December 2005 - Freeradius-Users - lists.freeradius.org

RE:Configuring freeRADIUS and NAS
by Sean 07 Dec '05

07 Dec '05

Hi, I use Linksys WRT54G Routers and I suggest that you check out DD-WRT firmware. It includes Chillispot and is easy to setup. I've posted a tutorial here http://swarmhotspots.com/faq.html BTW the new WRT54G (Release 5 Firmware) uses VxWorks and not Linux anyone needing to use third party firmware like DD-WRT should buy WRT54GL instead. I hope this helps. Regards, Sean Bracken

1 0

radius server reply
by Dinil Divakaran 07 Dec '05

07 Dec '05

Greetings !! I am using freeradius 1.0.4 server. I am trying to achieve the following. The radius client is supposed to send username, password and a text (say, abc). The server is supposed to authenticate using the system /etc/passwd and shadow (which it does currently). Apart from this the server should take the text and find another matching text (abc -> xyz). If such a matching entry exists, the radius server should send the matching text (xyz, here) along with the Access packet, or else it should send Access Reject packet. This can be achieved if we are able to define new attributes (like `Framed-IP-Address'), in which case we can add an entry Check-Item="abc", Reply-Item="xyz" for a user in the users file. But, unfortunately there are no user-defined attributes that are permitted ! Is there any other way to get this done ? Thanks in advance. - Dinil

2 2

Configuring freeRADIUS and NAS
by Madhuraka Godahewa 07 Dec '05

07 Dec '05

Hi All, First of all, let me thank for all those, who helped me to configure the freeRADIUS server. I have installed freeRADIUS 1.0.5 recently and configured it. I tested the server using RADIUS Test Client utility from IEA Software and it works well (both for authentication and accounting). Then, I configured a LinkSys WRT54G as a NAS and I configure it to make use of the freeRADIUS server to authenticate users. Now I can connect to the network using an XP Supplicant through the LinkSys WRT54G after authenticating through the RADIUS server (using PEAP). Now, I have a problem with the Session-Timeout attribute. With the Access- Accept packet, I send the Session-Timeout and Terminate-Action attributes to the NAS, but the NAS does not terminate the session as specified in the Session- Terminate parameter. And the NAS does not send any Account-Start or Account- Stop packets to the RADIUS server. Is this a problem with the configuration of the NAS or is it a limitation of the NAS? Have any body tried using LinkSys WRT54G as the NAS to do RADIUS accounting? I use the orginal firmware, which comes with the WRT54G. Thanking You., -------------------------------------------------------------------------------- Madhuraka Godahewa Telecommunications Engineer Research and Development Unit Electroteks Global Networks (Pvt.) Ltd. Mobile: + 94-777-647055

2 1

OS Update broke FR - rlm_exec-1.0.0.so not found
by Landon Cox 06 Dec '05

06 Dec '05

Hi FR community, I've been running FR on an updated (recently fully patched apps) SuSE 9.2 (kernel 2.6.8-24-default) I was successfully running an earlier version of FR and when I decided to do an update of FR through SuSE's online update, FR will no longer come up and fails with a dynamic link error: radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': /usr/lib/ freeradius/rlm_exec-1.0.0.so: cannot open shared object file: No such file or directory radius2:/home/lcox # ls /usr/lib/freeradius/rlm_exec-1* /usr/lib/freeradius/rlm_exec-1.0.0.la /usr/lib/freeradius/ rlm_exec-1.0.0.so As you can see, my /usr/lib/freeradius directory does have the .so file, but I can't tell from the output if rlm_exec is dependent upon some other file that is not found or the dynamic linker can't find rlm_exec-1.0.0.so. So, that's one question - what is not being found? Sounds obvious, except that I have the exact .so filename in the library search path. SuSE Yast claims it has installed FR 1.0.0-5.6. A radiusd -v produces: radiusd: FreeRADIUS Version 1.0.0, for host , built on May 30 2005 at 21:02:41 Copyright (C) 2000-2003 The FreeRADIUS server project. I've seen numerous references to this exact linkage error on various freeradius lists as well as have seen it on lists for various architectures and *nix's, not just x86/SuSE Linux. However, there is typically no response given to fix the problem except to rebuild FR with no shared libraries and even in those cases, the build often seems to break later leaving the admin stuck further down the line. Is there a known solution to what seems like a relatively common problem of rlm_exec dynamic linkage issues? What am I missing and what needs to be done to cause this to work with the shared .so lib file vs having to rebuild it with static libs? Thanks in advance for any help or direction. Landon (Full text of -X output follows) radius2:/home/lcox # /usr/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': /usr/lib/ freeradius/rlm_exec-1.0.0.so: cannot open shared object file: No such file or directory radius2:/home/lcox # ls /usr/lib/freeradius/rlm_exec-1* /usr/lib/freeradius/rlm_exec-1.0.0.la /usr/lib/freeradius/ rlm_exec-1.0.0.so

2 1

Re: IPv6 Support
by Paulo Alexandre Caceres Ferreira 06 Dec '05

06 Dec '05

> > > I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 > > Freeradius functioning. > > Why? Because I didn't arrange a machine for test it yet :) > > > Did the communications between NAS and Freeradius, in IPv6 only > networks, > > are made only with IPv6 packets (Access request packets, etc.)? > > Uh... you're asking if non-IPv6 packets are sent in an IPv6-only > network. > > That makes *no* sense. No, I wanted an IPv6 only, but I wasn't sure if Freeradius was communicating with NAS in IPv6 only packets, or if it was encapsulating IPv6 attributes (RFC 3162) over IPv4 packets. > > > Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated in > > IPv4 packets? > > Read the RFC's. The data in a RADIUS packet is completely > independent of the IPv4 or IPv6 transport. I already red the RFC 3162, and I think that was the idea, but I asked to the list this questions to had sure. Good, that means that it works with packets in both network protocols, depending of NAS support. > > Alan DeKok. > Thanks for the help, and I will try that when I will have opportunity. Regards, Paulo Ferreira

1 0

RE: RADIUS Auth-Type
by Bohannan, Chad W 06 Dec '05

06 Dec '05

Yes, Phil suggested that earlier. Looking into it now..thanks -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok "Bohannan, Chad W" <Chad_Bohannan(a)reyrey.com> wrote: > .....so is there not a way to have FR proxy request out to the AD > server? AD doesn't do RADIUS, so FreeRADIUS can't proxy requests to it. Terminology matters. If you want to authenticate PAP from FreeRADIUS to AD, use the LDAP module in the "authenticate" section. it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: IPv6 Support
by Paulo Alexandre Caceres Ferreira 06 Dec '05

06 Dec '05

Hi, it's me again with IPv6 questions :) I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 Freeradius functioning. My questions are: Did the communications between NAS and Freeradius, in IPv6 only networks, are made only with IPv6 packets (Access request packets, etc.)? Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated in IPv4 packets? Hi have these doubts, if anyone could help me, I thaks. Thanks in advance, Paulo Ferreira > -----Mensagem original----- > De: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] Em nome de Nicolas Baradakis > Enviada: sexta-feira, 2 de Dezembro de 2005 12:03 > Para: FreeRadius users mailing list > Assunto: Re: IPv6 Support > > Paulo Alexandre Caceres Ferreira wrote: > > > How I can test IPv6 Freeradius authentication? > > You know any IPv6 RADIUS client to interact with Freeradius and perform > an > > IPv6 authentication? > > There is a program called "radclient" in the FreeRADIUS source tree. > > -- > Nicolas Baradakis

2 1

RE: RADIUS Auth-Type
by Bohannan, Chad W 06 Dec '05

06 Dec '05

>>You cannot set the Auth-Type to "MS-CHAP" and have it work unless the >>MS-CHAP challenge and response are in the radius request, which means >>the NAS has to add them. - .....so is there not a way to have FR proxy request out to the AD server?

4 3

RE: XP auth + PEAP
by King, Michael 06 Dec '05

06 Dec '05

Several clients ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of debik Sent: Monday, December 05, 2005 6:30 PM To: FreeRadius users mailing list Subject: XP auth + PEAP Have enybody connect the client running Windows XP SP2 to the radius server with peap auth ???

5 11

Freeradius wont retry to connect SQL
by Fernando Brito 06 Dec '05

06 Dec '05

Hello. I'm using freeradius 1.0.5. I have 3 radiusd running on the same machine (a radiusd connects to mysql, the other two, connects to SQL using unixODBC 2.2.4-11 and freetds 0.61-6.2). Everything works fine until I stop the SQL server. The radiusd won't try to re-connect to SQL and I get the following error on my radiusd log file: Mon Dec 5 19:36:21 2005 : Error: rlm_sql_unixodbc: '00000 ' Mon Dec 5 19:36:21 2005 : Error: rlm_sql_getvpdata: database query error Mon Dec 5 19:36:21 2005 : Error: rlm_sql (mssql): SQL query error; rejecting user Mon Dec 5 19:36:24 2005 : Error: Discarding duplicate request from client MikroTik:1169 - ID: 178 due to unfinished request 164 Any idea?. Thanks in advance.

1 0