April 2006 - Freeradius-Users - lists.freeradius.org

[FreeRADIUS (EAP-TLS)] Server does not start.
by freeradius＠gmx.de 12 Apr '06

12 Apr '06

I need some help in configuring the radius server.It would be great if one of you could guide me to the solution. Here are my system details. (its a 1und1 Virtual Server) SUSE 9.3 FreeRADIUS 1.1.1 und openssl-0.9.7e-3 I have created a CA and Certficates using openssl. The names of these files are masterkey.pem and master_cert.pem respectively. They are kept in the /usr/local/etc/raddb/masterkeys directory. I took the following steps. Created CA with the following: /usr/share/ssl/misc/CA.sh -newca Signing request with: openssl req -new -nodes -keyout masterkey.pem -out masterreq.pem Sign: openssl ca -out master_cert.pem -infiles ./masterreq.pem eap.conf: tls{ ... certificate_file und private_key_file = ${raddbdir}/masterkeys/master_cert.pem CA_file = ${raddbdir}/masterkeys/cacert.pem ... } But after following the above standard procedure, i cannot start my radius server and its not clear to me what could be the actuall problem.Here are the last few lines of my error messages that i get when i start the server. rlm_eap_tls: Loading the certificate file as a chain rlm_eap_tls: Error reading Trusted root CA list rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1893] Unknown module "eap". radiusd.conf[1840] Failed to parse authenticate section. -- Analog-/ISDN-Nutzer sparen mit GMX SmartSurfer bis zu 70%! Kostenlos downloaden: http://www.gmx.net/de/go/smartsurfer

1 0

Help, Chap problem
by fjlagos＠vtr.net 12 Apr '06

12 Apr '06

Hello: I have this problem, i get this message in the log: "Tue Apr 11 14:43:18 2006 : Auth: Login incorrect (rlm_chap: Clear text password not available): [adexus/<CHAP-Password>] (from client 3com port 268443649 cli 0010-a484-6e7a)" I set the users file as follow: adexus Auth-Type := CHAP, User-Password == "adexus" i configure the windows 2000 802.1x client how: EAP type: MD5 challenge Any idea Saludos Francisco Lagos

2 1

RE: How do I set up simple AD integration?
by Burton, Steven 12 Apr '06

12 Apr '06

> -----Original Message----- > From: Stephen Walsh [mailto:S.Walsh@signadou.acu.edu.au] > Sent: 12 April 2006 00:41 > To: Burton, Steven > Subject: Re: How do I set up simple AD integration? > > > > > > > Hi Steve > > I've just completed an AD implementation of FreeRadius across two AD > domains, One AD2003 in Native mode, and one AD2000 in mixed > mode. If you'd > like any hints or tips, feel free to email me and I'll do > what i can to > help. > > Stephen Walsh > s.walsh(a)signadou.acu.edu.au Stephen, thanks for your kind offer of help. What I'm trying to achieve is to get 802.1x authentication working with FreeRadius passing off authentication to a Win2003 (Win 2000 mixed mode, soon to be 2003 native) DC. When the user tried to connect to the network I can see his domain\username in the output of radiusd -A -X which (I think) suggests that the supplicant and client are setup correctly. There seems to be no attempt by the RADIUS server to contact a DC. I don't want to take too much of your time but would it be possible for you to send me any (suitably sanitized) configuration files you have customized ? If this is unacceptable I'll send you details of what I've done so far. Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

different gateway for different users
by Felice.pizzurro 12 Apr '06

12 Apr '06

Hi, I have freeradius AAA server with mysql. I have 3 gateway, is possible to assign (statically at this time) different gataway at different users? thanks, Felice -- Computers are like air conditioners: they stop work properly when you open Windows... -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: America, Africa, Australia, Asia...con Email Phone Card chiami ovunque spendendo meno di una telefonata interurbana Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=2688&d=20060412

1 0

RE: How do I set up simple AD integration?
by Burton, Steven 12 Apr '06

12 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of King, Michael > Sent: 11 April 2006 16:34 > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > You would still need with_ntdomain_hack = yes > > But that isn't your actual problem. > > It never called ntlm_auth > I'd seen that. What I was trying to do (unsuccessfully 'cos I'm ignorant) was to try to find out what triggers ntlm_auth to run. Is there something in another file that sets this up? Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

pam_radius_auth token user
by Josh Restivo 12 Apr '06

12 Apr '06

This question appears in various forums time and time again though I've yet to discover a solution for it under linux. It *must* be a common issue.... The need exists to map users who are successfully authenticated via pam_radius_auth and who do not have a local account to a default 'token user'. FreeBSD's radius/pam module has a simple and obvious 'template_user' directive that suits this precise purpose well. Linux pam_radius_auth lacks this feature. Deploying centralized authentication only to require that all other user info be manually configured on each and every device anyway doesn't make any sense. Nor should it involve a full-blown and often unwieldy NIS (or similar) infrastructure to function. Surely I'm overlooking something.

1 0

Regarding VLAN
by radhika putty 11 Apr '06

11 Apr '06

Hi I tried sending tunneling attributes from Radius server and it shows sending those tunneling attributes.. But the access point doesnt seem to understand it anyway. I had configured both the access point and the switch for this.. What can be the problem --------------------------------- Yahoo! Messenger with Voice. PC-to-Phone calls for ridiculously low rates.

1 0

group definitions in users file
by ho 11 Apr '06

11 Apr '06

Hi folks, my environment: I do AAA with freeradius as a radius-proxy in combination with ms-ias (only for the passwords ;-) )for cisco asa 5540-box, which is similar to a cisco pix firewall. in the future we have many, many entries for users with the same Cisco-AVPairs USER1 Proxy-To-Realm := IAS Service-Type = Framed-User, Framed-Protocoll = PPP, Cisco-AVPair += "ip:inacl# = permit udp any host A.B.C.D eq domain", Cisco-AVPair += "ip:inacl# = permit udp any host A.B.C.D eq domain", Cisco-AVPair += "ip:inacl# = permit tcp any host A.B.C.D eq 264", Cisco-AVPair += "ip:inacl# = permit tcp any host A.B.C.D eq 443", Cisco-AVPair += "ip:inacl# = permit udp any host A.B.C.D eq isakmp", Cisco-AVPair += "ip:inacl# = permit udp any host A.B.C.D eq 2746", Cisco-AVPair += "ip:inacl# = permit esp any host A.B.C.D", Cisco-AVPair += "ip:inacl# = deny tcp any any", Cisco-AVPair += "ip:inacl# = deny udp any any", Fall-Through = 0 Is it possible to group the User entries and than give them the special profile with the AVPairs? If not, what could be another good workaround for this problem? thanks marco

2 1

sql database in freeradius-1.1.1 ???
by ho 11 Apr '06

11 Apr '06

Hi, am i right that the database schemes under e.g. src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql are lost in version 1.1.1, which i've downloaded 2 says ago? I've tried a find, but didn't have a match. Can i use the same schema i've downloaded with version 1.0.4? Best regards marco

3 3

Allow linking against OpenSSL? (Was Re: [GENERAL] Debian package for freeradius_postgresql module)
by Tyler MacDonald 11 Apr '06

11 Apr '06

Greetings FreeRadius people, This discussion started on the postgresql's "pgsql-general" mailing list. The problem here is that the freeradius-postgresql package needs to link against libpgsql, which means that it may be indirectly linked against openssl. There is a conflict between OpenSSL's BSD license and the GPL which means that it's not legal to distribute a copy of GPL code that is linked in this way. It appears that several other GPL apps have added a special clause to their license that allows them to be linked against OpenSSL. Could this be done for freeradius/freeradius-postgresql as well? This could pave the way towards enhanced freeradius support in Debian, specifically the addition of freeradius-postgresql to Debian's mainline. For your reference, here is the start of the thread on the pgsql-general list that got us to this point: http://archives.postgresql.org/pgsql-general/2006-04/msg00247.php Thanks, Tyler Tom Lane <tgl(a)sss.pgh.pa.us> wrote: > > I don't think so. I got curious and looked at what's on my Ubuntu > > system: Courier IMAP is GPL with an additional clause that explicitly > > allows linking with OpenSSL; Postfix has an Apache-ish license; Exim > > is GPL and also explicitly allows linking with OpenSSL; Cyrus IMAP is > > BSDish; Apache is non-GPL... I can't think offhand of anything that > > is GPL and links with OpenSSL without an explicit clause permitting > > same. > Hm. So can we lobby freeradius to tweak their license similarly?

5 19