date:20031210


 Hello, Collegues! 

 I'm using freeradius-0.7.1. I'm trying to configure this freeradius 
as proxy server to remote. 

--
rad_recv: Access-Reject packet from host 195.123.5.10:1288, id=1, length=48
Ignoring request from unknown proxy 195.123.5.10:1288
--

Host 195.123.5.10 was configured in proxy.conf 
In naslist too. 

Tell me, please, what I forgot to do? ;) 


-- 
Alex Radetsky   
AR2657-RIPE
RAD-UANIC


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: unknown proxy ?

2003-12-10 Thread Thomas MARCHESSEAU

Hi Alex,

did u check clients.conf ?

Thomas .

Alex Radetsky wrote:

Hello, Collegues! 

I'm using freeradius-0.7.1. I'm trying to configure this freeradius 
as proxy server to remote. 

--
rad_recv: Access-Reject packet from host 195.123.5.10:1288, id=1, length=48
Ignoring request from unknown proxy 195.123.5.10:1288
--
Host 195.123.5.10 was configured in proxy.conf 
In naslist too. 

Tell me, please, what I forgot to do? ;) 

 



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: unknown proxy ?

2003-12-10 Thread Alexey Balabushevich

On Wed, Dec 10, 2003 at 03:56:45PM +0200, Alex Radetsky wrote:
 
  Hello, Collegues! 
 
  I'm using freeradius-0.7.1. I'm trying to configure this freeradius 
 as proxy server to remote. 
 
 --
 rad_recv: Access-Reject packet from host 195.123.5.10:1288, id=1, length=48
 Ignoring request from unknown proxy 195.123.5.10:1288
 --
 
 Host 195.123.5.10 was configured in proxy.conf 
 In naslist too. 
 
 Tell me, please, what I forgot to do? ;) 

what about clients ?

-- 
Alexey Balabushevich
nic-hdl: AB433-RIPE

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: unknown proxy ?

On Wed, Dec 10, 2003 at 03:11:42PM +0100, Thomas MARCHESSEAU wrote:
 Hi Alex,
 
 did u check clients.conf ?
 
 

[EMAIL PROTECTED] bin]# grep 195.123.5.10 /usr/local/radius-proxy/etc/raddb/*
 clients:   195.123.5.10  123
 clients.conf:  client 195.123.5.10 {
 proxy.conf:   authhost= 195.123.5.10:1812
 proxy.conf:   accthost= 195.123.5.10:1645

Yes, I do.  

 Ok, I'll search this message in sources and will find what I got to do. 
 Thanks! ;) 


 Thomas .
 
 
 Alex Radetsky wrote:
 
 Hello, Collegues! 
 
 I'm using freeradius-0.7.1. I'm trying to configure this freeradius 
 as proxy server to remote. 
 
 --
 rad_recv: Access-Reject packet from host 195.123.5.10:1288, id=1, length=48
 Ignoring request from unknown proxy 195.123.5.10:1288
 --
 
 Host 195.123.5.10 was configured in proxy.conf 
 In naslist too. 
 
 Tell me, please, what I forgot to do? ;) 
 

-- 
Alex Radetsky   
AR2657-RIPE
RAD-UANIC


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: unknown proxy ?

On Wed, Dec 10, 2003 at 04:18:30PM +0200, Alexey Balabushevich wrote:
  
   I'm using freeradius-0.7.1. I'm trying to configure this freeradius 
  as proxy server to remote. 
  
  --
  rad_recv: Access-Reject packet from host 195.123.5.10:1288, id=1, length=48
  Ignoring request from unknown proxy 195.123.5.10:1288
  --
  
  Host 195.123.5.10 was configured in proxy.conf 
  In naslist too. 
  
  Tell me, please, what I forgot to do? ;) 
 
 what about clients ?

 clients conf configured. Please see latest message. 

 
 -- 
 Alexey Balabushevich
   nic-hdl: AB433-RIPE

Wow. Very glad to see you. :) 


-- 
Alex Radetsky   
AR2657-RIPE
RAD-UANIC


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

unknown proxy ? part 2

Hello! 

 I found this in files.c :

--
REALM *cl;
 
/*
 *  Note that we do NOT check for inactive realms!
 *
 *  If we get a packet from an end server, then we mark it
 *  as active, and return the realm.
 */
for(cl = realms; cl != NULL; cl = cl-next)
if ((ipaddr == cl-ipaddr)  (port == cl-auth_port)) {
cl-active = TRUE;
return cl;
} else if ((ipaddr == cl-acct_ipaddr)  (port == cl-acct_port)) {
cl-acct_active = TRUE;
return cl;
}
 
return NULL;
-- 

 So, if radius got packet from remote server with configured source_ip and 
 port, radiusd marks it as active. 

 But in my case, radius got packet from configured source_ip, but another 
 port. 

 What does it mean? Does some one proxy exist between my and remote radius? 
 Is it correct? 

 PS. I can rewrite this code to create workaround. But I do not know, may 
 be it will not correct. 

-- 
Alex Radetsky   
AR2657-RIPE
RAD-UANIC


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Running FreeRADIUS with user other than root

2003-12-10 Thread Nick Davis

On Tuesday 09 December 2003 17:25, Chris Parker wrote:
 At 05:18 PM 12/9/2003, Michael Shanafelt wrote:
 I actually already tried that, but still got the same error.
 
 Do I need to change the owner of radiusd to the user I want to run it
 as?

 What *is* the error message you get.  Posting that might be helpful.

 Also note that you can start radiusd as root, and have it switch to
 a different user.  See the comments in 'radiusd.conf'.

 You will also want to ensure that the user you are trying to run this
 as has appropriate permissions to read all of the config files, etc. in
 /path/to/raddb

Just another reminder, that user needs access to write to the log files and 
rad[wu]tmp too!

Nick
-- 
Nick Davis 
Associate Systems Administrator 
[EMAIL PROTECTED] 
Internet Exposure, Inc. 
http://www.iexposure.com  

(612)676-1946 
Web Development-Web Marketing-ISP Services


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

One suggestion about the default config file

2003-12-10 Thread Damjan

The FreeRadius default config file is pretty much complete and working
right out of the box. It's only that for some more advanced features the
admin *must* make some local changes.

I've noticed that a lot of questions asked here are due to people not
having the patience to read the config file in full, or beeing confused
by options not relevant to te problem thay are trying to solve.

I propose a sollution to this, one that's easy to implement on one hand,
but will reduce the confusion some people have about configuring
freeradius: I think the config file should be split in several smaller
files, inculded by the main file (for ex. eap.conf, ldap.conf ...)
sql.conf is a good exaple how this actually works.

just my $0.02 


-- 
Damjan Georgievski
jabberID: [EMAIL PROTECTED]

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: FreeRadius with MySQL

Please read the FAQ before posting again.

Turn off your Graphic and html.

Leandro Sant'ana wrote:

A bunch of html with a graphic covering the text


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: unknown proxy ?

I have noticed you have configured naslist, clients and clients.conf.

The clients.conf file is all you need, and should probably move or remove
the clients and naslist files since the are deprecated and may conflict.
I have not looked into the source to find out what happens when you have 
both sets
of files, but you should notice the informational messages warning you 
about
these files in your log file.

Also, whats up with the ports?

It looks like you have two different radius servers running, maybe your
problem is that you are looking at the wrong config files.
Alex Radetsky wrote:

On Wed, Dec 10, 2003 at 03:11:42PM +0100, Thomas MARCHESSEAU wrote:

Hi Alex,

did u check clients.conf ?


[EMAIL PROTECTED] bin]# grep 195.123.5.10 /usr/local/radius-proxy/etc/raddb/*
clients: 195.123.5.10 123
clients.conf: client 195.123.5.10 {
proxy.conf: authhost = 195.123.5.10:1812
proxy.conf: accthost = 195.123.5.10:1645
Yes, I do.

Ok, I'll search this message in sources and will find what I got to do.
Thanks! ;)
--
Guy Fraser
Network Administrator


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

how can I allow access only once?

2003-12-10 Thread Zoilo

I am giving tickets in a kiosk-environment, and would like to block an 
account as soon as it is used. So the username and password can only be 
used once; that's it.

What is the easiest way?

I am using SQL.

Z.



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Eap ttls and LDAP

Kostas Kalevras [EMAIL PROTECTED] wrote:
  I am using freeradius 0.9.3 on a linux box
  I have found the eap_ttls module in the CVS tree
  How to install it ???
 
 ./configure
 make
 make install

  And watch the server dies as soon as it receives an EAP-TTLS request.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: expr problems

Nikolas Geyer [EMAIL PROTECTED] wrote:
 ERROR: Cannot find a configuration entry for module expr.
 
 In my radiusd.conf I have the following;
 
 expr {
 }

  Where?  The location of that configuration entry matters.

  See the default 'radiusd.conf' for examples of where that
configuration entry should go.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Unable to load EAP-Type/ttls, as EAP-Type/TLS is required first

Holger Schurig [EMAIL PROTECTED] wrote:
 I thought TLS is where both the server and the clients have certificates.
 And TTLS is where only the client has a certificate (of the server).

  Yes.  If you're unsure, read the RFC's.  They're included with the
server.

 Therefore, TTLS and PEAP need only a subset of TLS, right?

  No.  They need the entire TLS protocol.

 Now, when I enable TTLS (and TLS because I need it) in radiusd.conf, then
 some client can try to authenticate/authorize with TLS. It's on, isn't it? 

  Yes.  You can turn it off.  See the EAP-Type attribute.

 And the client doesn't get back something like protocol not supported,
 but negative authentification.

  You don't understand how RADIUS works.  And it's authentication.,
not authentification.

  RADIUS returns Access-Reject, not protocol unsupported.  And the
wireless client doesn't even see that.

 So I would have thought that this is possible and makes sense:
 
  # tls {
  #   ...
  #}
 
  ttls {
certificate_file = ${prefix}/ca/cert-srv.pem
  }

  What what about the rest of the configuration options in the TLS
module?  Are you going to just throw those away?  They exist for a
reason, you know...

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: FreeRadius with MySQL

Leandro Sant'ana [EMAIL PROTECTED] wrote:
 I commented that's lines in file /etc/raddb/users
...
 #DEFAULT Auth-Type =3D System
 #Fall-Through =3D 1
 
 To force Auth-Type in databases 

  No.

  Uncommenting that line means you forced it to NOT use System
authentication.  But you didn't tell it what OTHER authentication
method to use, so the server failed.

  modcall: group authorize returns ok for request 0
 auth: No authenticate method (Auth-Type) configuration found for the
 request: Rejecting the user

  Did you try setting an Auth-Type somewhere?

  What part of the error message is unclear?

  Alan DeKok.



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Encrypting an Access Reply Attribute

2003-12-10 Thread Tom Stoll

Hello FreeRADIUS Users,

I am using FreeRADIUS Version 0.9.2.

Does anyone have an example that demonstrates how to encrypt an
individual access reply attribute?

I was going to encrypt the attribute using a custom Exec-Program-Wait
function but I could not figure out how to to obtain and pass the NAS'
shared secret and the authenticator to the function.  I was hoping to
find a macro substitution but didn't.

Thank you,

Tom Stoll
-- 


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Encrypting an Access Reply Attribute

Tom Stoll [EMAIL PROTECTED] wrote:
 Does anyone have an example that demonstrates how to encrypt an
 individual access reply attribute?

  You shouldn't have to.  See the dictionary files, and look for
encrypt=.  If you're going to use the standard User-Password
encryption, then create a dictionary file entry for your attribure
like:

ATTRIBUTE   My-Magic-Foo250 string  encrypt=1

  And the server will automatically encrypt it when sending, and
decrypt it when receiving.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: unknown proxy ?

Alex Radetsky [EMAIL PROTECTED] wrote:
  I'm using freeradius-0.7.1. I'm trying to configure this freeradius 
 as proxy server to remote. 

  Upgrade to 0.9.3.  Please.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Freeradius 0.9.3 with mysql

Hi all

I have freeradius 0.9.3 set up on a linux box with (presumably) mysql
compiled in as well.  I have the mysql-devel files installed before
configure/make/make installing.
I followed through the how-to found at
http://www.frontios.com/freeradius.html, but, that is a set of how-to
for a somewhat older version.  
At any rate, with the user test in the users file, it authenticates
just fine.  When I comment that out and add the user to the mysql table,
usergroups, it does not authenticate, and I don't notice any reference
to mysql in the rejection notice (I can copy/paste that notice in if it
will help anybody).

I did notice an extra table in the current version that was not
mentioned in the how-to, and that is the table radacct.  Is that where I
need to be adding users, later on (when this thing actually goes live)?

On a different note, has anybody used this radius daemon with the
Venturi acceleration server?  Any pointers on that would be helpful too!

Thanks!!

--===--
Justin Williams
Penguin Herder
Power Shift Online Services
571 South Main Street
Stowe, VT  05672
877-949-9967

Who shook my snow globe??


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: unknown proxy ? part 2

Alex Radetsky [EMAIL PROTECTED] wrote:
  So, if radius got packet from remote server with configured source_ip and 
  port, radiusd marks it as active. 
 
  But in my case, radius got packet from configured source_ip, but another 
  port. 
 
  What does it mean?

  It means that the server you're proxying the request to is broken.

  PS. I can rewrite this code to create workaround. But I do not know, may 
  be it will not correct. 

  It will be wrong.  You should contact the people running the other
server, and tell them to fix it.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Freeradius 0.9.3 with mysql

Justin Williams [EMAIL PROTECTED] wrote:
 At any rate, with the user test in the users file, it authenticates
 just fine.  When I comment that out and add the user to the mysql table,
 usergroups, it does not authenticate, and I don't notice any reference
 to mysql in the rejection notice 

  So run it in debugging mode to see what's going wrong.

  Also, you *do* need to configure 'radiusd.conf' to use the SQL
module.  You can't just put users into an SQL database, and hope that
the server magically knows where to look.

  Alan DeKok.



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Eap ttls and LDAP

Arthur EBEL [EMAIL PROTECTED] wrote:
 I am using freeradius 0.9.3 on a linux box
 I have found the eap_ttls module in the CVS tree
 How to install it ??? 

  You install a snapshot.  You can't use EAP-TTLS with 0.9.3.

 I dont want to use personnal certificate but only the login and ldap passwd
 of the personn

  EAP-TTLS doesn't require personal certificates.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: One suggestion about the default config file

Damjan [EMAIL PROTECTED] wrote:
 The FreeRadius default config file is pretty much complete and working
 right out of the box. It's only that for some more advanced features the
 admin *must* make some local changes.

  Yup.

 I've noticed that a lot of questions asked here are due to people not
 having the patience to read the config file in full, or beeing confused
 by options not relevant to te problem thay are trying to solve.

  If they're not willing to read the configuration file, then they're
probably not willing to read answers to their questions on the list.
See previous flamewars.

 I propose a sollution to this, one that's easy to implement on one hand,
 but will reduce the confusion some people have about configuring
 freeradius: I think the config file should be split in several smaller
 files, inculded by the main file (for ex. eap.conf, ldap.conf ...)
 sql.conf is a good exaple how this actually works.

  I'm not sure that would help, and I don't see it as necessary.
Apache has one large http.conf file, and no one seems to have problems
with it.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Freeradius 0.9.3 with mysql

Already running in debugging mode, but, too ignorant of what it all
means.  If there is a reference you recommend that would help me learn
more about radius, in general, I'll be happy to go hunting in there too.

I added sql to the accounting section in radius.conf, but I did not add
it into the authorize section...  Added that and will hope that it
works...

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Alan DeKok
Sent: Wednesday, December 10, 2003 1:30 PM
To: [EMAIL PROTECTED]
Subject: Re: Freeradius 0.9.3 with mysql 


Justin Williams [EMAIL PROTECTED] wrote:
 At any rate, with the user test in the users file, it authenticates 
 just fine.  When I comment that out and add the user to the mysql 
 table, usergroups, it does not authenticate, and I don't notice any 
 reference to mysql in the rejection notice

  So run it in debugging mode to see what's going wrong.

  Also, you *do* need to configure 'radiusd.conf' to use the SQL module.
You can't just put users into an SQL database, and hope that the server
magically knows where to look.

  Alan DeKok.



- 
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Freeradius 0.9.3 with mysql

Bingo...  That worked...  I was missing the sql entry in the authorize
section...

Would still love to go read up on radius, though!

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Justin
Williams
Sent: Wednesday, December 10, 2003 1:43 PM
To: [EMAIL PROTECTED]
Subject: RE: Freeradius 0.9.3 with mysql 


Already running in debugging mode, but, too ignorant of what it all
means.  If there is a reference you recommend that would help me learn
more about radius, in general, I'll be happy to go hunting in there too.

I added sql to the accounting section in radius.conf, but I did not add
it into the authorize section...  Added that and will hope that it
works...

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Alan DeKok
Sent: Wednesday, December 10, 2003 1:30 PM
To: [EMAIL PROTECTED]
Subject: Re: Freeradius 0.9.3 with mysql 


Justin Williams [EMAIL PROTECTED] wrote:
 At any rate, with the user test in the users file, it authenticates
 just fine.  When I comment that out and add the user to the mysql 
 table, usergroups, it does not authenticate, and I don't notice any 
 reference to mysql in the rejection notice

  So run it in debugging mode to see what's going wrong.

  Also, you *do* need to configure 'radiusd.conf' to use the SQL module.
You can't just put users into an SQL database, and hope that the server
magically knows where to look.

  Alan DeKok.



- 
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html


- 
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Freeradius 0.9.3 with mysql

Justin Williams [EMAIL PROTECTED] wrote:
 Bingo...  That worked...  I was missing the sql entry in the authorize
 section...

  That's good to hear.

 Would still love to go read up on radius, though!

  Buy the RADIUS book.  See the web site for details.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Freeradius 0.9.3 with mysql

Thank you!

By the way, I did not see a command in the man pages to restart radiusd
after making config changes.  Is there such?

Thanks again!

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Alan DeKok
Sent: Wednesday, December 10, 2003 1:48 PM
To: [EMAIL PROTECTED]
Subject: Re: Freeradius 0.9.3 with mysql 


Justin Williams [EMAIL PROTECTED] wrote:
 Bingo...  That worked...  I was missing the sql entry in the authorize

 section...

  That's good to hear.

 Would still love to go read up on radius, though!

  Buy the RADIUS book.  See the web site for details.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Freeradius 0.9.3 with mysql

2003-12-10 Thread International WHO'S WHO of Professionals

Justin Williams [EMAIL PROTECTED] wrote:
 By the way, I did not see a command in the man pages to restart radiusd
 after making config changes.  Is there such?

  Huh?  It's a normal program.  You just kill it, and re-start it.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Your Selection to Who's Who

Dear WHO'S WHO Candidate,

On behalf of International WHO'S WHO of Professionals, I am pleased to inform
you that you have been selected as a potential candidate. We congratulate you.
Nomination to WHO'S WHO is an honor in itself. WHO'S WHO has over 20,000 members
in 154 countries. It is the most elite professional network in the world. The
members assist each other daily with business and career opportunities. It is in
times like these that such a network is most valuable and we are seeing members
help other members expand their businesses, find new positions, even relocate to
another country.

If selected into WHO'S WHO, you will also be listed in the 2004-2005 edition of
International WHO'S WHO of Professionals. This is the definitive work on the
world's leaders in commerce, economics, policy, and trade.

We do require additional information to complete the selection
process and ask that you provide your biographical data by accessing
the form on our website at:
http://internationalwhoswho.com/fax/FE524C.htm

Our editorial deadline is quickly approaching. I urge you to act
today. If you delay, I cannot guarantee the committee will have
ample time to review your submission.

Sincerely,

Brooke O. Filger
Membership Director

P.S. There is no cost or obligation to be listed in the International WHO'S WHO of Professionals. To ensure your biographical data is received in time, please complete the online form at http://internationalwhoswho.com/fax/FE524C.htm
by January 1, 2004. Upon review, our Membership Selection Committee will be in touch with you.

TradeLion.com is the e-commerce affiliate of Global Services Foundation,
Inc. ("GSF"). You have received this e-mail because our records
indicate you (1) are or have been a buyer of GSF consulting or trade
lead services; (2) originally subscribed to GSF's PASSPORT TO THE
NEW GLOBAL ECONOMY and its periodic updates; or (3) attended seminars
co-sponsored by GSF or its affiliates. If you believe you received
this message in error, please click here to opt-out automatically.
If your e-mail system does not recognize HTML links, please copy
the following URL and paste it to your browser to run:
http://clk.etracks.com/r/r0.4?2C3SWx9PdfQwVqLBwpyJr2C395FGmz1qk7ecGEJu-W-aLg6pt1HpVqG2EV6dMIzHYtRnh0OoL58905
Thank you.

TradeLion, TradeLion.com, TradeLion.com international, PASSPORT TO
THE NEW GLOBAL ECONOMY and accompanying design are trademarks of
TradeLion.com, Inc.

Re: Encrypting an Access Reply Attribute

2003-12-10 Thread Tom Stoll

On Wed, 2003-12-10 at 12:26, Alan DeKok wrote:
 Tom Stoll [EMAIL PROTECTED] wrote:
  Does anyone have an example that demonstrates how to encrypt an
  individual access reply attribute?
 
   You shouldn't have to.  See the dictionary files, and look for
 encrypt=.  If you're going to use the standard User-Password
 encryption, then create a dictionary file entry for your attribure
 like:
 
 ATTRIBUTE My-Magic-Foo250 string  encrypt=1
 
   And the server will automatically encrypt it when sending, and
 decrypt it when receiving.
 
   Alan DeKok.

Thank you, that is exactly what I was looking for, but missed.

Regards,

Tom Stoll



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Freeradius 0.9.3 with mysql

Thanks!  Was thinking in terms of daemons like httpd, which have their
own start/stop commands.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Alan DeKok
Sent: Wednesday, December 10, 2003 1:57 PM
To: [EMAIL PROTECTED]
Subject: Re: Freeradius 0.9.3 with mysql 

Justin Williams [EMAIL PROTECTED] wrote:
 By the way, I did not see a command in the man pages to restart 
 radiusd after making config changes.  Is there such?

  Huh?  It's a normal program.  You just kill it, and re-start it.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Relocation Error - Checked the SSL versions, but still apear

2003-12-10 Thread Ivan Barrera


Hi,

I was using an old snap version of freeradius, compiled with an old snap
version of OpenSSL, it was working fine with EAP-TLS, but I wanted to try
the TTLS, so I tried to set the OpenSSL to the latest stable version
0.9.7c and use the SNAPSHOT version of Freeradius to get the TTLS.

Now I'm getting the error:
./radiusd: relocation error:
/usr/local/radius//lib/rlm_eap_tls-1.0.0-pre0.so: undefined symbol:
SSL_set_msg_callback

as soon as a client tries to get in.

An old posted message said to be a problem with OpenSSL versions. I'm not
good with this linux installations. So what I did was to remove the old
directory where the snapshot were, and I used again to install the stable
version. As soon as it finished, anyway I replaced the libcrypto.so and
libssl.so in the /usr/lib to point to the new ones. (also openssl file by
it self). - I'm using RH8 and I think I also have the 0.9.6 (engine) which
I just renamed as openssl.old.

I thought that was enough to fix the problem and make the freeradius point
to the 0.9.7c version, but still I compiled and executed getting this
error.

Probably I'm doing all wrong, but still I don't know what it is. If you
can help me out showing me the path, that would be awesome!!

Thanks a lot for your help,

Ivan Barrera


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Problem with attributes of date type in attr_rewrite

2003-12-10 Thread James Nedila

freeradius version: 0.9.3

So i'm trying to rewrite an attribute Event-Timestamp, which has a type 
of date, according to the dictionary file.
This is a new attribute, and i'm adding this to requests that I proxy.

This attr_rewrite module works great if I change the type of 
Event-Timestamp to integer, but does not work when it's type is date.

radiusd -X says the attribute was added successfully, but the attribute 
is not present.

So tracing through the code, I see that the problem starts when 
pairmake() is called in do_attr_rewrite() in rlm_attr_rewrite.c.

Within pairmake(), if the type of an attribute is 'date', the method 
gettime() is called on it to apparently parse out a valid time_t 
structure from a specifically formatted date (day \t month \t year \t).

The problem I have with this, is the date string i'm sending is in 
seconds from 1970, so more like '100203823823'.

So what ends up happening, is gettime() fails, returns -1, and pairmake 
doesn't actually create the valuepair.
This eventually bubbles back up to do_attr_rewrite(), which tries to add 
the attribute, and happily prints out the success message, even though 
the process failed.

I've dug up an old (2001) message in the mailing list archives that 
specifically talks about this dual nature of how dates should be 
specified, but there was no definite answer.

So what is the fix for this?
Should gettime() realize which type of date is passed to it?
Thanks,
James
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with attributes of date type in attr_rewrite

2003-12-10 Thread Alan T. DeKok

James Nedila [EMAIL PROTECTED] wrote:
 Within pairmake(), if the type of an attribute is 'date', the method 
 gettime() is called on it to apparently parse out a valid time_t 
 structure from a specifically formatted date (day \t month \t year \t).
 
 The problem I have with this, is the date string i'm sending is in 
 seconds from 1970, so more like '100203823823'.

  Submit a patch to gettime(), which accepts integer dates.

 So what ends up happening, is gettime() fails, returns -1, and pairmake 
 doesn't actually create the valuepair.
 This eventually bubbles back up to do_attr_rewrite(), which tries to add 
 the attribute, and happily prints out the success message, even though 
 the process failed.

  Submit a patch to do_attr_rewrite(), so that it checks if the
attribute was created, and erros if not.

 So what is the fix for this?
 Should gettime() realize which type of date is passed to it?

  It should be more accepting of what the input it receives.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Relocation Error - Checked the SSL versions, but still apear

Ivan Barrera [EMAIL PROTECTED] wrote:
 version of OpenSSL, it was working fine with EAP-TLS, but I wanted to try
 the TTLS, so I tried to set the OpenSSL to the latest stable version
 0.9.7c and use the SNAPSHOT version of Freeradius to get the TTLS.

  That should work.

 Now I'm getting the error:
 ./radiusd: relocation error:
 /usr/local/radius//lib/rlm_eap_tls-1.0.0-pre0.so: undefined symbol:
 SSL_set_msg_callback

  The server was compiled using the OLD version of OpenSSL, but you
linked it against the NEW version of OpenSSL.

 An old posted message said to be a problem with OpenSSL
 versions. I'm not good with this linux installations. So what I did
 was to remove the old directory where the snapshot were, and I used
 again to install the stable version.

  It's not a problem with FreeRADIUS.  It's a problem with OpenSSL.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Relocation Error - Checked the SSL versions, but still apear - HELP

2003-12-10 Thread Ivan Dario Barrera


Hi,

I was using an old snap version of freeradius, compiled with an old snap
version of OpenSSL, it was working fine with EAP-TLS, but I wanted to try
the TTLS, so I tried to set the OpenSSL to the latest stable version
0.9.7c and use the SNAPSHOT version of Freeradius to get the TTLS.

Now I'm getting the error:
./radiusd: relocation error:
/usr/local/radius//lib/rlm_eap_tls-1.0.0-pre0.so: undefined symbol:
SSL_set_msg_callback

as soon as a client tries to get in.

An old posted message said to be a problem with OpenSSL versions. I'm not
good with this linux installations. So what I did was to remove the old
directory where the snapshot were, and I used it again to install the
stable version. As soon as it finished, anyway I replaced the libcrypto.so
and libssl.so in the /usr/lib to point to the new ones. (also openssl file
by it self). - I'm using RH8 and I think I also have the 0.9.6 (engine)
which I just renamed as openssl.old.

I thought that was enough to fix the problem and make the freeradius point
to the 0.9.7c version, but still I compiled and executed getting this
error. I regenerated the certificates, I removed the whole radius
directory and installed it again, but it doesn't work.

Is there any way to check what are the versions I'm trying to use?
Is there a way to uninstall correctly whether freeradius or Openssl?

Probably I'm doing all wrong, but still I don't know what it is. If you
can help me out showing me the path, that would be awesome!!

Thanks a lot for your help,

Ivan D. Barrera

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Relocation Error - Checked the SSL versions, but still apear - HELP

Ivan Dario Barrera [EMAIL PROTECTED] wrote:
...

  You do READ the list, don't you?

http://lists.cistron.nl/pipermail/freeradius-users/2003-December/026413.html

 Is there any way to check what are the versions I'm trying to use?

  ldd.  See the FAQ.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Relocation Error - Checked the SSL versions, but still apear

2003-12-10 Thread Ivan Dario Barrera

So sorry, looks like the page was cached, and I never saw my message
posted!, thanks I will check on that.


Ivan D. Barrera


Ivan Dario Barrera [EMAIL PROTECTED] wrote:
...

  You do READ the list, don't you?

http://lists.cistron.nl/pipermail/freeradius-users/2003-December/026413.html

 Is there any way to check what are the versions I'm trying to use?

  ldd.  See the FAQ.


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: One suggestion about the default config file

2003-12-10 Thread Peter Nixon

Alan DeKok wrote:
Damjan [EMAIL PROTECTED] wrote:

The FreeRadius default config file is pretty much complete and working
right out of the box. It's only that for some more advanced features the
admin *must* make some local changes.


  Yup.


I've noticed that a lot of questions asked here are due to people not
having the patience to read the config file in full, or beeing confused
by options not relevant to te problem thay are trying to solve.


  If they're not willing to read the configuration file, then they're
probably not willing to read answers to their questions on the list.
See previous flamewars.

I propose a sollution to this, one that's easy to implement on one hand,
but will reduce the confusion some people have about configuring
freeradius: I think the config file should be split in several smaller
files, inculded by the main file (for ex. eap.conf, ldap.conf ...)
sql.conf is a good exaple how this actually works.


  I'm not sure that would help, and I don't see it as necessary.
Apache has one large http.conf file, and no one seems to have problems
with it.
Actually this is not entirely correct, at least not with vendor supplied 
versions of apache.
On SuSE Linux httpd.conf is actually split into about 6 different files, 
for standard config, vhosts, sslconfig, aditional modules etc

Having said that, radius.conf is significantly shorter than httpd.conf 
and I am not sure if the ldap config which is currently less that one 
screen long in vim (at my resolution) really warrants a separate file.

Cheers

Peter



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Freeradius 0.9.3 with mysql

The init command will depend on the distribution you are using.

On RH, as root it should be somthing like :

/sbin/service radiusd restart

On Debian :

/etc/init.d/freeradius restart

On Suse:

/etc/init.d/radiusd restart

On FreeBSD :-)

/usr/local/etc/rc.d/radiusd.sh restart

Good luck.

Justin Williams wrote:

Thanks!  Was thinking in terms of daemons like httpd, which have their
own start/stop commands.
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Alan DeKok
Sent: Wednesday, December 10, 2003 1:57 PM
To: [EMAIL PROTECTED]
Subject: Re: Freeradius 0.9.3 with mysql 

Justin Williams [EMAIL PROTECTED] wrote:
 

By the way, I did not see a command in the man pages to restart 
radiusd after making config changes.  Is there such?
   

 Huh?  It's a normal program.  You just kill it, and re-start it.

 Alan DeKok.

- 
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

 



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: Freeradius 0.9.3 with mysql

In Mandrake (very similar to redhat in most respects), service radiusd
restart returned the error that radiusd was not registered as a
service...  

For the moment, kill works...  ;-)

Thanks!

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Guy Fraser
Sent: Wednesday, December 10, 2003 5:46 PM
To: [EMAIL PROTECTED]
Subject: Re: Freeradius 0.9.3 with mysql


The init command will depend on the distribution you are using.

On RH, as root it should be somthing like :

/sbin/service radiusd restart

On Debian :

/etc/init.d/freeradius restart

On Suse:

/etc/init.d/radiusd restart

On FreeBSD :-)

/usr/local/etc/rc.d/radiusd.sh restart

Good luck.

Justin Williams wrote:

Thanks!  Was thinking in terms of daemons like httpd, which have their 
own start/stop commands.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Alan 
DeKok
Sent: Wednesday, December 10, 2003 1:57 PM
To: [EMAIL PROTECTED]
Subject: Re: Freeradius 0.9.3 with mysql 


Justin Williams [EMAIL PROTECTED] wrote:
  

By the way, I did not see a command in the man pages to restart
radiusd after making config changes.  Is there such?



  Huh?  It's a normal program.  You just kill it, and re-start it.

  Alan DeKok.

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html


-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html


  



- 
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Multiple values for the same integer-attribute in one RADIUS reply???

2003-12-10 Thread stephan_seeger

Hello everybody,

Yesterday I ran into deep problems trying to configure freeradius 0.9.0
for so called authenticated switch access (asa) which is a feature of
alcatel (formerly xylan) lan switches enabling them to query a radius
server for user authentication.

My users file looks like:
...
user2   Auth-Type := Local, User-Password == testpw
Alcatel-Access-Priv= Alcatel-Read-Priv,
Alcatel-Access-Priv= Alcatel-Write-Priv,
Alcatel-Access-Priv= Alcatel-Admin-Priv
...


My vendor specific dictionary file looks like:

...
ATTRIBUTE   Alcatel-Access-Priv 16  integer Alcatel
VALUEAlcatel-Access-Priv   Alcatel-Read-Priv   1
VALUEAlcatel-Access-Priv   Alcatel-Write-Priv   2
VALUEAlcatel-Access-Priv   Alcatel-Admin-Priv 3
...

My configuration seems to be working fine so far, because 'user2' is
authenticated by the radius server an can login to the device. But now
the problem arises: I need the user to get assigned all of the three
privileges that I mentioned above concurrently and not alternatively. At
the moment my user only gets read, write or admin access - the actually
assigned privilege depends on the sequence of privileges for user2 in my
users-file (only the first privilege is assigned).

Maybe there's anybody out there who got an idea of how to solve this
problem and return all of the three integer values for the attribute
'Alcatel-Access-Priv' in one radius-reply.

Thanks in advance.

Stephan



-- 






- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Multiple values for the same integer-attribute in one RADIUS reply???

2003-12-10 Thread Chris Parker

At 05:02 PM 12/10/2003, [EMAIL PROTECTED] wrote:
Hello everybody,

Yesterday I ran into deep problems trying to configure freeradius 0.9.0
for so called authenticated switch access (asa) which is a feature of
alcatel (formerly xylan) lan switches enabling them to query a radius
server for user authentication.
My users file looks like:
...
user2   Auth-Type := Local, User-Password == testpw
Alcatel-Access-Priv= Alcatel-Read-Priv,
Alcatel-Access-Priv= Alcatel-Write-Priv,
Alcatel-Access-Priv= Alcatel-Admin-Priv
...
See the docs, man users, the list archives from the last few days.

You need the += attribute to add mutile attributes of the same type
to a reply.
-Chris
--
   \\\|||///  \  StarNet Inc.  \ Chris Parker
   \ ~   ~ /   \   WX *is* Wireless!\   Director, Engineering
   | @   @ |\   http://www.starnetwx.net \  (847) 963-0116
oOo---(_)---oOo--\--
  \ Wholesale Internet Services - http://www.megapop.net


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

How to implement walled garden with freeRadius?

2003-12-10 Thread Richard Yang


Any recommendation on implementing walled garden
with freeRadius and cisco 1100 APs.  The walled
garden allows wireless user to access some
pre-defined websites even BEFORE they login.
Has anyone done this before?  The idea is to allow
user visit our sign-up website and download the
certificate (generated with OpenSSL). 
After the user has installed the certificate,
freeRadius will autheticate the user with EAP-TLS and
the user can access any websites after that.

Is there any other free software that supports the
walled garden?  Any suggestions or URL refs are
appreciate.
Richard

__
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: How to implement walled garden with freeRadius?

2003-12-10 Thread freeradius

I am climbing a learning curve at the moment, and intend to provide this
sort of functionality.

I am looking at setting up a regional wireless ISP. I am planning on
allowing everyone to associate with the wireless APs. When they open up a
web browser and try to hit a page, I am going to use squid to redirect
them to this walled garden page that provides limited free content and
instructions on how to subscribe to our services.

Paid subscribers will then be able to login and access the internet. I
think there may be a few ways to achieve this, but I have been testing it
using PPPoe and a RADIUS server (freeradius).

When they login, a PPP tunnel will be created and routed correctly to the
internet (with relevant access controls setup through squid).

If anyone else has any ideas in respect to this sort of setup, I would
welcome suggestions!



 Any recommendation on implementing walled garden
 with freeRadius and cisco 1100 APs.  The walled
 garden allows wireless user to access some
 pre-defined websites even BEFORE they login.
 Has anyone done this before?  The idea is to allow
 user visit our sign-up website and download the
 certificate (generated with OpenSSL).
 After the user has installed the certificate,
 freeRadius will autheticate the user with EAP-TLS and
 the user can access any websites after that.

 Is there any other free software that supports the
 walled garden?  Any suggestions or URL refs are
 appreciate.
 Richard

 __
 Do you Yahoo!?
 New Yahoo! Photos - easier uploading and sharing.
 http://photos.yahoo.com/

 -
 List info/subscribe/unsubscribe? See
 http://www.freeradius.org/list/users.html



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: How to implement walled garden with freeRadius?

2003-12-10 Thread Rob Genovesi

Check out Mikrotik (www.mikrotik.com) -- a linux-based router with 
Hotspot functionality.

I am using it to do this exact sort of thing.  Mikrotik has a built-in 
radius client and it works flawlessly (so far) with FreeRadius on the 
backend.  Users are redirected to a sign-in page and once they sign in 
firewall rules are updated to allow them access beyond the gateway.

-rob

At 10:46 AM 12/11/2003 +1100, you wrote:
I am climbing a learning curve at the moment, and intend to provide this
sort of functionality.
I am looking at setting up a regional wireless ISP. I am planning on
allowing everyone to associate with the wireless APs. When they open up a
web browser and try to hit a page, I am going to use squid to redirect
them to this walled garden page that provides limited free content and
instructions on how to subscribe to our services.
Paid subscribers will then be able to login and access the internet. I
think there may be a few ways to achieve this, but I have been testing it
using PPPoe and a RADIUS server (freeradius).
When they login, a PPP tunnel will be created and routed correctly to the
internet (with relevant access controls setup through squid).
If anyone else has any ideas in respect to this sort of setup, I would
welcome suggestions!

 Any recommendation on implementing walled garden
 with freeRadius and cisco 1100 APs.  The walled
 garden allows wireless user to access some
 pre-defined websites even BEFORE they login.
 Has anyone done this before?  The idea is to allow
 user visit our sign-up website and download the
 certificate (generated with OpenSSL).
 After the user has installed the certificate,
 freeRadius will autheticate the user with EAP-TLS and
 the user can access any websites after that.

 Is there any other free software that supports the
 walled garden?  Any suggestions or URL refs are
 appreciate.
 Richard

 __
 Do you Yahoo!?
 New Yahoo! Photos - easier uploading and sharing.
 http://photos.yahoo.com/

 -
 List info/subscribe/unsubscribe? See
 http://www.freeradius.org/list/users.html

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: How to implement walled garden with freeRadius?