date:20040421

loader <[EMAIL PROTECTED]> wrote:
> Or where can I get a list of APs supported by freeradius?

  The only AP's I've heard of which have problems are Intel.  They seem
to think that following the RFC's is unimportant.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: testing values for LDAP attributes

Hans Fiedler <[EMAIL PROTECTED]> wrote:
> I can't get the attribute value checking to work.  I've tried mapping the
> attribute in the ldap.attrmap file,
> 
> checkItem   WirelessStatus  WirelessStatus
> 
> and checking the value in the users file.  I'm not getting that to work.

  The ldap.attrmap file maps entries in an LDAP database to RADIUS
attributes.  If you haven't defined "WirelessStatus" in the
dictionaries, the LDAP entry won't map to anything.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

Believe me when I tell you I do understand what your saying. The problem was
that I was tossed in to this after all our fee's were paid to the wholesale
dialup provider when he told us they do PAP, and on the day we were ready to
start it didn't work. So I was between the rocks and a hard place and was
recommended to use mySQL and freeradius, both that I have never used or
looked at before a week ago.

It has been authenticating fine so far, no problems noticeable, but I still
have to leave the two auth-type in the uesrs file or it quits. It works now
and I think I'll leave it and hope it doesn't break.

Thanks for all your help.
Bob Ross

- Original Message - 
From: "Alan DeKok" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, April 21, 2004 2:20 PM
Subject: Re: Authentication Help

> "Bob Ross" <[EMAIL PROTECTED]> wrote:
> > Meaning, PAP with /passwd/shadow files and CHAP with the mySQL files?
>
>   I don't recall the details in 0.9.3, but in the latest CVS snapshot
> this should work with minimal changes.  Once you add the SQL
> configuration, the server should do this automatically.
>
>   Remember, it's *designed* to do the right thing in the common
> cases.  You're working very hard to get it to do "something", but
> you're not clear as to how the server works, or how to configure it to
> do that something.  Rather than fighting with the configuration, your
> time would be better spent learning more about how the server works,
> so you don't have to fight with the configuration.
>
>   Alan DeKok.
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Does anyone know whether freeradius work with Linksys WRT54G?

2004-04-21 Thread loader


Or where can I get a list of APs supported by freeradius?


Regards,
loader

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

testing values for LDAP attributes

2004-04-21 Thread Hans Fiedler

I need to allow users from a wireless access point by MAC address (it comes
as a userid) and then if the MAC address is not defined in the users file to
check their userid/password against a LDAP database.  I now had an
additional requirement put on that I need to check the values of an
attribute in the LDAP database.

I have it working fine checking the MAC address, then if it's not defined
in the local users file, rejecting access if the userid is the form of
a MAC address (12 hex digits), then if it's not a MAC address checking
the userid/password against LDAP.

I can't get the attribute value checking to work.  I've tried mapping the
attribute in the ldap.attrmap file,

checkItem   WirelessStatus  WirelessStatus

and checking the value in the users file.  I'm not getting that to work.

I also tried adding the attribute in the LDAP filter in radiusd.conf,
as a long shot), then nothing in LDAP works

filter = "(&(cn=%{User-Name})(WirelessStatus=ACTV))"

with

filter = "(cn=%{User-Name})"

being the working line just doing userid/password checking.

I was hoping someone might have some suggestions.  Is the users file
the place to do this, and I just need to get my syntax working, or since
the users file is checked then falls through to LDAP is out of the picture
at that point?

-- 
Hans K. Fiedler Information Technology
Network Analyst Communications Services
[EMAIL PROTECTED]  University of Louisville
Louisville, Ky. 40292

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: OS for FreeRADIUS

2004-04-21 Thread Paul Hampson

On Wed, Apr 21, 2004 at 03:03:26PM -0600, Guy Fraser wrote:
> Paul Hampson wrote:
> ...snip...

> >_I_ haven't tested against the lastest release of FreeBSD. I'd welcome
> >any improvements to the thread-safety of FreeRADIUS, so if you want to
> >test it out and suggest changes that don't break any other versions of
> >FreeBSD, any other BSD flavours, and (if possible) Tru64 and OS/X...
> >
> >However, given that we're ramping up to a release, I'd rather not
> >duplicate the 0.9 series's tendancy to need autoconf fixes for
> >gethostby* immediately after _each_ release. If we have something safe-
> >looking before we start the pre release cycle, and it gets _tested_ by
> >various FreeBSD and other bodies, then maybe. :-)
> >
> ...snip...

> I rebuilt from CVS on 2004Apr20 08:56 MDT, with the usual warnings about  
> *_r possibly not being thread safe, but no errors were generated on 
> FreeBSD 5.2.1-RELEASE-p1. I did not apply any patches to CVS before I 
> compiled.

gethostbyaddr{,_r} is overridden to be BSD-style if we detect FreeBSD...
Try deleting lines 8519 to 8528 inclusive from configure (Pasted below
for comparison) and see if it still builds/runs.

case "$host" in
*-freebsd*)
cat >> confdefs.h <<\EOF
#define GETHOSTBYADDRRSTYLE BSDSTYLE
EOF

gethostbyaddrrstyle=BSD
echo "configure: warning: FreeBSD overridden to BSD-style" 1>&2
;;
esac

gethostbyname{,_r} isn't overridden, and sounds like it's still
BSD-style on FreeBSD. I guess the question is, is it now thread-safe?

-- 
Paul "TBBle" Hampson, on an alternate email client.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

It tried to send everyone to the mySQL database. Doesn't check the local at
all.

- Original Message - 
From: "Guy Fraser" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, April 21, 2004 3:05 PM
Subject: Re: Authentication Help


> Bob Ross wrote:
>
> >What is funny, whit checking the diffs on the files, the only thing
> >different is in the users file and used the prozy.conf this time also.
> >
> >I was trying := System or := Local, or == Local. == System, or local on
> >first,
> >
> >But they were always the same also on the Fall-Through either both yes or
1,
> >this was the only time I tried different, but if it works. I had asked
about
> >this once before, and was told it didn't make a difference what they
were,
> >but maybe they did.
> >
> >Any ideas if this really could have caused my hang up?
> >
> >DEFAULT Auth-Type = System
> >Fall-Through = yes
> >
> >DEFAULT Auth-Type = Local
> >Fall-Through = 1
> >
> Do NOT use Auth-Type at all, it is not needed for most situations.
>
> If you are trying to use authenticate from SQL it most certainly will
> cause you grief if it is used.
>
> There is tons of information in the archives on this subject, and it
> usualy boils down to : Do NOT use Auth-Type .
>
>
>
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

I did. It doesn't work.

I commented out both lines on each one.

- Original Message - 
From: "Guy Fraser" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, April 21, 2004 3:05 PM
Subject: Re: Authentication Help


> Bob Ross wrote:
>
> >What is funny, whit checking the diffs on the files, the only thing
> >different is in the users file and used the prozy.conf this time also.
> >
> >I was trying := System or := Local, or == Local. == System, or local on
> >first,
> >
> >But they were always the same also on the Fall-Through either both yes or
1,
> >this was the only time I tried different, but if it works. I had asked
about
> >this once before, and was told it didn't make a difference what they
were,
> >but maybe they did.
> >
> >Any ideas if this really could have caused my hang up?
> >
> >DEFAULT Auth-Type = System
> >Fall-Through = yes
> >
> >DEFAULT Auth-Type = Local
> >Fall-Through = 1
> >
> Do NOT use Auth-Type at all, it is not needed for most situations.
>
> If you are trying to use authenticate from SQL it most certainly will
> cause you grief if it is used.
>
> There is tons of information in the archives on this subject, and it
> usualy boils down to : Do NOT use Auth-Type .
>
>
>
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

2004-04-21 Thread Guy Fraser

Bob Ross wrote:

What is funny, whit checking the diffs on the files, the only thing
different is in the users file and used the prozy.conf this time also.
I was trying := System or := Local, or == Local. == System, or local on
first,
But they were always the same also on the Fall-Through either both yes or 1,
this was the only time I tried different, but if it works. I had asked about
this once before, and was told it didn't make a difference what they were,
but maybe they did.
Any ideas if this really could have caused my hang up?

DEFAULT Auth-Type = System
Fall-Through = yes
DEFAULT Auth-Type = Local
Fall-Through = 1
Do NOT use Auth-Type at all, it is not needed for most situations.

If you are trying to use authenticate from SQL it most certainly will
cause you grief if it is used.
There is tons of information in the archives on this subject, and it
usualy boils down to : Do NOT use Auth-Type .


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

There is a question also.

It logs the detail files with the IP address. I really have looked but can't
seem to find it. Is there a way I can tell it to use the ras name I assigned
to each IP ?, I found the config link, but it didn't give what to call
the --- to do this.

ras1, ras2, usa1,usa2, etc...

Thanks


- Original Message - 
From: "Alan DeKok" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, April 21, 2004 2:20 PM
Subject: Re: Authentication Help


> "Bob Ross" <[EMAIL PROTECTED]> wrote:
> > Meaning, PAP with /passwd/shadow files and CHAP with the mySQL files?
>
>   I don't recall the details in 0.9.3, but in the latest CVS snapshot
> this should work with minimal changes.  Once you add the SQL
> configuration, the server should do this automatically.
>
>   Remember, it's *designed* to do the right thing in the common
> cases.  You're working very hard to get it to do "something", but
> you're not clear as to how the server works, or how to configure it to
> do that something.  Rather than fighting with the configuration, your
> time would be better spent learning more about how the server works,
> so you don't have to fight with the configuration.
>
>   Alan DeKok.
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

What is funny, whit checking the diffs on the files, the only thing
different is in the users file and used the prozy.conf this time also.

I was trying := System or := Local, or == Local. == System, or local on
first,

But they were always the same also on the Fall-Through either both yes or 1,
this was the only time I tried different, but if it works. I had asked about
this once before, and was told it didn't make a difference what they were,
but maybe they did.

Any ideas if this really could have caused my hang up?

DEFAULT Auth-Type = System
Fall-Through = yes

DEFAULT Auth-Type = Local
Fall-Through = 1

- Original Message - 
From: "Alan DeKok" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, April 21, 2004 2:20 PM
Subject: Re: Authentication Help

> "Bob Ross" <[EMAIL PROTECTED]> wrote:
> > Meaning, PAP with /passwd/shadow files and CHAP with the mySQL files?
>
>   I don't recall the details in 0.9.3, but in the latest CVS snapshot
> this should work with minimal changes.  Once you add the SQL
> configuration, the server should do this automatically.
>
>   Remember, it's *designed* to do the right thing in the common
> cases.  You're working very hard to get it to do "something", but
> you're not clear as to how the server works, or how to configure it to
> do that something.  Rather than fighting with the configuration, your
> time would be better spent learning more about how the server works,
> so you don't have to fight with the configuration.
>
>   Alan DeKok.
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

"Bob Ross" <[EMAIL PROTECTED]> wrote:
> Meaning, PAP with /passwd/shadow files and CHAP with the mySQL files?

  I don't recall the details in 0.9.3, but in the latest CVS snapshot
this should work with minimal changes.  Once you add the SQL
configuration, the server should do this automatically.

  Remember, it's *designed* to do the right thing in the common
cases.  You're working very hard to get it to do "something", but
you're not clear as to how the server works, or how to configure it to
do that something.  Rather than fighting with the configuration, your
time would be better spent learning more about how the server works,
so you don't have to fight with the configuration.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Paul Hampson wrote:
...snip...
_I_ haven't tested against the lastest release of FreeBSD. I'd welcome
any improvements to the thread-safety of FreeRADIUS, so if you want to
test it out and suggest changes that don't break any other versions of
FreeBSD, any other BSD flavours, and (if possible) Tru64 and OS/X...
However, given that we're ramping up to a release, I'd rather not
duplicate the 0.9 series's tendancy to need autoconf fixes for
gethostby* immediately after _each_ release. If we have something safe-
looking before we start the pre release cycle, and it gets _tested_ by
various FreeBSD and other bodies, then maybe. :-)
...snip...

I rebuilt from CVS on 2004Apr20 08:56 MDT, with the usual warnings about
*_r possibly not being thread safe, but no errors were generated on
FreeBSD 5.2.1-RELEASE-p1. I did not apply any patches to CVS before I
compiled.

This is what I used to configure :

--localstatedir=/var --with-logdir=/var/log/radiusd \ --with-radacctdir=/var/log/radiusd/acct --quiet

I made a couple config changes to enable postgresql auth and acct, then started it, and tested an sql users with an encrypted and clear test
passwords, and they both worked. Just to make sure I used some wrong
passwords and they were rejected. The postauth table did have entries
inserted, but I have not yet tested from a real nas to get accounting
records. Accounting did work a month ago, but since then I don't have a
nas set aside for testing, and I don't want to mess with a prodution
nas right now.

Hope that helps.

I will reconfig for MySQL next and make sure all is well with it too.

Have a nice day.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

Well, actually I did, in the beginning.

But so far it looks as if I managed somehow to get it going after deleting
everything and starting over.

*** First Post
I'm told I should be able to do PAP - CHAP on the same server, but have been
having one hard time doing so.

Anyone have any examples or instruction to get this done. Right now we can
only get it to do either one, not both.

Meaning, PAP with /passwd/shadow files and CHAP with the mySQL files?

Any examples of raddb files to help me with?
*
- Original Message - 
From: "Alan DeKok" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, April 21, 2004 1:55 PM
Subject: Re: Authentication Help

> "Bob Ross" <[EMAIL PROTECTED]> wrote:
> > I deleted everything to start over again so it's a clean install. It's
about
> > the third time.
>
>   That's part of your problem.  There's no need to delete &
> re-install.  It's not Windows.
>
> > Is there any docs or example raddb files that show what I'm trying to
do?
>
>   You haven't explained what it is you're trying to do, so the answer
> is "No".
>
>   Alan DeKok.
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>
>

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

"Bob Ross" <[EMAIL PROTECTED]> wrote:
> I deleted everything to start over again so it's a clean install. It's about
> the third time.

  That's part of your problem.  There's no need to delete &
re-install.  It's not Windows.

> Is there any docs or example raddb files that show what I'm trying to do?

  You haven't explained what it is you're trying to do, so the answer
is "No".

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Freeradius + PostgreSQL not working

2004-04-21 Thread Guy Fraser

This is what I am using {I am not using 0.9.3, but 1.0-pre0 from CVS} 
for radiusd.conf :

...snip...
modules {
...snip...
   $INCLUDE  ${confdir}/postgresql.conf
...snip...
}
...snip...
authorize {
   preprocess
   chap
   mschap
   suffix
   eap
# 'files' can be uncommented if you do NOT have a
# default 'Auth-Type' in the 'users' file.
#files
   sql
   daily
}
...snip...
accounting {
   acct_unique
   detail
   unix
   radutmp
   sql
}
session {
   radutmp
   sql
}
post-auth {
   sql
}
...snip...
The test data I use is listed below, the password for troll is skunk, 
but is
'MD5' encrypted, so linux must be configured to athenticate with MD5.

Here is the test data I use :
... %< cut here ...
COPY radcheck (id, username, attribute, op, value) FROM stdin;
1   fredf   User-Password   ==  wilma
2   barneyr User-Password   ==  betty
3   troll   Crypt-Password  ==  $1$ODa8qvTP$DWfshR5SI4uSIp68a3DfD1
4   frogUser-Password   ==  kermit
\.
COPY radgroupcheck (id, groupname, attribute, op, value) FROM stdin;
\.
  

COPY radgroupreply (id, groupname, attribute, op, value) FROM stdin;
1   ppp-unlimited   Framed-Compression  :=  Van-Jacobsen-TCP-IP
2   ppp-unlimited   Framed-Protocol :=  PPP
3   ppp-unlimited   Service-Type:=  Framed-User
4   ppp-unlimited   Framed-MTU  :=  1500
5   ppp-static  Framed-Compression  :=  Van-Jacobsen-TCP-IP
6   ppp-static  Framed-Protocol :=  PPP
7   ppp-static  Service-Type:=  Framed-User
8   ppp-static  Framed-MTU  :=  1500
9   nas-prompt  Framed-MTU  :=  1500
10  nas-prompt  Framed-Compression  :=  Van-Jacobson-TCP-IP
11  nas-prompt  Service-Type:=  NAS-Prompt
\.
COPY radreply (id, username, attribute, op, value) FROM stdin;
1   barneyr Framed-IP-Address   :=  10.19.65.38
2   barneyr Framed-IP-Netmask   :=  255.255.255.252
\.
COPY usergroup (id, username, groupname) FROM stdin;
1   fredf   ppp-unlimited
2   barneyr ppp-static
3   troll   ppp-unlimited
4   frognas-prompt
\.
... %< cut here ...
Note : Spaces are supposed to be TAB's
VoipOne NOC wrote:

Hi

I have freeradius 0.9.3, compiled on a Debian Unstable system for PostgreSQL
support.
Once I installe everything, it seems to work right. Following is the final
output from "freeradius -xxyz -l stdout" :
Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on
1814/udp.
Ready to process requests.
And when I try to send the radius packets for accounting from my Cisco
router, it just doesn't work
I have the following lines changed in my radiusd.conf:
with_cisco_vsa_hack = yes
$INCLUDE ${confdir}/postgresql.conf 
#unix (wtmp file) * commented out
#radutmp		* commented out
Added sql instead of the unix accounting method.

If anyone has experience with this, please let me know what I can do.

Regards.
 



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

As I said I deleted everything, I mean everything related to free radius was
deleted. All directories it created.

When I go to start over I start over from scratch. If one way doesn't work,
I don't want the problems of one config conflicting with another.

I'm back to the way it was when I first extracted it to start.

I can only hope someone else has done it the way I'm trying to.

If not I'll just have to run to different radius's on the server until I get
around to
putting them on two different ones.

I'm told I should be able to do PAP - CHAP on the same server, but have been
having one hard time doing so.

Anyone have any examples or instruction to get this done. Right now we can
only get it to do either one, not both.

Meaning, PAP with /passwd/shadow files and CHAP with the mySQL files?

Any examples of raddb files to help me with?

Thanks
Bob Ross


- Original Message - 
From: "Milver S. Nisay" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, April 21, 2004 9:31 AM
Subject: Re: Authentication Help


> > Since I have only started working with FreeRadius, and have not touched
a
> > radius file for 7 years, I have to say No, because I have no idea what
> your
> > asking.
>
>
> google helps both technical and non-technical on planet earth a REALLY
lot.
> you might want to share us your radiusd.conf and sql.conf to light a new
way
> for you.
> how about a book? (just kidding) :) share it to me offlist and let me see
> what i can do for you.
>
>
>
>
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

I'm not experienced in this area. I only started using FreeRadius a week
ago, and have not touched radius for 7 years other than upgrades to Cistron.
Other than that I have not needed to know any more about it except that it
was working, and no it's

So you have me lost.

I deleted everything to start over again so it's a clean install. It's about
the third time.

One of these times it will start to work. Just need guidance to do so.

Is there any docs or example raddb files that show what I'm trying to do?

Thanks
Bob

- Original Message - 
From: "Alan DeKok" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, April 21, 2004 10:47 AM
Subject: Re: Authentication Help

> "Bob Ross" <[EMAIL PROTECTED]> wrote:
> > I'm told I should be able to do PAP - CHAP on the same server, but have
been
> > having one hard time doing so.
>
>   The server does this out of the box.
>
>   The larger problem is I don't think you're clear on WHY some
> requests do PAP, and others do CHAP.  If you can tell the two apart,
> it should be trivial to configure the server to handle them
> differently.
>
>   Alan DeKok.
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>
>

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: OS for FreeRADIUS

2004-04-21 Thread Holger Steppke

Hi,

well don?t lmow how well it runs on the others. I run it on Solaris 2.6 and
2.8
and it works well.


Bye
Holger


[EMAIL PROTECTED] <> wrote on :

> Is there a recommended OS for freeradius?
> Is there really a difference (performance or otherwise) between running
> freeradius on FreeBSD compared to a distrobution of Linux (RedHat,
> Gentoo, etc...)?
>
> Evan Stenmark
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

unsubscribe

2004-04-21 Thread Eric

unsubscribe



- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

"Bob Ross" <[EMAIL PROTECTED]> wrote:
> I'm told I should be able to do PAP - CHAP on the same server, but have been
> having one hard time doing so.

  The server does this out of the box.

  The larger problem is I don't think you're clear on WHY some
requests do PAP, and others do CHAP.  If you can tell the two apart,
it should be trivial to configure the server to handle them
differently.

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Appending a user name.

"J Thomas Hancock" <[EMAIL PROTECTED]> wrote:
> We are running freeradius-0.9.3 on a Linux box. Due to a specific need of
> one of our clients, we need to be able to authenticate a user based on their
> Called-Station-ID and their username/password without specifying a domain.
> The usernames are stored in our MySQL database as [EMAIL PROTECTED]  I
> am having problems configuring the users file to append @domainname.com to
> the username based on their Called-Station-Id.  Does anyone have any
> experience doing this sort of thing?  

  It shouldn't be necessary.  You can use rlm_passwd to map
Called-Station-Id to a domain, and then edit the SQL queries.  Where
they say:

%{User-Name}

  Replace it with:

[EMAIL PROTECTED]

  Alan DeKok.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

> Since I have only started working with FreeRadius, and have not touched a
> radius file for 7 years, I have to say No, because I have no idea what
your
> asking.


google helps both technical and non-technical on planet earth a REALLY lot.
you might want to share us your radiusd.conf and sql.conf to light a new way
for you.
how about a book? (just kidding) :) share it to me offlist and let me see
what i can do for you.





- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

Since I have only started working with FreeRadius, and have not touched a
radius file for 7 years, I have to say No, because I have no idea what your
asking.

I did do what it said to about getting rid of the old files no longer used
and enabling the /etc/passwd - /etc/shadow - /etc/group files.

I followed the directions inside those the best I thought they were telling
me, and what I found on the net.

I already deleted the freeradius tree to start over from scratch so it's a
clean system. It's not that big of a deal, I have already done this 3 times.
Helps with the learning curve sometimes, but this one is definitely
different.

I have been installing it in a test directory to not interfere with the
current
running radius. When I have something to test, I turn one off and this one
on or just have them running on different ports until I'm ready to test with
actual log ins from both sides.

>
> have you tried combining or enabling both configuration with the
> radiusd.conf?
> what is the freeradius debug message?
>
>
>
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>
>


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: OS for FreeRADIUS

2004-04-21 Thread Paul Hampson

On Wed, Apr 21, 2004 at 08:49:47AM -0400, Gary McKinney wrote:
> I realize this is not a direct FreeRadius issue but possibly could be indirectly 
> related if the
> actual problem still exists with thread locking...

> I checked the FreeBSD site for any PR listings for what you have described... did 
> not find
> anything - have you checked against the latest release of FreeBSD for the problem??? 

http://lists.cistron.nl/archives/freeradius-users/2003/09/frm00212.html
* http://lists.cistron.nl/archives/freeradius-users/2003/09/msg00212.html
http://lists.cistron.nl/archives/freeradius-users/2003/09/frm00434.html
http://lists.cistron.nl/archives/freeradius-devel/2003/09/frm00093.html

_I_ haven't tested against the lastest release of FreeBSD. I'd welcome
any improvements to the thread-safety of FreeRADIUS, so if you want to
test it out and suggest changes that don't break any other versions of
FreeBSD, any other BSD flavours, and (if possible) Tru64 and OS/X...

However, given that we're ramping up to a release, I'd rather not
duplicate the 0.9 series's tendancy to need autoconf fixes for
gethostby* immediately after _each_ release. If we have something safe-
looking before we start the pre release cycle, and it gets _tested_ by
various FreeBSD and other bodies, then maybe. :-)

Whoops. While trawling the list archives from September I found someone
who asked me a question, and I never answered. :-( I hope he found
enlightenment eventually, and didn't leave us for Radiator.

-- 
Paul "TBBle" Hampson, on an alternate email client.

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication Help

> I'm told I should be able to do PAP - CHAP on the same server, but have
been
> having one hard time doing so.
>
> Anyone have any examples or instruction to get this done. Right now we can
> only get it to do either one, not both.

have you tried combining or enabling both configuration with the
radiusd.conf?
what is the freeradius debug message?




- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Authentication Help

I'm told I should be able to do PAP - CHAP on the same server, but have been
having one hard time doing so.

Anyone have any examples or instruction to get this done. Right now we can
only get it to do either one, not both.

Meaning, PAP with /passwd/shadow files and CHAP with the mySQL files?

Any examples of raddb files to help me with?

Thanks
Bob Ross


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Appending a user name.


> We are running freeradius-0.9.3 on a Linux box. Due to a specific need of
> one of our clients, we need to be able to authenticate a user based on
their
> Called-Station-ID and their username/password without specifying a domain.
> The usernames are stored in our MySQL database as [EMAIL PROTECTED]
I
> am having problems configuring the users file to append @domainname.com to
> the username based on their Called-Station-Id.  Does anyone have any
> experience doing this sort of thing?

your username attribute from MySQL is an exact matching login name that will
be searched by freeradius based from
your realms configuration coming from MySQL database. freeradius assumes
that the requests coming in have @domains.com appended
from their usernames during the time of request and after the radiusd.conf
was loaded. i think, i have not done it though, that your
MySQL structures conflicts with the username request (from clients) coming
in. that setup will not pass from authenticaion process.
give a ring to google.




- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Appending a user name.

2004-04-21 Thread J Thomas Hancock

We are running freeradius-0.9.3 on a Linux box. Due to a specific need of
one of our clients, we need to be able to authenticate a user based on their
Called-Station-ID and their username/password without specifying a domain.
The usernames are stored in our MySQL database as [EMAIL PROTECTED]  I
am having problems configuring the users file to append @domainname.com to
the username based on their Called-Station-Id.  Does anyone have any
experience doing this sort of thing?  

Any help with the matter would be much appreciated.

Thank you,
Tom




- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: PAP/CHAP

Sorry to bother you.

when you said this we thought you were on the development. No he hasn't left
us. He just as stumped.

**
no realm or with realm, freeradius does not care, it will do what we design
its radiusd.conf to be.

**


- Original Message - 
From: "Milver S. Nisay" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Tuesday, April 20, 2004 12:34 PM
Subject: Re: PAP/CHAP


> > I was told that FreeRadius can answer PAP/CHAP at the same
> > time that it didn't care.
>
> Yes, freeradius does not care what authentication request are coming in,
> whether PAP/CHAP or system authenticated
> accounts. If freeradius was configured properly, it will reply as it was
> tasked to do.
>
> > The problem I'm having is if a user loges in with no realm (PAP) and
> > there user name is in the system files, it doesn't work. If I use a
> > different user and log in to our wholesale(CHAP) side the user name in
the
> mysql
> > database does fine.
>
> no realm or with realm, freeradius does not care, it will do what we
design
> its radiusd.conf to be.
> there's a work around, PAP accounts can be configured to be authenticated
> based from account names, password and
> expiration attributes and others inside MySQL database too, without
ofcourse
> using /etc/passwd and /etc/shadow files.
>
> > How do I tell FreeRadius to look in the system file first and then the
> > Local (mySQL) second if not found in the System files?
>
> it does and that is why you don't need to..
>
> > I did not really want to run two radius on the same machine on different
> > ports if at all possible.
>
> if you like it that way, it can be worked out without considering pros and
> cons.
> >
> > Other than this little snag, I have all my tools to work everything from
> the
> > command prompt. Add, Disable, Enable, Remove, etc..
>
> hope this helps.
>
> //milver
>
>
>
> -
> List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
>


- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 benchmarking tools attached for you to use / comment on/ improve

2004-04-21 Thread Tariq Rashid

2 benchmarking tools (code and output is resdable and self-evident) attached for you 
to use / comment on/ improve.

python uses pyrad module, C uses libradius from standard BSD install (a static version 
exists for linux).

comments appreciated.


thread_test_linear.py
Description: thread_test_linear.py


thread_test.c
Description: thread_test.c

Re: Re[3]: how to create check attribute dinamically?