- Freeradius-Users - lists.freeradius.org

/local/dialup page will not display for dialupadmin
by Miguel Ramirez 16 Sep '05

16 Sep '05

Hey gus I am new to this and usually I follow evey step to make it work, and do try hard (I have had my had on this for a week now). I have read the readme file the 'How to" document and upto the point where I have to get the dialupadmin page displayed on the browser it does not happen :-( well I have tried on SuSe 9.0 server and Fedora Core 3 and 4 I get to make the installer for radius source and Date::Manip PerlModule and they seam to get install ok. I know this type of things is like finding a needle in a histack, but I am running out of patience, please help me!, thanks now can someone please give me some clues

1 0

Tru64 again
by Tim Winders 15 Sep '05

15 Sep '05

I'm back at trying to get freeradius working under Tru64. This time using 1.0.5. I have an older cvs version working, but I can't remember what I did to make it work. :-( The working version I have is marked 1.1.0-pre0 built on Feb 17, 2005. First, in src/main/radiusd.c I have commented out the OSFC2 define. I do this because I'm not running C2, but it is always found and enabled, which kills the make. Then, I run configure with these options: CFLAGS="-I/usr/local/ssl/include -I/usr/local/include" LDFLAGS="-L/usr/local/ssl/lib -L/usr/local/lib" LIBS="-lssl -lcrypto -lsecurity" ./configure \ --disable-shared \ --enable-ltdl-install=no \ --with-openssl-includes=/usr/local/ssl/include \ --with-openssl-libraries=/usr/local/ssl/lib \ --without-mysql --disable-mysql radiusd seems to compile, but with many warnings. However, when I run it, it immediately seg faults and dumps core. Unfortunately, I am not a programmer, so I don't know how to begin troubleshooting this and try to help get freeradius working under Tru64. I remember being told that none of the development team uses Tru64. So, it's possible this will never work "right". But, I'm willing to help out in whatever limited capacity I can, including CPU/shell account. Any useful suggestions are welcome. --- Tim Winders Associate Dean of Information Technology South Plains College Levelland, TX 79336 Problem replying to my email? Click the "Sign" button in the OE toolbar or, better yet, get your own FREE Personal E-Mail Digital ID: http://www.thawte.com/email/index.html

4 5

Two different sources, one with a single value
by Martin.Ward＠uk.neceur.com 15 Sep '05

15 Sep '05

Hi all, I'm just about getting the hang of FreeRadius now, thanks to the various emails and stuff that people have been asking, but I've not been able to find the answer to one particular question. I have a radius server that will process two types of request: 1. A user name and password login. Currently it's a flat file but I will change that the use the rlm_unix module in the near future. 2. A MAC address, which is passed in as two attributes, "User-Name=MAC Address" and "User-Password=MAC Address" For the MAC address I want a flat file with just the MAC addresses in it. I have tried using the passwd module and just ignoring the User-Password attribute like so: passwd mac_address { filename = /var/mac_addresses format = "*User-Name" } but this fails to authenticate even though it gets through the Authorize section OK: rad_recv: Access-Request packet from host 172.29.252.228:1026, id=98, length=160 NAS-IP-Address = 172.29.252.228 NAS-Port-Id = "10:2" Extreme-Attr-208 = 0x556e6b6e6f776e204c6f636174696f6e NAS-Port-Type = Wireless-802.11 User-Name = "000e359ec2ce" User-Password = "000e359ec2ce" Calling-Station-Id = "000e359ec2ce" Called-Station-Id = "0004960e2e00" NAS-Identifier = "Altitude 300" Proxy-State = 0x31303a32040436c236c236c236c236c236c236c236c2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 42 modcall[authorize]: module "preprocess" returns ok for request 42 radius_xlat: '/var/log/freeradius/radacct/172.29.252.228 /auth-detail-20050913' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.29.252.228/auth-detail-20050913 modcall[authorize]: module "auth_log" returns ok for request 42 modcall[authorize]: module "mac_address" returns ok for request 42 modcall: group authorize returns ok for request 42 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [000e359ec2ce/000e359ec2ce] (from client wlan-switch port 0 cli 000e359ec2ce) Am I simply doing the impossible, or am I missing something obvious (again)? |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356

2 3

Questions about freeradius, ntlm_auth and windows groups
by Claudio 15 Sep '05

15 Sep '05

Hi to all, I have a freeradius 1.0.4 (upgrade to 1.0.5 is nearly coming...) with ntlm_auth on a Windows 2000 PDC. With the standard authentication with ntlm calls there is no problem. Now my question is that: is possible to assign some ip pools based on the user-group on the PDC? A quick example... i have a user called user01 with group free. The freeradius must look if the user belongs to group free (group on the PDC, not on unix) and if yes, it assign the ip pool like 10.0.1.0 to 10.0.1.10. If have another group, like only_internet, the radius must assign an ip in the pool of 10.0.1.11 to 10.0.1.20. Something like that is possible? I think yes....but how? I have searched into the previous post of the list, without any good results... someone can help me? Tnx in advance, Claudio Prono.

2 3

Re: SQL Documentation
by Sean 15 Sep '05

15 Sep '05

Sean <sean(a)swarmhotspots.com> wrote: > Can anyone recommend a good source for documentation for FreeRadius. The files that come with it, and the web pages? There really isn't any "secret treasure trove" of documentation that you get told about only if you ask for it. > I'm trying to understand the processes that occur between > Chillispot, FreeRadius and MySql. In particular I need to understand > how the Counter works and how to use the counter in MySQL. "the counter"? Please be specific. rlm_sqlcounter exists in the server source. It has sample configurations and documentation. What part of that do you have questions about? Alan DeKok. In particular I want to use the following in my radiusd.conf. counter daily{ reset =24h } counter weekly{ reset =7d } counter monthly{ reset=30 } What I need to know is do I have to add extra fields to my radius database and if so which tables need to be changed and how to address them from sql.conf. Regards, Sean

2 1

Let's share photos
by Aguirre Fernando 15 Sep '05

15 Sep '05

Hi I'm updating my address book. Please click on the link below and enter your contact info for me: http://www.ringo.com/i.html?i=119599134x886574&homeEmail=freeradius-users%4… I'm using a new, free service where I put in my contact info for you, you put in your contact info for me, and everyone stays up to date automatically. It's surprisingly easy and useful. Thanks for your help. Aguirre Fernando Don't receive any more invitations from Aguirre Fernando: http://www.ringo.com/friends/invite/block.html?memberId=119599134&email=fre… Don't receive any more invitations from anyone: http://www.ringo.com/friends/invite/block.html?email=freeradius-users%40lis…

1 0

RE: custom variable in config files
by Tariq Rashid 15 Sep '05

15 Sep '05

thanks for the suggestion and clarification. trying what you suggested gives me ... Config: including file: /opt/freeradius102/etc/raddb/proxy.conf config: No such entry network_address for string ${network_address}.126:1812 Errors reading radiusd.conf i'll keep trying and report back anything that works. tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 15 September 2005 17:18 To: FreeRadius users mailing list Subject: Re: custom variable in config files "Tariq Rashid" <tariq.rashid(a)uk.easynet.net> wrote: > i'd like to do something like ... > > realm abc.def { > type = radius > authhost = `%{config:network_address}`.126:1812 The expansion of configuration-file variables is not the same as the expansion of run-time variables. See other examples in the configuration. What *could* work is: authhost = ${network_address}.126:1812 Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Receivin a full DN in a radius request
by Jean-Francois Gobin 15 Sep '05

15 Sep '05

Hello there, For some purpose, I'm receiving a full DN in a radius request, which I must authenticate on a LDAP server. FOr now, I got a problem : radiusd strips everything after the first "=", leaving me with a username of "uid" ... Is there something I missed ? I read all the documentation I can find, nothing helped. Regards, Jean-Francois Gobin ---------- Jean-Francois Gobin - Administrateur gobinjf.be http://www.gobinjf.be mailto:gobin@gobinjf.be

4 16

Small patch for proxy code - listen.c
by Michael Mitchell 15 Sep '05

15 Sep '05

Hi, I have a small patch for the proxy code, in particular for listen.c in CVS HEAD. When the proxy reply comes back, only the cl->ipaddr is checked against the reply source address, however it is possible to configure cl->acct_ipaddr differently to cl->ipaddr (ie different auth and acct home servers for a single realm entry), and thus the active status and last reply time may never be updated for an accounting home server. I'm not sure what functional detriment the current behaviour might have, as I only stumbled across this while trying a small modification to proxy.c so that it would choose one of the home servers, even if they are all marked dead. Unfortunately I can't get CVS HEAD to compile under Solaris 10 x86 using gcc, so I have to admit I haven't compiled this code yet, but I have test the equivalent for 1.0.1 at work today. Sorry. Actually, this brings up another point that just crossed my mind, should cl->last_reply be split between authentication and accounting? Probably not a big deal, but I think it could result in for example the home auth server not being marked dead for the realm if a reply had been received from the home accounting server? (files.c around line 500) regards, Mike -bash-3.00$ diff -u listen.c.orig listen.c --- listen.c.orig Thu Sep 1 23:28:11 2005 +++ listen.c Fri Sep 2 00:00:48 2005 @@ -916,17 +916,24 @@ * as garbage. */ for (cl = mainconfig.realms; cl != NULL; cl = cl->next) { - if (oldreq->proxy_reply->src_ipaddr.af != cl->ipaddr.af) continue; + if ((oldreq->proxy_reply->src_ipaddr.af != cl->ipaddr.af) && + (oldreq->proxy_reply->src_ipaddr.af != cl->acct_ipaddr.af)) + continue; + if (cl->ipaddr.af != AF_INET) continue; /* FIXME */ - if (oldreq->proxy_reply->src_ipaddr.ipaddr.ip4addr.s_addr == cl->ipaddr.ipaddr.ip4addr.s_addr) { - if (oldreq->proxy_reply->src_port == cl->auth_port) { - cl->active = TRUE; - cl->last_reply = oldreq->timestamp; - } else if (oldreq->proxy_reply->src_port == cl->acct_port) { - cl->acct_active = TRUE; - cl->last_reply = oldreq->timestamp; - } + if ((oldreq->proxy_reply->src_ipaddr.ipaddr.ip4addr.s_addr == cl->ipaddr.ipaddr.ip4addr.s_addr) && + (oldreq->proxy_reply->src_port == cl->auth_port)) { + + cl->active = TRUE; + cl->last_reply = oldreq->timestamp; + + } else if ((oldreq->proxy_reply->src_ipaddr.ipaddr.ip4addr.s_addr == cl->acct_ipaddr.ipaddr.ip4addr.s_addr) && + (oldreq->proxy_reply->src_port == cl->acct_port)) { + + cl->acct_active = TRUE; + cl->last_reply = oldreq->timestamp; + } }

3 2

RE: custom variable in config files
by Tariq Rashid 15 Sep '05

15 Sep '05

i'm running into the same problem again in the clients.conf file where variables are not visible in the "host =" entries. i'd like to do something like ... realm abc.def { type = radius authhost = `%{config:network_address}`.126:1812 accthost = `%{config:network_address}`.126:1813 secret = llustreamkey nostrip } where network_address is defined in a file included in radius.cfg (which works for the users file shown below). any ideas? can i force the clients.conf to be xlat'ed? tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Nicolas Baradakis Sent: 13 September 2005 18:08 To: FreeRadius users mailing list Subject: Re: custom variable in config files Tariq Rashid wrote: > but this doesn't ... > > # local test user for monitoring and diagnostics > test1@proxyradius.%{config:easynet_site} User-Password == "test1.proxyradius.%{config:easynet_site}" > Reply-Message = "hello from the proxyradius layer %{config:easynet_site}" > > any ideas? i'm using version 1.0.2 on debian 3.1 It doesn't work because the name of the entry isn't xlat'ed in src/main/files.c. Perhaps this syntax would work: DEFAULT User-Name = "test1@proxyradius.%{config:easynet_site}", User-Password == "test1.proxyradius.%{config:easynet_site}" Reply-Message = "hello from the proxyradius layer %{config:easynet_site}" -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1