December 2005 - Freeradius-Users - lists.freeradius.org

Happy Christmas
by Sean 24 Dec '05

24 Dec '05

Wishing Alan DeKok and everyone involved with FreeRadius a very happy Christmas and thanks for all the work put into developing and supporting one of the best open source products available. Regards, Sean Bracken

1 0

Re: Any Good Documentation for newbies
by Sean 24 Dec '05

24 Dec '05

> Hello > As I am new to this free radius, could you please suggest me a good > documentation(free) available on the net. > Version I am using is Free RADIUS 1.0.5. > > > Regards > Manuj Hi, I've written a tutorial that you might find helpful. You'll find it here http://www.swarmhotspots.com/faq.html Let me know how you get on. Sean Bracken

2 2

FreeRadius-1.0.5 + MySQL + Dialup_admin
by jaylai (sent by Nabble.com) 24 Dec '05

24 Dec '05

Finally, I was successful to build radius server with combination of freeradius-1.0.5, apache2, mysql, dialup_admin, snmp n .......................... there are some little problem in freeradius-1.0.5 n need some time to study n debug. However, freeradius-1.0.5 provide best security and best performance compare to the previous version. Hope u all lucky -- Sent from the FreeRadius - User forum at Nabble.com: http://www.nabble.com/FreeRadius-1.0.5-%2B-MySQL-%2B-Dialup_admin-t801045.h…

1 0

problem compiling
by pelusa vali 24 Dec '05

24 Dec '05

hi everybody, well i downloaded last version of freeradius and want to use with openssl, so i tried to compile using: --with-experimental-modules --enable-ltdl-install but i get an error and is impossible to compile, i must delete these options. when i try to run server then i get this: rlm_eap:Failed to link EAP-TYPE/TLS:rlm_eap_tls.so: cannot open shared object: no such file or directory radiusd[9] my configurations point to openssl locations, so why i cann't compile and why this error?? ok, thanks for your time. _________________________________________________________________ Las mejores tiendas, los precios mas bajos, entregas en todo el mundo, YupiMSN Compras: http://latam.msn.com/compras/

2 1

MYSQL installation for interaction with freeradius
by Rafael Roldán 24 Dec '05

24 Dec '05

Hy all, I am testing freeradius 1.0.5 in a solaris 8 machine and it really satisfied me. Now I want to test freeradius with MYSQL. So first, I am going to install the MYSQL software. When I visit the download page (http://dev.mysql.com/downloads/mysql/5.0.html) I see there are three software package options (standard, max and debug). Also, reading the document "Freeradius and MYSQL" (http://www.frontios.com/freeradius.html) I read that I have to make sure to install the MYSQL development headers installed. Which of these MYSQL packages do you recommend me to interact with freeradius? Thank you very much, Rafa

2 1

Radius Configuration Helping
by Kai Geek 24 Dec '05

24 Dec '05

Hi; I setup freeradius on slackware. When i send ssh request to a router/switch in network i want radius to check on the identify control. How can I do this? I dont know raddb (radiusd.conf) configuration. Thank you, ------------------------------------------- Radius konfigurasyonunu yapmak için bir dokuman var mıdır? Saygilarimla, -- +-+-+- BEGIN PGP SIGNATURE -+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) ___ / __) Kai "Ozgur" Geek \__ \ PGP ID: B1B63B6E (___/lackware Network Engineer +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

2 1

RE: Cisco WLSE status?
by Alek Barsky 23 Dec '05

23 Dec '05

I am working with WLSE in my organization. The product has a lot of shortcomings. I do not think it is time well spent to create a workaround for Cisco LEAP authentication issue. I can recommend to use one of the Cisco AP ( I would assume that you are using them ) to be LEAP server for the WLSE instrumentation mode authentication. In this case you do not have to introduce another RADIUS server. Thanks, Alek. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeffrey C. Ollie Sent: Wednesday, December 21, 2005 12:34 AM To: FreeRadius users mailing list Subject: Cisco WLSE status? Ok, I know that the problems getting Cisco WLSE to authenticate properly with FreeRadius is a problem with the Cisco supplicant, but I'm wondering: 1) Has anyone opened up a ticket with Cisco trying to get them to fix the problem? If so, what is the status of the ticket? 2) Has anyone polished up a patch that will allow WLSE to authenticate agianst FreeRadius? It'd be nice to have a hack that could be enabled conditionally so it doesn't break other hosts but if I have to run a separate server on a different host or port that'd probably work until we can get Cisco to fix their problem. Jeff Ollie

2 1

use of pam and sql db simultaneously
by Markus Krause 23 Dec '05

23 Dec '05

hello list, i would like to authenticate users via pam and sql. part of my radiusd.conf (freeradius 1.0.5 on sles 9) is: +++++ part of radiusd.conf instantiate { } authorize { preprocess files sql shorttermaccount } authenticate { pam } preacct { preprocess acct_unique files } accounting { detail radutmp sql } ------- part of radiusd.conf if i have the following line in /etc/raddb/users: ++++++ users Auth-Type = PAM Fail-Through = Yes ------ users users known by pam get access-accept, but those in sql don't, the debug output says: ++++++ radiusd -XA Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32768, id=144, length=59 User-Name = "sqluser" User-Password = "XXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 3 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'sqluser' rlm_sql (sql): sql_set_user escaped user --> 'sqluser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'sqluser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'sqluser' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sqluser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sqluser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'sqluser' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'sqluser' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sqluser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sqluser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "shorttermaccount" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type PAM auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <sqluser>. Reason: User not known to the underlying authentication module modcall[authenticate]: module "pam" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Login incorrect: [sqluser] (from client localhost port 1) Delaying request 0 for 1 seconds Finished request 0 ----- radiusd -XA if i delete the line "DEFAULT Auth-Type = Pam" (and Fall-Through = Yes) the users in sql get an access-accept answer. what am i doing wrong here? do theses modules (rlm_pam and rlm_sql) exclude each other? how can i use them simultaneously i.e. in parallel? thanks in advance for any hints! and merry x-mas everyone! :-) regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Re: Windows WPA
by Stefan Adams 23 Dec '05

23 Dec '05

Phil, thanks for the information! "Finally you need an AD domain (not NT4) to do that." Are you saying I actually need a Microsoft Server? A Samba domain control won't suffice? Being that I have no (ZERO) Microsoft servers, are my chances of doing machine authentication nil? Stefan > Date: Thu, 22 Dec 2005 12:44:04 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Windows WPA > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <43AA9F94.5070108(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Stefan Adams wrote: > > Does anyone know how it's possible to log into a windows domain (no > > local account) from a Windows XP computer using WPA when the user has > > never logged in before (making cached credentials impossible)? > > > > I work at a high school. We have several mobile carts with laptop > > computers that do NOT have local accounts for each student. > > Therefore, each student is required to logon to the windows domain > > using wireless. This works fine using WEP. > > > > However, using WPA, with the automatically supply windows > > username/password/domain checkbox selected, a user that has never > > logged into that machine before is not able to log on. The Windows > > computer complains that the domain controller is not available. This, > > of course, is true because there are no 'up' network interfaces. > > > > But wouldn't it be logical for Windows to first supply the entered > > credentials to the access point for authorization to the WPA WLAN and > > then supply those same credentials to the domain controller? > > It would be logical. It does not do that. > > See the archives for "machine AND PEAP" - basically, you need to make > the machines authenticate themselves with their machine account first, > then those creds are used for the network login during profile download, > at which point windows will switch to the user creds. > > One point to note: apparently the inbuilt windows supplicant has to use > the *same method* for both the machine and user creds (e.g. both TLS or > both PEAP+MS-CHAP). > > Also note that in order to authenticate a machine (as opposed to user) > account, FreeRadius needs to be talking to an "ntlm_auth" which in turn > talks to a patched samba (the messages you find with the above search > should reference the location of the patch and/or the version from which > it's integrated). Finally you need an AD domain (not NT4) to do that. > > > > > Is that the way it works, is there some other way, or are people that > > have never logged on to these laptops before condemned to never logon > > at all given our new WPA infrastructure? > > No, you just have to work hard to fix microsoft's broken behaviour. As > always.

4 5

Re: [FREERADIUS] Re: patch for sqlcounter, please test!
by Damjan 23 Dec '05

23 Dec '05

> Hello. I'm also interested in this. > What Expire attribute? The attribute name is actually "Expiration". You set it in rad(group)check to something like Expiration == "24 Dec 2005 14:00:00", and if the user connects in 13:48, he'll get a 12 minutes of Session-Timeout. > Can't find any reference of that attribute in the dictionaries. It is in the dictionary, unfortunenatelly it's seems it's not documented anywhere. -- damjan | дамјан This is my jabber ID --> damjan(a)bagra.net.mk <-- not my mail address!!!

1 0