March 2006 - Freeradius-Users - lists.freeradius.org

need info regarding Reply-Message
by Vishwanath Srikant Pattanshetti 10 Mar '06

10 Mar '06

Hello All I am using Freeradius 1.1.0 with Oracle. I want to return a reply-message for all failed authentications. How should I configure this? Do I need to handle it through the query - select the reply-message if password does not match? Any information, or pointer to the same would be of great help. Thanks in advance -Vishwa.

1 0

Reload on freeradius 1.1.0
by André Lemos 10 Mar '06

10 Mar '06

freeradius 1.1.0 doesn't seem to cope with reloads as well as it did with freeradius 1.0.5. On the version 1.1.0 after about 2/3 reloads, I get the following on the logs: Tue Feb 25 16:23:22 2003 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Feb 25 16:23:22 2003 : Error: rlm_eap_tls: Error reading certificate file Tue Feb 25 16:23:22 2003 : Error: rlm_eap: Failed to initialize type tls Tue Feb 25 16:23:22 2003 : Error: radiusd.conf[9]: eap: Module instantiation failed. Tue Feb 25 16:23:22 2003 : Error: radiusd.conf[1668] Unknown module "eap". Tue Feb 25 16:23:22 2003 : Error: radiusd.conf[1616] Failed to parse authenticate section. this seems a bug related to how the version 1.1.0 copes with kill signals (I can't reproduce the problem with the version 1.0.5) Thanks Ps.: the command used was: kill -1 `cat /var/run/radiusd/radiusd.pid` -- **_____________________** * *André Ventura Lemos** **Software Engineer** **Critical Software, SA** **Webpage:** **www.andrelemos.com** **MSN:** **tux(a)tuxslare.org** **GSM:** **+351916401042** **TLF:** **+351239989100** DISCLAIMER: This message may contain confidential information or privileged material and is intended only for the individual(s) named. If you are not a named addressee and mistakenly received this message you should not copy or otherwise disseminate it: please delete this e-mail from your system and notify the sender immediately. E-mail transmissions are not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete or contain viruses. Therefore, the sender does not accept liability for any errors or omissions in the contents of this message that arise as a result of e-mail transmissions. Please request a hard copy version if verification is required. Critical Software.

2 7

freeradius newbie
by Atkins, Dwane P 10 Mar '06

10 Mar '06

Thank you for this mailing list. I am trying to install Freeradius on a FC4 device. I am also trying to use the MySql database function. I am having problems getting a good install. So, as usual, I have a few questions for you all. 1. Is there a good document that I can follow that will give me step-by-step instructions to install freeradius on Fedora 4? I would even do FreeBSD if need be but I am more familiar with the FC 4 processes. 2. Is there a GUI front-end that will allow us to https into the FreeRadius Server and make changes to the mysql database? 3. Where would I find the debug documents that I read about when I execute the radtest executable? Thanks for the help. Dwane <mailto:atkinsd@uthscsa.edu>

3 3

[freeradius-users]dialup_admin can't connect to the Sql server!!
by 刘杰 10 Mar '06

10 Mar '06

Hi, there. I'm configuring the dialup_admin but it always tell can't connect to the sql. Anything wrong with? I've configured the admin.conf as follows: " sql_debug: true sql_type: mysql sql_server: 2*.4*.2*.5* sql_port: 3306 sql_username: root sql_password: ****** sql_database: radius sql_accounting_table: radacct sql_badusers_table: badusers sql_check_table: radcheck sql_reply_table: radreply sql_user_info_table: userinfo sql_groupcheck_table: radgroupcheck sql_groupreply_table: radgroupreply sql_usergroup_table: usergroup sql_total_accounting_table: totacct sql_nas_table: nas sql_command: /usr/bin/mysql " and i've been running mysql server properly so is there anything more not properly made? Thx in advance. By the way, what does "use 'clear cache' page if you use sessions and do any changes in any of the configuration files" does it mean clear cache when using the browser? Regards. Jedliu 2006-03-10

1 0

freeradius auth logging (rlm_detail)
by ???????, ?? ???????? 10 Mar '06

10 Mar '06

Hi! Is it possible to log more detailed information about radius response packet for authorization? At the moment it looks like: Packet-Type = Access-Accept Wed Mar 8 10:25:57 2006 Auth-Type = Accept But how can I know, for which request it has responsed? Can I log the "Authenticator"? (Both, in the request and in the response?) ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

1 0

RE: Machine Authecitation with PEAP
by King, Michael 09 Mar '06

09 Mar '06

> -----Original Message----- > If it helps, this the ntlm command (which i think you have correct): > /usr/bin/ntlm_auth --request-nt-key --username=cse-mpr$ > --challenge=4de0a9c09623ab12 > --nt-response=d4b9516b28ba1760f8d31f8ac2b257d74a2439b9e104a102 > > - are you passing the domain correctly? (i dont specify the domain on > the ntlm_auth command line, whereas you have) i have the following in > samba.conf > I didn't have the ntlm_auth line correct. I did have the domain correct. I had this in the radius.conf file ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{msc hap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} BUT, in my notes, and on my working server, I had this: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response= %{mschap:NT-Response}" I removed the :-00 from the NT-Response and the Challenge options, and I also removed the --domain, since I had no idea why it was in there either. I think I only replaced bits and pieces of the default line in the example config, instead of deleting the whole line and pasting in my notes. Thanks, it works great now!

1 0

Re: Machine Authecitation with PEAP
by James J J Hooper 09 Mar '06

09 Mar '06

>>> ------------------------------ >>> >>> Message: 6 >>> Date: Thu, 9 Mar 2006 13:17:48 -0500 >>> From: "King, Michael" <MKing(a)bridgew.edu> >>> Subject: Machine Authecitation with PEAP >>> >>> Has anyone gotten Machine Authentication with PEAP working? >> Yes >>> >>> radius_xlat: '/usr/bin/ntlm_auth --request-nt-key >>> --username=boy-it-tel-2528$ --domain=campus --challenge=8498683817c21d86 >>> --nt-response=c92c >>> 121419368a6b599e159c9ef21bbc4d98138946d6df29 ' >>> >>> Exec-Program: /usr/bin/ntlm_auth --request-nt-key >>> --username=boy-it-tel-2528$ --domain=campus --challenge=8498683817c21d86 >>> --nt-response=c92c1 >>> 21419368a6b599e159c9ef21bbc4d98138946d6df29 >>> >>> Exec-Program output: Logon failure (0xc000006d) >>> >>> Exec-Program-Wait: plaintext: Logon failure (0xc000006d) >> >> From my experience this means the credentials the machine is sending are >> wrong or your version of samba is too old - get 3.0.21c (or at least >> 3.0.21a) >I wish it was that easy. I'm using Debian Package of the Testing >release. It's currently at 3.0.21b > >Does it have to anything to do with the host/ getting stripped off? Nope ... --username=boy-it-tel-2528$ is in the correct format If it helps, this the ntlm command (which i think you have correct): /usr/bin/ntlm_auth --request-nt-key --username=cse-mpr$ --challenge=4de0a9c09623ab12 --nt-response=d4b9516b28ba1760f8d31f8ac2b257d74a2439b9e104a102 for the radius packet: NAS-IP-Address = 172.17.51.78 NAS-Port = 50018 Cisco-NAS-Port = "GigabitEthernet0/18" NAS-Port-Type = Ethernet User-Name = "host/cse-mpr.cse.bris.ac.uk" Called-Station-Id = "00-16-C8-7C-A9-12" Calling-Station-Id = "00-07-E9-E7-41-50" Service-Type = Framed-User Framed-MTU = 1500 State = 0x2155356ae073362e26296c9869da2893 EAP-Message = 0x0207006d190017030100629bfa223d9efed1787d6bdeee43082a4a43adaf1792f0bd93acc6fbe8e4b7ee82d8d88380e459496d97435e7225e057fac5dd15e2525bd4ff36ae085cc54c677cc3e3a96d1f7a023f6b49 As far as i can tell the problem is with the windows / samba side of things: - might be a stupid question, but is the computer account properly registered in the domain? - is the account locked ?? - does it work if you try to auth as a user? - if you updated samba recently - have you restarted winbindd? - are you passing the domain correctly? (i dont specify the domain on the ntlm_auth command line, whereas you have) i have the following in samba.conf (the domain is UOB): [global] workgroup = UOB netbios name = IS-RHUBARB security = domain password server = ads.bris.ac.uk realm = ads.bris.ac.uk winbind use default domain = no winbind nested groups = Yes winbind enum users = No winbind enum groups = No remote browse sync = ads.bris.ac.uk where ads.bris.ac.uk is a round robin resolving to the IPs of 11 domain controllers. Regards, James -- James J J Hooper, Information Services University of Bristol --

1 1

Problem compiling Freeradius + MySQL on Solaris 9
by Alan 09 Mar '06

09 Mar '06

I've made symlinks like recommended in the mailing lists. I have also specified the lib, include and base MySQL directory when running the configure script. After running configure I always get the same output. Please help. -- configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. configure: warning: sql submodule 'mysql' disabled -- OS: Solaris 9 (SPARC) MySQL Package: Sunfreeware (mysql-4.0.21-sol9-sparc-local.gz) -- ln -s /usr/local/mysql/lib /usr/lib/mysql ln -s /usr/local/mysql/include/mysql /usr/include/mysql -- ./configure \ --with-mysql-dir-dir=/usr/local/mysql/ \ --with-mysql-include-dir=/usr/local/mysql/include/mysql/ \ --with-mysql-lib-dir=/usr/local/mysql/lib/ -- "/usr/lib/mysql" libdbug.a libheap.a libmerge.a libmyisam.a libmyisammrg.a libmysqlclient.a libmysqlclient.la libmysqlclient.so -> libmysqlclient.so.12.0.0 libmysqlclient.so.10 -> libmysqlclient.so.10.0.0 libmysqlclient.so.10.0.0 libmysqlclient.so.12 -> libmysqlclient.so.12.0.0 libmysqlclient.so.12.0.0 libmysqlclient_r.a libmysqlclient_r.la libmystrings.a libmysys.a libnisam.a libvio.a

2 3

RE: Machine Authecitation with PEAP
by King, Michael 09 Mar '06

09 Mar '06

> -----Original Message----- > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of james > Sent: Thursday, March 09, 2006 3:06 PM > >From my experience this means the credentials the machine is sending > >are > wrong or your version of samba is too old - get 3.0.21c (or at least > 3.0.21a) > > Regards, > James I wish it was that easy. I'm using Debian Package of the Testing release. It's currently at 3.0.21b Does it have to anything to do with the host/ getting stripped off?

1 0

proxy.conf multiples Default realm's
by Vasco Santos 09 Mar '06

09 Mar '06

Hi, I have FF 1.0.1 and I what to put two diferent default realm's biscose I have two diferents companys with very domains names. ex: gric. proxy.conf ex: realm example.com { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL secret = testing123 } realm DEFAULT { type = radius authhost = radius1.company.com:1600 accthost = radius1.company.com:1601 secret = testing123 } realm DEFAULT { type = radius authhost = radius2.company.com:1600 accthost = radius2.company.com:1601 secret = testing123 } At this point the auth request only go to radius2.company.com if the radius1.company.com its dead, correct? But I need to make this by login failed, incorrect ou server fail. If the login failed (password or username) in radius1.company.com the request need to go to radius2.company.com. I search to solutions for this case and I found someting, a function on radius config file the "authorize". As I make a configurantion for this work to all my realm servers? Please say me all procedures. Note: I still use the old version of realm the realms file, it is possible to config some options on it to my question? Tanks.

2 1