September 2006 - Freeradius-Users - lists.freeradius.org

Using CVS, Unknown host cvs.freeradius.org. why happen error?
by 나종현 13 Sep '06

13 Sep '06

2 1

Re: Re: Re: IAS e Openser
by Artur Hayne 13 Sep '06

13 Sep '06

Olá a todos, Como faço para transformar o Freeradius num cliente do IAS? Existe algum tutorial, ou artigo? Se for sem passar pelo servidor freeradius eu já configurei o radiusclient para ir direto ao IAS, mas não deu certo, nada acontece, e o pior de tudo que não tenho nem como debugar o problema e o arquivo de log do IAS é muito fraco. |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| Da pra fazer isso? Como faço isso? Alguma idéia? Obrigado. ----------------------------- Marcos escreveu: Pessoal, facam o seguinte: - instale o IAS no windows - esse software atua como um radius server - configure o freeradius para atuar como um radius client, usando o IAS como radius server. pronto, assim fica mais facil. infelizmente o windows nao eh 100% LDAP. o AD do windows 2003 eh mais LDAP que o AD do windows 2000, mas mesmo assim nao sao 100% compativeis com o padrao LDAP. []s Marcos --- Marcelo Costa escreveu: > Arthur, > > qual ? a pesquisa que o freeradius est? fazendo no > ldap? > o que tem no users.conf? > > eu f? utilizei freeradius+ldap sem problemas. > > []s > Marcelo Costa > > Em 20/8/2006, "Artur Hayne" > escreveu: > > >Ol? a todos, > > > > Eu tenho um problema que parece n?o haver > solu??o. Tenho um servidor openser que deve > autenticar os usu?rios no servidor ldap Active > Directory atrav?s do FreeRadius. Consigo estabelecer > uma se??o do Freeradius com o AD, porem quando o > usu?rio tenta se autenticar atraves de um > softphone, passando pelo FreeRadius, aparece um > erro. > > > > Vejam aqui o debug do Radius: > > > > radius_xlat: 'ou=bli,dc=blo,dc=blu,dc=br' > > rlm_ldap: ldap_get_conn: Checking Id: 0 > > rlm_ldap: ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in > ou=bli,dc=blo,dc=blu,dc=br, with filter (uid=jab) > > rlm_ldap: object not found or got ambiguous > search result <---------- essa linha!!! > > rlm_ldap: search failed <---------- essa linha!!! > > rlm_ldap: ldap_release_conn: Release Id: 0 > > modcall[authorize]: module "ldap" returns > notfound for request 47 <---------- essa linha!!! > > modcall: leaving group authorize (returns ok) for > request 47 > > rad_check_password: Found Auth-Type DIGEST > > auth: type "digest" > > Processing the authenticate section of > radiusd.conf > > modcall: entering group authenticate for request > 47 > > rlm_digest: Configuration item "User-Password" or > MD5-Password is required for authentication. > <---------- essa linha!!! > > modcall[authenticate]: module "digest" returns > invalid for request 47 <---------- essa linha!!! > > modcall: leaving group authenticate (returns > invalid) for request 47 > > auth: Failed to validate the user. <---------- > essa linha!!! > > > > Eu vi alguns tutoriais mostrando como autenticar > no dominio utilizando a ferramneta ntlm_auth, mas > ela parece que so funciona com o protocolo mschap, > sendo que o Openser utiliza o digest para > autenticar. > > No radiusd.conf o digest e o ldap est?o > descomentados tanto para autentica??o como para > autoriza??o. > > ? necess?rio fazer alguma configura??o nos > aquivos users ou em outro? > > Eu ainda estou tentando entender um pouco mais do > Freeradius. > > > > Obrigado. > > > > > > > >--------------------------------- > > O Yahoo! est? de cara nova. Venha conferir! > >__ > >masoch-l list > >https://eng.registro.br/mailman/listinfo/masoch-l > __ > masoch-l list > https://eng.registro.br/mailman/listinfo/masoch-l > --------------------------------- Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. Registre seu aparelho agora! --------------------------------- Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. Registre seu aparelho agora!

2 1

Proxy Control
by Josh 12 Sep '06

12 Sep '06

I have a VPN appliance authenticating users (~20 users) against my freeradius server. I have another radius server running on a windows box authenticating users on local and trusted domains (250+ users). For technical reasons I can't point the VPN appliance to the windows radius server. However, I'm setting up a proxy on the freeradius server to redirect auth requests to the windows radius server (to authenticate VPN users with active directory). The problem now is all 250+ users can essentially authenticate on the VPN. I'm wondering if there is a way to control which users (the ~20 users) in freeradius can be proxied to the windows radius server? Almost like a list of valid proxy users? Josh __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 4

FreeRadius suport IPv6 ??????????????/
by 나종현 12 Sep '06

12 Sep '06

3 3

Probs with pppoe-server + radius
by Ali Jawad 12 Sep '06

12 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys Iam using freeradius on a debian sarge box. I use the following : noccbox:~# freeradius -v freeradius: FreeRADIUS Version 1.1.2, for host , built on Jul 2 2006 at 11:19:11 noccbox:~# uname -a Linux noccbox 2.6.8-3-686 #1 Sat Jul 15 10:32:25 UTC 2006 i686 GNU/Linux I have dialup-admin installed and configured sql.conf accordingly. I have downloaded NTRadping and added my windows machine to the /etc/raddb/clients file. Then I sent an authenication request using my root password "WITH CHAP TURNED OFF". It was successfull and I got the following reply. Sending authenication request to server 192.168.1.1:1812 Transmitting packet, code=1 id=12 length=44 receied reponse from server in 16 milliseconds reply packet code=2 id = 12 length=20 reponse: Access-Accept Then I did the same test with "CHAP TURNED ON" the test failed and returned the following: Sending authenication request to server 192.168.1.1:1812 Transmitting packet, code=1 id=13 length=45 receied reponse from server in 2000 milliseconds reply packet code=3 id = 13 length=20 reponse: Access-Reject The info above is to help you guys in helping me pinpoint my prolem, my real problem is that I can dial into my server using pppoe and simple chap and/or pap authenication. However once I use radius to authenicate the pppoe-dialup requests into the server. I get the following output in pppd.log Using interface ppp0 Connect: ppp0 <--> /dev/pts/1 rc_read_mapfile: can't read /etc/radiusclient/port-id-map: No such file or directory RADIUS: Can't read map file /etc/radiusclient/port-id-map Peer root failed CHAP authentication Connection terminated. pppoe: read (asyncReadFromPPP): Session 4: Input/output error Terminating on signal 15 Using interface ppp0 Connect: ppp0 <--> /dev/pts/1 Terminating on signal 15 Connection terminated. Modem hangup pppoe: read (asyncReadFromPPP): Session 5: Input/output error Any help would be welcome. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFBl7rkgA8mKGs24MRAjgCAKChmFQ5NRD3v06cz22AKLe9INM2gACeK/ja teE0/8nQfY7xagP3BJ2CT7o= =+Vfz -----END PGP SIGNATURE-----

2 2

STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the comunication-----------------------------------
by ego seek 12 Sep '06

12 Sep '06

Does Anybody know HOW I can make radius WORK with md5-stored password in the db? I use EAP-PEAP-MSCHAPv2, and if the system works great if the pwds are in clear in the mysqlDB best regards. Nicola

4 3

FreeRADIUS install time errors on Solaris
by Ronak Sutaria 12 Sep '06

12 Sep '06

Hello, I am trying to compile and install the latest FreeRADIUS version 'freeradius-1.1.3' on Solaris 5.8 I am able to run the './configure' and 'make' commands, but when I run 'make install' I'm getting the following error: /nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/install-sh -c -c .libs/libradius.lai /usr/local/lib/libradius.la /nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/install-sh -c -c .libs/libradius.a /usr/local/lib/libradius.a chmod 644 /usr/local/lib/libradius.a ranlib /usr/local/lib/libradius.a /nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/libtool: ranlib: command not found make[4]: *** [install] Error 127 make[4]: Leaving directory `/nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/src/lib' make[3]: *** [common] Error 2 I can gather that my solaris instance is missing the 'ranlib' command- but I was wondering if someone could tell me which is the package I need to install on solaris for the 'make install' to work fine? Is there anything else that I could be doing wrong here? Help is much appreciated, in advance! Thanks, Ronak

2 2

Re: How to enable session-timeout in freeradius
by Ranjeet Kumar 12 Sep '06

12 Sep '06

Peter, Can you please tell me how to send it (session-timeout) as reply item to NAS? Thanks, Ranjeet Date: Sat, 9 Sep 2006 15:40:01 +0000 From: Peter Nixon <listuser(a)peternixon.net> Subject: Re: How to enable session-timeout in freeradius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200609091540.07568.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-15" On Sat 09 Sep 2006 12:24, Ranjeet Kumar wrote: > Hi, > > I am using freeradius and backend as mysql. > > Can you tell how to enable session-timeout? Simply send it as a reply item to your NAS. -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

Mac auth configuration
by Vineet Verma 11 Sep '06

11 Sep '06

Hi, I have been able to configure FreeRadius to successfully authenticate a client based on the MAC address with entries like: 00-0c-41-5f-91-4b Auth-Type := Local, User-Password == "00-0c-41-5f-91-4b" Acct-Interim-Interval = 60 Is there any way to configure it so I don't have to list every client? For example can I have some kind of glob as follows, say for all clients with OUI 00-0c-41: 00-0c-41-* Auth-Type := Local, User-Password == "00-0c-41-5f-91-4b" Acct-Interim-Interval = 60 If not, how do I do something like this? Thanks, Vineet

2 2

auth flow according to attribute value
by Giuseppe Tricarico 11 Sep '06

11 Sep '06

Hi all I'm new to freeradius, I would like to know if there is a module that basing on some attribute of the radius request execute a module, i.e. I want to alter the execution flow of the authorize section ... This give me the possibiltity to manage some "business logic" through the configuration of radius server... For example I could analize the "nas-port-type" attribute in the request and autheticate users on different database, basing on such parameter.. Best regards Giuseppe Tricarico

3 2