- Freeradius-Users - lists.freeradius.org

Issue with increasing the number of ACL's in users file
by Niall Browne 22 Jun '05

22 Jun '05

Hi I am having a problem with an apparent limit on ACL's on my freeradius servers. I have been running this servers for a number of years, and have always had the number of ACL's on the users file below 52, and have never had any problems. I noticed as soon as I increased the ACL's above 52 it appeared to authenticate in the logs, however the auth connection through Cisco VPN simply continued to try to authenticate and nothing happened. As soon as I removed the ACL's below 52 and restarted it works fine. I dumped the logs /usr/local/freeradius/sbin/radiusd -p 1647 -sfxxyz -l stdout When I then auth'd and viewed the stdout logs, they are identical for <52 and then >52 (when compared). The only difference is that the ACL's after the magic 52 mark do not show in the stout, and this causes my timeout to fail. When I revert to <52 I can see the last ACL's and all works fine. I have checked through the configs including radiusd.conf however I cannot find a hard coded limitation on ACL's anywhere. Is anyone aware of how to resolve this ? Thanks in advance, Niall

1 0

Huntgroups-Problem (bug or feature ?)
by Lutz Petersen 22 Jun '05

22 Jun '05

We have the following szenario, in which i got a problem: We use huntgroups to allocate different types of dialins (isdn, dsl, and so on). So we have a huntgroups File which looks similar to this: xDSL NAS-IP-Address == 1.1.1.1 xDSL NAS-IP-Address == 1.1.1.2 xDSL NAS-IP-Address == 1.1.1.3 Wireless-802.11 NAS-IP-Address == 1.1.2.1 Wireless-802.11 NAS-IP-Address == 1.1.2.2 Wireless-802.11 NAS-IP-Address == 1.1.2.3 and so on. Access is huntgroup based, and via Calling-Station-Id or NAS-Port-Type attributes and so on. Now, we tried to make special groups for admin access on different servers. So we added some groups like AdminA NAS-IP-Address == 1.1.1.1 AdminA NAS-IP-Address == 1.1.2.1 AdminB NAS-IP-Address == 1.1.1.3 AdminB NAS-IP-Address == 1.1.2.3 and so on. Reason was to get a radius based way which admin (group) will be allowed to get access on which NAS (additional to other restrictions). Now, it doesn't work. As I checked out, it doesn't work when an ip address of a NAS was within the huntgroups file earlier for another group. So my question: is it ok not to build different huntgroups which contains in some cases servers with the same ip address ? Or other questioned - why ? That would be a nice feature. Ok, not an daily configuration scheme, but it would help to do some access restriction things.

2 2

Re: rlm_exec
by Doug Hardie 22 Jun '05

22 Jun '05

I have 2 exec-prog-wait modules that I am converting to rlms. The process fork time is very significant for both because of the various startup things that have to be done. By making them rlm's that is done infrequently. One of them is for authorization and the other for accounting. i have already created the accounting rlm and it seems to work fine. The question I have is should I add the authorization code to that rlm or create a separate rlm? There is virtually no commonality between them. Both are fairly complex so intermingling them in the same source file will make it fairly difficult to read/maintain. Are there any performance differences to having 2 rlm's vs one?

2 1

propy peap requests
by B. Tolka 22 Jun '05

22 Jun '05

I am trying to setup freeradius to forward peap requests to another radius server. I have the proxy.conf setup with the address to the other server. I really do not want this server to do anything but proxy to the other server. Can someone help with the configuration. I am using Fedora Core 4 any help would be appreciated. Bryan

2 1

Version 1.0.4 Upgrading
by Abdul Lateef 22 Jun '05

22 Jun '05

Hello, Currently i am using i have 1.0.2 version running on my linux box. I made plan to upgrade it with the letest Version 1.0.4. I have a small question about the 1.0.2 configuration files. How i should upgrade it. Is configuration files will be also upgraded or it will be not effected? Thnak You __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

variable containing server IP
by Tariq Rashid 22 Jun '05

22 Jun '05

hi - i'd like to use the radius server's IP within the configuration files. specifically, to include it in the reply-message - i know that some variables are defined %u, %p, %n, etc ... see doc... but none of these contain the radius server's IP address. this needs to be not from the radius packet's target address, but the real IP as defined by the OS. why the difference? in load-balancing situations, the target IP on the request packet is shared amongst different physical servers, so the real IP is the real identifier. so i'd like to do something like this in the users file... test1@proxyradius User-Password == "test1.proxyradius" Reply-Message = "hello from the proxyradius layer server %{Real-IP}" is there anyway to achieve this? i don't want to hard-code it on each different server as that is not as efficient as using a common paramterised configuration file for many servers of the same function. tariq

2 1

Re: How to use different ldap-modules?
by Stefan.Neis＠t-online.de 22 Jun '05

22 Jun '05

Hi, > I am really stuck :-( > > Let me try to explain what I inted to do: > > 1.) PAP is just the clear-text password??? > -> I thought pap is hashing the password with a challenge (MD-5). This > means the client is then transmitting this Hash to the radius, which > might hold the password in cleartext or as a MD-5-Hash as well. Either > comparing the Hashes or the passwords No. > So I want to the server to hold a crypted Password (MD-5) for PAP, but > retrieving that from the ldap server. In fact, that wouldn't even work if you where correct, as for encrypting password you typically add a random seed before hashing, so if you build two password hashes, they are different even for the same password (to avoid "replay attacks" in whatever flavour). > 2.) I do not want to do any binding to the ldap for authentication! > I just want to retrieve the information from the ldap, but then > authenticate only by the radius itself!! Gettig the plaintext password from the LDAP server should FreeRadius allow to always work. Some more details on the protocols, if you are interested: PAP: The RADIUS client takes the password and XORs it with a hash value obtained from the RADIUS secret that the client shares with the server and transmits the "encrypted" password. The server does the same computation and obtains the cleartext password. If it knows the cleartext password from your LDAP-Server it checks it and is done, if it knows a hash value from your LDAP-Server, it computes the hash value of the password it obtained from the client and compares the hash values. CHAP: During the authentication process, the machine trying to authenticate gets a challenge and responds to it, based on the cleartext password. The RADIUS client (i.e. the NAS) takes CHAP challenge and CHAP response and sends both of them to the RADIUS server. The server takes the cleartext password and checks that the given response is correct for the given challenge. If the server cannot get the cleartext password is cannot verify the CHAP data. MS-CHAP: Essentially the same with an initially somewhat less secure method for computing responses to challenges (probably to conform with US export laws of that time), meanwhile "updated" to use a reasonable protocol (if you use NT-Response and not the old LM-Response). Mostly interesting because it also computes/distributes session keys based on username and password. Note that if an attacker can guess (or brute-force) the password, he also obtains the communication keys, so this encryption is only worth mentioning, if you put your users under strict password policies (i.e. use complicated passwords, change them often and don't write them down). :-( Note that contrary to CHAP, where you do need the cleartext password to verify the response for the challenge, there's an intermediate result ("LM-Password" or "NT-Password" depending on whether you're using NT-Response or LM-Response mentioned above) which is sufficient to check the correctness of the response (OTOH, it's also sufficient to steal said intermediate result to convince NAS and RADIUS server to give you access, so if your server isn't secure, it doesn't help if you only stored those intermediate results instead of the cleartext passwords). Regards, Stefan

2 1

Compilation errors in 1.0.4
by Oleg M. Golovanov 22 Jun '05

22 Jun '05

I fixed the shown error but got the following. I set CPPFLAGS in my configure script as follows -- CPPFLAGS="-I/usr/local/include -I/usr/local/pgsql/include" LDFLAGS="-L/usr/local/lib -L/usr/local/pgsql/lib" ./configure --prefix=/usr/local/freeradius --with-raddbdir=/usr/local/freeradius/etc --with-logdir=/var/log/radius --with-radacctdir=/var/log/radacct --without-rlm-krb5 --without-rlm-sql-mysql --without-rlm-sql-oracle --with-iodbc-lib-dir=/usr/local/lib --without-rlm-sql-unixodbc --with-rlm-counter-include-dir=/usr/local/include 2>&1 > sci-freeradius.log -- But it don't help to solve it. -- gcc -g -O2 -pthread -D_THREAD_SAFE -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../../include -c rlm_counter.c -o rlm_counter.o rlm_counter.c:38: gdbm.h: No such file or directory gmake[5]: *** [rlm_counter.o] Error 1 gmake[5]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules/rlm_counter' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /usr/home/olmi/com/freeradius-1.0.4 -- Respectively, Oleg Golovanov Krasnoyarsk city Russia

2 1

RE: Log / Dialup admin Nas lookup
by Shepherd, Dave 22 Jun '05

22 Jun '05

You could try radiusreport http://www.pgregg.com/projects/radiusreport/ Very nice perl script, and if I remember there is a switch to just list who has ever logged in. To get it from the specific NAS point it top the relevant detail file. HTH Dave Shepherd > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Cris Boisvert > Sent: 21 June 2005 16:09 > To: 'FreeRadius users mailing list' > Subject: Log / Dialup admin Nas lookup > > Freeradius fedora core 3 > Mysql with dialup admin.. > > Is their a way to have the dialup admin show all the users that have > logged > in to one > Nas Server in a one month period? But not list all the login and > accounting > info? > > I just need a list of the users not everytime each logged in. > > Currently I do this.. From the radius.log > > > Cat radius.log | grep nasserveraddress > NEWFILE > > Then I import the file and sort them and delete all the login lines but > one.. > > Any recccomenddations? > > Thanx > Cris > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Debian .deb Installation Version 1.0.2 Ca.all dosn' exist
by Michael Langer 22 Jun '05

22 Jun '05

Hi @all, i read some HowTo's for installing FreeRadius/PEAP and they have used the CA.all script to create the certificats. But i can't find this script after installing FreeRadius deb version 1.0.2 on my PC. I have to install other packets ? Openssl is already installed. (After installing Freeradius) thx for hints Michael L. -- Geschenkt: 3 Monate GMX ProMail gratis + 3 Ausgaben stern gratis ++ Jetzt anmelden & testen ++ http://www.gmx.net/de/go/promail ++

4 11