June 2005 - Freeradius-Users - lists.freeradius.org

Question about reauthentication
by Ignacio Siles 08 Jun '05

08 Jun '05

Hi all, I have a problem with reauthenticacion, because my AP doesn't have the option to set "reauthenticacion interval". Is there any possibility that freeradius "force" reauthenticacion? My system is as follows: - Gemtek P-560 as AP. - Freeradius 1.0.1 in a Red Hat Enterprise 3. - Windows XP SP2 EAP/PEAP clients. Thanks in advance, Ignacio.

3 3

Couldn't load plugin radius.so
by Marios Maravelias 08 Jun '05

08 Jun '05

I cannot connect to the VPN and the error i get in the logs is : pptpd[14191]: CTRL: Client 213.16.179.235 control connection started Jun 8 13:30:51 linux7 pptpd[14191]: CTRL: Starting call (launching pppd, opening GRE) Jun 8 13:30:51 linux7 pppd[14192]: /usr/lib/pppd/2.4.3/radius.so: undefined symbol: chap_auth_hook Jun 8 13:30:51 linux7 pppd[14192]: Couldn't load plugin radius.so Jun 8 13:30:51 linux7 pptpd[14191]: GRE: read(fd=4,buffer=804e6e0,len=8196) from PTY failed: status = -1 error = Input/output error, usually caused by unexpected termination of pppd, check option syntax and pppd logs Jun 8 13:30:51 linux7 pptpd[14191]: CTRL: PTY read or GRE write failed (pty,gre)=(4,5) Jun 8 13:30:51 linux7 kernel: application bug: pptpctrl(14191) has SIGCHLD set to SIG_IGN but calls wait(). Jun 8 13:30:51 linux7 kernel: (see the NOTES section of 'man 2 wait'). Workaround activated. Jun 8 13:30:51 linux7 pptpd[14191]: CTRL: Client 213.16.179.235 control connection finished Why is that ? Couldn't load plugin radius.so ????? -- *Marios Maravelias Web Server Administrator - Support *TopHost - Usable Web Company - Hosting Services* *+ 46 Karaiskaki Str. - Crete - Nea Alikarnassos GR 71601* *( Tel: +30 2810 229 000 , Fax: +30 2810 229 010* ** M.Maravelias(a)tophost.gr <mailto:M.Maravelias@TopHost.gr> web: http://www.tophost.gr/ <http://www.tophost.gr> ------------------------------------------------------------------------ **Disclaimer** This email may contain confidential and privileged material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient please contact the sender and delete all copies.

5 5

RE: Copyright and GPL infringement in tinyPEAP
by Nico.Baggus＠mail.ing.nl 08 Jun '05

08 Jun '05

Alan, are you aware of the site http://gpl-violations.org/ from Harald Welte? Kind Regards, Nico Baggus ----------------------------------------------------------------- ATTENTION: The information in this electronic mail message is private and confidential, and only intended for the addressee. Should you receive this message by mistake, you are hereby notified that any disclosure, reproduction, distribution or use of this message is strictly prohibited. Please inform the sender by reply transmission and delete the message without copying or opening it. Messages and attachments are scanned for all viruses known. If this message contains password-protected attachments, the files have NOT been scanned for viruses by the ING mail domain. Always scan attachments before opening them. -----------------------------------------------------------------

2 1

Error: Discarding new request from client!!!
by Andres 08 Jun '05

08 Jun '05

itprola FirmaI have FCI and freeradius-0.9.3-1.1 This is a problem in my log file!!! Wed Jun 8 09:55:08 2005 : Error: Discarding new request from client 10.10.0.10:1812 - ID: 239 due to live request 3056 Wed Jun 8 09:55:10 2005 : Error: Discarding new request from client 10.10.0.10:1812 - ID: 239 due to live request 3056 Wed Jun 8 09:55:12 2005 : Error: Discarding new request from client 10.10.0.10:1812 - ID: 239 due to live request 3056 Wed Jun 8 09:55:14 2005 : Error: Discarding new request from client 10.10.0.10:1812 - ID: 239 due to live request 3056 every minute or seconds is repeated to. What is the problem? Regards, Andrés de Barros Ingeniería en Data Canelones 2271 11200 Montevideo - Uruguay Tel: (598 2) 408 3506* http://www.itprola.com

1 0

RADIUS: IP-Pooling and connection management
by "Ferreira, André" 08 Jun '05

08 Jun '05

I understand that the radius keeps track of all open connections and their assigned IP addresses. If one of these connections closes, the radius can pass on an access-stop message to a CENTRAL CONTROLLER to indicate the end of this one connection. What about the case that the CENTRAL CONTROLLER realizes that another entity of the system is down. Does the CENTRAL CONTROLLER need to send an access-stop to the radius for each of the current open/active connections, or can it send one message to the radius? Will the radius send the required access-stop message to the other entities (IE:NAS) upon reception of this? Thanx. André Ferreira

1 0

Error: Trying to look up name of unknown client 127.0.0.1.
by kolargol＠kolargol.com 08 Jun '05

08 Jun '05

Hello, I'am keep getting �hose errors in logs: Wed Jun 8 10:15:50 2005 : Error: Trying to look up name of unknown client 127.0.0.1. Wed Jun 8 10:15:50 2005 : Auth: Login OK: [autocom/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 0) Wed Jun 8 10:15:50 2005 : Auth: Login OK: [autocom/<no User-Password attribute>] (from client CMTS-KROW-DOCSIS port 0 cli 000ce5475611) and in RADACCT: Packet-Type = Access-Request Wed Jun 8 08:20:52 2005 EAP-Message = 0x0205000c016175746f636f6d FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "autocom" NAS-IP-Address = 127.0.0.1 Client-IP-Address = 127.0.0.1 ...but i have DISABLED proxy and don't want to use it. How can i fix that? --i use PEAP auth configuration to authorize wireless networks gretz Zbigniew Zolkiewski

1 0

[Fwd: rlm_passwd & realms]
by Edgars 08 Jun '05

08 Jun '05

anyone, please? -------- Original Message -------- Subject: rlm_passwd & realms Date: Wed, 01 Jun 2005 16:34:56 +0300 From: Edgars <edzix19(a)inbox.lv> To: Freeradius List <freeradius-users(a)lists.freeradius.org> Hello, 1)can i make so that each separate proxy.conf realm uses different rlm_passwd file? At the moment it works in a simply way - using one passwd file. 2)Is it possible to separate Reply attributes from passwd file, i mean - passwd contains only username, but some other file (users(?)) is used for giving back reply attributes? Regards, Edgars

3 10

Redback dictionary patch
by Graeme Hinchliffe 08 Jun '05

08 Jun '05

Hiya 1st.. oops! my bad. When I added the Redback VSA's I put 2 of them down as being octet instead of integer.. sorry to anyone having headaches trying to get sensible values in rate limiting. Attached is the patch to fix this against the latest version of the file from CVS sorry again -- ----- Graeme Hinchliffe (BSc) Core Systems Designer Zen Internet (http://www.zen.co.uk/) Direct: 0845 058 9074 Main : 0845 058 9000 Fax : 0845 058 9005

1 0

Copyright and GPL infringement in tinyPEAP
by Alan DeKok 07 Jun '05

07 Jun '05

Your web site http:/www.tinypeap.com is distributing binaries built at least in part from code that is derived from the FreeRADIUS server project (http://www.freeradius.org) I refer you to the following URL's: http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=5649 This message contains text with error messages "rlm_eap_tls: SSL_read failed inside of TLS ". The "rlm_eap_tls" module is part of FreeRADIUS, and it is beyond reason to believe that you have independently chosen a name for an internal portion of the server that is identical to that used by FreeRADIUS. http://www.linksysinfo.org/modules.php?name=Forums&file=viewtopic&t=4533 This message contains text by you which claims that tinyPEAP is "closed source". http://www.tinypeap.com/bin/peapd-beta1.zip This URL points to a file which contains "peapd.exe". That file contains at least the following text strings, which are either identical to strings included with FreeRADIUS, or substantially similar: -- rlm_eap_tls: FATAL SSL error ..... %d rlm_eap_tls: %s failed inside of TLS (%d), TLS session fails. rlm_eap_tls: %s failed in a system call (%d), TLS session fails. handshake_send rlm_eap_tls: Application Data In SSL Connect mode In SSL Accept mode Before SSL Handshake Phase In SSL Handshake Phase SSL Connection Established SSL_read rlm_eap_tls: Requiring client certificate rlm_eap_tls: Error creating new SSL -- Once again, it is beyond reason that you have independently come up with an implementation that is identical to that chosen by FreeRADIUS. I will be investigating this matter further, and may contact you with additional details about this matter. Nothing under copyright law gives you permission to use our copyrighted code without our permission. The only license terms available for the code in question is the GNU GPL, which is distributed with the FreeRADIUS server source. The terms of that license require you to make the source code for derived works available under the same terms as the the original code. I refer you to section 2 (b): --- b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. --- To that end, we offer you one of the following two choices: 1) Remove any infringing binaries from your website, until such time as you remove the infringing code from your product. This removal may be done by re-writing the code in question. A simple edit of the text strings will not suffice, as our copyright applies to the binaries produced from the C source code, in addition to the text strings. 2) Release all relevant code under the terms of the GPL license, as required by the terms of the FreeRADIUS server license. We look forward to seeing your response in this matter. Alan DeKok. Project Leader, The FreeRADIUS Server Project

3 2

...traffic control with freeradius?
by alexander＠infomed.sld.cu 07 Jun '05

07 Jun '05

Hi Just a question: There any way to establish that a user (or group) connects at certain hours of the day only? For example: If Peter attempts to connect after 3:00 pm, the radius should reject the request; because Peter can connect only between 12:00 am and 3:00 pm. Thanks you. ------------------------------------------------- Este mensaje fue enviado usando el servicio de correo en web de Infomed http://webmail.sld.cu

2 1