January 2006 - Freeradius-Users - lists.freeradius.org

problem with EAP-TLS
by dark0s dark0s 30 Jan '06

30 Jan '06

Hi, I have to realize a RADIUS server with freeradius 1.0.5 and Cisco Aironet AP. The authentication method I must to use is EAP-TLS. I'm using the certificates created with openssl, for the authentication. When I have distributed the certificates to the server and the to client too, I proceed with authentication of the client. The software of PCMCIA card says the client is connected and associated, but access point says the authentication is failed. What could to be the reason of failure about the authentication? Regards, Saverio ___________________________________ Yahoo! Messenger with Voice: chiama da PC a telefono a tariffe esclusive http://it.messenger.yahoo.com

9 27

user guide
by Shain Lee 30 Jan '06

30 Jan '06

Hi , Where can i find proper / basic level to advance level user's guide for freeradius configurations ? Thank you, Shaine. --------------------------------- Yahoo! Messenger NEW - crystal clear PC to PC calling worldwide with voicemail

1 0

Radius problem
by Satrio Pradono 29 Jan '06

29 Jan '06

hello...im trying to build a radius server using free radius, and my access point is using linksys wrt54g, but something went wrong, so when i tried to connect with my laptop, the message was authentication failed, and in the server the error msg are rlm_eap_tls: Received unexpected tunneled data after successful handshake. rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select can somebody help me what went wrong? Best regards, Satrio Pradono --------------------------------- What are the most popular cars? Find out at Yahoo! Autos

1 0

Error: Assertion failed in request_list.c, line 1119
by masetio 29 Jan '06

29 Jan '06

I used FS freeradius-snapshot-20060119 in Debian Sarge, if FS running on daemon mode have error like : Wed Jan 25 00:51:34 2006 : Info: Ready to process requests. Wed Jan 25 02:05:16 2006 : Error: Assertion failed in request_list.c, line 1119 'n crash but if running in Debug mode (radiusd -X) work fine... plz i need help to solve that problem tnkz -- ~_|[]~

2 3

Windows PPTP and Cisco VPN Concentrator
by Stuart Berman 28 Jan '06

28 Jan '06

Looks like you need to assign an IP address range in the Cisco VPN concentrator "configuration" -> "system" -> "address management" -> "pools" section. (That assumes you are configured to assign IP addresses from address pools. You can also proxy DHCP, etc.)

1 0

Re: Re: rlm_sql_mysql search path Bug ?
by Jérémy Cluzel 28 Jan '06

28 Jan '06

>>Hello, >> >>I'm under FreeBSD 6.0 - Freeradius 1.0.5 >>I did an install from the port (/usr/ports/net/freeradius) with >>rlm_sql_mysql enabled. >>I set radiusd_enable="YES" in "rc.conf" >>But when I reboot, radius doesn't start and I got this in my >>"/var/log/radius.log": >> >>Sat Jan 28 00:39:55 2006 : Error: rlm_sql (sql): Could not link driver >>rlm_sql_mysql: Shared object "libmysqlclient.so.14" not found, required >>by "rlm_sql_mysql-1.0.5.so" >>Sat Jan 28 00:39:55 2006 : Error: rlm_sql (sql): Make sure it (and all >>its dependent libraries!) are in the search path of your system's ld. >>Sat Jan 28 00:39:55 2006 : Error: radiusd.conf[14]: sql: Module >>instantiation failed. >> >>Very curiously, if I did a "/usr/local/etc/rc.d/radiusd.sh start" then, >>everything goes fine... may I miss something to do ? >> >>Regards, >> >>Jeremy >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html >> >> >> >As I can see the problem is that you dont have shared-mysql and >client-libraries installed, try to install them and then run the radius. > > >------------------------------ > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >End of Freeradius-Users Digest, Vol 9, Issue 112 >************************************************ > > -> http://www.freeradius.org/faq/#4.14 Sorry Alan :-) Thanks for all. Jeremy Cluzel

1 0

Authenticating CHAP-Password to Pam (Kerberos 5 to AD)
by Patrick Bartkus 28 Jan '06

28 Jan '06

Please tell me someone has fixed this problem. I'm trying to authenticate an Ascend MAX dial-up server back to Windows Active Directory. I am using a local unix group for authorization. I have Pam set up on my system and it uses Kerberos 5 to authenticate to AD just fine. But I'm getting: auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_pam: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "pam" returns invalid for request 0 I did some checking and found this posting from 2003 basically saying it can't be done: http://www.mail-archive.com/freeradius-users@lists.cistron.nl/msg19439.html I do have other options other than the Windows Domain authentication, but I was not wanting to pursue them unless I had to. Has this been solved or am I SOL? Patrick

3 10

rlm_sql_mysql search path Bug ?
by Jérémy Cluzel 28 Jan '06

28 Jan '06

Hello, I'm under FreeBSD 6.0 - Freeradius 1.0.5 I did an install from the port (/usr/ports/net/freeradius) with rlm_sql_mysql enabled. I set radiusd_enable="YES" in "rc.conf" But when I reboot, radius doesn't start and I got this in my "/var/log/radius.log": Sat Jan 28 00:39:55 2006 : Error: rlm_sql (sql): Could not link driver rlm_sql_mysql: Shared object "libmysqlclient.so.14" not found, required by "rlm_sql_mysql-1.0.5.so" Sat Jan 28 00:39:55 2006 : Error: rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. Sat Jan 28 00:39:55 2006 : Error: radiusd.conf[14]: sql: Module instantiation failed. Very curiously, if I did a "/usr/local/etc/rc.d/radiusd.sh start" then, everything goes fine... may I miss something to do ? Regards, Jeremy

2 1

error if running daemon
by masetio 27 Jan '06

27 Jan '06

I used freeradius-snapshot-20060119 in Debian Sarge implemen sqlcounter module if running with daemon Freeradius crash with log : Thu Jan 26 09:32:46 2006 : Info: Ready to process requests. Thu Jan 26 10:02:58 2006 : Error: Assertion failed in request_list.c, line 1119 but if running with debug mode doesn't have any error. plz i need sugest tengkyu.... ~_|[]~ ------- .:Learning by Doing:.

3 3

Capturing the inner authentication ID for Radius accounting
by CHui 27 Jan '06

27 Jan '06

I have been looking for a way to maintain accurate wireless access and usage information for security auditing purposes. The problem I have is that wireless network users may choose to provide an alternative identity by providing an outer identity in the supplicant software. Although the user still need a legitimate user id/password to pass the EAP TTLS authentication. So far I could not find a "standard" way to track the user identity via Radius accounting records. I do manage to configure the FreeRadius to send the inner authentication user ID to the Cisco Aironet Access point (IOS 12.3(7)JA) using the Radius attribute "Class" (ID 25). For example, in my users file, the following is configured for guest access: DEFAULT Hint == "guest" Auth-Type = sql, Class = "%{User-Name}", Session-Timeout = 3600, Fall-Through = No The actual user id used in the EAP-TTLS authentication is passed to the Cisco Aironet AP via the Class attribute. I have observed that both the Radius "start" and "stop" records sent by the Cisco Aironet AP contained the Class attribute with the actual user's ID. The reason I chose the Class attribute is that it is the only attribute honored by the Aironet AP in Access-Accept message and also included in the radius accounting send by the Aironet AP according to the Cisco IOS Software Config Guide for Aironet APs. Although it seems to work for me, I am not sure about the use of attribute Class for tracking user ID would interfere with other operation (like the one attribute Class was originally designed for)? Also, the attribute Class is of type Octet. Does anyone know of a way to convert it to text in SQL? I would like to convert it to text before writing it into the mySQL database, preferably by way of the accounting_xx_query in the sql.conf file. Thanks Cedric

2 1