- Freeradius-Users - lists.freeradius.org

=* operator really work in 1.0.2 ?
by Ruslan A Dautkhanov 04 Aug '05

04 Aug '05

Hello ! I use "=*" operator in User-Password attribute for special account, that accept any passwords. User-Password =* anypassword In pre-1.0.0 CVS it works fine. After upgrading to 1.0.2 it is really don't work. Is it bug or some configuration changes must be applied? Is any known work-arounds exists? Thanks a lot. -- Ruslan A Dautkhanov

1 0

RE: How to connect freeradius and SER!
by Jose Divino de Lima 04 Aug '05

04 Aug '05

Hello.. It's possible. We've a SER that authenticate in a freeRadius. Please, fell free to send me an email (jdlima(a)prolan.com.br) and I can help you. Lima -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Alan DeKok Sent: Wed 3/8/2005 23:24 To: zhu lizhong; FreeRadius users mailing list Cc: Subject: Re: How to connect freeradius and SER!

1 0

How to connect freeradius and SER!
by zhu lizhong 04 Aug '05

04 Aug '05

Hello, guys: I try ot connect Freeradius and SER. when i include the dictionary.ser in dictionary, the ser tells me that it can nor open the dictionary.ser. anyone knows how to fix it? thanks in advance! zhu

2 1

Authentication problem-FreeRadius Output
by Hamid Salim 03 Aug '05

03 Aug '05

[root@radiusd sbin]# /opt/radiusd/sbin/runradiusd -X + LD_LIBRARY_PATH=/opt/openssl/lib + LD_PRELOAD=/opt/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH + export LD_PRELOAD + /opt/radiusd/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/radiusd/etc/raddb/proxy.conf Config: including file: /opt/radiusd/etc/raddb/clients.conf Config: including file: /opt/radiusd/etc/raddb/snmp.conf Config: including file: /opt/radiusd/etc/raddb/eap.conf Config: including file: /opt/radiusd/etc/raddb/sql.conf main: prefix = "/opt/radiusd" main: localstatedir = "/opt/radiusd/var" main: logdir = "/opt/radiusd/var/log/radius" main: libdir = "/opt/radiusd/lib" main: radacctdir = "/opt/radiusd/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/radiusd/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/radiusd/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/radiusd/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/radiusd/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/opt/radiusd/etc/1x/radiusd.ece.neu.edu.pem" tls: certificate_file = "/opt/radiusd/etc/1x/radiusd.ece.neu.edu.pem" tls: CA_file = "/opt/radiusd/etc/1x/root.pem" tls: private_key_password = "serverpwd" tls: dh_file = "/opt/radiusd/etc/1x/dh" tls: random_file = "/opt/radiusd/etc/1x/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/opt/radiusd/etc/raddb/huntgroups" preprocess: hints = "/opt/radiusd/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/opt/radiusd/etc/raddb/users" files: acctusersfile = "/opt/radiusd/etc/raddb/acct_users" files: preproxy_usersfile = "/opt/radiusd/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addr" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/opt/radiusd/var/log/radius/radacct/%{Client-IP-Address}" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/opt/radiusd/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/opt/radiusd/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. Hamid Salim wrote: >Hi all, >i was wondering if anyone has successfully implemented the following >setup and/or had any issues. this is my second post. your help will be >greatly appreciated. > > >I have a setup as follows: > >Fedora core 3 >FreeRadius 1.0.4 >openssl .098 >Dell TrueMobile 1170 Access Pointv2.3.3 >802.11b/g cards for AP and supplicant >Windows XP SP2 > >FreeRadius is not authenticating, there are no messages on the screen >or the logfile. The AP does not see the FreeRadius server! > >I think this is a configuration issue outside of FreeRadius. > >Has anyone had similar problem. > >Any help will be greatly appreciated as i have hit a wall here and i am >on a deadline! > >thanks >Hamid.

2 1

Simple flat file passwords?
by Martin.Ward＠uk.neceur.com 03 Aug '05

03 Aug '05

I am trying to use the passwd module to configure a simple flat file with two fields, a user name and a password. I believe I have the module configured right: passwd text_file { filename = /var/text_file format = "*User-Name:*User-Password" authtype = PAP } The contents of this file are: mward:feeble However I can't figure out which authtype to use. If I use PAP (above) I get the following errors: rlm_pap: login attempt by "mward" with password feeble rlm_pap: No password (or empty password) to check against for for user mward If I use CHAP or MSCHAP I get errors like: rlm_chap: Attribute "CHAP-Password" is required for authentication. Cannot use "User-Password". and if I change the format=line to suit, my passwd module fails with: modcall[authorize]: module "text_file" returns notfound for request 0 Can anyone point out the undoubtedly siple thing I am missing? Thanks. |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356

2 2

Limiting the number of connections
by Jose Divino de Lima 03 Aug '05

03 Aug '05

Hi people, I need your help. We´ve a solution that use SER athenticating, athotizing and accounting in a freeRadius+mySQL. I´ve a challenge now to limit thu number of simultaneous connections (i.e: we can permit only ten connections at the same time). Does anybody has any idea to implement this in freeRadius+mySQL ? I imagine that i need to change the sql queries in sql.conf, but i´m not sure.. Any ideas ? Tks, Lima

2 1

Authentication problem
by Hamid Salim 03 Aug '05

03 Aug '05

Hi all, i was wondering if anyone has successfully implemented the following setup and/or had any issues. this is my second post. your help will be greatly appreciated. I have a setup as follows: Fedora core 3 FreeRadius 1.0.4 openssl .098 Dell TrueMobile 1170 Access Pointv2.3.3 802.11b/g cards for AP and supplicant Windows XP SP2 FreeRadius is not authenticating, there are no messages on the screen or the logfile. The AP does not see the FreeRadius server! I think this is a configuration issue outside of FreeRadius. Has anyone had similar problem. Any help will be greatly appreciated as i have hit a wall here and i am on a deadline! thanks Hamid.

3 2

Coa and Disconnect Message
by gennaro amelio 03 Aug '05

03 Aug '05

hi all, i' am an italian student and i' m a newbie with freeradius. So sorry if i ask stupid things... Can i use Freeradius to do a prepaid-billing system?? Freeradius supports CoA and Disconnect Mesage? Thanks

2 1

ldap basedn assignment
by ggreen＠olemiss.edu 03 Aug '05

03 Aug '05

I have freeradius setup to use 2 ldap servers as backend authentication. One is openldap and the other is windows active directory. They have different basedn structures and these are laid out separately in the conf file. I have it setup to authenticate off of active directory first and openldap second. Everything is working fine except for the case of a user who's openldap username is the same as someone in active directory. In the authorize stage it looks in both AD and ldap. In the authenticate stage it queries both AD and ldap. The problem is that in the authenticate stage it uses the basedn of the server that returns the first ok in the authorize stage. So if the username is in both AD and ldap, openldap rejects the user because it is using the AD basedn to query the openldap server. Is there a way for me to force the basedn for the ldap server regardless of which server returned the first ok? Thanks in advance g

2 1

rlm_sql post-auth variable bug?
by Fernando Schapachnik 03 Aug '05

03 Aug '05

Hi, In my AAA chain I have a module that *sometimes* adds a custom attribute (defined in my dictionary as ipaddr) called Auth-NAS. This module is called in the authorize section. Later on, in the post-auth session I have a SQL-module that has: postauth_query = "INSERT INTO ${postauth_table} (...) \ VALUES (.... \ '%{check:Auth-NAS:-0.0.0.0}', ...)" When run, and Auth-NAS is not present, it outputs: rlm_sql (sql-xxx) in sql_postauth: query is INSERT INTO table (...) ??VALUES (..., '=01', ...); Sometimes the '=01' is replaced by '255.255.255.255'. Is this a bug in some place or am I doing something wrong? Any ideas? Thanks in advance. Fernando.

1 1