June 2005 - Freeradius-Users - lists.freeradius.org

How long is the nas-table cached by freeradius?
by Evert Meulie 03 Jun '05

03 Jun '05

Hi all! Just wondering about the following: If a change is made in the nas-table of the radius-db, how long does it take for the freeradius daemon to start using this updated info? Or is the nas-table only read at freeradius (re)start? Regards, Evert

2 1

Configuring maximum number of password attempts
by Martin.Ward＠uk.neceur.com 03 Jun '05

03 Jun '05

Hi all, I am using freeradius to talk to an OpenLDAP server to validate passwords. This all works fine and dandy. If the user enters the right password they get in, if they enter the wrong password the don't. However, I can't find a way of locking out the user if they enter an invalid password three times in a row. I've trolled through the LDAP stuff but can't find anything in there. Is there a way I can create a password policy to do this? |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356

4 3

RE: shared secret problem
by Kris 03 Jun '05

03 Jun '05

Novell/SuSE development has an updated package in testing that fixed my problem. I would assume it will be available shortly. While I do not have a continuing support package with them yet, they took care of this problem promptly. Consider me one satisfied user. --Kris -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Tuesday, May 24, 2005 11:46 AM To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem Hi, you welcome ;) If you contact Novell/SuSE and get an answer about this topic ( or maybe a solution ) I would be thankful if you could mail it to this mailing list. I intend to move on SLES shortly, and now when I know the fact that freeRadius is not working ( on x86_64 ) whis move could be delayed. Regards, Edvin Seferovic -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Kris Sent: Dienstag, 24. Mai 2005 18:24 To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem Thanks so much for the information and quick response. I'll attempt to contact Novell/SuSE. I tried the procedure below without much success over the last week or two. -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Tuesday, May 24, 2005 11:17 AM To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem BINGO... there u go ;) I was using SuSE PRO 9.1 on x86_64 WHICH WAS BROKEN !! SuSE changed this in the next version 9.2. Aparently SLES 9 has the same problem. You could try contacting Novell/SuSe about this ;) Here is a part of a friendly person from this list which encountered the same problem, and solved it : --- cut --- Since, I also got the SuSE 9.2 RPM working on SuSE 9.1 I will include the more detailed instructions below: Well I just got mine working on SuSE 9.1 64 bit. It was one heck of a hack, and probably not done in the correct way, but this is what I did: 1. I grabbed the 9.2 source rpm: freeradius-1.0.0-5.4.src.rpm 2. I ran rpm build --rebuild freeradius-1.0.0-5.4.src.rpm to learn dependencies. I installed the dependencies I could off of the 9.1 distribution. From the 9.2 distribution I installed: libnscd-1.0-2.x86_64.rpm and libzio-0.1-4-0.1-4.x86_64.rpm. 3. I thought I had other issues so I also installed libtool-1.5.8-3.x86_64.rpm and libtool-32bit-9.2-200410061204.x86_64.rpm but they are probably not required from 9.2. 4. I installed the source rpm. 5. I went into /usr/src/packages/SOURCES and bunzipped freeradius-1.0.0.0.tar.bz2 6. I cd'ed into the freeradius-1.0.0.0 directory and in Make.inc I modified the variable LIBLTDL to: LIBLTDL = /usr/lib64/libltdl.so 7. I re-bzipped the directory so the change was stored in the bzipped file. 8. I cd'ed into the /usr/src/packages/SPEC/ directory and ran: rpmbuild -bb freeradius.spec 9. I cd'ed into /usr/src/packages/RPMS/x86_64 and installed the 2 created packages: freeradius-1.0.0-5.4.x86_64.rpm freeradius-devel-1.0.0-5.4.x86_64.rpm 10. eap was still broken so I cd'ed into /usr/src/packages/BUILD/ freeradius-1.0.0/src/modules/rlm_eap/.libs/ 11. I copied rlm_eap-1.0.0.soU to /usr/lib/freeradius 12. I cd'ed into /usr/lib/freeradius and did a ln -s rlm_eap-1.0.0.soU rlm_eap.so --- cut --- Maybe you could just take the RPM package from another SuSE distro and try it. I hope this could help. BTW - I spent over 2 weeks looking for this crapy error. Regards, Edvin Seferovic -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Kris Sent: Dienstag, 24. Mai 2005 17:59 To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem So sorry, I'm using SLES 9 for x86_64 --Kris -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Tuesday, May 24, 2005 10:50 AM To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem Hi, can you tell us what operating system are you using? I had recently problems with SuSE 9.1 where some packages were broken and therefore the shared secret auth wasn't functioning. Regards, Edvin Seferovic -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Kris Sent: Dienstag, 24. Mai 2005 17:38 To: freeradius-users(a)lists.freeradius.org Subject: shared secret problem If I'm getting a incorrect checksum error on the UDP packet sent from the client to the server, would that be the cause of my "Shared secret is incorrect" error? I've removed/readded the secret on both sides many times... If that is the case, I'm assuming the problem is with the md5 hash on the server and not anything with Freeradius. Is that correct? Thanks, Kris - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Authenticate to eDirectory
by carnold5＠nc.rr.com 03 Jun '05

03 Jun '05

>>One possible reason could be that the user you are building the >>radius >>server as does not have the appropriate file system permissions to >>create >>files within the /usr/local directory. I should have stated that i am logged in and running this as root. >>You can also get the FreeRADIUS RPMs for SLES 8 or SLES 9 from: http://forge.novell.com/modules/xfcontent/downloads.php/edirfreeradius So, i downloaded the rpm (and consoleone plug-in (thanks for the link)) and tried to install it using yast. Of course, when yast checks the dependencies, it says that libk5xx.so, libmysql.so and lib5kcrypto are missing. So, i searched (in yast>software>install and remove software) for the said lib's/files, none found. Huh?? So, i thought maybe i could install the freeradius 0.9.3 version and then "upgrade" to the new version 1.0.5 (i think). So as it stands now, i can not install the 1.0.5 version on SLES9/OES-Linux using edirectory. What am i missing. Thanks for all the help!

1 0

PEAP with Freeradius 1.02 on Linux
by Stephen Donovan 03 Jun '05

03 Jun '05

Hello All I have spent the morning looking for a solution to this problem, but I have been unable to find a solution. I am trying to use both PEAP and TTLS to authenticate a mobile device through an Access Point to my radius server. Using TTLS everything works fine, however I can not get it to work using PEAP. I am using Windows 2000 with Funk's Odyssey Client as my supplicant. I am not using certificates on the mobile and I have placed the user information in the users file. I am seeing similar behaviour with PEAP using Windows XP and the built in supplicant. Thanks Stephen Donovan I have attached the debug logs from starting Freeradius with radiusd -X -A. If any one could suggest anything it would be greatly appreciated.

3 3

Re: Authenticate to eDirectory
by Sayantan Bhowmick 03 Jun '05

03 Jun '05

Hi, This will work with eDirectory 8.7.1 onwards with eDirectory running on any eDirectory supported platform. -Sayantan >>> dhesse(a)mmrcsl.org 06/02/05 7:16 PM >>> Does this only work with versions of eDirectory running on Linux or will it work with eDirectory on Netware 6.5 Daniel D. Hesse Technology Administrator Methodist Manor Retirement Community 712-732-1120 Ext.116 dhesse(a)mmrcsl.org >>> sbhowmick(a)novell.com 6/2/2005 12:05 AM >>> Hi, FreeRADIUS 1.0.2 has been integrated with eDirectory to support wireless authentication. See (http://www.novell.com/documentation/edir_radius/index.html) You can also use FreeRADIUS 0.9.3. That supports LDAP authentication to eDirectory. In this case you could try EAP-TTLS + PAP. http://lists.cistron.nl/pipermail/freeradius-users/2005-March/042093.html Hope this helps. Regards, -Sayantan >>>carnold5(a)nc.rr.com 06/01/05 12:35 pm >>> Hello all! I would like to know if anyone has gotten freeradius to work with eDirectory (LDAP)? We are using freeradius 0.93 (ships with sles9) and want our wireless users to authenticate to the eDirectory box. I changed the radiusd.config file at the ldap entry. Clients file has not been touched. It seems that i may need to "extend the schema" on the eDirectory box. Then include the supplied radiusxx.schema file in the slapd.conf file. Any help will be appreciated. Chris - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Authenticate to eDirectory
by Sayantan Bhowmick 02 Jun '05

02 Jun '05

Hi, One possible reason could be that the user you are building the radius server as does not have the appropriate file system permissions to create files within the /usr/local directory. Try running make install as root user. You can also get the FreeRADIUS RPMs for SLES 8 or SLES 9 from: http://forge.novell.com/modules/xfcontent/downloads.php/edirfreeradius Get back to me in case you have any further queries. -Sayantan >>> carnold5(a)nc.rr.com 06/03/05 7:32 AM >>> Thanks for the replies. >>This is also noted on the main web page: http://www.freeradius.org Sorry about that, it seems i overlooked that :) >>See 1.0.2, which includes eDirectory integration. OK, so i uninstalled the 0.9.3 version and i downloaded the tarball and followed the instructions to compile and install v1.0.2. When i ran ./configure, i ran it with the --with-edir option. This process ran for awhile; i did see some warnings during this step but the process did not stop. Then i ran make, no options; i did see some warnings during this step but the process did not stop. Now, during the make install step i did see some warning and errors but again, the process did not stop. When it did complete, i see "error:radiusd not found". Indeed, when i do a search for raddb, i see a folder in usr/local/raddb. The weird thing is, there are 0 files in this folder. When i search for radiusd.conf, no file found. When i go to the shell prompt and type radiusd, command not found. Anybody got any ideas? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Proxy EAP-TTLS inner auth type
by Sayantan Bhowmick 02 Jun '05

02 Jun '05

Thanks for your help Alan. I will try this setup. -Sayantan >>> aland(a)ox.org 06/02/05 11:12 PM >>> "Sayantan Bhowmick" <sbhowmick(a)novell.com> wrote: > This talks about PEAP. Is the same possible for EAP-TTLS? Yes. > Also i could not find any information about the attribute > "proxy_tunnel_request_as_eap" mentioned in the previous mail. > Can someone please point me to any documentation on how to > configure the server to terminate the tunnel and proxy the > inner auth type. The server terminates the tunnel by default. To proxy the inner session, do: DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := "foo" Which will proxy the inner session, as-is, to realm "foo". The "proxy_tunnel_request_as_eap" is strictly for PEAP, and if set to "no", the code converts EAP-MSCHAPv2 to plain old MSCHAPv2, before proxying it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Authenticate to eDirectory
by carnold5＠nc.rr.com 02 Jun '05

02 Jun '05

Thanks for the replies. >>This is also noted on the main web page: http://www.freeradius.org Sorry about that, it seems i overlooked that :) >>See 1.0.2, which includes eDirectory integration. OK, so i uninstalled the 0.9.3 version and i downloaded the tarball and followed the instructions to compile and install v1.0.2. When i ran ./configure, i ran it with the --with-edir option. This process ran for awhile; i did see some warnings during this step but the process did not stop. Then i ran make, no options; i did see some warnings during this step but the process did not stop. Now, during the make install step i did see some warning and errors but again, the process did not stop. When it did complete, i see "error:radiusd not found". Indeed, when i do a search for raddb, i see a folder in usr/local/raddb. The weird thing is, there are 0 files in this folder. When i search for radiusd.conf, no file found. When i go to the shell prompt and type radiusd, command not found. Anybody got any ideas?

1 0

(no subject)
by Rupak 02 Jun '05

02 Jun '05

Hello ALL I am interested in installing dialup admin.I am currently running freeradius-1.0.2 with mysql that ships with redhat9.and chillispot for wireless authentication.i wanted to know where can I find good configuration resources that would help me install dialup-admin. I checked the how to's under /dialupadmin/docs/*.But did'nt find it friendly.It was specifying to create a data base named "radius".But I have already created a database named "radius" when I installed radius with mysql support.Now I don't wanna proceed until I am confident. So please help me with some resources. Thanking You Rupak

1 0