June 2005 - Freeradius-Users - lists.freeradius.org

help for using eap and TTLS
by Maurice.Bourguel 01 Jun '05

01 Jun '05

Hello all, I'm using freeradius-1.0.2 with AceesPoint Cisco ap1100; I'm using eap/ttls to authenticate users. I try to connect to with Xp clients or Mac osX clients; All go wrong. When using Mac OSX client and 802.1X setup ( authentification TTLS alone with PAP Authentication interne TTLS) Mac OSX client obtain the two certificates: authoritative and server. But it is not connecting. It loops on authentication process. Here is the trace from /usr/local/sbin/radiusd -X -A: Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 127 to 139.124.3.235:21661 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x37a760f21d2a0b8d0fdd492ccd5e7d17 Finished request 2 Going to the next request --- Walking the entire request list --- What means rlm_eap_tls: Requiring client certificate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 2 How should I fix this? Any help will be appreciated. I have configured freeradius and openssl using these articles: http://www.alphacore.net/spip/article.php3?id_article=45 http://www.alphacore.net/spip/article.php3?id_article=33 http://rbirri.9online.fr/howto/Freeradius_+_TTLS.html Regards, Maurice *********************************************************** * e-mail : bourguel(a)cirm.univ-mrs.fr * ---------------------------------------------------------- * Maurice Bourguel + * * CIRM - MENRT-CNRS-SMF + * * case 916, 163 Avenue de Luminy + tel (33) 04 91 83 30 23* * 13288 Marseille Cedex 9 + fax (33) 04 91 83 30 05* *********************************************************** *http://www.cirm.univ-mrs.fr * ***********************************************************

2 1

rlm_passwd & realms
by Edgars 01 Jun '05

01 Jun '05

Hello, 1)can i make so that each separate proxy.conf realm uses different rlm_passwd file? At the moment it works in a simply way - using one passwd file. 2)Is it possible to separate Reply attributes from passwd file, i mean - passwd contains only username, but some other file (users(?)) is used for giving back reply attributes? Regards, Edgars

1 0

RE: Freeradius+mysql+error
by Abdul Lateef 01 Jun '05

01 Jun '05

Hello, Check your sql configuration in sql.conf in the following area # Connect info server = "yousqlip" login = "user" password = "pws" Abdul Lateef Kapilvastu Lumbini __________________________________ Discover Yahoo! Find restaurants, movies, travel and more fun for the weekend. Check it out! http://discover.yahoo.com/weekend.html

3 2

Re: Freeradius-Users Digest, Vol 2, Issue 3
by markcapelle＠pcmc.com 01 Jun '05

01 Jun '05

>Hello all! I would like to know if anyone has gotten freeradius to work >with eDirectory (LDAP)? We are using freeradius 0.93 (ships with sles9) >and want our wireless users to authenticate to the eDirectory box. I >changed the radiusd.config file at the ldap entry. Clients file has not >been touched. It seems that i may need to "extend the schema" on the >eDirectory box. Then include the supplied radiusxx.schema file in the >slapd.conf file. Any help will be appreciated. >Chris I had this running in my environment for about 2 years. You don't need any schema changes(that I can recall) and you don't need to do anything with slapd. Just configure freeradius to look at your eDir as a LDAP store. Search the archive lists, there should be plenty of examples there. Mark Capelle CONFIDENTIALITY NOTICE: This e-mail may contain trade secrets or privileged, undisclosed or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying or distribution of this message in whole or in part is strictly prohibited. Please inform the sender immediately and destroy the original transmittal. Thank you for your cooperation.

1 0

How to? - use/configure winbind/ntlm_auth for Windows authentication
by Pete Flynt 01 Jun '05

01 Jun '05

Hello, I'm trying to set up a FreeRadius solution for a Windows2k AD environnment. The FreeRadius-server is already running right. I can authenticate a testuser with Auth-Type := EAP (username and password stored as cleartext in the users file) Now I want to use FreeRadius to check username/password from the Active Directory Server when a user logs onto the computer. I checked the list already. Some say to use ntlm_auth and winbind, others LDAP, then samba... but nobody is able to explain how to get it working. Is it really as complicated? ntlm_auth seems very simple, returnig 1 if user/pwd is alright and 0 when not. But how can I test this from the command line? Where do I specify the address of the AD-server? When running ntlm_auth -- usage there are too much parameters that are unknown to me. Thanks in advance for any help! Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 1

MySQL Authentication on Solaris
by Eva Kolega 01 Jun '05

01 Jun '05

Hello everybody. I have installed freeradius 1.0.1 on Solaris 9. However, it seems that I have a problem with MySQL Aythentication. As far as unix authentication is concearned everything seems to be working fine. I have installed MySQL 4.0.21 package, but radius complains about the modules used. I also ran ./configure with "with-mysql-include-dir=/usr/local/src/mysql-4.0.21/include" but nothing good happened. To be precise, there is no devel package for mysql 4.0.21, as this verison of mysql contains almost everything. Does anybody have a clue of how can I have MySQL authentication for RADIUS server on Solaris 9? Thanks in advance, Eva Kolega Network Operations Centre, Techonological Educational Institute of Athens

1 0

Configuring PHP functions to allow Dialup_admin to access ORACLE DB
by Jamal Taweel 01 Jun '05

01 Jun '05

Hello All, I am seeking for a way to configure functions.php3 to allow the dialup_admin to connect ORACLE DB instead of MySQL DB. If any one have an idea regarding this, I will appreciate his/her response. Thanks, Jamal ************************************************************************************* The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ************************************************************************************* PALTEL E-Safety System scanned this email and found NO viruses, vandals or malicious content. ************************************************************************************* Should you need any information or clarifications regarding this system, please do not hesitate to contact our team at the IP Dep. <esafety(a)paltel.net>. *************************************************************************************

1 0

I did it MYsql+freeradius+chillispot
by Rupak 01 Jun '05

01 Jun '05

Thank you very much to all the participants for helping me to successfully installing the server.i have now created users in my sql and it is authenticating successfully.Now in the current scenerao I am only able to give prepaid facility to my users I mean that in the section "Simeltaneous-Use" I give the required seconds. Now I want to know what is the "attribute" for the postpaid scheme. I mean that I wont define any sort of time limitations.But I want my customer's surfing time to be appended in mysql.How can this be done?. And can the Max-All-Session value be given in minutes/hour's. Thank you Rupak Shrestha

2 1

Freeradius+mysql+error
by rupak＠sns.com.np 01 Jun '05

01 Jun '05

Hello everybody. I have configured free radius yo work with my sql.my sql server is also running.I have configured sql.conf and freeradius.conf to work with free radius.But when i start radius in debugging mode then i find the following errors.What can be the error. [root@chillispot mysql]# /usr/local/freeradius/sbin/radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius rlm_sql_mysql: Mysql error 'Access denied for user: 'root@localhost' (Using password: YES)' rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. and it does not authenticate any users.... Rupak

2 1

Certificate creation????
by Andreas Korber 01 Jun '05

01 Jun '05

Hi, What i am doing wrong? The creation of my certificates for EAP/TLS with CA.all or CA.certs always end with an message like this: ----- Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, YOUR name) []:Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:An optional company name []:Using configuration from /etc/ssl/openssl.cnf ./demoCA/serial: No such file or directory error while loading serial number 3164:error:02001002:system library:fopen:No such file or directory:bss_file.c:276:fopen('./demoCA/serial','r') 3164:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:278: Failed to do sign certificate radius:/usr/local/etc/raddb/certs # So i looked for the serial file. But it dosn´t exist. I think because of an earlier message: CA certificate filename (or enter to create) unknown option -next_serial usage: x509 args -inform arg - input format - default PEM (one of DER, NET or PEM) -outform arg - output format - default PEM (one of DER, NET or PEM) -keyform arg - private key format - default PEM -CAform arg - CA format - default PEM -CAkeyform arg - CA key format - default PEM -in arg - input file - default stdin -out arg - output file - default stdout -passin arg - private key password source -serial - print serial number value -hash - print hash value -subject - print subject DN -issuer - print issuer DN -email - print email address(es) -startdate - notBefore field -enddate - notAfter field -purpose - print out certificate purposes -dates - both Before and After dates -modulus - print the RSA key modulus -pubkey - output the public key -fingerprint - print the certificate fingerprint -alias - output certificate alias -noout - no certificate output -ocspid - print OCSP hash values for the subject name and public key -trustout - output a "trusted" certificate -clrtrust - clear all trusted purposes -clrreject - clear all rejected purposes -addtrust arg - trust certificate for a given purpose -addreject arg - reject certificate for a given purpose -setalias arg - set certificate alias -days arg - How long till expiry of a signed certificate - def 30 days -checkend arg - check whether the cert expires in the next arg seconds exit 1 if so, 0 if not -signkey arg - self sign cert with arg -x509toreq - output a certification request object -req - input is a certificate request, sign and output. -CA arg - set the CA certificate, must be PEM format. -CAkey arg - set the CA key, must be PEM format missing, it is assumed to be in the CA file. -CAcreateserial - create serial number file if it does not exist -CAserial arg - serial file -set_serial - serial number to use -text - print the certificate in text form -C - print out C code forms -md2/-md5/-sha1/-mdc2 - digest to use -extfile - configuration file with X509V3 extensions to add -extensions - section from config file with X509V3 extensions to add -clrext - delete extensions before signing and input certificate -nameopt arg - various certificate name options -engine e - use engine e, possibly a hardware device. -certopt arg - various certificate text options Can anyone help me plaese??

3 2