- Freeradius-Users - lists.freeradius.org

RE: FreeRADIUS 1.0.3 has been released
by Abdul Lateef 04 Jun '05

04 Jun '05

Thanx for new version of freeradius. It will be more easy if you can tell what are new features added in the new ver.? Thank You Abdul Lateef Kaplivastu Lumbini __________________________________ Discover Yahoo! Use Yahoo! to plan a weekend, have fun online and more. Check it out! http://discover.yahoo.com/

2 1

Re: ldap.attrmap problem
by pieter.hotting 04 Jun '05

04 Jun '05

> -----Oorspronkelijk bericht----- > Van: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Namens Alan DeKok > Verzonden: donderdag 2 juni 2005 23:47 > Aan: FreeRadius users mailing list > Onderwerp: Re: ldap.attrmap problem > > "pieter.hotting" <pieter.hotting(a)hetnet.nl> wrote: >> When I look at a datascope to the interaction between FreeRadius and >> eDirectory I see correctly the response: >> >> rADIUSDialAccessGroup-->cn=E_VPN_Clients_1,ou=RmtAcc,ou=SERVICES,o=AN. >> However if I look at the output of radius I see: >> rlm_ldap: looking for reply items in directory... >> rlm_ldap: Adding rADIUSDialAccessGroup as CVPN-3k-Groups, >> value cn & op=11 >> >> This tells me that for some reason the response is stripped at the '=' >> sign. >> >> Can anyone point me in the right direction what I'm doing wrong? > The LDAP module looks in the contents of the returned data to > determine the operator. You can force it to use a particular operator > by adding an extra field to ldap.attrmap: > > replyItem CVPN-3k-Groups rADIUSDialAccessGroup += > > This only works in the CVS snapshot, though. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? > See http://www.freeradius.org/list/users.html Thanks for the response. I tested with the CVS snapshot and modified ldap.attrmap. However I could not get it to work. Freeradius kept sending just "cn" as a response to the VPN server instead of the full string which Freeradius received from the ldap-server. However you pointed me in the right direction. I made a "quick an dirty" change in rlm_ldap.c. I changed the procedure ldap_pairget. The parameter "value" is the stripped version of what ldap returned. The parameter vals[0] is containing the original string. I just replaced value by vals[0] and it is working. Below you can see the changes I applied. The original code is commented out by /* */: DEBUG("rlm_ldap: Adding LDAP attribute %s as RADIUS attribute %s %s %s", element->attr, element->radius_attr, /* lrad_int2str(tokens, token, "?"), value); */ lrad_int2str(tokens, token, "?"), vals[0]); /* if ((newpair = pairmake(element->radius_attr, value, token)) == NULL) */ if ((newpair = pairmake(element->radius_attr, vals[0], token)) == NULL) If there is a beter more elegant way to solve this problem, please let me know. Thanks, Pieter

1 0

No Calling-Station-Id in Auth-Request
by open source 04 Jun '05

04 Jun '05

hey guys I have been trying to authenticate user based on mac-address. But the problem is my pppd is not sending the mac address of clients in it's Auth-Request. I'm using following softwares: (i) rp-ppoe (ii) pppd-2.4.1 (iii) ppp-2.4.1-vanilla-radclient-v2.1.patch (iv) freeradius-1.0.2 Can anyone tell me how to send the mac-address of the client in the Auth-Request as Calling-Station_Id or anyother attribute/value pair. Thanks in advance Open

2 1

No Calling-Station-Id in Auth-Request
by open source 04 Jun '05

04 Jun '05

hey guys I have been trying to authenticate user based on mac-address. But the problem is my pppd is not sending the mac address of clients in it's Auth-Request. I'm using following softwares: (i) rp-ppoe (ii) pppd-2.4.1 (iii) ppp-2.4.1-vanilla-radclient-v2.1.patch (iv) freeradius-1.0.2 Can anyone tell me how to send the mac-address of the client in the Auth-Request as Calling-Station_Id or anyother attribute/value pair. Thanks in advance Open

1 0

error at end of make install
by Thor Spruyt 03 Jun '05

03 Jun '05

Hi, I just ran a quick test on Centos 3.4 for freeradius-1.0.3. Successfully did "./configure" and "make", but then just at the end of "make install" there's an error. Making install in main... gmake[4]: Entering directory `/home/thor/freeradius-1.0.3/src/main' /home/thor/freeradius-1.0.3/libtool --mode=install /home/thor/freeradius-1.0.3/install-sh -c -m 755 -s radiusd /opt/freeradius-1.0.3/sbin /home/thor/freeradius-1.0.3/install-sh -c -m 755 -s .libs/radiusd /opt/freeradius-1.0.3/sbin/radiusd /home/thor/freeradius-1.0.3/install-sh -c -m 755 -s radwho /opt/freeradius-1.0.3/bin strip: /opt/freeradius-1.0.3/bin/#inst.3617#: File format not recognized gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/home/thor/freeradius-1.0.3/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/thor/freeradius-1.0.3/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/home/thor/freeradius-1.0.3/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/thor/freeradius-1.0.3' make: *** [install] Error 2 -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

2 1

FreeRADIUS 1.0.3 has been released
by Alan DeKok 03 Jun '05

03 Jun '05

We have released version 1.0.3 of FreeRADIUS. ftp://ftp.freeradius.org/pub/radius/freeradius-1.0.3.tar.gz ftp://ftp.freeradius.org/pub/radius/freeradius-1.0.3.tar.gz.sig Changelog: * Return EAP-Fail in Access-Reject, rather than an empty Access-Reject * Escape more strings in rlm_sql. See http://www.freeradius.org/security.html * Don't send Proxy-State from home server in TTLS. * Fixes for forking external programs, so the server doesn't suddenly stop processing requests, or stop forking programs. * radzap now works, but it's command-line options have changed completely, and it's a shell script. * radwho has updated command-line options, and no longer reads Unix "utmp" files. * Fix bug in calling checkrad script with NAS port > 9999999 * Fix long-standing bug when both crypt and pthreads are in use Alan DeKok.

1 0

Abt dialup Admin
by Rupak 03 Jun '05

03 Jun '05

Hello ALL I am interested in installing dialup admin.I am currently running freeradius-1.0.2 with mysql that ships with redhat9.and chillispot for wireless authentication.i wanted to know where can I find good configuration resources that would help me install dialup-admin. I checked the how to's under /dialupadmin/docs/*.But did'nt find it friendly.It was specifying to create a data base named "radius".But I have already created a database named "radius" when I installed radius with mysql support.Now I don't wanna proceed until I am confident. So please help me with some resources. Thanking You Rupak

1 0

RE: 'Segmentation fault' loading rlm_sql_postgresql
by Christiaan Ehlers 03 Jun '05

03 Jun '05

Hi, Managed to find the code and plug it into the right place... (I am NO C programmer!) All compiled well and the CALLING_STATION_ID is getting passed on to the server... Here is the diff if anybody is interested in doing the same ============================================== 1258d1257 < CONST char *rhost; 1306,1312d1304 < retval = pam_get_item(pamh, PAM_RHOST, (CONST void **) &rhost); < PAM_FAIL_CHECK; < if (rhost) { < add_attribute(request, PW_CALLING_STATION_ID, (unsigned char *) rhost, < strlen(rhost)); < } < 1613d1604 < =============================================== Thanks Christiaan Ehlers -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: 03 June 2005 17:30 To: FreeRadius users mailing list Subject: Re: 'Segmentation fault' loading rlm_sql_postgresql Achim Friedland <mailinglists(a)ahzf.de> wrote: > is there a known problem with freeradius 1.0.2 and rlm_sql_postgresql? > Load the sql.conf just makes my freeradius segfaulting... It's a libltdl problem. It can't find the postgres libraries on your system, as they're probably installed in a non-standard place. Set LD_LIBRARY_PATH, or in radiusd.conf, "libdir". Or, build the server statically. Or, install the postgres libraries in a standard place. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

FreeRADIUS + MPPE for PPTP VPN clients
by Alexei Monastyrnyi 03 Jun '05

03 Jun '05

Hi List. I have a Q about MS-CHAP and MPPE configuration for FreeRADIUS. OS and software versions Servers OS Solaris 9 SPARC FreeRADIUS 1.0.2 OpenLDAP 2.2.24 SAMBA 3.0.11 Network gateways Cisco PIX 506, IOS 6.3(4) PPTP VPN Clients Windows 2K/XP, MAC OSX. The RADIUS server we're talking about is a secondary LDAP server and SAMBA BDC as well. I'd like to use this FreeRADIUS as a username/password backend for PPTP VPN clients. VPN hub in my case is Cisco PIX device, which supports AAA RADIUS for PPTP VPDN groups. PPTP VPN against Cisco PIX works perfectly well with local authentication, i.e when usernames/passwords are configured locally on PIX. The RADIUS is already configured with OpenLDAP as a backend, authenticating against userPassword attribute. This part works OK. The OpenLDAP server is also a backend for my SAMBA domain controller, the same domain I'm trying to use for user logins via PPTP VPN. All users have both POSIX and SAMBA attiributes in LDAP. The following chain works. Cisco VPN clients --- NAS --- RADIUS --- LDAP This one doesn't PPTP VPN clients --- NAS --- RADIUS --- SAMBA --- LDAP I have configured RADIUS server as following (omitted some lines here). Modules section mschap { authtype = MS-CHAP use_mppe = yes #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no #ntlm_auth = "/usr/local/samba/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = localhost basedn = "ou=People,dc=orcsoftware,dc=com" filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no password_attribute = userPassword } authorize { preprocess auth_log reply_log mschap suffix ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } For PPTP logins it doesn't work for user MYDOMAIN\username and the server says (omiting the beginning of debug) Fri Jun 3 12:50:37 2005 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 0 Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: Told to do MS-CHAPv1 with NT-Password Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: MS-CHAP-Response is incorrect. My Q is: should I use ntlm_auth program for getting NTLM passwords? If yes, should my RADIUS server be join a SAMBA domain which it is trying to use? Actually I'm a bit confused here and highlighting how RADIUS obtains or generates MPPE keys might be heplful. Any hints or useful URLs would be highly appreciated. Cheers, A.

2 1

radclient: received response to request we did not send.
by Juan Nin 03 Jun '05

03 Jun '05

Alan, Sorry I don't reply to your original mail, but I received it at home, and now I'm at work. My problem was I was receiving this error: # /bin/echo 'Framed-IP-Address=192.168.1.197' | /home/radius/bin/radclient -d /home/radius/etc/raddb/ -x aaa.aaa.aaa.aaa disconnect secret Sending Disconnect-Request of id 196 to aaa.aaa.aaa.aaa:1700 Framed-IP-Address = 192.168.1.197 rad_recv: Disconnect-NAK packet from host aaa.aaa.aaa.aaa:1645, id=196, length=20 radclient: received response to request we did not send. You told me the problem is I'm sending packet to port 1700 and receiving the reply from port 1645... but how can I fix this?? I tried using: # /bin/echo 'Framed-IP-Address=192.168.1.197' | /home/radius/bin/radclient -d /home/radius/etc/raddb/ -x aaa.aaa.aaa.aaa:1700 disconnect secret but I receive the same error, and with: # /bin/echo 'Framed-IP-Address=192.168.1.197' | /home/radius/bin/radclient -d /home/radius/etc/raddb/ -x aaa.aaa.aaa.aaa:1645 disconnect secret I get no response from NAS.. Thanks again! Juan

2 1