October 2005 - Freeradius-Users - lists.freeradius.org

ap telabria and freeradius
by Nurul Faizal M.Shukeri 29 Oct '05

29 Oct '05

Hi. Anyone who has experiences configuring telabria to authenticate with freeradius, plz help me. I'm stuck.

1 0

Accounting and anonymous outer identity in EAP-TTLS
by Damjan 29 Oct '05

29 Oct '05

I've been searching the mail list about this, but haven't found a definitive sollution. The scenario, I'm using WPA2 access points, they are setup to authorize users against my freeradius server. The freeradius server is setup to use a MySQL database, and eap-ttls is configured (and that works ok). My Windows clients connect with the SecureW2 (1) supplicant. The problem is that radius accounting requests have the User-Name = anonymous attribute/value, so I can't separate accounting from different users. I've tried to replace the User-Name in the Access-Accept reply, with this configuration: - I have this in the "users" file: DEFAULT FreeradiusProxiedTo == 127.0.0.1 User-Name := "%{User-Name}", FallThrough = yes BTW I've tried User-Name = "%{User-Name} too. And this is the authorize section in radiusd.conf: authorize { preprocess chap mschap suffix eap files sql } The problem is that the Access-Accept reply from freeradius has two User-Name AV pairs, like this: User-Name := "anonymous" User-Name := "damjan" And the accounting packet has the User-Name = "anonymous" AV pair. Shouldn't the := operator in "user" replace the User-Name = "anonymous", or it doesn't because files is before sql in the authorize section, and my users are in the MySQL database?... and if I put sql before files, that DEFAULT entry will not be triggered, am I right? Can I just remove UserName from the "authorize_reply_query" SELECT in sql.conf? Note however that the same radius instance is used for non-EAP clients too, those clients authenticate through chillispot and use plain and simple PAP. My platform is: slackware linux 10.1 openssl-0.9.7e freeradius-1.0.2 (I'd update if that's a sollution but this system has several radius instances (ports) in production use) (1) http://www.securew2.com/ -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

2 2

Re: FreeRADIUS - 802.1x WPA-TKIP, WPA2-AES settings
by Damjan 28 Oct '05

28 Oct '05

> add to it: forward the DHCPDISCOVER to the DS if no internal table entry > for this MAC is found. yapp, that would be even very easy to integrate. > > but i don't think that _any_ AP does that. Well, an AP that does 802.1x + chillispot is all you need :) You get the accounting, bandwidth shapping and traffic limits for free > >>just for the case: no, it is > >>NOT possible to assign IP addresses by 802.1X; you have to do DHCP after > >>the authentication (yes, it is strange). > > > > > >A clever AP could support this: > >1. Serving DHCP to the wireless netowork only > >2. Getting the Framed-IP-Address from the radius Access-Accept, and > >putting it in a internal table (MAC -> IP) > >3. Serving that exact IP via DHCP when the subsciber asks for a lease. > > > >I don't know of an AP that does that, though. > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

1 0

Upgrading Realms
by Jeffrey Froman 28 Oct '05

28 Oct '05

Hi, I have a working installation of freeradius 0.9, and I am attempting to migrate my configuration to freeradius-1.0.4 on a newer server. Authentication for the local domain is working fine, but there is a problem with way realms are being handled. In huntgroups, I have the following: MyHunt Client-IP-Address == "192.168.1.12", Realm == "star.my.com" and in proxy.conf: realm star.my.com { type = radius authhost = LOCAL accthost = LOCAL } radiusd uses LDAP for authentication, with a filter that includes: (objectClass=%{Huntgroup-Name}) Under freeradius-0.9, when handling a request for user(a)star.my.com, this filter is expanded to: (objectClass=MyHunt) But under 1.0.4 I get: (?=undefined) Any ideas as to why this is happening, or what updates need to be made to my configuration? Thank you, Jeffrey

1 0

rlm_sql module won't compile under Solaris 10
by M.McNeil 28 Oct '05

28 Oct '05

Hello, I'm trying to get FreeRadius 1.0.5 to compile with MySQL / RLM_SQL, under Solaris 10. Configure works just fine, however, after running "make", I get the following: gmake[7]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' Making static in drivers... gmake[8]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' /usr/sfw/bin/gmake -w WHAT_TO_MAKE=static common gmake[9]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' Making static in rlm_sql_iodbc... gmake[10]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_iodbc' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making static in rlm_sql_mysql... gmake[10]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -xc99=none -c sql_mysql.c -o sql_mysql.o gcc: language c99=none not recognized gcc: sql_mysql.c: linker input file unused because linking not done /export/home/freeradius-1.0.5/libtool --mode=link ld -module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -xc99=none sql_mysql.o -o rlm_sql_mysql.a mkdir .libs (cd . && ln -s sql_mysql.lo sql_mysql.o) ar cru rlm_sql_mysql.a sql_mysql.o ar: cannot open sql_mysql.o No such file or directory ar: sql_mysql.o not found gmake[10]: *** [rlm_sql_mysql.a] Error 1 gmake[10]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' gmake[8]: *** [static] Error 2 gmake[8]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' gmake[6]: *** [static] Error 2 gmake[6]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/export/home/freeradius-1.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/export/home/freeradius-1.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/export/home/freeradius-1.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/freeradius-1.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/export/home/freeradius-1.0.5' *** Error code 2 The following command caused the error: /usr/sfw/bin/gmake WHAT_TO_MAKE=all common make: Fatal error: Command failed for target `all' I dowloaded the binary MySQL package from mysql.com and added /usr/local/mysql to my PATH and LD_LIBRARY_PATH variables. FreeRadius can see the files, however, it will *not* compile the rlm_sql module. I've combed the mailing list archive, but I have yet to find a solution to this problem. Has anyone else experienced this issue ? Best Regards, Mike McNeil Sr. Network Engineer Communications & Network Services University of California Berkeley

1 0

Problem installing freeradius 1.0.1 or 1.05 on 64 bit platform
by Ashwin Gobind 28 Oct '05

28 Oct '05

Good day I am attempting to install freeradius on a 64 bit platform with Suse Linux 9. However I get the following error during make. What maybe the problem ? /usr/software/freeradius-1.0.1/libtool --mode=link gcc -release 1.0.1 \ -module -export-dynamic -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../../include \ -o rlm_counter.la -rpath /usr/local/lib rlm_counter.lo -lgdbm -lnsl -lresolv -lpthread -lcrypto -lssl rm -fr .libs/rlm_counter.la .libs/rlm_counter.* .libs/rlm_counter-1.0.1.* gcc -shared rlm_counter.lo /usr/lib/libgdbm.so -lnsl -lresolv -lpthread -lcrypto -lssl -Wl,-soname -Wl,rlm_counter-1.0.1.so -o .libs/rlm_counter-1.0.1.so /usr/lib/libgdbm.so: could not read symbols: Invalid operation collect2: ld returned 1 exit status gmake[6]: *** [rlm_counter.la] Error 1 gmake[6]: Leaving directory `/usr/software/freeradius-1.0.1/src/modules/rlm_counter' gmake[5]: *** [common] Error 1 gmake[5]: Leaving directory `/usr/software/freeradius-1.0.1/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/software/freeradius-1.0.1/src/modules' gmake[3]: *** [common] Error 1 gmake[3]: Leaving directory `/usr/software/freeradius-1.0.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/software/freeradius-1.0.1/src' gmake[1]: *** [common] Error 1 gmake[1]: Leaving directory `/usr/software/freeradius-1.0.1' make: *** [all] Error 2 �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

freeradius, 802.1x, PEAP for wlan
by Juan Mauel Lopez Villalobos 28 Oct '05

28 Oct '05

Hi all, two newbie questions: is there a way of not using ntlm_auth-samba-ldap if I only have ldap? i prefer to use only ldap. how works "ntlm_auth --request-nt-key --username=%{St ripped-User-Name:-%{User-Name:-None}} --challenge= %{mschap:Challenge:-00} --nt-r esponse=%{mschap:NT-Response:-00}", what values return? Thanks -- LCC Juan Manuel Lopez Villalobos Departamento de Sistemas de Informacion Coordinacion de Informacion Academica Universidad Autonoma de Baja California Tel: (686) 551 8274 Fax: (686) 551 8269 Conmutador: (686) 551 8222 y 8270 ext. 3360

2 1

controling bandwidth
by Alex M 28 Oct '05

28 Oct '05

Hi, How can I control bandwidth for specific users? And how can I block all ports except one, for their connection? Thanks!

1 0

Problem using "Calling-Station-Id"-Attribute in radcheck
by kdr akm 28 Oct '05

28 Oct '05

Hello, I´m using freeradius-1.0.1-0.FC2.i386.rpm and freeradius-mysql-1.0.1-0.FC2.i386.rpm with Mysql for Authentication for my lan client . Now, I want also to check the MAC-Address of this Lan Client. Therefore I added the "Calling-Station-Id"-Attribute to the radcheck table. mysql> select * from radcheck; +----+----------+--------------------+----+--------------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+--------------+ | 1 | tala | User-Password | == | 123123 | | 2 | tala | Calling-Station-Id | == | 000d88522f1f | +----+----------+--------------------+----+--------------+ 2 rows in set (0.00 sec) Unfortunatelly, freeradius cannot validate this user anymore. Are there any config-files I have to change? or i use this attribut wrong i.am a beginner in radius and thanks in advanced . --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

2 1

RE: Problem using "Calling-Station-Id"-Attribute in radcheck
by Guy Davies 28 Oct '05

28 Oct '05

In what format does your NAS send the calling-station-id? Mine uses 00-00-00-00-00-00. Maybe you're simply not matching the format? Rgds, Guy ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of kdr akm Sent: 28 October 2005 15:16 To: freeradius-users(a)lists.freeradius.org Subject: Problem using "Calling-Station-Id"-Attribute in radcheck Hello, I´m using freeradius-1.0.1-0.FC2.i386.rpm and freeradius-mysql-1.0.1-0.FC2.i386.rpm with Mysql for Authentication for my lan client . Now, I want also to check the MAC-Address of this Lan Client. Therefore I added the "Calling-Station-Id"-Attribute to the radcheck table. mysql> select * from radcheck; +----+----------+--------------------+----+--------------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+--------------+ | 1 | tala | User-Password | == | 123123 | | 2 | tala | Calling-Station-Id | == | 000d88522f1f | +----+----------+--------------------+----+--------------+ 2 rows in set (0.00 sec) Unfortunatelly, freeradius cannot validate this user anymore. Are there any config-files I have to change? or i use this attribut w! rong i.am a beginner in radius and thanks in advanced . ________________________________ Yahoo! FareChase - Search multiple travel sites in one click. <http://us.lrd.yahoo.com/_ylc=X3oDMTFqODRtdXQ4BF9TAzMyOTc1MDIEX3MDOTY2ODgxNj…> This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0