October 2006 - Freeradius-Users - lists.freeradius.org

EAP-TTLS success
by Rafiqul Ahsan 24 Oct '06

24 Oct '06

Hi all, I found the issue for below error "EAP-request timed out OR EAP-response to an unknown EAP-request" --- NAS was not responding with the state attribute received from radius server. As soon as we fixed this at NAS, it went through all the steps required to authenticate an user using TTLS-MSCHAPV2. My plaform was Solaris 10, with freeradius version 1.1.3 Thanks all for your valuable input. Rafi

1 0

RE: freeradius+hpidm+cisco
by Jonathan De Graeve 24 Oct '06

24 Oct '06

> All, > We have an hp infrastructure and use identity driven management to enforce > some additional rights to users(as forcing vlan assignment). > We have a mixed wireless environment with hp procurve and cisco(1200) > For hp access points we don't have any problem, but when trying with cisco > devices freeradius crasches with a segmentation fault. > The segmentation fault happens when accessing the module hpidm.post- > auth.conf which is loaded through radius.conf. > (if i comment out this module i don't get the error, but then vlan > assignment does't work for the hp's). > It would be usefull to debug and to post whats in the hpidm.post-auth.conf J. -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98

3 5

cvs issue
by Guilherme Franco 24 Oct '06

24 Oct '06

Hello, I'm only seeing cistron on the cvs: FTP directory /pub/radius/CVS-snapshots/ at ftp.freeradius.org________________________________ Up to higher level directory 10/23/2006 09:10 201,051 radiusd-cistron-1.6-snapshot-20061023.tar.gz ________________________________

1 0

Hints, Attr_rewrite - Add session timeout with Framed IP
by Breuer Nicolas 24 Oct '06

24 Oct '06

Hello all, Any others suggestions ? I've made a small script into the rlm _sqlippool to add the session time-out attribue... ------- Forwarded message follows ------- From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> To: freeradius-users(a)lists.freeradius.org Subject: Hints, Attr_rewrite - Add session timeout with Framed IP? Send reply to: Nicolas.Breuer(a)BelCenter.biz Date sent: Mon, 23 Oct 2006 12:02:03 +0200 Hello I'm looking for a solution to add in the accept packets a session timeout value when framed ip address is assigned in the users file. I tried to add "hints" rules but doesn't seems to work. I also tried to rewrite the packet : not works. Can you help me to do this ? ------- End of forwarded message -------

1 0

Re: SNMP with Freeradius - Again
by Velikanov 24 Oct '06

24 Oct '06

>SNMP/SMUX support should not affect the rlm_sql module in any way. > >See doc/bugs for steps to debug the segfault issue and identify where the >program is actually failing. Good Day. I did all the steps in doc/bugs, and this is the result: [root@test freeradius-1.1.3]# gdb /usr/local/sbin/radiusd GNU gdb Red Hat Linux (6.3.0.0-1.96rh) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"...Using host libthread_db library "/lib/tls/libthread_db.so.1". (gdb) set logging file gdb-radiusd.log (gdb) set logging on Copying output to gdb-radiusd.log. (gdb) run Starting program: /usr/local/sbin/radiusd [Thread debugging using libthread_db enabled] [New Thread -1208568128 (LWP 6866)] Tue Oct 24 09:25:22 2006 : Info: Starting - reading configuration files ... Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1208568128 (LWP 6866)] 0x0804e816 in cf_expand_variables (cf=0x8065a9e "?", lineno=0x9fd2d38, outercs=0x9fd2d30, output=0xbff15700 "\001", input=0x8061711 "") at conffile.c:233 233 for (parentcs = outercs; (gdb) Is it usefull information? May be i must do something else? Thanks.

1 0

[RE]Freeradius-Users Digest, Vol 18, Issue 98
by Kartthik Raghunathan 23 Oct '06

23 Oct '06

1 0

ssl header file skips from test
by Kartthik Raghunathan 23 Oct '06

23 Oct '06

1 0

Server stopped responding, throwing multiple SSL-related errors
by Ben Beuchler 23 Oct '06

23 Oct '06

I'm running FreeRADIUS 1.1.2 on Ubuntu. This morning one of the two servers stopped answering requests. The radius log contained thousands of lines like these: Mon Oct 23 12:32:56 2006 : Error: TLS Alert write:fatal:illegal parameter Mon Oct 23 12:32:56 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 23 12:32:56 2006 : Error: rlm_eap: SSL error error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size Mon Oct 23 12:32:56 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 23 12:33:02 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 23 12:33:02 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 23 12:33:02 2006 : Error: TLS Alert write:fatal:bad record mac Mon Oct 23 12:33:02 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 23 12:33:02 2006 : Error: rlm_eap: SSL error error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Mon Oct 23 12:33:02 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 23 12:33:02 2006 : Error: TLS Alert write:fatal:illegal parameter Mon Oct 23 12:33:02 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 23 12:33:02 2006 : Error: rlm_eap: SSL error error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size Mon Oct 23 12:33:02 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 23 12:33:16 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Restarting radiusd fixed it. My build of FreeRADIUS was built from source, the SSL library is the Ubuntu system openssl (v. 0.9.7). Any idea what might have gone wrong? -Ben

3 3

problem with SQL Redundant
by Guido 23 Oct '06

23 Oct '06

Hi list, I'm using Freeradius with 2 mysql redundant for accounting. redundant { sql-instance1 sql-instance2 } The problem: when from NAS arrive an 'Stop packet with zero session length', freeradius returns noop for request 1 in sql-instance1. This way, freeradius try to update in sql-instance2, which is not correct, because in sql-instance2 there is no any start reccords. How can I set up freeradius for update ONLY sql-instance1 in case that arrive 'Stop packet with zero session length'? Thanks in advanced Guido

2 1

how to use != == =~ and !~ on multiple keys?
by Mike 23 Oct '06

23 Oct '06

I have the following keys in a radius request: Cisco-AVPair = "src-codec=g729 g711A64k g711U64k g7231 gsmFR NS:iLBC-15k2 " Cisco-AVPair = "dst-codec=g729 " When using the != == =~ and !~ conditionals with Cisco-AVPair key, which one(s) are checked?

2 4