +496925738971(a)sip.claranet.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '=2B496925738971(a)sip.claranet.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '=2B496925738971(a)sip.claranet.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User +496925738971(a)sip.claranet.de not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 254 modcall[authorize]: module "sql" returns notfound for request 1 modcall: group authorize returns ok for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [+496925738971(a)sip.claranet.de/<no User-Password attribute>] (from client test port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.20.23.232:33352, id=212, length=69 Sending Access-Reject of id 212 to 172.20.23.232:33352 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.20.23.232:33353, id=213, length=69 Sending Access-Reject of id 213 to 172.20.23.232:33353 Waking up in 1 seconds... --- Walking the entire request list --- Either i have a problem with my authorize section or the username shouldnt include an "+" i think. Anybody with an idea? kind regards, -christian

3 2

RLM_IPPOOL bug?
by magmike＠mail.ru 20 Oct '05

20 Oct '05

my radiusd uses rlm_ippool. Sometimes ippool gives one ip for two different users simultaneously. here output of rlm_ippool_tool. # rlm_ippool_tool -va /etc/raddb/pools/db.pool-1-pool1* | grep X.Y.Z.170 NAS:192.168.0.1 port:0xde - ipaddr:X.Y.Z.170 active:1 cli:0 num:1 NAS:192.168.0.1 port:0xad - ipaddr:X.Y.Z.170 active:1 cli:0 num:1

1 0

adding a nas via dialupadmin
by Nick B 20 Oct '05

20 Oct '05

Hello while adding a NAS thru dialupadmin i noticed that the changes dont take effect unless the freeradius process is restarted is this intended? or is something wrong with my config I.E. i added 192.168.0.1 / as a NAS but when i tried to authenticate with the nas , the debug showed it being as unreconized.. I stoped and restarted freeradius and then that nas was able to authenticate. Freeradius 1.02-4 (debian stable version) Thanks. Nick.

1 0

Newbie question. Where does Freeradius fit in?
by jamrock 20 Oct '05

20 Oct '05

I have done some reading re: radius in general and Freeradius in particular. When should one use radius? I have read that radius is useful when one needs a centralized user/password database. I guess that would be good when one has lots of remote access servers. I have read that radius is good when one needs accounting. We just need a dial in solution for 6 or so users. No accounting is necessary. What are the disadvantages of using a simple ppp solution that authenticates against the /etc/passwd file on a Linux box? We were thinking of using a pci card with 8 modems. Is Freeradius overkill for us or is it a more secure solution? Any advice/links to documentation would be useful. The Freeradius FAQ's don't address this issue.

1 1

NULL file
by ramiro de zavalia 19 Oct '05

19 Oct '05

Hi, i'm using freeradius 1.0.5. In /etc/raddb is a NULL file which keep increasing it's size. What is it ? Sorry for my bad inglish thanks

2 3