August 2006 - Freeradius-Users - lists.freeradius.org

RE: Web up
by Joel Eddy 25 Aug '06

25 Aug '06

Site up from here in Iowa Joel

1 0

RE: No memory
by Hasan Ovuc 25 Aug '06

25 Aug '06

I believe to solve my problem. I installed linux machine with xfs file system. Xfs file system gives all memory to radius and cached it. Even I try to start radiusd it gives no memory error. I set echo 2 > /proc/sys/vm/overcommit_memory onto the my system. Related link: http://www.win.tue.nl/~aeb/linux/lk/lk-9.html > -----Original Message----- > From: > freeradius-users-bounces+hasan.ovuc=superonline.net(a)lists.free > radius.org > [mailto:freeradius-users-bounces+hasan.ovuc=superonline.net@li > sts.freeradius.org] On Behalf Of Hasan Ovuc > Sent: Friday, August 18, 2006 6:10 PM > To: Peter Nixon; freeradius-users(a)lists.freeradius.org > Subject: RE: No memory > > > FC5 > kernel-smp-2.6.15-1.2054_FC5 > > Additional info: > Sybase ODBC-12_5 odbc drivers > > Which db connection type do you suggest to connect SYBASE database ? > > Rlm_unixodbc, rlm_iodbc or rlm_perl > > > > > -----Original Message----- > > From: Peter Nixon [mailto:listuser@peternixon.net] > > Sent: Friday, August 18, 2006 3:22 PM > > To: freeradius-users(a)lists.freeradius.org > > Cc: Hasan Ovuc > > Subject: Re: No memory > > > > On Fri 18 Aug 2006 14:39, Hasan Ovuc wrote: > > > Dear Members, > > > > > > I am trying to use > > > freeradius-snapshot-20060817 > > > unixODBC-2.2.11 > > > ODBC-12_5 > > > > > > Radiusd successfully started, after first sql query it > dies with no > > > memory error. > > > > Which Linux version? > > > > -- > > > > Peter Nixon > > http://www.peternixon.net/ > > PGP Key: http://www.peternixon.net/public.asc > > > > > > Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya > kuruma ozeldir. Eger dogru kisiye ulasmadigini > dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya > herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde > bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece > gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test > edilmistir. > > This e-mail and any files transmitted with it are > confidential and intended solely for the use of the > individual or entity to whom they are addressed. If you are > not the intended recipient you are hereby notified that any > dissemination, copying or use of the information is > prohibited. The opinions expressed in this message belong to > sender alone. There is no implied endorsement by > SUPERONLINE.This e-mail has been scanned for all known > computer viruses. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

4 5

RE: Everything should be back up now...
by Geoff Dornan 25 Aug '06

25 Aug '06

Backup and working from South Africa :-) -----Original Message----- From: freeradius-users-bounces+geoff=cmcnetworks.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+geoff=cmcnetworks.net@lists.freeradius. org] On Behalf Of Alan DeKok Sent: Friday, August 25, 2006 5:09 PM To: freeradius-users(a)lists.freeradius.org Subject: Everything should be back up now... I transferred the domain to a different registrar, who discarded the name server information, and pointed the web site to their machines. I will be expressing my concern with this behavior. It should be back up. Sorry for the problem. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Everything should be back up now...
by Alan DeKok 25 Aug '06

25 Aug '06

I transferred the domain to a different registrar, who discarded the name server information, and pointed the web site to their machines. I will be expressing my concern with this behavior. It should be back up. Sorry for the problem. Alan DeKok.

1 1

Freeradius Domain name (& website) registration expired ?
by Jeff Green 25 Aug '06

25 Aug '06

Can anyone else get to http://www.freeradius.org ? I'm getting redirected to a domain name registration of some ISP. Seems like the domain names registration has expired ??? ------------------------------------------------------------------------ Confidentiality Note: The information contained in this email and document(s) attached are for the exclusive use of the addressee and may contain confidential, privileged and non-disclosable information. If the recipient of this email is not the addressee, such recipient is strictly prohibited from reading, photocopying, distribution or otherwise using this email or its contents in any way. Please notify the Sapiens (UK) Ltd. Systems Administrator via e-mail immediately at networksupport(a)sapiens.co.uk, if you have received this email in error. Disclaimer: The views, opinions and guidelines contained in this confidential e-mail are those of the originating author and may not be representative of Sapiens (UK) Ltd. ------------------------------------------------------------------------

8 9

Eap-Tls Problem
by Matteo Lazzarini 25 Aug '06

25 Aug '06

Freeradius I have installed last version available (1.1.2 that it seems to work!) but I know that there is also an August version SNAPSHOT but to me it has given problems in compile and did not install me module EAP-TLS (bug Debian). The lib I have installed to them with the command apt-get install openssl libssl-dev and this is the command dphg - l|grep SSL ii libflac++5c2 1.1.2-1ubuntu2 Free Lossless Audio Codec - C++ runtime libr ii libflac7 1.1.2-1ubuntu2 Free Lossless Audio Codec - runtime C librar ii liboggflac3 1.1.2-1ubuntu2 Free Lossless Audio Codec - runtime C librar ii libssl-dev 0.9.7g-1ubuntu1.1 SSL development libraries, header files and ii libssl0.9.7 0.9.7g-1ubuntu1.1 SSL shared libraries ii libwww-ssl0 5.4.0-9ubuntu0.5.10 The W3C-WWW library (SSL support) ii openssl 0.9.7g-1ubuntu1.1 Secure Socket Layer (SSL) binary and related ii python-pyopenssl 0.6-2ubuntu1 Python wrapper around the OpenSSL library (d ii python2.4-pyopenssl 0.6-2ubuntu1 Python wrapper around the OpenSSL library, e ii ssl-cert 1.0-11 Simple debconf wrapper for openssl On the Openssl site many versions can be downloaded which 0.9.7a-x, 0.9.8a-x, ecc.. Which the correct version? Someone knows gives to me of the information to care of coupled freeradius-version&Openssl-version? anticipated thanks Matteo

2 3

Active Directory/freeradius/enterasys - combination
by Michael Messner 24 Aug '06

24 Aug '06

hello, we are testing the 802.1x authentication in a small test network. (http://www.enterasys.com/products/whitepapers/secure-networks-wp.pdf) The user management works via an active directory on a Windows 2003 server, a Freeradius on a Linux machine, and the switch is an Enterasys Matrix-series. Windows 2003 (AD) <---> Freeradius <---> Enterasys switch <---> Linux/MS-Client The user is able to authenticate with PEAP and MD5 from a Linux and a Windows Client. Active Directory and Freeradius (ntlm_auth) give the OK as well. The Enterasys switch is dynamically configured with the Policy Manager. Therefore it is possible to define rules for various user groups, and in the AD different user groups are defined. Now the switch needs the group to user information from the AD with the filter ID, which normally looks like this: Filter-Id = "Enterasys:version=1:mgmt=su:policy=adminrole" If I define the users on the Radius with the help of the users file it is no problem and it works perfectly, but how can I use the information from the AD? The problem is that the users are correctly authenticated, but the switch doesn't have information what to do with these users and they get an invalid role and furthermore they don't get access to the network (they are assigned to the default role which is a blocking role)! We made the first tests with the IAS from Microsoft where we created different "Remote Access Policies", and there we added the different user groups from the AD. I've not found anything in the Internet concerning this very matter, so I hope someone of you can give me more information how this can be realized. Thanks! mIke

6 12

Re: Cannot compile and run on Mac OS X 10.4.7
by Lasse 24 Aug '06

24 Aug '06

I followed the info in the Mac OS Read Me file, which is included in the Docs folder I believe. I uncommented the references to rlm_eap and rlm_sql, but see the Doc for more info on how to do that and where. /L Den 24/08/2006 kl. 17.04 skrev Michael Check: > On 8/24/06, Lasse <lassejakobsen(a)mac.com> wrote: >> I can't say for sure what the problem is, but 1.0.5 is the last one I >> have been able to get running on Mac OS X. > > Thanks Lasse, can you tell me a bit about your environment in which it > worked? (OSX version, DeveloperTools version, platform, etc.) Did > you change anything at compile or run time? > > Thanks, > > Michael Check > - List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html

1 0

processes invoked goes <defunct>
by Fabio Pedretti 24 Aug '06

24 Aug '06

I have just upgraded to 1.1.3, but I get again the same error. Fabio > "Fabio" <fabio.ped at libero.it> wrote: > > Install 1.1.2. > > Alan DeKok. My previous message (Thu Jun 1 15:21:59 CEST 2006): Hi, I am using freeradius 1.0.5, configured so that when a user fails the password for X times, a mail is sent to a sysadmin. I have added the following to modules section: exec accept_notify { wait = no program = "/usr/local/etc/raddb/radius_reject_notify %{User-Name} accept %{FreeRADIUS-Proxied-To}" input_pairs = request } exec reject_notify { wait = no program = "/usr/local/etc/raddb/radius_reject_notify %{User-Name} reject %{FreeRADIUS-Proxied-To}" input_pairs = request } and this is my posth-auth section: post-auth { accept_notify Post-Auth-Type REJECT { reject_notify } } radius_reject_notify is the bash script attached. However, when a user log in and the script is executed, I see that the script remains in a <defunct> state. After some time I see hundreds of such processes: Output of ps -e: 13110 ? 00:00:00 radius_reject_n <defunct> 13232 ? 00:00:00 radius_reject_n <defunct> 13233 ? 00:00:00 radius_reject_n <defunct> .... Has someone idea why freeradius does not close correctly my script? Thanks, Fabio radius_reject_notify: #!/bin/bash # #Sintax: # #mail_notify user access type # user: user name # access: accept or reject # type: accepted only if ( == FreeRADIUS-Proxied-To ) == 127.0.0.1 # # TRY: number of retry TRY=10 FAILED_USERS_DIR=/tmp/radius_user_fail/ MAIL_ADMINS="admin at domain.com" USER_RETRY=0 CURRENT_USER=$1 ACCESS=$2 failed() { mkdir -p $FAILED_USERS_DIR if [ -e $FAILED_USERS_DIR/$CURRENT_USER ] then USER_RETRY=`cat $FAILED_USERS_DIR/$CURRENT_USER` fi USER_RETRY=$(( USER_RETRY + 1 )) echo $USER_RETRY > $FAILED_USERS_DIR/$CURRENT_USER if (( USER_RETRY == $TRY )) then #Limit exceded! send_mail fi ; } success() { if [ -e $FAILED_USERS_DIR/$CURRENT_USER ] then rm -f $FAILED_USERS_DIR/$CURRENT_USER fi } send_mail() { HOSTNAME=`hostname` env MAILRC=/dev/null from=radius.admin@$HOSTNAME smtp=smtp.domain.com nail -n -s "RADIUS - Autentication failed $TRY times" $MAIL_ADMINS <<-END $CURRENT_USER failed authentication for $TRY times. END } case $3 in '127.0.0.1') case $ACCESS in 'accept') success ;; 'reject') failed ;; esac ;; esac

2 1

MSCHAP-SUCCESS message in TTLS/MSChapV2
by Andrew 24 Aug '06

24 Aug '06

Hi, I am trying to use wpa_supplicant with freeradius server. I am using FreeRadius server version 1.1.2. I read a wpa_supplicant document saying the FreeRadius server does not send MSChap-Success message at the end of a successful TTLS/MSCHAPV2 authentication. It only sends EAP-Success. Is that true? Is there anyway to fix this? Thanks, Andrew -- http://www.fastmail.fm - Access your email from home and the web

2 1