November 2005 - Freeradius-Users - lists.freeradius.org

802.1x machine authentication patch help
by Jamie Crawford 18 Nov '05

18 Nov '05

Hi, I am trying to get machine authentication working with freeradius. I have patched the samba code and freeradius code. But am getting this error when the machine tries to authenticate. I patched the rlm_chap module by taking last nights cvs snapshot and copying over the rlm_chap folder overwriting the contents of the same folder in the freeradius-1.0.5 release and recompiling. I see that it is trying to pass the username as "host/IS--000031176". I thought the updated rlm_mschap was suppposed to strip the "host/" part of the username. Do I need to create a realm to strip the "host/"? Any help would be appreciated!!! Thanks, jamie make clean ./configure --configure --with-raddbdir=/etc/radius --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql --without-rlm_ldap --without-rlm_krb5 make make install modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: d3 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key --username=host/IS--000031176 --challenge=ba9273ce0768615e --nt-response=fd385f1011a2f799b5d62e04ba d8bb39719fa48c3d11299e' Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key --username=host/IS--000031176 --challenge=ba9273ce0768615e --nt-response=fd385f1011a2f799b5d62e04bad8bb39719fa48c3d11299e Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed.

2 1

pam radius integration with http server
by nagaraj 18 Nov '05

18 Nov '05

hi, I have successfully integrated PAM radius client http boa server to facilitate remote authentication. However I am facing few issues. If the number of re-tries is configured to 2 and timeout value is set to 3, it takes 24 secs to timeout when radius server is not available. Http client is making 4 connections and hence it takes 24 secs(2*3*4) to timeout. In the event of server not being reachable, http server should default to local authentication that happens only after 24 secs which is not acceptable. Is there any way I can fine tune this? Has any body dealt with this kind of issue? Please reply. Thanks, Nagaraj

2 1

rlm_counter and rlm_sqlcounter configuration, help!
by Jorge Pomoro 18 Nov '05

18 Nov '05

Hi, I have a few questions: - What's the difference between rlm_counter and rlm_sqlcounter? - If I use freeradius with a mysql db, I have to use rlm_sqlcounter and NOT rlm_counter ? - The module (rlm_counter or rlm_sqlcounter) is including in freeradius or is necessary to download it? - After download and compiling the module, how I tell to the freeradius to use that module? - Is there any list of the attributes of this module? (rlm_counter or rlm_sqlcounter). I was looking on Internet but I did not find any listing. Thanks!!! Regards, Jorge

1 0

Failed to link to module 'rlm_eap'
by Nicola Iotti 18 Nov '05

18 Nov '05

Hi, I'm using Freeradius 1.0.5, I ran ./configure -disable-shared but when I start radiusd -s -X .. it stops with this message ... radiusd.conf[9] Failed to link to module 'rlm_eap': unknown error I see in past mail that other people had this problem but I can't find solution.. Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

1 0

sql.conf and case sensitive UserNames fr 1.0.5
by Andreas Engler 18 Nov '05

18 Nov '05

If i understand the sql.conf from freeradius-1.0.5 right, then the default queries do a case sensitive check for the UserName. The alternate queries are marked for case insensitive usernames. So i understand the default queries are for case sensitive usernames. Am i wrong in this understanding? That would be different from behavior in freeradius-1.0.4. After a few tests i would say, that the UserName is still case insensitive in the default queries for freeradius-1.0.5. Thank You Andreas

4 3

radsqlrelay queries
by Ming-Ching Tiew 18 Nov '05

18 Nov '05

Hi All, I have a configuration where I need to populate the free radius data into MS SQL database but over the wide area network. So what I do is I have a radius server writing to flat files and then I will write some scripts to compress to files and sent them over the wide area network and then on the other end, I will decompress it and then I will use 'radsqlrelay' to read the flat files and store them into MSSQL. But a quick check on the latest radius server snap shot revealed that the program 'radsqlrelay' - a perl script - only support 'mysql' and 'pg'. Any chance of it supporting unixODBC or iODBC ? What does it take to modify it to support unixODBC or iODBC ? Cheers.

2 1

AW: Is there a Changelog for freeradius 1.0.5?
by Völker, Christian 18 Nov '05

18 Nov '05

Yohoo! What about "doc/ChangeLog" ? Greets

1 0

Is there a Changelog for freeradius 1.0.5?
by Andreas Engler 18 Nov '05

18 Nov '05

Sorry for the Question. Maybe i'm to blind, but i can't find the changelog in my tarball of freeradius-1.0.5. Could someone tell me where to find the changelog? Thank you Andreas

1 0

Limiting number of logins (not simultaneous)
by Jorge Pomoro 17 Nov '05

17 Nov '05

Hi I want to know how to limit the number of connections with a certain user (Radius). I do not talk about simultaneous connections. That is to say, to create a user and that can do login, for example, 5 times, after that, the user is automatically rejected . Is there an attibute for do this ?? Thanks!!

2 1

Expired system passwords are still authenticating
by Mark Tunnell 17 Nov '05

17 Nov '05

I've set up a Cisco router to authenticate against a freeradius server on a Linux box using the local system account. Everything looked great until I expired the password. If I log into that account on the Linux box it tells me the password has expired and I need to change it. However, if I log into the router it continues to authenticate that password just fine. What am I missing? Thanks, Mark

4 5