- Freeradius-Users - lists.freeradius.org

errors when compiling cvs version on Fedora Core 3
by Ilia Chipitsine 05 Jul '05

05 Jul '05

I'm trying to compile cvs version of freeradius using attached spec file on Fedora Core 3 (with gcc4), what can cause the following error ? ..... /usr/bin/libtool --mode=compile gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I../../include -I. -c rfcnb-io.c gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I../../include -I. -c rfcnb-io.c -fPIC -DPIC -o .libs/rfcnb-io.o `-mcpu=' is deprecated. Use `-mtune=' or '-march=' instead. gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I../../include -I. -c rfcnb-io.c -o rfcnb-io.o >/dev/null 2>&1 /usr/bin/libtool --mode=compile gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I../../include -I. -c rfcnb-util.c gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I../../include -I. -c rfcnb-util.c -fPIC -DPIC -o .libs/rfcnb-util.o `-mcpu=' is deprecated. Use `-mtune=' or '-march=' instead. rfcnb-util.c: In function 'RFCNB_Name_To_IP': rfcnb-util.c:317: error: 'lrad_ipaddr_t' undeclared (first use in this function) rfcnb-util.c:317: error: (Each undeclared identifier is reported only once rfcnb-util.c:317: error: for each function it appears in.) rfcnb-util.c:317: error: syntax error before 'ipaddr' rfcnb-util.c:319: error: 'ipaddr' undeclared (first use in this function) gmake[6]: *** [rfcnb-util.lo] Error 1 gmake[6]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1/src/modules/rlm_smb' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.69431 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.69431 (%build) Cheers, Ilia Chipitsine

2 1

about the fixes for forking external programs
by Archana Vemulapalli 05 Jul '05

05 Jul '05

Hello, With regards to the fixes ( in 1.03 and 1.04) for forking external programs, could anyone elaborate on the circumstances that lead to the failure condition? "Change log: * Fixes for forking external programs, so the server doesn't suddenly stop processing requests, or stop forking programs." Thanks, Archana

2 1

freeradius LDAP& EAP/TLS
by Felice Pizzurro 05 Jul '05

05 Jul '05

Hi, Is possible to use ldap only for authorization (by the radiusGroupName attribute), and EAP/TLS for authentication? I have tried, the authorization is works fine... and I have: "user [Felice] is authorized to remote access" but after I have, "rad_check_password" naturally the TLS authentication haven't password and i have "login failed". anyone know how I can use ldap only for authorization based on the radiusGroupName, without any password control? thanks... -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Calzature moda sport. Da Oliviero.it le ultime novità autunno-inverno 2004/2005: Nike, Puma, Adidas.... * Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=2846&d=5-7

2 1

Proxy, only if local auth fails?
by Woods, Bryan 05 Jul '05

05 Jul '05

In a nutshell: I'd like to like to proxy authentication requests to a Microsoft IAS server only if the attempt to first handle them locally has returned a REJECT. Details: I have IAS properly configured to authenticate AD users. FreeRADIUS (1.0.1) is running on a Linux (Debian, kernel 2.4.26) box and can authenticate properly against a local LDAP server (default realm) or proxy the requests to the IAS server (ntdomain) realm. This configuration is working. If the request contains the username in ntdomain format (e.g. "domain\username"), it gets forwarded to the IAS server. If the username has no prefix/suffix (e.g. "username"), it gets handled locally. Again, the radtest util has confirmed that this configuration is working the way that I'm expecting. However, what I'd like to do is have the server attempt to handle this request locally. If the local authentication attempt results in a 'reject', I then would like to have this request proxied to the IAS server. I could reverse the order and have the request first proxied to the IAS server and then handled locally if it's rejected, but the majority of our users have local accounts so it makes sense to try the local system first. I would greatly appreciate any suggestions that can be offered. Bryan

2 1

Re: Freeradius and eDirectory
by Mearl Danner 05 Jul '05

05 Jul '05

Thanks - that worked. I'm getting a tls connect. Now I have a problem testing using radtest. Using the following syntax. radtest jmuser heath10er server13.samford.edu 199.20.16.13 testing123 >From the log the admin bind and login is OK - I've obscured the password, but it shows in the log exactly as it is in radiusd.conf. rlm_ldap: starting TLS rlm_ldap: bind as cn=admin,ou=cts,o=dxmltemp/xxxxxx to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful Here's the excerpt showing the request from radtest. The password is represented correctly. rad_recv: Access-Request packet from host 199.20.16.13:33419, id=137, length=58 User-Name = "jmuser" User-Password = "heath10er" NAS-IP-Address = 255.255.255.255 NAS-Port = 199 Here's the attempted bind by the user. Note that the password presented is not "heath10er" but "aeath10er" and the bind fails. rlm_ldap: starting TLS rlm_ldap: bind as cn=jmuser,ou=R&D,ou=New Users,o=DXMLTEMP/aeath10er to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: eDirectory account policy check failed. rlm_ldap: NDS error: failed authentication (-669) Changed the Universal Password to "aeath10er" and got the following. rlm_ldap: starting TLS rlm_ldap: bind as cn=jmuser,ou=R&D,ou=New Users,o=DXMLTEMP/beath10er to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: eDirectory account policy check failed. rlm_ldap: NDS error: failed authentication (-669) It appears that the Universal Password is being misread. Can that be true? Full log is below. Thanks Mearl >>> sbhowmick(a)novell.com 6/27/2005 10:55:07 PM >>> Hi, You need to extract the Self Signed certificate of the CA (from inside the Security Container). Once you have extracted that you need to configure tls_cacertfile in the ldap section of radiusd.conf. You have configured the tls_certfile. Once you do that it should start working. -Sayantan. >>> jmdanner(a)samford.edu 06/27/05 9:20 PM >>> I'm having trouble getting a TLS connection from freeradius to my Novell LDAP Server. I've used Novell's document "Integrating Novell eDirectory with FreeRadius" to set it up. The radius -X log shows "rlm_ldap: could not start TLS Connect error" I've configured ldap.conf to use the same certificate and am able to do a successful search using: ldapsearch -vvv -h gwtemp.samford.edu -x -Z -b o=dxmltemp "cn=jmuser" dn FreeRadius 1.0.4 compiled --with-edir Redhat AS3 update 5 on an IBM p615 openldap-2.0.27-17 openssl-0.9.7a-33.15 Netware 6.5 SP3 on Dell hardware. Mearl Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded LDAP ldap: server = "gwtemp.samford.edu" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=admin,ou=cts,o=dxmltemp" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "demand" ldap: password = "xxxxx-xxxxx" ldap: basedn = "o=dxmltemp" ldap: filter = "(uniqueID=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x1016f6d8 Module: Instantiated ldap (ldap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 199.20.16.13:33419, id=137, length=58 User-Name = "jmuser" User-Password = "heath10er" NAS-IP-Address = 255.255.255.255 NAS-Port = 199 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jmuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jmuser radius_xlat: '(uniqueID=jmuser)' radius_xlat: 'o=dxmltemp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to gwtemp.samford.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=admin,ou=cts,o=dxmltemp/xxxxxx to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=dxmltemp, with filter (uniqueID=jmuser) rlm_ldap: checking if remote access for jmuser is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jmuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to gwtemp.samford.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=jmuser,ou=R&D,ou=New Users,o=DXMLTEMP/aeath10er to gwtemp.samford.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: eDirectory account policy check failed. rlm_ldap: NDS error: failed authentication (-669) rlm_ldap: ldap_release_conn: Release Id: 0 modcall[post-auth]: module "ldap" returns reject for request 0 modcall: group Post-Auth-Type returns reject for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 199.20.16.13:33419, id=137, length=58 Sending Access-Reject of id 137 to 199.20.16.13:33419 Reply-Message = "NDS error: failed authentication (-669)" --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 137 with timestamp 42cabe38 Nothing to do. Sleeping until we see a request.

1 0

Multiple Sql Databases
by psyco＠sunny-net.ne.jp 05 Jul '05

05 Jul '05

Righ now my organization has 2 master radius servers (1 primary 1 slave) which have sql databases stored on them. I also have 4 radius servers under these two master servers which handle proxied radius requests based on realm names from the two master servers and authenticate using sql databases that are located on the two master servers. Basically I couldn't find a better way to do it and I'm now to the point where I need to add in three more sql databases and three more realms. I'm looking for a solution where I don't need to keep on adding more radius servers just to take the request and throw it back at the masters. Just incase it is hard to understand what is going on, here is what I have currently. 2 Master servers that recieve requests from an outside NAS for realms such as username(a)adsl.domainname.net username(a)fiber.domainname.net, username(a)dialup.domainname.net, username(a)mobile.domainname.net, username(a)isdn.domainname.net etc. etc. etc. These Master servers also have postgresql databases with names such as adsl, dialup, mobile etc. etc. etc. 4 Radius Servers that recieve requests from the masters. For instance in the master i might have a config in proxy.conf to forward requests for adsl.domainname.net to xxx.xxx.xxx.xxx radius server. This radius server recieves that request and authenticates the user using the database that is written in /etc/postgresql.conf. (In my case I keep all the databases on the master radius servers NOT on the individual radius servers.) So as you see these 3 radius servers seem to be a little out of place but this is the only way I could find to do this. It would be handy if I could say in proxy.conf to authenticate to localhost on database adsl etc. etc. However, as I see it you can't do that and the configurable failover is only to configure failovers so I really don't know what else to do. I can't keep on adding radius dummy radius servers everytime I make a new realm. I would appreciate ANY help all of you well experienced geniuses could give. PK

2 1

Re: Windows -> VPN -> Radius
by Roberto Greiner 05 Jul '05

05 Jul '05

> > If the request contained MSCHAP, yes, the mschap module should > > return ok. Since the request doesn't contain MSCHAP, the mschap > > module returns noop. > > > > Make the client send MSCHAP, or CHAP-Password, or User-Password. No > > amount of playing with radiusd.conf will fix the client. > > Now THAT would be a nice trick. How do you convince Windows to do what > you wan't (or expect) it to do??????? :-P > > Well, I tried to change the (few) options the windows VPN client gives > for authentication/security, and none made windows send me the > CHAP-Password in the request. Anyway, I will try to google some other > options. Well, I think I finally found what's happening. Windows IS sending the proper password. The problem is with radiusclient, the program that my VPN server (poptop) uses to interface with radius. It does not have a dictionary.microsoft file by default, and due to this it's discarding some of the pairs Windows is sending. Do I need to say that the pairs discarded are the ones with the password??? I'm trying to solve this problem, but the dictionary.microsoft files I've tried didn't work. The one that comes with freeradius isn't understood by radiusclient, and the one I found in the radiusclient site didn't work properly (did overwrite non-Vendor pairs) Does somebody know where I can get properly working dictionary files for this case? (I know this is not a freeradius question, but I need it to make the client work properly. Sorry) Thank you very much, Marcos Roberto Greiner

2 1

Database Replication
by Santiago Balaguer García 05 Jul '05

05 Jul '05

2 1

forming Tunnel with TLS
by kiran kumar gullapalli 05 Jul '05

05 Jul '05

Hi all, Is it possible with free RADIUS to form tunnel directly between two radius servers which dont have any shared secret between them but knowing each other IP address. Means by forming the secret dynamically with TLS handshaking?

3 3

customer with wrong passwords
by Vects 05 Jul '05

05 Jul '05

Hi there, I want to implement default 'catch all' rules in radius for customers with wrong passwords, they suppose to be connected and redirected to some web proxy. In the same time that default shouldn't concern customers with correct passwords. Is below correct for my purpose? ... DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Service-Type = Framed-User, Framed-MTU = 1500, Fall-Through = Yes DEFAULT Auth-Type := Reject Service-Type = Framed-User, Framed-IP-Address = 255.255.255.254, Framed-MTU = 1500, Cisco-AVPair += "lcp:interface-config=ip route-cache policy\nip policy route-map toproxy" ... Thank you, Vects

2 1