January 2007 - Freeradius-Users - lists.freeradius.org

RPM Build-error
by King, Michael 30 Jan '07

30 Jan '07

I'm trying to create a Redhat RPM from the nightly CVS snapshots. (Following the Wiki instructions) I've tried a few different snapshot dates, and they all die with the attached error. I'm not too familiar with RedHat packaging. Any idea what I've done wrong? Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/freeradius-root error: Installed (but unpackaged) file(s) found: /usr/include/freeradius/hash.h /usr/include/freeradius/libradius.h /usr/include/freeradius/md4.h /usr/include/freeradius/md5.h /usr/include/freeradius/missing.h /usr/include/freeradius/packet.h /usr/include/freeradius/radius.h /usr/include/freeradius/radpaths.h /usr/include/freeradius/sha1.h /usr/include/freeradius/token.h /usr/include/freeradius/udpfromto.h RPM build errors: Installed (but unpackaged) file(s) found: /usr/include/freeradius/hash.h /usr/include/freeradius/libradius.h /usr/include/freeradius/md4.h /usr/include/freeradius/md5.h /usr/include/freeradius/missing.h /usr/include/freeradius/packet.h /usr/include/freeradius/radius.h /usr/include/freeradius/radpaths.h /usr/include/freeradius/sha1.h /usr/include/freeradius/token.h /usr/include/freeradius/udpfromto.h

2 6

RSA / Smart Cards
by Joseph 30 Jan '07

30 Jan '07

Does anyone have pointers on setting up a solution where freeradius authenticates against an RSA Secure ID or a smart card? Is there a good package that supports some sort of standard password-less authentication? Any experiences using smart cards or RSA Secure IDs with Linux would be welcomed. respectfully, Joseph

3 4

(no subject)
by Jorge Martinez de Salinas Vazquez 30 Jan '07

30 Jan '07

Hello everybody! We are trying to assign configuration parameters to the supplicants based on RADIUS decision. I would like to know is someone else is working on it and if there is an easy way to send this parameters directly to the supplicant. I have read the RFC 4014 which shows a way to assign network configuration to the supplicant through a DHCP server, but it is very specific (just networking options). Thanks in advance.

2 1

radiusd and oracle accounting
by Dourty, Brian R. (IATS) 30 Jan '07

30 Jan '07

We have configured our radius servers to send accounting information to an Oracle database. It works our really well except when the oraclce database server isn't available (I.E. maintenance or cold backups). The radius process dies when it loses connectivity to the oracle server. Has anyone else noticed this problem? Any suggestions on how to make radiusd more robust and able to recover from this? Thanks, Brian Dourty System Administrator - Team Lead IAT Services University of Missouri - Columbia 573-882-1035

4 4

RE: LAN accounting
by Josh Howlett 29 Jan '07

29 Jan '07

> >>>I'm newbie,I wanna know that can i use FreeRadius+Dialup_admin as a > >>>LAN accounting? > >>It means that i use them without dialing? > > > > the name "dialup"_admin is a bit misleading. You can as > well manage LAN users > > with them. > > It's a generic user management system. > > agree if RADIUS is used to authenticate users, > but they're asking about accounting. > Besides there's no way to prevent connection to LAN switches > with RADIUS Yes - 802.1x > and restrict internal communication between local hosts. Kinda - Dynamic VLAN allocation. Josh.

2 1

EAP-TTLS inner auth methods for 802.1x
by James Lever 29 Jan '07

29 Jan '07

I have configured a working EAP-TLS system and am now migrating to use EAP-TTLS (with both client side certificates and a password authentication mechanism). I'm stuck trying to work out how to avoid sending the password unhashed to the server and think that some form of CHAP/MSCHAPv2 might be the right way to go. My current thoughts are that I should use PAP with SHA1 or SSHA1 but I seem to get the right config (if it is even possible). So, with this problem, can anybody suggest a way to use SHA1/SSHA1 or some other form of cryptographically secure, non-cleartext password within the inner authentication mechanism of EAP-TTLS for use in WPA2 Enterprise/802.1x. If this is feasible/possible, are there any gotcha's with the various supplicants to getting this to work from the client side and avoiding sending the passwords in cleartext (inside the EAP-TLS tunnel). Also, while I'm here, any suggestions for an appropriate backend password store so that there is never a cleartext password except for the initial entry (password change) on the server side would be appreciated. cheers, James

3 4

PEAP Fast Reconnect
by King, Michael 29 Jan '07

29 Jan '07

Does FreeRADIUS support PEAP Fast Reconnect?

3 3

rlm_python
by Peter Nixon 29 Jan '07

29 Jan '07

Hi Guys Is anyone actually using rlm_python in production? Unlike rlm_perl we don't seem to have any example code or any decent documentation. I am looking at using it myself and just looking for some feedback.. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

4 5

3Com SuperStack3 4400
by diego＠gigadata.it 29 Jan '07

29 Jan '07

Hi, I'm authing about 60 3com 4400 switch with mysql. Everithing goes ok until the switch sends a particular request to the server. This is the request: rad_recv: Access-Request packet from host 10.10.0.219:2049, id=57, length=87 User-Name = "a3Com" User-Password = "a3Com" NAS-Port-Type = Virtual NAS-IP-Address = 10.10.0.219 Service-Type = Administrative-User Framed-MTU = 1024 Message-Authenticator = 0xebe1ebfa3372940ad96d932c10457ff8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 84 modcall[authorize]: module "preprocess" returns ok for request 84 radius_xlat: 'a3Com' rlm_sql (sql): sql_set_user escaped user --> 'a3Com' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'a3Com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'a3Com' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'a3Com' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'a3Com' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'a3Com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 84 modcall: group authorize returns ok for request 84 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [a3Com] (from client XXXXXXXXX port 0) Sending Access-Accept of id 57 to 10.10.0.219:2049 Finished request 84 Going to the next request This is OK, but switch says "The RADIUS Authentication service is not responding." The strange thing is the userame a3Com that i've never seen in any switch configuration. Is something related to including dictionary.3Com in dictionary file ? I've googled a lot and searched in 3Com knowledge base but can't find anything.

3 2

2GB problems
by Tas Dionisakos 29 Jan '07

29 Jan '07

I have setup a captive portal with mysql,chilli, and freeradius. My portal allows users access base on data use (quota), I am using the rlm_sqlcounter (from freeradius 1.1.4) to measure the usage on login. The problem Im having is that if I assign a quota more than 2gb freeradius sees the bytes in a negative value for some reason, I have attached rad logs. This is the line I dont understand (rlm_sqlcounter: Rejected user will, check_item=-1149239296, counter=0). Yet in mysql its fine! Any help with this will be greatly appreciated! rad_recv: Access-Request packet from host 127.0.0.1:32772, id=0, length=195 User-Name = "will" User-Password = "pass" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-16-CB-BE-3A-41" Called-Station-Id = "00-14-5E-18-83-D9" NAS-Identifier = "nas01" Acct-Session-Id = "45b7e66b00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0x0444eede46ea26a2629277905eb408f7 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "will", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'will' rlm_sql (sql): sql_set_user escaped user --> 'will' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'will' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'will' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'will' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'will' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='%{User-Name}'' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' rlm_sql (sql): - sql_xlat radius_xlat: 'will' rlm_sql (sql): sql_set_user escaped user --> 'will' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='will'' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user will, check_item=-1149239296, counter=0 modcall[authorize]: module "mb" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 -- ************************************* Tas Dionisakos IT Manager St Mary’s College and Newman College The University of Melbourne T: 03 9342 1708 M: 0439 655 565 E: tas(a)newman.unimelb.edu.au C: (0o (||||)(||||) o0) *************************************

3 3