November 2005 - Freeradius-Users - lists.freeradius.org

RE: expiration
by Serge Lhermitte 03 Nov '05

03 Nov '05

Thanks a lot. After some more troubleshooting, it appears it is not the release_1_0 which is having a problem but rather the fact that I was trying to compile it on a 64 bits machine. I'll work it out. About the Expiration being handled by the server core, I'll double check this as well. Cheers. S. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Nicolas Baradakis Sent: jeudi 3 novembre 2005 10:56 To: FreeRadius users mailing list Subject: Re: expiration Serge Lhermitte wrote: > I am trying to get a working version of freeradius that includes the > expiration module. It seems this module doesn't exist in 1.0.x versions. I think the check item "Expiration" is handle by the server core (in auth.c), therefore you don't need a module. If you get version 1.0.5, it should work. > I actually succeeded a while ago, getting the following CVS > > $ cvs -d :pserver:[EMAIL PROTECTED]:/source checkout -r release_1_0 radiusd That's strange: the module rlm_expiration doesn't exist in this branch of the CVS. > However, it has not been compiling any longer for a couple of weeks now > and unfortunately, I didn't keep the sources at that time. There're only bugfixes in branch "release_1_0", and there's currently no known problems. Please detail your setup and post error messages. -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Using counters or Password-Retry attribute (RFC2869)
by Martin.Ward＠uk.neceur.com 03 Nov '05

03 Nov '05

Hi all, I am having another go at trying to implement a "maximum login attempts" using FreeRadius. >From what I can glean from the documentation and files I (currently) have two choices: 1. Use the Password-Retry attribute as per RFC2869. This attribute is used in Access-Reject packets (according to my O'Reilly book) and as I understand it is simply a number that is set in the Radius server which states how many times a user is allowed to attempt to login before they are locked out. The lock-out function is done by the FreeRadius client and clearly this client must understand and utilise the Password-Retry attribute for it to have any effect. I have no idea if my Radius client uses this attribute or not since I can't find a sensible place to store the attribute, at least I've tried it in various places and none of them work but this may simply be due to the fact that the client just ignores this attribute. 2. Use the counter module. While this might not be the way the modules was intended for use I have been thinking I could have it count the number of password failure attempts and when that value reaches a limit, say 3, the FreeRadius system rejects logins for that ID from then onwards. Investigating this option shows that I am missing a number of things: a. The counter should only be incremented when a password attempt fails. b. Ideally the counter should reset when the user logs in correctly, but it would be acceptable for the counter to be reset once a week or once a day or something like that. I know I can reset the counter at a given time ('reset' attribute of the counter module) but resetting it at a successful login would be best. So I guess I ma asking three questions. 1. Where should I put the Password-Retry attribute in the FreeRadius config files so that I can prove or disprove that the Radius client is using this attribute. 2a. How do I use the counter module to increment a counter only on Access-Reject? 2b. Can I reset the counter value on Access-Accept? Thanks fellows, |\/|artin -- Senior Network Consultant, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356 ***************************************************************** IMPORTANT: The information contained in this e-mail and attachment (if any) is intended for the person to whom it is addressed and may contain confidential and/or privileged information. The contents of this message may contain personal views which are not the views of NEC Europe Ltd or its subsidiaries, unless specifically stated. You should not copy, retain, forward or disclose its contents to anyone else, or take any action based upon it, if it is not addressed to you personally. If you have received this e-mail in error please contact the sender immediately. Any legally binding agreement resulting from its content must be made separately in a printed medium. *****************************************************************

1 0

expiration
by Serge Lhermitte 03 Nov '05

03 Nov '05

Hi, I am trying to get a working version of freeradius that includes the expiration module. I actually succeeded a while ago, getting the following CVS $ cvs -d :pserver:[EMAIL PROTECTED]:/source checkout -r release_1_0 radiusd However, it has not been compiling any longer for a couple of weeks now and unfortunately, I didn't keep the sources at that time. Thanks SL.

2 1

802.1x
by Alex M 02 Nov '05

02 Nov '05

What is the difference between plain Radius identification compare to 802.1x? What are additional functionality that 802.1x gives to radius? Thanks!

4 9

RE: 802.1x
by Seferovic Edvin 02 Nov '05

02 Nov '05

I hate quoting but "IEEE 802.1X is an IEEE standard for port-based network access control, part of the IEEE 802 (802.1) group of protocols. It provides authentication to devices attached to a LAN port, establishing a point-to-point connection or preventing access from that port if authentication fails. It is used for certain closed wireless access points, and is based on the EAP, Extensible Authentication Protocol (RFC 2284). RFC 2284 has been obsoleted by RFC 3748" Says it is a standard for port-based network access control, and as far as I know - is has nothing to do with PORTS on a user machine. by "port-based" it is not meant the port on a user machine, but the ports on an access hardware like a switch. I hope I could help you out of dilemma ! Regards, Edvin -----Original Message----- From: Alex M [mailto:alexm@lrcommunications.net] Sent: Mittwoch, 02. November 2005 23:07 To: edvin.seferovic(a)kolp.at; 'FreeRadius users mailing list' Subject: RE: 802.1x Wikipedia well, can it show me how to block ports like port 88 on user side? Yea I should learn how to use goggle he he.... -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Wednesday, November 02, 2005 4:42 PM To: 'FreeRadius users mailing list' Subject: RE: 802.1x Maybe you should learn how to do a research with google ;) or just use an encyclopedia... http://en.wikipedia.org/wiki/802.1x have fun ! Regards, Edvin -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alex M Sent: Mittwoch, 02. November 2005 22:34 To: 'FreeRadius users mailing list' Subject: RE: 802.1x That what I started with... but it returns me all very very expansive enterprise equipment, and other junk... well I maybe I'm using wrong keyword but goggle doesn't give me anything I'm looking for -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Oliver Graf Sent: Wednesday, November 02, 2005 4:14 PM To: freeradius-users(a)lists.freeradius.org Subject: Re: 802.1x On Wed, Nov 02, 2005 at 11:10:20AM -0500, Alex M wrote: > Now im totally lost... > Can u give me an example what 802.1x does? Can u use google? Oliver. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: 802.1x
by Jeff Reilly 02 Nov '05

02 Nov '05

2 1

RE: 802.1x
by Jeff Reilly 02 Nov '05

02 Nov '05

2 1

SV: rlm_sql module won't compile under Solaris 10
by Torkel Mathisen 02 Nov '05

02 Nov '05

Hi Add /usr/ccs/bin to your PATH. Regards, Torkel -----Opprinnelig melding----- Fra: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] På vegne av M.McNeil Sendt: 28. oktober 2005 22:55 Til: freeradius-users(a)lists.freeradius.org Emne: rlm_sql module won't compile under Solaris 10 Viktighet: Høy Hello, I'm trying to get FreeRadius 1.0.5 to compile with MySQL / RLM_SQL, under Solaris 10. Configure works just fine, however, after running "make", I get the following: gmake[7]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' Making static in drivers... gmake[8]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' /usr/sfw/bin/gmake -w WHAT_TO_MAKE=static common gmake[9]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' Making static in rlm_sql_iodbc... gmake[10]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_iodbc' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making static in rlm_sql_mysql... gmake[10]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -xc99=none -c sql_mysql.c -o sql_mysql.o gcc: language c99=none not recognized gcc: sql_mysql.c: linker input file unused because linking not done /export/home/freeradius-1.0.5/libtool --mode=link ld -module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -xc99=none sql_mysql.o -o rlm_sql_mysql.a mkdir .libs (cd . && ln -s sql_mysql.lo sql_mysql.o) ar cru rlm_sql_mysql.a sql_mysql.o ar: cannot open sql_mysql.o No such file or directory ar: sql_mysql.o not found gmake[10]: *** [rlm_sql_mysql.a] Error 1 gmake[10]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' gmake[8]: *** [static] Error 2 gmake[8]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' gmake[6]: *** [static] Error 2 gmake[6]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/export/home/freeradius-1.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/export/home/freeradius-1.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/export/home/freeradius-1.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/freeradius-1.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/export/home/freeradius-1.0.5' *** Error code 2 The following command caused the error: /usr/sfw/bin/gmake WHAT_TO_MAKE=all common make: Fatal error: Command failed for target `all' I dowloaded the binary MySQL package from mysql.com and added /usr/local/mysql to my PATH and LD_LIBRARY_PATH variables. FreeRadius can see the files, however, it will *not* compile the rlm_sql module. I've combed the mailing list archive, but I have yet to find a solution to this problem. Has anyone else experienced this issue ? Best Regards, Mike McNeil Sr. Network Engineer Communications & Network Services University of California Berkeley - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

RE: 802.1x
by Guy Davies 02 Nov '05

02 Nov '05

Which Vendor Specific Attributes are implemented by a Vendor are, as the name suggests, specific to the vendor and totally up to them to choose. I would not be surprised if DLink implement *NO* VSAs. Given the market into which they're pitching their kit, I doubt very much that their kit will do bandwidth control. Authenticating access to the port is the basic function of 802.1x so if DLink claim 802.1x support, then you can configure your NAS so that you don't get any access without authenticating first. Rgds, Guy ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alex M Sent: 02 November 2005 17:04 To: 'FreeRadius users mailing list' Subject: RE: 802.1x Ok I got it... By the way what is AV pair? And how do you get NAS related attributes to control bandwidth from vendors? Like if im using D-Link how could I get attributes from them? Thanks! ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeff Reilly Sent: Wednesday, November 02, 2005 11:53 AM To: FreeRadius users mailing list Subject: RE: 802.1x Alex, Features such as 'bandwidth and port blocking" (if any) are allocated/configured on the _NAS_ (in this case a NAS port) via AV pair/s provided by RADIUS... the '802.1x Supplicant" (Client/Endpoint) in simple terms... provides a secure/standard conduit which facilitates the communication of credentials (from the Supplicant to the Authenticator). The '802.1x Authenticator" (or NAS) _MAY_ provision/enforce Authorization for the specific endpoint in the context of a user or group... The management & granularity of this functionality verifies greatly by switch vendor as a result providing this functionality across a multi-vendor environment... in a large scale deployment... is often too complex to seriously consider.<? jmr -------- Original Message -------- Subject: RE: 802.1x From: "Alex M" <alexm(a)lrcommunications.net> Date: Wed, November 02, 2005 9:10 am To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Now im totally lost... Can u give me an example what 802.1x does? -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, November 02, 2005 11:04 AM To: FreeRadius users mailing list Subject: Re: 802.1x "Alex M" <alexm(a)lrcommunications.net> wrote: > So then such features as bandwidth and port blocking could be controlled via > 802.1x? No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

Patches
by kdr akm 02 Nov '05

02 Nov '05

Hi i need to ask is there any patch for PPPD to send this MAC adress to RADIUS ??? and what about rp-pppoe is there any patch let pppoe server is probrably rp-pppoe to send Mac address to pppd ? --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0