- Freeradius-Users - lists.freeradius.org

IP address assignment
by Infusino, Michael - ADP Dataphile 14 Oct '05

14 Oct '05

I am using radius to authenticate access from VPN. Would anyone now how to record the IP address the user is assigned after they log in. Michael _ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

3 2

Using PAM to authenticate Radius auth requests with PEAP
by Joseph Silverman 14 Oct '05

14 Oct '05

A co-worker of mine here has been asking questions of the list today but I have some of my own. Namely, I don't know much about how Radius does it's magic, but unless I am completely off the bat here, it appears to me that some sort of channel is created between the Radius client and the server over which requests are sent. These requests include a user and a password and other information. The radius server will then compare the user and password to the ones in it's configured database and either authenticate or not. Unix passwords are encrypted through a one-way function and stored in a password file. These passwords can no longer be reversed back to their "clear text" format but it is possible to take a "clear text" user and password (from the radius client) and convert it to this format and compare the two thus matching, or not. I can imagine that PEAP, specifically, does the password encryption on the client and passes that on, using a similar but obviously not the same, one way encryption algorithm, thus requiring the radius server to have access to a clear text password which it would encrypt with the same key and algorithm in order to match to the one from the client. If this is the case, than I can readily see how it can never (never being a long time) be possible to use these sorts of passwords along with UNIX encrypted passwords. This is a darn shame, but if it is indeed the case, so be it. I am asking the list if this is the case or if the reason authentication isn't possible is a simple programming effort that hasn't been done. Also, given our setup: Client: Cisco Wireless AP (1200) Server: Linux running Freeradius What is the optimal means to provide maximum security and still be able to authenticate against the unix shadow password file? Thank you for your time - Yossie

2 1

Re: Microsoft SQL 2000 interface
by Duane Cox 13 Oct '05

13 Oct '05

http://www.freeradius.org/development.html#cvs ----- Original Message ----- From: "Cliff Hayes" <chayes(a)afo.net> To: "Duane Cox" <duanec(a)mail.illicom.net> Sent: Thursday, October 13, 2005 1:56 PM Subject: RE: Microsoft SQL 2000 interface > All, > > Please help with instructions on how to "download the CVS ver of freeradius" > mentioned below. I'm new to Linux. I know how to tar, configure, and make. > Don't know how to CVS. > > Cliff > > -----Original Message----- > From: Duane Cox [mailto:duanec@mail.illicom.net] > Sent: Wednesday, October 12, 2005 11:12 AM > To: Cliff Hayes > Subject: Re: Microsoft SQL 2000 interface > > > I've posted this a few times, so you can search the archives for my previous > email, or download the CVS ver of freeradius. > There is a file in the doc folder called mssql and in there is detailed info > for setting up MSSQL and FR. > I assume this file will be released into FR 1.0.6 > > I would read both my post in the email archives and read the doc in CVS. > > You will have to adjust your views to pull the correct data from platypus. > > But it is possible to do, yes. > > Duane Cox > > > ----- Original Message ----- > From: "Cliff Hayes" <chayes(a)afo.net> > To: "Duane Cox" <duanec(a)mail.illicom.net>; "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Wednesday, October 12, 2005 10:19 AM > Subject: RE: Microsoft SQL 2000 interface > > > > Duane, > > > > No, I don't know where to start in that department. I'm in the inquiry > > stage now. Just trying to find out if it can be done. Is there a HOW-TO > > file somewhere? I just loaded a box with a fresh copy of Fedora 4 and > > freeRadius. I've been tasked with replacing Radiator, and freeRadius is > the > > preferred path. This is my first stumbling block. > > > > Cliff > > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Duane > > Cox > > Sent: Wednesday, October 12, 2005 9:15 AM > > To: FreeRadius users mailing list > > Subject: Re: Microsoft SQL 2000 interface > > > > > > Yes it can be done. > > > > Do you have freeradius talking to the MSSQL db yet? > > > > Duane Cox > > > > ----- Original Message ----- > > From: "Cliff Hayes" <chayes(a)afo.net> > > To: <freeradius-users(a)lists.freeradius.org> > > Sent: Wednesday, October 12, 2005 8:56 AM > > Subject: Microsoft SQL 2000 interface > > > > > > > All, > > > > > > Sorry to have to bring up the "M" word, but that's what we have - > > Microsoft > > > SQL 2000 interfacing with Platypus and Radiator. I searched the FAQ and > > > archives and found no reference to a Microsoft SQL interface. > > > > > > Can I populate my Microsoft SQL DB with freeRadius? If so, how? > > > > > > Thanks, > > > > > > Cliff > > > > > > - > > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > >

4 5

Packet of Disconnect
by Ashwin Gobind 13 Oct '05

13 Oct '05

Can freeradius handle a Disconnect Request (Attribute 40). If so how ? �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

3 3

Patch for Statistics page
by Matt Vollmar 13 Oct '05

13 Oct '05

I was having problems with the statistics page only displaying the from date and the to date, rather than all of the dates in between. Come to find out, the reason is that the wrong "date config" variable is used in stats.php3. You basically just change sql_date_format to sql_full_date_format. Here is what to change: Lines 35 and 36 should be: $before = date($config[sql_full_date_format], $now + 86400); $after = ($after != '') ? "$after" : date($config[sql_full_date_format], $now - 604800 ); If you don't want to change the code, change the variable "sql_date_format" to look like "sql_full_date_format" in the admin.conf. Hope this helps someone. Matt

1 0

Ippool mysql
by Mark Novitzkas 13 Oct '05

13 Oct '05

Hi There I am trying to setup freeradius 1.0.0.5 using mysql and ippools. Basically i want to use mysql to auth the incoming request and and use ippool to assign an adress to that request. Firstly is that possible? I have setup the mysql DB correctly with the radcheck table specifiying the Pool-Name ( in my case im testing with the main_pool as configured in the radiusd.conf. My second probelm is that if i start up radiusd in debug mode it shows the following error? Module: Loaded IPPOOL ippool: session-db = "/home/radius/db.ippool" ippool: ip-index = "/home/radius/db.ipindex" ippool: range-start = 192.168.1.1 IP address [192.168.1.1] ippool: range-stop = 192.168.3.254 IP address [192.168.3.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = yes ippool: maximum-timeout = 0 rlm_ippool: Failed to open file /home/radius/db.ippool: Permission denied radiusd.conf[1467]: main_pool: Module instantiation failed. Do i need to create the db files first? If so how is this done? I know this may be arb questions but this is my first time using freeradius :) Thanks Mark Notice This email is intended for the addressee only and may contain legally privileged and/or confidential information. If you have received this email in error and are not the intended recipient, you are hereby informed that you are not entitled to read, broadcast, distribute or in any manner whatsoever use the contents of this email or any attachments thereto. You are requested to please notify Psitek that you have received the email and then delete it. Unless clearly stated otherwise, the content and sentiments expressed in this email or any attachments thereto are those of the sender and not of Psitek (Proprietary) Limited. Psitek does not accept liability for any damages, loss or expense of any nature whatsoever arising (a) out of or in connection with the email or any attachments thereto and/or (b) from any act or omission by the recipient relying upon the content of the email or attachments. Psitek further disclaims liability for any damages caused by computer and/or software viruses. Should this email contain the terms of a contract, no binding agreement will result until such time as a written (hardcopy) document is signed on behalf of Psitek.

2 1

EAP Fast
by Juan Daniel Moreno 13 Oct '05

13 Oct '05

Hi, I would like to know if EAP FAST is accepted by freeRadius or if it's under development. If it is under development, when will it be available? Thank you, Juan Daniel MORENO

2 1

Problem with OpenSSL functions
by Juan Daniel Moreno 13 Oct '05

13 Oct '05

Hi, I would like to ask you (experienced people) something. I'm using freeradius 1.0.4 and I have a message of 48 bytes long (a premaster secret) generated with the random function of openssl. This message has to be "public_encrypted" and sent to a radius server. Nevertheless, when I use the RSA_public_encrypt() function this encrypts the message of 48 bytes and generates a 64 bytes encrypted message. Normally this functions like this; but as I sent this "encrypted message" to the server, the server responds me: "tls rsa encrypted value length is wrong". This means that the message is well generated but not well encrypted. Can any of you tell me please how can I fix this problem? Knowing that the RSA public key is 64 bytes long, is it normal that the encrypted message is 64 bytes long too? Do you know another openSSL function that "public_encrypts" a message? Thank you, Juan Daniel MORENO

2 1

build snapshot on freebsd 5.4-release
by Roy 13 Oct '05

13 Oct '05

Hi, Anyone ever tried building current snapshot from cvs on freebsd 5.4- release? Tried searching from the archive and seems like this wasn't resolved yet. Anyone? BR, roy

2 1

RE: Counter reset
by Jonathan De Graeve 13 Oct '05

13 Oct '05

In your SQL query J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 16:51 Aan: 'FreeRadius users mailing list' Onderwerp: AW: Counter reset Ok, now i understand. Thanks. One more question. Where to set the octets value for recalculation? Thanks -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Jonathan De Graeve Gesendet: Donnerstag, 13. Oktober 2005 15:22 An: FreeRadius users mailing list Betreff: RE: Counter reset Octet values are in bytes So just calculated what it would be in MB or in GB. I recalculate the value to be in MB so I force the max octets to like 1024MB for 1GB Divide your end result with 1024*1024 or something J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 15:13 Aan: 'FreeRadius users mailing list' Onderwerp: AW: Counter reset Sorry.... Which value. What query???? Thanks for helping me, but i don´t really understand andi -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Jonathan De Graeve Gesendet: Donnerstag, 13. Oktober 2005 11:59 An: FreeRadius users mailing list Betreff: RE: Counter reset Yes there's a 4GB limit in the counter You have to use smaller values (change your sql query to divided all values by a given value) J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 9:37 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Counter reset Hi, i´m running freeradius 1.0.4 with mysql & chilli. Most of them works good :-) But i have some users, which won´t log out. And now comes the problem: if a user has something like 4GB traffic up or download in one session his traffic would get lost and the counter resets. i´m not sure, but is there a buffer wich will overflowed? Or something like this?? Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1