February 2006 - Freeradius-Users - lists.freeradius.org

Root Certificate via ADS
by Armin Krämer 10 Feb '06

10 Feb '06

Hi, im planing to install my generated root Certifikate via W2k ADS to the Clients. How can i do this via AADS? What do i have to do in ADS and Group Policies? The second question ist that i will have to set a mark onto my certifikate at the Trusted RootCertifikate Field at the network Connection (hoe you understand what i mean) . How can i do this? Intall Root Certifikate and set this mark that i can use EAP-TLS wit Freeradius? I dont want to put it on 300 clients per hand :-) Thank Armin

2 1

cntinue with mistake
by Alvaro Quiñones 10 Feb '06

10 Feb '06

Hi Continue with the same problem, the mistake continue and when i tried with ./configure --without-openssl --without-rlm_eap_peap --without-rlm_eap_tls --without-rlm_eap_ttls --without-rlm_otp and ./configure --without-openssl --without-rlm_eap_peap --without-rlm_eap_tls --without-rlm_eap_ttls --without-rlm_otp bash-3.00# make gmake[1]: Entering directory `/usr/local/freeradius-1.1.0' Making all in libltdl... gmake[2]: Entering directory `/usr/local/freeradius-1.1.0/libltdl' /bin/sh ./libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c mkdir .libs gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c -fPIC -DPIC -o .libs/ltdl.lo ltdl.c: In function `lt_dlopenext': ltdl.c:2926: warning: unused variable `file_found' gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c -o ltdl.o >/dev/null 2>&1 mv -f .libs/ltdl.lo ltdl.lo /bin/sh ./libtool --mode=link gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -o libltdl.la -rpath /usr/local/lib -no-undefined -version-info 4:0:1 ltdl.lo -ldl -lssl -lcrypto -lnsl -lresolv -lsocket -lposix4 -lpthread rm -fr .libs/libltdl.la .libs/libltdl.* .libs/libltdl.* /usr/ccs/bin/ld -G -z defs -h libltdl.so.3 -o .libs/libltdl.so.3.1.0 ltdl.lo -ldl -lssl -lcrypto -lnsl -lresolv -lscket -lposix4 -lpthread -lc ld: error fatal: library -lssl: no encontrado ld: error fatal: library -lcrypto: no encontrado ld: error fatal: Errores en el proceso de archivos. No se escribirá la salida en .libs/libltdl.so.3.1.0 gmake[2]: *** [libltdl.la] Error 1 gmake[2]: Leaving directory `/usr/local/freeradius-1.1.0/libltdl' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/freeradius-1.1.0' make: *** [all] Error 2

1 0

NAS ID re-write
by Nicola Iotti 10 Feb '06

10 Feb '06

Hi all, I'm using freeradius 1.0.5 just as proxy to do a realm based messages redirection... How can I re-write NAS_ID ( attribute 32) with different ID for different redirection options... Thank you Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

2 1

Problem Seg Fault
by Breuer Nicolas 10 Feb '06

10 Feb '06

Hello I've just installed Fedora 4 with MYSQL 4.1.18 I tried to install the last version of freeradius and i 've a big error at the startup Mysql is correctly installed into the system.. startup with -X Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "xxx.yyy.be" sql: port = "" sql: login = "" sql: password = "" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/var/log//sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" ........................ sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ012 3456789.-_: /" Segmentation fault

2 2

ld: error fatal: library -lssl: no encontrado
by Alvaro Quiñones 10 Feb '06

10 Feb '06

Hi I have this mistake "ld: error fatal: library -lssl: no encontrado" when i try to make. Version is freeradius-1.1.0 and my SO is Solaris10. how can i compile freeradius without support OpenSSL?? i tried: ./configure --without-OpenSSL however appear checking for openssl/ssl.h... yes checking for openssl/err.h... yes checking for openssl/crypto.h... yes checking for openssl/rand.h... yes checking for openssl/engine.h... yes checking for OpenSSL version >= 0.9.7... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking for openssl/ssl.h... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking how to run the C preprocessor... (cached) gcc -E checking for openssl/err.h... (cached) yes checking for openssl/engine.h... (cached) yes creating ./config.status checking for SSL_new in -lssl... (cached) yes checking for openssl/des.h... yes checking for openssl/hmac.h... yes checking for openssl/md4.h... yes checking for openssl/md5.h... yes checking for openssl/sha.h... yes What can i do? Regards Alvaro

2 1

prepaid counter
by Rusma 10 Feb '06

10 Feb '06

dear all, I need your advice for my prepaid billing, i have several scenario : 1. prepaid for 4 hours and expire in 2 days after login. 2. prepaid for 8 hours and expire in 4 days after login. 3. prepaid for 24 hours and expire in 1 day. i have configured my freeradius and mysql using rlm_sqlcounter, i have tested with sample account from sqlcounter doc and its works. . i need to make or change default scripts for above schemes. can any body help me. best regards, rusma permana

1 0

problem with simultanous use...any idea???
by tommy garsia 09 Feb '06

09 Feb '06

Hi guys... I've finished compile and install freeradius v1.1.0 with mysql...and work great... and i'm happy with it... now i have a problem during the accounting.... what should i do if i want to limit only one connection per one user..?? what should i do with my freeradius configuration? best regards, tommy __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

radutmp file administration
by Leonardo Reginin 09 Feb '06

09 Feb '06

Hi fellows. I am relatively newbie with freeradius. Are there problem in remove the radutmp file ( radius stop; rm; radius start of course) ? What kind of information are lost ? Are there any utility to admin the radutmp file such to remove an user entry ? Sorry for that elementary questions :-) Thanks !

2 3

MS-CHAP, LDAP, ADS
by Elizabeth Palomino 09 Feb '06

09 Feb '06

Greetings, I have poked about on google and read several how to's. Is it possible using any authentication module ( rlm_pam,rlm_ldap...) To authenticate a connection from a client using CHAP or MS-CHAP to an Active Directory Server (TM) *cough*. I can authenticate just fine with cleartext to the radius server using PAM---Winbind -->ADS Gives the same error as below LDAP -->ADS Error: User-Password is Required for authentication. Cannot use "CHAP-Password" Looking at the debug output I see the request with the CHAP-Password. I am now thoroughly confused. I had this working with a mirapoint (LDAP server), Any ideas on getting chap-pap authentication working against an ADS server. To Summarize: 1) What should the users file contain? 2) Which is a better way to authenticate? ldap,PAM-->Winbind? 3) Can I use the ntlm_auth line with the chap 4) I have read about peap and eap. Perhaps this would work? 5) Is there a good freeradius book you would recommend? Heck, I'll even volunteer to write a howto on it! (I write heaps of documentation). What I am trying to avoid is having password transmitted clear text over the network. Is there perhaps a better Solution? Thanks!

2 1

users file before ldap
by Stephane Branchoux 09 Feb '06

09 Feb '06

Hello, i use freeradius with openldap When i try to autenticate some users with users file for wifi connections (cisco bbsm captive portal) , authentication fails. user is defined like this : toto Auth-Type := Local, User-Password == "clear password" ou toto1 User-Password == "clear password" My authorize section of free radius is defined like this (files before ldap) : authorize { preprocess auth_log chap mschap suffix eap files ldap } But when i use ntradping tool, authentication succeeds with ldap and with user fille. Any idea ? Many thanks in advance. -- stephane BRANCHOUX Centre de Ressources Informatiques de l'Université de Perpignan. Systèmes/Réseaux mailto:stephane.branchoux@univ-perp.fr 04 68 66 21 24 Validation signature / Trusting signature: http://igc.cru.fr/trust.html

1 1