May 2006 - Freeradius-Users - lists.freeradius.org

(no subject)
by rmbc401＠hotmail.com 16 May '06

16 May '06

_________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

Check the subject and issuer in the EAP-TLS
by Michal Prochazka 16 May '06

16 May '06

Hello, as I have noticed there is no possibility to check the subject and issuer of the client certificate. My idea is to use EAP-TLS authN, but allow only some of certificates issued by concrete CA. Two options which are available in EAP-TLS config are not suitable for me. I don't want to revoke the certs and the RE cannot be also used. That's why I created small patch to the freeradius 1.1.0. I've added new option check_script in config of EAP-TLS, where can be defined path to the script or application which is executed after successuf TLS authentication. The script/application will recieve in environ variables request packet with two new value pairs: X509_SUBJECT and X509_ISSUER. The EAP-TLS module decide on the returned value of the script/app if the request will be discarded or allowed. I'm open for every remark and enhancement of this patch. I'm runnig patched freeradius in our organization and till now it works good. Patch is attached if anyone is interested. Best regards, Michal -- Michal Prochazka // michalp(a)ics.muni.cz Supercomputing Center Brno Institute of Computer Science Masaryk University Botanicka 68a, 60200 Brno, CZ CESNET z.s.p.o. Zikova 4, 16200 Praha 6, CZ

3 7

Mysql with freeradius Error again
by Abul Monsur Mannan 16 May '06

16 May '06

Hello memebers, how can I configure freeradius to accept request from mysql ? I'm using Freeradius1.1.1 on Redhat Enterprise4.Should I populate the tables 'redrely' as well as 'redgroup' with others? Alan, thank U for your reply.But U didn't show me the way to get rid of the problem..U know I'm new here. Please help me out. -Monsur

1 0

Freeradius Guru Needed to Write Config
by Drew Linsalata 15 May '06

15 May '06

This should be simple for most of you. We have a customer that needs to authenticate wireless clients (on a Proxim AP-700) via both username/password and MAC address. We have zero man-hours to devote to this, and its been quite a long time since any of us was in RADIUS mode. (-: If anyone wants to make a few bucks on this, contact me off-list and we can go over the requirements. -- Drew Linsalata The Gotham Bus Company, Inc. Dedicated Servers and Colocation Solutions Long Island, New York http://www.gothambus.com

2 3

RE: rlm_sqlippool and a few issues
by RobertB 15 May '06

15 May '06

I guess I sent my post a bit too early. I have spent some more time with the module and it seems like most of my concerns can be accomplished by playing with sql statements. >>2. # lease_duration. fix for lost acc-stop packets - >>lease-duration = 3600 Seems like rlm_ippool handles this much >>better. rlm_ippool will free an ip address either on an >>accounting-stop or if a new authentication request comes on >>an allocated nas-ip/port. >> >>Can this be done in rlm_sqlippool? Actually when a new auth request arrives sqlippool frees the ip(which was assigned on the same nas/port) first and then tries to assigne it if it's still available.. >>3. DEFAULT as an pool name. >>Is there any way to tell rlm_sqlippool to pick up an ip from any pool >>available? >>Something like rlm_ipppool's DEFAULT for the pool name? by naming ip pools like sqlippool1, sqlippool2, etc. we can do SELECT ip_address FROM radippool WHERE pool_name LIKE 'sqlippool%' instead of SELECT ip_address FROM radippool WHERE pool_name = 'sqlippool1'. Seems like it works just fine. cheers, Robertb

1 0

proxy failover
by Michael Markstaller 15 May '06

15 May '06

Just did some tests to verify failover and I came across two issues: - running FreeRADIUS 1.0.1 - one realm (used with DEFAULT Huntgroup,Proxy-To-Relam in users), entered with two home-servers With config proxy server { synchronous = no retry_delay = 10 retry_count = 3 dead_time = 600 default_fallback = no post_proxy_authorize = no } The first failed server *never* gets marked as "dead" using retry_delay = 5 retry_count = 3 one authentication try fails, then the server is marked as dead and subsequent suceed within dead_time The problem is, I need the larger timeout/retry-delay for lame upstream servers and I know the failover also worked with these settings some time ago, but this might have been with an earlier 0.9x release. Is there a way now (I remember some dicussions years ago it wasn't) to make the failover to multiple proxies work without losing one authentication-try each dead_time ? I checked the changelog but found no hints something was fixed or changed in later versions.. Might it be worth a try to use v1.1.1 ? (although I'd really love to keep my stable Debian-package) Michael

2 1

Attribute User-name is mising
by Assa Tal 15 May '06

15 May '06

Hi all, My Free Radiuss 1.1.1. doesn't want to Proxy an accounting request if he is missining the User-Name attribute My co partneres are Cellular company and they don't use" User-Name attribute" I was trying to use the radrelay , but it has some limitition Pls help me to resolve this issue Any help will be appriciate My setup is very basic My set up goes like this Proxy.conf Realm DEFAULT type = radius authhost = x.x.x accthost.= x.x.x.x secret = aaaaa Realm NULL type = radius authhost = x.x.x accthost.= x.x.x.x secret = aaaaa I was truing to use hints file but no sueccess Hints file DEFAULT User-Name = "ccc" , Realm = DEFAULT

2 1

accessing diferent devices
by Carlos Mauricio Reyes Sanmiguel 15 May '06

15 May '06

Hi, I just installed the fre radius in a linux box. I got it working ok, but there is a couple of thig that i don´t know how to do or if they can be done. The first one is i need to create special kind of groups of people that can access some devices but no others, like i have the admin group that has to access all of the 20 devices (switches, routers..) but i also have the operator group that only has to access 2 of them, and on the same radius i need to enable some VPN users that only need to registrate to the radius for the VPN account that connects to the PX firewall and not to any of the devices... Can that be done?, how can i specify witch equipments the users have access to? Thanks. Carlos Reyes

2 1

FreeRadius
by Matteo Lazzarini 15 May '06

15 May '06

Hello, for my net I would want to use freeradius in order to authenticate host windows XP and Linux. First of all which Access Point good ecomomico but is found in Italy? (I live to Bergamo.) Thanks Matteo

1 0

v1.1.1 rlm_eap compile problem (no prob in v1.1.0)
by Aaron Paetznick 15 May '06

15 May '06

I'll save people a lot of time and just paste the bomb out below. Help??? Otherwise, can I simple choose to not compile rlm_eap (I don't use it). I've tried --disable-eap and similar arguements. Thanks. --Aaron /usr/local/src/freeradius-1.1.1/libtool --mode=compile gcc -O2 -march=pentium4 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/usr/local/src/freeradius-1.1.1/src/include -I../.. -I../../libeap -DNO_OPENSSL -c rlm_eap_peap.c mkdir .libs gcc -O2 -march=pentium4 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/usr/local/src/freeradius-1.1.1/src/include -I../.. -I../../libeap -DNO_OPENSSL -c rlm_eap_peap.c -fPIC -DPIC -o .libs/rlm_eap_peap.lo In file included from eap_peap.h:25, from rlm_eap_peap.c:24: ../../libeap/eap_tls.h:138: error: parse error before "SSL" ../../libeap/eap_tls.h:138: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:141: error: parse error before '*' token ../../libeap/eap_tls.h:141: warning: type defaults to `int' in declaration of `into_ssl' ../../libeap/eap_tls.h:141: warning: data definition has no type or storage class ../../libeap/eap_tls.h:142: error: parse error before '*' token ../../libeap/eap_tls.h:142: warning: type defaults to `int' in declaration of `from_ssl' ../../libeap/eap_tls.h:142: warning: data definition has no type or storage class ../../libeap/eap_tls.h:172: error: parse error before '}' token ../../libeap/eap_tls.h:172: warning: type defaults to `int' in declaration of `tls_session_t' ../../libeap/eap_tls.h:172: warning: data definition has no type or storage class ../../libeap/eap_tls.h:182: error: parse error before "tls_session_t" ../../libeap/eap_tls.h:186: error: parse error before "SSL" ../../libeap/eap_tls.h:188: error: parse error before '*' token ../../libeap/eap_tls.h:371: error: parse error before "SSL_CTX" ../../libeap/eap_tls.h:371: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:372: warning: type defaults to `int' in declaration of `eap_tls_t' ../../libeap/eap_tls.h:372: warning: data definition has no type or storage class ../../libeap/eap_tls.h:383: warning: type defaults to `int' in declaration of `SSL' ../../libeap/eap_tls.h:383: error: parse error before '*' token ../../libeap/eap_tls.h:384: error: parse error before "X509_STORE_CTX" ../../libeap/eap_tls.h:386: error: parse error before "SSL" ../../libeap/eap_tls.h:387: error: parse error before '*' token ../../libeap/eap_tls.h:387: error: parse error before '*' token ../../libeap/eap_tls.h:387: warning: type defaults to `int' in declaration of `cbtls_rsa' ../../libeap/eap_tls.h:387: warning: data definition has no type or storage class ../../libeap/eap_tls.h:390: error: parse error before '*' token ../../libeap/eap_tls.h:390: error: parse error before '*' token ../../libeap/eap_tls.h:390: warning: type defaults to `int' in declaration of `eaptls_new_session' ../../libeap/eap_tls.h:390: warning: data definition has no type or storage class ../../libeap/eap_tls.h:391: error: parse error before '*' token ../../libeap/eap_tls.h:392: error: parse error before '*' token ../../libeap/eap_tls.h:393: error: parse error before '*' token ../../libeap/eap_tls.h:397: error: parse error before '*' token ../../libeap/eap_tls.h:398: error: parse error before '*' token In file included from rlm_eap_peap.c:24: eap_peap.h:52: error: parse error before "tls_session_t" rlm_eap_peap.c: In function `eappeap_authenticate': rlm_eap_peap.c:165: error: `tls_session' undeclared (first use in this function) rlm_eap_peap.c:165: error: (Each undeclared identifier is reported only once rlm_eap_peap.c:165: error: for each function it appears in.) rlm_eap_peap.c:165: error: parse error before ')' token gmake[9]: *** [rlm_eap_peap.lo] Error 1 gmake[9]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types/rlm_eap_peap' gmake[8]: *** [common] Error 2 gmake[8]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types' gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types' gmake[6]: *** [common] Error 2 gmake[6]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/freeradius-1.1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/freeradius-1.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/freeradius-1.1.1' make: *** [all] Error 2

4 3