- Freeradius-Users - lists.freeradius.org

remove AV pairs from proxy request ?
by Massimiliano Liccardo 06 Jun '05

06 Jun '05

hi all, I need to remove in a configurable manner some AV pairs from my proxy request, in order to send to a home server just a "secure" AV pairs subset. It looks very close to the rlm_attr_filter but in the opposite path....any idea? thanx! -- Massimiliano Liccardo (maX) <liccardo(a)acmesolutions.it> jid:coccolesto@jabber.org GnuPG public key available on wwwkeys.eu.pgp.net Key ID: D01F1CAD Key fingerprint: 992D 91B7 9682 9735 12C9 402D AD3F E4BB D01F 1CAD "la velocità induce all'oblio, la lentezza al ricordo"

1 0

Port-Limit/Simultaneous Use based on NAS IP
by N White 06 Jun '05

06 Jun '05

Is this possible? Set a Port-Limit/Simultaneous-Use based on the NAS-IP that is sent to the FreeRadius server? Here is the setup I am looking at: I have several users on Dial-Up that are only allowed 1 login at a time. Now I have several Wireless users that will be logging in twice via PPPoE (Twice because once for their CPE/Radio and once more for their home Router). The wireless users are allowed Dial-Up on top of their wireless service, but only when their Wireless is not in use. I want them to be able to login twice if they are logging in through the PPPoE server, otherwise only login once for Dial-Up. So then is this setup possible? I've read through a lot of the docs that are included with FreeRADIUS but haven't really seen anything relating to this. Any guidance/examples/input is appreciated. Thanks -Nick nwtech(a)tele-net.net

1 0

RADIUS IP Pooling
by "Ferreira, André" 06 Jun '05

06 Jun '05

I am looking for more technical information regarding how RADIUS does IP pooling. Is there a specific RFC explaining the process. I am assuming that when RADIUS sends an ACCESS_ACCEPT message, an IP is selected from the pool and it is send together with the ACCESS_ACCEPT message to the client. Any documentation pointers welcome. Thanx. André Ferreira

2 1

Ip pool doesn't works properly
by Simone Giovanardi 06 Jun '05

06 Jun '05

Hi, How can I configure FreeRADIUS to assign IP address dinamically with Ip Pool when there is a successful authentication from Cisco 7200 access server with FreeRADIUS 1.0.0? This is my ip pool config section on radiusd.conf: ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 83.216.175.129 range-stop = 83.216.175.253 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 127 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db-satc.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db-satc.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 86400 } Like this it works sending out only 2 ip address...always the same... Bye

2 1

Trouble with HTTPS and mod_auth_radius
by Zawacki Jason D Contr AFRL/IFOS 06 Jun '05

06 Jun '05

Hey folks, I'm having trouble getting my configuration to work with SSL enabled in apache 1.3.33 using mod_auth_radius (mod_auth_radius.c,v 1.15 2003/03/24 19:16:15). This same setup works fine when SSL is not enabled. If I go to the page I've configured for radius auth, I get an Internal Server Error. I've shut off all other authentications for this location (NTLM) and the mod_auth module is not being activated. Even so, the apache error log indicates that it is looking for a user file as if I were using mod_auth. Here is my setup: ... LoadModule radius_auth_module libexec/mod_auth_radius.so ... #AddModule mod_auth.c ... AddModule mod_auth_radius.c ... AddRadiusAuth X.X.X.X:1812 XXXXXXXXXXXXXXXXXXXXXX AddRadiusCookieValid 5 ... <Location /test-radius> AllowOverride None order allow,deny allow from all AuthName "RRS Radius test" AuthType Basic NTLMAuthoritative off NTLMAuth off NTLMBasicAuth off AuthRadiusAuthoritative on AuthRadiusActive on require valid-user </Location> Like I said, the same setup works fine for a non-SSL URL, which puzzles me greatly. I'm using this box to test several authentication schemes including ldap, ntlm, and kerberos and none of demonstrated the same behavior. Any help is greatly appreciated. Jason

1 0

Re: ADSL access server, freeradius and MULTI IP assignement
by Simone Giovanardi 06 Jun '05

06 Jun '05

Hi Dario, I have the same cisco 7200 Access server. try to set at 255.255.255.255 the framed ipo netmask parameter... In my configuration works. I have a question for you: i've tried to configure ip pool for releasing of dynamic IP range address but doesn' work well and i don't understand why it gives out always the same 2 address in the range that i have configured!! How have you configured your radiusd.conf file? Thank a lot Simon

1 0

Re: Authenticate to eDirectory
by Sayantan Bhowmick 06 Jun '05

06 Jun '05

Hi, The documentation in: http://www.novell.com/documentation/edir_radius/index.html gives a list of dependencies for the freeRADIUS rpm. If you install these rpms(through yast) you should be able to install the freeradius rpm at: http://forge.novell.com/modules/xfcontent/downloads.php/edirfreeradius The latest version of FreeRADIUS is 1.0.3. You can get the source from freeRADIUS site(http://www.freeradius.org/getting.html). -Sayantan >>>carnold5(a)nc.rr.com 06/03/05 12:49 pm >>> >>One possible reason could be that the user you are building the >>radius >>server as does not have the appropriate file system permissions to >>create >>files within the /usr/local directory. I should have stated that i am logged in and running this as root. >>You can also get the FreeRADIUS RPMs for SLES 8 or SLES 9 from: http://forge.novell.com/modules/xfcontent/downloads.php/edirfreeradius So, i downloaded the rpm (and consoleone plug-in (thanks for the link)) and tried to install it using yast. Of course, when yast checks the dependencies, it says that libk5xx.so, libmysql.so and lib5kcrypto are missing. So, i searched (in yast>software>install and remove software) for the said lib's/files, none found. Huh?? So, i thought maybe i could install the freeradius 0.9.3 version and then "upgrade" to the new version 1.0.5 (i think). So as it stands now, i can not install the 1.0.5 version on SLES9/OES-Linux using edirectory. What am i missing. Thanks for all the help! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

crash of freeradius 1.0.2
by Schweizer Laurent 06 Jun '05

06 Jun '05

Hello, i use freeradius with the jradius module and i have many crashes. Loaded symbols for /usr/local/lib/rlm_eap_mschapv2-1.0.2.so #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=470) at util.c:331 #6 0x08059c4f in rl_delete (request=0x815c3b8) at request_list.c:491 #7 0x0805a502 in refresh_request (request=0x815c3b8, data=0xbfffec40) at request_list.c:1048 #8 0x0805aaff in rl_clean_list (now=0) at request_list.c:1398 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815b8a0, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 (gdb) bt #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815a678, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 #0 0x40242ef1 in kill () from /lib/libc.so.6 #1 0x40081bb1 in pthread_kill () from /lib/libpthread.so.0 #2 0x40081f2b in raise () from /lib/libpthread.so.0 #3 0x40242b24 in raise () from /lib/libc.so.6 #4 0x402443fd in abort () from /lib/libc.so.6 #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=1000) at util.c:331 #6 0x0805a489 in refresh_request (request=0x815b570, data=0xbfffec40) at request_list.c:1000 #7 0x0805a33e in rl_walk (walker=0x805a460 <refresh_request>, data=0xbfffec40) at request_list.c:895 #8 0x0805a96c in rl_clean_list (now=0) at request_list.c:1425 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492 (gdb) #5 0x0804f5d2 in rad_assert_fail (file=0x806105f "request_list.c", line=470) at util.c:331 #6 0x08059c4f in rl_delete (request=0x815c3b8) at request_list.c:491 #7 0x0805a502 in refresh_request (request=0x815c3b8, data=0xbfffec40) at request_list.c:1048 #8 0x0805aaff in rl_clean_list (now=0) at request_list.c:1398 #9 0x0804d141 in main (argc=1, argv=0x0) at radiusd.c:1492

1 0

Dialupadmin
by Rupak 05 Jun '05

05 Jun '05

Hello all I want to install dialup admin for free radius 1.0.2.I am using free radius with mysql to authenticate my user's+accounting too.Now after installing dialup admin will it make any defect in my box. Thank You Rupak

1 0

How to secure PAM?
by David LePage 05 Jun '05

05 Jun '05

I know others have run into this scenario, and I'm curious how it has been resolved. I have users that may be in two different databases - either a remote database that utilizes RADIUS (pam_radius_auth.so), or a database that uses ldap (pam_ldap.so). On Linux, my pam.d/sshd looks like: auth sufficient /lib/security/pam_radius_auth.so auth required /lib/security/pam_ldap.so My problem is as follows... I have some users that should only authenticate to pam_ldap.so, and others that I want to enforce authentication at pam_radius_auth.so. How do I do it without allowing the users defined on the system, AND in ldap, to bypass the first module? What seems to make sense, is that the pam_radius_auth.so module has a flag to reject authentication IF the user exists on the local system, when the LDAP user accounts are stored remotely. It would have to check for the users existance, and not proceed to the next module. Setting this module to required doesnt work because some users only reside in LDAP and need to bounce down to the next module.. Any ideas? D __________________________________ Discover Yahoo! Have fun online with music videos, cool games, IM and more. Check it out! http://discover.yahoo.com/online.html

1 0