June 2006 - Freeradius-Users - lists.freeradius.org

Debian & TLS support
by Scott Hughes 23 Jun '06

23 Jun '06

Hello, I think in my last reqest to the list I wasn't quite clear as to the information I was trying to find. I'll try again and sorry for any toes that were stepped on. When I install Freeradius (after installing OpenSSL) I get this message when starting Freeradius: rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[9]: eap: Module instantiation failed I have tried downloading and compiling the Freeradius source (Freeradius-1.1.2.tar.gz) and have the same error. I understand why this is (licensing issues) and I have searched this list AND the web for any information as to how to make Freeradius work with Debian using TLS. I found a lot of discussion about it, but nothing concrete for someone like myself who is not deeply familiar with Linux. Is there a HOWTO for example on how a person can do what I am trying to do? Do I need to move off of Debian and onto something else? Thanks in advance for any links and/or information that anyone can provide.

4 3

RE: error: Installed (but unpackaged) files(s) found: on REDHAT Enterprise 4.0 (RHEL4) and FreeRadius 1.1.2
by Sandworm 22 Jun '06

22 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > > How do i have to modify freeradius.spec file to build it successfully? > > Has anyone (besides Alberto Cruz) also managed to build RPM on RHEL 4? > > Thanky for any info, > Tadej Bregar Hi Yes, I've successfully built on RHEL4 ES (I'm using FR 1.1.1, though 1.1.2 shouldn't be different, I think). A diff of my spec file against the standard one in the tarball is shown below: $ diff -u /usr/src/redhat/SPECS/freeradius.spec freeradius.spec.orig - --- /usr/src/redhat/SPECS/freeradius.spec 2006-04-09 18:26:53.000000000 +1000 +++ freeradius.spec.orig 2006-02-13 02:54:56.000000000 +1100 @@ -23,8 +23,6 @@ %prep %setup - -sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile - - %build CFLAGS="$RPM_OPT_FLAGS" \ %configure --prefix=%{_prefix} \ @@ -101,14 +99,7 @@ %files %defattr(-,root,root) - -%doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX - -%doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema - -%doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend - -%doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover - -%doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas - -%doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file - -%doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt - -%doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL +%doc doc/ChangeLog doc/README* todo/ COPYRIGHT INSTALL %config /etc/pam.d/radius %config /etc/logrotate.d/radiusd %config /etc/rc.d/init.d/radiusd Regards -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkSbXB8ACgkQmw4BJyaatJ2b8gCfaXuYxjruzPqHjXh8e6x5swy8sCsA oIDGkhRlJOc/VPBSLGei1pSaIxE5 =idM8 -----END PGP SIGNATURE-----

1 0

freeradius with AD
by Kartthik Raghunathan 22 Jun '06

22 Jun '06

Am trying to join the freeradius machine to active directory, so i can authenticate the users against active directory. When i try to bind am getting the below error message: net join ADS -U username%password ads_join_realm: Operations error ADS join did not work, falling back to RPC... Joined domain CORP. i dont see any issue with my domain password it work fine with kinit username(a)domain.com Also am running nis server on a linux box and freeradius server is part of this nis, when i binded it to the active directory which password will be given 1st preferrence. I think i may be out of this group box, but still its involved in freeradius operation. Thanks in advance. -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

Is there a good guide to writing rlm modules
by David Goodenough 22 Jun '06

22 Jun '06

I am a newbie to Radius, and need to implement some function that is not easily done by any of the existing modules. So I want to write my own, and being a Java programmer I chose JRadius as well we FreeRadius. I wrote a module but it is not taking my acceptance of the user i the authorize step, but rather send a rejection to the post_auth step. Obviously I am missing something, so I thought that some documentation on writing modules would be good reading. Anyone know where I can find some? Thanks David

2 2

how to configure NAI realms routing table
by Dhaval Shah 22 Jun '06

22 Jun '06

Hi I have a question about how to use freeradius server as a proxy and configure a NAI realms based routing table to help incomming RADIUS packets to be forwarded to the correct next proxy towards the home AAA server. I also wanted to find out whether freeradius working as a proxy would modify the NAI it received in the User-Name attribute and prepare a new one (with this proxy's FQDN stripped out), do a lookup in the realms routing table, find the IP address of the FQDN of the next proxy and forward it to the next proxy. Any links to documentation on how to achieve this with freeradius would be appreciated. thanks Dhaval.

2 1

Beginner question
by Khan 22 Jun '06

22 Jun '06

Hi to all, I just register to the ML as I'm looking for specific item in freeradius without being able to find any help. Even if google is supposed to be my friend, it was not in that cases ;) My first one is to use several root CA in an EAP-TLS config. There is a line for "root CA List", but how can I set 2 root CAs or more ? I tried to have the line several times and also separate the rootCAs file names by a comma (,). None of this attempts seems to work. What am I doing wrong ? Is it possible to do it, and if so, how ? The second one is regarding an EAP-TLS connection. My client get authenticated properly using the certificates (CISCO's AP), but I noticed that when authenticated, there is no more "traffic" with the radius server. Is it possible to force FreeRadius or the CISCO AP to verify the authenticated client regurlarly in a similar way DHCP is done ? I don't want to kill the connection, traffic between AP/client should still be running. Many thanks for the help you may provide. Regards Khan

3 2

Re: So how do you suppress
by Walter Reynolds 22 Jun '06

22 Jun '06

Well that did not work. That is what I was trying to look at the C file. If needed I can paste my whole config if needed, but here is that one section of the config: suppress { User-Password } Here is output form radius debug: rad_recv: Access-Request packet from host 198.111.224.36:32798, id=106, length=138 User-Name = "simple" User-Password = "abc123" NAS-IP-Address = 198.111.224.36 Service-Type = Login-User Framed-IP-Address = 141.213.227.94 Called-Station-Id = "00:07:E9:D1:8F:C2" Calling-Station-Id = "" NAS-Identifier = "wg-lab1100.ilab" Acct-Session-Id = "00:07:E9:D1:8F:C2:1151002507" NAS-Port-Type = Wireless-802.11 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/198.111.224.36/auth-detail-20060622' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/198.111.224.36/auth-detail-20060622 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_realm: No '@' in User-Name = "simple", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "simple" rlm_realm: Proxying request from user simple to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry simple at line 77 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [simple/abc123] (from client wg-lab1100.ilab port 0 cli ) Sending Access-Accept of id 106 to 198.111.224.36 port 32798 Finished request 0 Am I misinterpreting what tihs does or missing something? > Date: Thu, 22 Jun 2006 19:09:22 +0200 > From: Stefan Winter <stefan.winter(a)restena.lu> > Subject: Re: So how do you suppress > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <200606221909.22270.stefan.winter(a)restena.lu> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > >> So how do I actually suppress the user password from the detail log based >> on this? Looking at the rlm_detail file and I might as well be looking at >> a foreign language. > > I don't use this directive, so I might be wrong but my guess is: you don't > need to look at the source of rlm_detail (which is indeed written in a > foreign language, it's called "C") but have to add this directive in > radiusd.conf, in the instances of > detail ... { > ... > suppress > } > > If that doesn't do it, it was wrong. Then you would need to wait for someone > with more knowledge in this list to clear things up. > > Greetings, > > Stefan Winter > > -- > Stefan WINTER > > Fondation RESTENA - R�seau T�l�informatique de l'Education Nationale et de > la Recherche - Ing�nieur de recherche > > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > > > > -- Walter Reynolds University of Michigan

2 1

rlm_exec
by Leandro Pereira de Lima e Silva - ViaLink 22 Jun '06

22 Jun '06

Hello everybody, does anyone knows what rlm_exec module does? Thanks, -- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay

3 5

Can you use TLS and Request users authentication as well
by Walter Reynolds 22 Jun '06

22 Jun '06

Hi, What I am trying to figure out is a way to not only have a certificate, but a secondary way to verify that that certificate is being used by a person we allow. If we put cert onto a machine, we have authenticated that the cert was trusted. The problem is coming from a university, we do not have a way to control a users machine. So a user could take that certificate and put it onto a friends machine. This friend may not be affiliated and should not have access. So I would like to use the cert as machine authentication and then follow up with another (username/pass) using the KRB module. Is this something that can be done? Has anyone run into a similar problem and what did they do? I know we could go TTLS and not have a machine cert, but then we get fears of man-in-the-middle. Thanks. -- Walter Reynolds University of Michigan

5 9

RE: Re: PEAP Auth
by Scott Hughes 22 Jun '06

22 Jun '06

The exact error is: rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[9]: eap: Module instantiation failed. The entire startup log is here: Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[9]: eap: Module instantiation failed. Thanks, Scott >------- Original Message ------- >From : Stefan Winter[mailto:stefan.winter@restena.lu] >Sent : 6/22/2006 12:51:54 AM >To : scott(a)renshawauto.com; freeradius-users(a)lists.freeradius.org >Cc : >Subject : RE: Re: PEAP Auth > >Hi, > Freeradius. I still get the same error message on startup regarding no > file for TLS. > > I have searched the Debian site, the Freeradius site, and the web in > general and cannot seem to find out how to fix this. > > Does anyone know? How should we? You don't even tell us what the error is. "OMG, an error!" is not enough to effectively help you. Please stick to the common, well-documented process of posting your log files. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 3