- Freeradius-Users - lists.freeradius.org

difference between Acct-Session-Id and Acct-Unique-Session-Id
by marc racal 07 Sep '05

07 Sep '05

what is the difference between Acct-Session-Id and Acct-Unique-Session-Id? thanks in advance. regards, marc -- Get Firefox! http://tinyurl.com/cocg2 The browser you can trust.

1 0

users who are listed in /usr/local/etc/raddb/users cannot authenticate.
by Drew Weaver 06 Sep '05

06 Sep '05

I have a number of users whom are listed in my /usr/local/etc/raddb/users file in this format: User1 password="4978" fall-through="1" user2 password="knjy500" fall-through="1" user3 password="8556" fall-through="1" user4 password="8556" fall-through="1" user5 password="rocky" fall-through="1" none of them are able to authenticate. These users are both listed in /usr/local/etc/raddb & in the local system's password file (for chap purposes) if I remove the listing from the users file they can authenticate via PAP. Thanks, -Drew

1 0

Digest and MD5
by Iandc Davies 06 Sep '05

06 Sep '05

All, For the Digest, the MD5 hashed response is, as far as I can make out, generated as follows :- A1 = H[Digest-User-Name:Realm:Password] A2 = H[Digest-Method:URI] KD1 = H[Hexdump(A1):Nonce] KD2 = H[KD1:Hexdump(A2)] KD = H[KD2] - - Which should match the final received Digest-Reponse element. Right... The question. All info apart from the Password come from the incoming VAS AVP packet. The Password seems to be sourced from a structure called REQUEST defined in libradius.h, in a specific pointer VALUE_PAIR element called config_items. Where and when does this element get populated and with data from where ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

DIGEST-MD5 and LDAP Backend
by Daniel Corbe 06 Sep '05

06 Sep '05

Hello, Would it even be possible to support this type of scenario? I'm passing a Digest auth request from my SIP server to my Radius server and then to my LDAP back-end. The only way I can get it to work is if I store the userPassword attribute on the LDAP server in plain text. Ideally I'd like to be able to store them in MD5 I'm looking to get some kind of rough idea of what may need to change about FreeRADIUS to facilitate this or even if it is possible at all. Thanks. -Daniel

2 1

Moving a freeradius installation
by bendowling＠lineone.net 06 Sep '05

06 Sep '05

Hi, I have built freeradius-1.04 from source and installed it to the default directories (for example, /usr/local/etc/raddb for the configuration files). I now wish to move the whole installation to /usr/radius so that it will be possible to tar the directory and copy it to other severs. I know I can configure which directories radusd uses in radiusd.conf, but is there any way to make radiusd look in /usr/radius/etc for radiusd.conf without rebuilding? If I do need to do a fresh build and install is there anyway of cleanly uninstalling what is currently there? Thanks in advance, Ben Dowling __________________________________________________________________ 1Mb Tiscali Broadband for £14.99. Offer ends 30th June 2005 http://www.tiscali.co.uk/products/broadband

2 1

Script to process authentications & accounting
by ricklim＠telus.net 06 Sep '05

06 Sep '05

Is there any information about using a script with freeradius to process authentications? TIA

3 2

Can't start freeradius - auth bind error
by NECTIS NetVoice Sales 06 Sep '05

06 Sep '05

Hi, can not start freeradius: Starting RADIUS server: Tue Sep 6 13:08:47 2005 : Info: Starting - reading configuration files ... auth bind: Address already in use [FAILED] What is it? Regards,

2 1

Authentication using LDAP on port 636
by Dany Cuyt 06 Sep '05

06 Sep '05

Hi, I installed freeradius 1.0.1 for RHEL4 from RedHat network. As an ldap server I have Sun Directory server 5.2 patch3 with SSL enabled. I have plenty of applications using port 636 to access LDAP (ypldapd from padl, /etc/ldap.conf on linux, Mozilla address book, etc..) . With freeradius as long as I use standard port 389 I don't have problems to use LDAP, but I have problems to use port 636 (Can't contact LDAP server). Or I missed something but I seem to be unable to find a procedure how to setup freeradius using SSL. Any help would be appriciated Thanks, Dany

1 0

Require realm suffix
by Ben Thompson 06 Sep '05

06 Sep '05

Hi I have set up FreeRADIUS so that I am using the relam format username@suffix. I have succesfully got this working by adding the relevent realm to proxy.conf and setting authhost and acchost to LOCAL. Currently when someone logs without specifying a realm, they are still authenticated and I would like to know if it is possible to change this behavoir so that users must specify the realm suffix. Thanks Ben Thompson

2 2

Can I add extra fields to the radius accounting database?
by Miguel Angel Quiles 06 Sep '05

06 Sep '05

Hi, I've got freeradius 1.0.2 on a SUSE 9.3. I was thinking if I could add a new field to the radius accounting. I'm using mysql. I already added the field to the radacct table in the radius database. And I've tried to modify the sql.conf file in the raddb directory. When I restart the service the freeradius won't start because off an error. I've created the field "TunnelType", and I added the values in the different queries, such as: accounting_update_query_alt = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, TunnelType) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Tunnel-Type:0}')" I hope somebody can help me. Thanks

2 2