- Freeradius-Users - lists.freeradius.org

Transmitted packet
by Iandc Davies 20 Sep '05

20 Sep '05

All, The contents of the transmitted packet include an uint8_t *data. What exactly is this pointing to ? The radius.c code sems to check it the first time round against NULL ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

Radius PEAP protocol
by Juan Daniel Moreno 20 Sep '05

20 Sep '05

Hi everyone, I am trying to create a client's interface for Radius PEAP protocol. The server has donne all I wonder it to do, but now I have a question about the finish handshake message I have to send. When I get the server's cetificate, I get a public key too. I have to "public-key-encrypt" a PreMasterSecret that is a vector of 46 random bytes and the tls version (1.0). My question is how can I do that. Am I obliged to get the ssl libraries to "public-key-encrypt" this packet? Thank you for any complemetary information. Juan Daniel MORENO

2 1

Multiple LDAPS
by S�bastien Cantos 20 Sep '05

20 Sep '05

Hi, I was wondering if there's a way to look for users in differents LDAP trees and/or servers depending of the suffix (@something) in the login. If it's possible could someone show me the config ? Thanks in advance. Regards, -- Sebastien Cantos <scantos(a)technodiva.com> Network / System Manager Neopost DIVA

2 2

RE: Transmitted packet
by Jonathan De Graeve 20 Sep '05

20 Sep '05

Actie voltooid. Wordt naar zowel Wendy als kathleen gestuurd. J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Iandc Davies Verzonden: dinsdag 20 september 2005 15:05 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Transmitted packet All, The contents of the transmitted packet include an uint8_t *data. What exactly is this pointing to ? The radius.c code sems to check it the first time round against NULL ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: 12077 error???
by King, Michael 20 Sep '05

20 Sep '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > Behalf Of Armin Krämer > > Hi, I set up freeradius with eap-tls and after I generated my > certificates with TinnyCA and configured it in eap.conf File > I get this error message...Does anyone knows what causes this error? > Thanks Armin > > debian:~# freeradius -X -A Did you install FreeRadius via Apt (aptitude) or compile from source?

3 2

Hashed passwords in the users file???
by Miguel Angel Quiles 20 Sep '05

20 Sep '05

Hi, does someone know how to use hashed passwords for the users entries in the users file????? I hope someone can help me.

1 0

RE: Nortel Networks Passport 8600 + Radius AAA
by Jonathan De Graeve 20 Sep '05

20 Sep '05

There were bugs in that release. Upgrade to 3.5.10.0 J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- ________________________________ Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Inci Gedik Verzonden: dinsdag 20 september 2005 10:53 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Nortel Networks Passport 8600 + Radius AAA Hi Everyone, I have the same problem. Could someone send me the correct configuration Radiusd.conf , users, clients.conf or if it is necessary dictionary files? Thanks Inci Gedik ------------------------------------------------------------------------ -- I am in the testing phase using Nortel 8600's (8010 is the chassis), No dictionary needed. I have had no problems. but I am also using 3.5 code. maybe trying the current version of code might help. Just a thought >>> ettan(a)online.no 1/15/2004 9:01:32 AM >>> Hi We have just bought a few Nortel Passport 8010, and I like to use freeradius to authenticate the user that want to log on to configure this switches. I can se the Radius server is sending Access-Accept back to the switch, but I don't get any login prompt, but ask me again about login name. Have someone got this to work or have any hints for me ? I can't find any dictionary for Nortel, do I need that ? users file: jon Auth-Type := local, User-Password == "jon",Huntgroup-Name == "pp8600" Service-Type = Login-User, Fall-Through = NO debuging from radiusd -X: modcall: group authorize returns ok rad_check_password: Found Auth-Type local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 23 to 10.10.9.51:1051 Service-Type = Login-User Finished request 0 Going to the next request The PP8610 config,Software Release 3.2.3.0 configuration: LAB_550:5/config/radius/server# enable true LAB_550:5/config/radius/server# create 10.10.1.2 secret test LAB_550:5/config/radius/server# set 10.10.1.2 secret test - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----------------------------------------------------- This message is intended only for certain recipients and may be privileged or confidential. If you have received it in error, please notify sender and delete it without making or retaining a copy. ----------------------------------------------------- <<<<*P*H*L*>>>>

2 1

Weird huntgroup issue
by Jonathan De Graeve 20 Sep '05

20 Sep '05

Hello, I have a weird huntgroup issue. I have users in a group 'artsen' with HuntgroupName => == ^(vpn|ras)$ I have users in group 'stagiars' with HuntgroupName => == hotspot On the radiussystem itself I can successfully authenticate users from group artsen but not from group stagiairs. But I can login with a user from group stagiars from a nas with ip 194.8.52.37 My NASclients from SQL: 17 | localhost | localhost | other | 0 |... Huntgroup file: # VPN infrastructure vpn NAS-IP-Address == 10.2.254.1 vpn NAS-IP-Address == 10.2.254.2 vpn NAS-IP-Address == localhost # ras NAS-IP-Address == 10.2.254.81 ras NAS-IP-Address == 10.2.254.82 ras NAS-IP-Address == localhost # hotspot NAS-IP-Address == x.y.z.37 hotspot NAS-IP-Address == x.y.z.38 hotspot NAS-IP-Address == localhost This comes in the logging when I do a check on the radiusystem itself with following arguments: radtest lvanhoey0 password localhost:1812 0 passwordhere radius_xlat: 'lvanhoey0' rlm_sql (sql): sql_set_user escaped user --> 'lvanhoey0' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'lvanhoey0' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'lvanhoey0' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): No matching entry in the database for request from user [lvanhoey0] rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns notfound for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "uploadlimit" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "volumelimit" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "prepaidcounter" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [lvanhoey0/jo0clni3] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- And logging when login in from nas-ipadress modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 modcall[authorize]: module "digest" returns noop for request 12 rlm_realm: No '@' in User-Name = "lvanhoey0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 12 radius_xlat: 'lvanhoey0' rlm_sql (sql): sql_set_user escaped user --> 'lvanhoey0' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'lvanhoey0' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'lvanhoey0' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 12 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "uploadlimit" returns noop for request 12 rlm_sqlcounter: Entering module authorize code Any idea's??? -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite ---------

2 1

Nortel Networks Passport 8600 + Radius AAA
by Inci Gedik 20 Sep '05

20 Sep '05

Hi Everyone, I have the same problem. Could someone send me the correct configuration Radiusd.conf , users, clients.conf or if it is necessary dictionary files? Thanks Inci Gedik -------------------------------------------------------------------------- I am in the testing phase using Nortel 8600's (8010 is the chassis), No dictionary needed. I have had no problems. but I am also using 3.5 code. maybe trying the current version of code might help. Just a thought >>> ettan(a)online.no 1/15/2004 9:01:32 AM >>> Hi We have just bought a few Nortel Passport 8010, and I like to use freeradius to authenticate the user that want to log on to configure this switches. I can se the Radius server is sending Access-Accept back to the switch, but I don't get any login prompt, but ask me again about login name. Have someone got this to work or have any hints for me ? I can't find any dictionary for Nortel, do I need that ? users file: jon Auth-Type := local, User-Password == "jon",Huntgroup-Name == "pp8600" Service-Type = Login-User, Fall-Through = NO debuging from radiusd -X: modcall: group authorize returns ok rad_check_password: Found Auth-Type local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 23 to 10.10.9.51:1051 Service-Type = Login-User Finished request 0 Going to the next request The PP8610 config,Software Release 3.2.3.0 configuration: LAB_550:5/config/radius/server# enable true LAB_550:5/config/radius/server# create 10.10.1.2 secret test LAB_550:5/config/radius/server# set 10.10.1.2 secret test - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----------------------------------------------------- This message is intended only for certain recipients and may be privileged or confidential. If you have received it in error, please notify sender and delete it without making or retaining a copy. ----------------------------------------------------- <<<<*P*H*L*>>>>

1 0

RE: Walled Garden for Users Without Realms.
by Alexander C. Fossa 19 Sep '05

19 Sep '05

Hi James, Exactly what I have been trying to do for about 6 months, but keep getting distracted by doing something else. What software do you use for the wildcard DNS? Any example configs? Regards, Alexander Fossa -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of McCain, Al Sent: 19 September 2005 14:26 To: FreeRadius users mailing list Subject: RE: Walled Garden for Users Without Realms. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of James Wakefield (Sunet Sysadmin) Sent: Sunday, September 18, 2005 6:27 PM To: FreeRadius users mailing list Subject: Re: Walled Garden for Users Without Realms. G'day Al, We're doing the same thing here changing a dial-up number and migrating off of the NASes that serve that number. My approach is: * Match customers who need to be placed in the walled garden, this is easy enough for our situation, as they're in the huntgroup comprised of the old NASes. I could also match Called-Station-Id if I wanted. * Send specific attributes for those users, giving them a short session timeout (say 5, 10 minutes) which, if they fail to see or heed our message, will motivate them to call helpdesk and get sorted out, and also setting their primary DNS server to one which resolves every hostname to one of your IP addresses using a wildcard zone or some such. If this DNS server is already providing other services, you'll want to use a view for walled garden users, which you may need to facilitate by putting them into a specific subnet. What attribtues you use, exactly, will depend on your NAS gear. * On that IP address that you're resolving * to, is a webserver which displays the message you wish the walled garden users to read. If this webserver already serves other pages, you'll need to do some URL rewriting to send them to the appropriate page eg: using Apache's mod_rewrite. This way, any request for a web page will display your message. Personally, I find the easiest approach is to just dust off a box that's not being used and put the wildcard DNS and webserver on it - it's only got a couple of very simple functions to perform and it's not a critical service. You may also want to consider applying packet filtering to walled garden users as they'll still be able to reach the entire Internet by IP address, though the session timeouts make that only a moderate concern in our situation. You could also do a similar thing with email by setting up a mailserver on the wildcarded IP and bouncing everything with your walled garden message. Personally, I think sending your customers an email and then putting in the web-based walled garden is enough. Cheers, James Wakefield Systems Administrator +61 03 5227 6888 We have now moved head office to 8-12 Pakington Street, Geelong West. McCain, Al wrote: >Hi. > >I was wondering if there was a way to place users in a Walled Garden if >they try to Auth without a Realm. >We are currently running FreeRADIUS Version 0.9.3. Our users are stored >in MySQL. > >Company: >I work for an ISP. We seem to aquire new properties every few months. > >Current structure : > >We have multiple instances of RADIUS running: one for each domain. (I >have NO clue who set it up this way). > >I would like to consolidate these intances into one, and force our >users to use realms. > >Problem: > >We can't just force the customers to use realms. We would need to >notify them of the changes. (This can prove tricky). > >What I would like to see: > >Aside from contacting the customer about changes, I would like to send >the users to a web page after they log in without a realm. The page >would tell them that they need to log in with realms. I believe this >is called hURL'ing, however I cannot seem to find any documentation. > >Has anyone ever done this, or know if it can be done ? > >Any help is greatly appreciated. > >Thanks, >Al > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Very good idea James. I will test that out. -Al - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1