- Freeradius-Users - lists.freeradius.org

Need inbound CHAP authentication user profile examples
by RUCHIR MALHOTRA 04 Aug '05

04 Aug '05

Hi RADIUS gurus,I need some inbound CHAP authentication user profile examples for RADIUS testing with CHAP turned on. Please email me if you have some. Thanks in advance, Ruchir __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Cisco, DNIS and ISDN Problems
by Wilhelm Lehmann 04 Aug '05

04 Aug '05

Hi Everyone, I have been using Livingston Radius for a very long time, and decided it was time to upgrade to FreeRadius. We have various pop's authenticating to our radius server, and to make sure everything worked ok I first set only the lucent based pop's to authenticate on FreeRadius. This worked 100% and we decided to let the cisco boxes also authenticate on the new radius server. Suddenly we found the ISDN users can't authenticate. "tail -f radius.log Thu Aug 4 11:24:28 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as2 port 20012 cli 061xxx) Thu Aug 4 11:24:30 2005 : Auth: Login incorrect: [sonjapretorius/xxx] (from client Windhoek-as2 port 20012 cli 061xxx) Thu Aug 4 11:24:31 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as2 port 20330 cli 061xxx) Thu Aug 4 11:24:33 2005 : Auth: Login incorrect: [japhet/xxx] (from client Windhoek-as2 port 20330 cli 061xxx) Thu Aug 4 11:24:52 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Industria-as1 port 77 cli 061xxx) Thu Aug 4 11:24:58 2005 : Auth: Login OK: [lords/<CHAP-Password>] (from client Industria-as1 port 77 cli 061xxx) Thu Aug 4 11:25:05 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as1 port 20424 cli 061xxx) Thu Aug 4 11:25:10 2005 : Auth: Login incorrect: [japhet/xxx] (from client Windhoek-as1 port 20424 cli 061xxx) Thu Aug 4 11:25:51 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as1 port 72 cli 061xxx) Thu Aug 4 11:25:56 2005 : Auth: Login OK: [kaysererongo/<CHAP-Password>] (from client Windhoek-as1 port 72 cli 061xxx) " The two Login OK's are Async users. I noticed the port numbers are very high on the ISDN users, 20000+ while the Async ports are < 200 Just something else, for example the same user "japhet" can connect fine as he should on the Lucent NAS on ISDN or Async. The moment he connects to the Cisco I get the Login incorrect. No changes done at all. (Async works fine on the Cisco) On the DNIS:1040 even on my Livingston radius I used to get the dnis:1040 user every time a user connects to the cisco nas's but this is just a minor irritation it didn't affect the users operation. How can I get rid of this ? The National Teleco (running the Cisco's) say there is nothing they can do, as they share the E1's and modems with all ISP's in our country, but determining who's customer it is by the number dialed, and this is where the dnis:1040 comes from and told me just to ignore it. Running radiusd -xx gives no info as to why it was rejected. Hope someone can assist. Thank you Wilhelm Lehmann

3 5

RES: Limiting the number of connections
by Jose Divino de Lima 04 Aug '05

04 Aug '05

Hi Alan, Thanks for your explanation. We´ve a shell script that do exactly what you sad. I´m trying to look for another way to do this. We´ve here a VoIP network and we need to restrict "N" connections to some groups. When i using a shell script it´s run properly, but it´s not fast. I thought that it can be did via mySQL in authorize_check query. It´s my scenario. Tks, Lima -----Mensagem original----- De: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]Em nome de Alan DeKok Enviada em: quarta-feira, 3 de agosto de 2005 13:32 Para: FreeRadius users mailing list Assunto: Re: Limiting the number of connections "Jose Divino de Lima" <jdlima(a)prolan.com.br> wrote: > I´ve a challenge now to limit thu number of simultaneous connections > (i.e: we can permit only ten connections at the same time). doc/Simultaneous-Use If you're limiting connections to 10 *different* people, you'll have to write some custom code. Even a shell script would do. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: ldap basedn assignment
by ggreen＠olemiss.edu 04 Aug '05

04 Aug '05

> How do you have this setup? Check out doc/configurable_failover. That > should show you how to do it. > I'm using configurable failover to get it to roll as it is. >From my radiusd.conf file: Authorize{ ldap1{ reject=1 } ldap2{ reject=1 ok=return } } Authenticate{ Auth-Type LDAP { ldap1{ reject=1 ok=return } ldap2{ reject=1 ok=return } } } The output I see when I try to authenticate with an openldap username/password where the username is also in AD rad_recv: Access-Request packet from host 130.74.186.38:17688, id=1, length=46 User-Name = "username" User-Password = "test123" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(sAMAccountName=username)' radius_xlat: 'cn=Users,dc=dept,dc=university,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ad.dept.university.edu:389, authentication 0 rlm_ldap: bind as cn=aduser,cn=Users,dc=dept,dc=university,dc=edu/adpassword to ad.dept.university.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in cn=Users,dc=dept,dc=university,dc=edu, with filter (sAMAccountName=username) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(uid=username)' radius_xlat: 'dc=university,dc=edu,c=US' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to openldap.university.edu:1744, authentication 0 rlm_ldap: bind as uid=ldapuser,ou=Special Users,dc=university,dc=edu,c=US/ldappassword to openldap.university.edu:1744 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=university,dc=edu,c=US, with filter (uid=username) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap2" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "username" with password "test123" rlm_ldap: user DN: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu rlm_ldap: (re)connect to ad.dept.university.edu:389, authentication 1 rlm_ldap: bind as CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu/test123 to ad.dept.university.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap1" returns reject for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "username" with password "test123" rlm_ldap: user DN: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu rlm_ldap: (re)connect to openldap.university.edu:1744, authentication 1 (THIS LINE IS THE PROBLEM) rlm_ldap: bind as CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu/test123 to openldap.university.edu:1744 rlm_ldap: waiting for bind result ... rlm_ldap: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu bind to openldap.university.edu:1744 failed No such object rlm_ldap: ldap_connect() failed modcall[authenticate]: module "ldap2" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 auth: Failed to validate the user. The above problem line should be: rlm_ldap: bind as uid=username, ou=People, dc=university,dc=edu,c=us/test123 to openldap.university.edu:1744 However, it is taking the userdn from the ad server which gave the first authorize ok. What I need is for it to attempt to authenticate with the appropriate userdn depending on which server it is authenticating to. So it would use the userdn from AD authenticating to the AD server and the openldap userdn when authenticating to the openldap server. Thanks

3 2

Authentication problem
by Hamid Salim 04 Aug '05

04 Aug '05

On Wed, 3 Aug 2005, Hamid Salim wrote: > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Listening on proxy *:1814 > Ready to process requests. > Dusty's response: You need to figure out why your NAS is not sending radius packets to the radius server. Check your network connections, your firewall rules, etc.. My question: i am not using NAS (as i understand) also i am not using Radius accounting. I am trying to use FreeRadius solely for authentication. what is check_with_nas = yes used for? do i need to change this??? thanks. Hamid.

2 1

RE: accounting - respose from freeradius, and forward
by Tariq Rashid 04 Aug '05

04 Aug '05

i'm happy to work with anyone with the programming talent to do this. tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 04 August 2005 16:34 To: FreeRadius users mailing list Subject: Re: accounting - respose from freeradius, and forward Tariq Rashid <tariq.rashid(a)uk.easynet.net> wrote: > i'll have another look to see if it is possible using mechanisms within the > radiusd.conf (perhaps calling 2 modules, one to reply, one to forward). There could be a "replicate" module, which would send packets to multiple destinations. I'd prefer not to have it in the server core. For that matter, proxying could very much be a module. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: accounting - respose from freeradius, and forward
by Tariq Rashid 04 Aug '05

04 Aug '05

thanks for the suggestion. i've had a look at this and it doesn't seem like an elegant solution to me. i'll have another look to see if it is possible using mechanisms within the radiusd.conf (perhaps calling 2 modules, one to reply, one to forward). t -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Nicolas Baradakis Sent: 03 August 2005 15:47 To: FreeRadius users mailing list Subject: Re: accounting - respose from freeradius, and forward Tariq Rashid wrote: > we'd like freeradius to reply to accounting requests (start, stop, interim) > with acknowledgements, but also to forward the accounting request to a > backend radius server but to ignore the response from this prozy behaviour. > > this means that the querying NAS equipment doesn't spend time and resources > waiting for a backend reply to an accounting request. however, the backend > radius (possibly belionging to a 3rd party organisation) will need to see > the accounting packets - we just ignore/drop their repsonse. You could use radrelay. See the radrelay(8) manpage in 1.0.x version or radrelay.conf(5) manpage in CVS version. -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Coa and Disconnect Message
by gennaro amelio 04 Aug '05

04 Aug '05

So Alan, FreeRadius can' t send Disconnect Message? Then i think that the better solution is use rlm_sqlcounter and an external apllication that control the session time and send Disconnect message. You are agree with me? Thanks

2 1

Regarding checkrad
by Nurul Faizal M.Shukeri 04 Aug '05

04 Aug '05

Hi all... I'm trying to use checkrad to check for double login. I have read doc/Simultaneous-Use. The problem is when I'm trying to use checkrad, this is the output :- sony# checkrad cisco 10.201.1.3 37 ultrabalad 3706 Timeout: No Response from 10.201.1.3. Timeout: No Response from 10.201.1.3 My ap is cisco 340 and I already enable snmp feature. I don't know what the problem is. Plz help me.

2 6

Dialupadmin docs
by Simon Jones 04 Aug '05

04 Aug '05

Hi, Can anyone point me in the direction of the docs for dialupadmin, just installed Free RADIUS 1.0.4, total newbie so any info would be great. Thanks . Simon Jones SAQ Internet VoIP: 4822813 www.saq.co.uk simon(a)saq.co.uk -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.338 / Virus Database: 267.9.9/62 - Release Date: 02/08/2005

1 0