March 2007 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 23, Issue 13
by Arran Cudbard-Bell 06 Mar '07

06 Mar '07

> Dana 5/3/2007, "Tim Tyler" <tyler(a)beloit.edu> pi?e: > >> Freeradius experts, >> I am trying to configure freeradius to use openldap as a backend >> for authentication, but I can't seem to get the passwords to >> authenticate. It seems to have no problem binding and finding the >> username (uid). I am using crypt passwords in the ldap userPassword field: >> userPassword:: e1NTSEF9aXBWQklEYnZYSU9RdWl2V0ZtdGR5MWxIWFFsZWVCMjQ= >> >> I am not using any radius attributes. I simply want to allow any >> uid to authenticate. I get these results: >> >> rad_recv: Access-Request packet from host 144.89.40.8:59881, id=60, length=59 >> User-Name = "tylertj" >> User-Password = "xxxxxx" >> NAS-IP-Address = 255.255.255.255 >> NAS-Port = 1812 >> rlm_ldap: - authorize >> rlm_ldap: performing user authorization for tylertj >> rlm_ldap: ldap_get_conn: Checking Id: 0 >> rlm_ldap: ldap_get_conn: Got Id: 0 >> rlm_ldap: (re)connect to ldap.beloit.edu:389, authentication 0 >> rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer >> rlm_ldap: starting TLS >> rlm_ldap: bind as / to ldap.beloit.edu:389 >> rlm_ldap: waiting for bind result ... >> rlm_ldap: Bind was successful >> rlm_ldap: looking for check items in directory... >> rlm_ldap: looking for reply items in directory... >> rlm_ldap: user tylertj authorized to use remote access >> rlm_ldap: ldap_release_conn: Release Id: 0 >> rad_recv: Access-Request packet from host 144.89.40.8:59881, id=60, length=59 >> Sending Access-Reject of id 60 to 144.89.40.8:59881 >> >> >> What might I be doing wrong? I presume that the ldap server >> doesn't have to store the passwords in plain text, correct? I can >> store them in md5 or SHA1 hash if I want, correct? I did uncomment: >> >> authenticate { >> Auth-Type LDAP { >> ldap >> } >> >> Am I wrong to think this is now a password issue? >> Tim >> >> >> >> >> >> Tim Tyler >> Network Engineer - Beloit College >> tyler(a)beloit.edu >> You need to prefix your crypt password with {crypt}, else LDAP won't know which hashing scheme your using, and when you attempt a v3 bind it'll treat your crypted password as plaintext. Also, in order to use crypted password you'll need a authentication mechanism that supports reversible encryption, like PAP or GTC. -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Unversity of Sussex | Infrastructure Services ++441273873900/ext:3900

1 0

Some problem
by zhangxianshi 06 Mar '07

06 Mar '07

Dear All, I use a Linux system called Ubuntu. Yesterday I tried to complier the freeradius 1.1.4. When I begun to make, there is something wrong. This is the error log: Making all in rlm_passwd... make[6]: Entering directory `/home/stone/freeradius-1.1.4/src/modules/rlm_passwd' make[6]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules/rlm_passwd' Making all in rlm_perl... make[6]: Entering directory `/home/stone/freeradius-1.1.4/src/modules/rlm_perl' /home/stone/freeradius-1.1.4/libtool --mode=link gcc -release 1.1.4 \ -module -export-dynamic -o rlm_perl.la \ -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /home/stone/freeradius-1.1.4/src/lib/libradius.la \ `perl -MExtUtils::Embed -e ldopts` -lnsl -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/stone/freeradius-1.1.4/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /home/stone/freeradius-1.1.4/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.1.4.so -o .libs/rlm_perl-1.1.4.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/stone/freeradius-1.1.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/stone/freeradius-1.1.4/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/stone/freeradius-1.1.4' make: *** [all] Error 2 How can I slove it? Regards Zhang

4 4

freeradius + mssql error
by satish patel 06 Mar '07

06 Mar '07

Dear I have useing freeradius with mssql and it was working fine but last day when i restrat radius server i got error like this '22018 [unixODBC][FreeTDS][SQL Server]Syntax error converting the datetime value '1900-01-01' to a column of data type int.' what is this ?? Satish Patel $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Upgrading 1.0.5 to 1.1.4
by Linda Pagillo 06 Mar '07

06 Mar '07

Hi everyone. I'm currently running FreeRadius verison 1.0.5 on a Linux Redhat 9 server. I need to upgrade my FreeRadius to the latest, greatest version 1.1.4. Awhile back i upgraded from 0.9.3 to 1.0.5, but for the life of me i can't remember how to do the upgrade without completely messing up my current configuration. Can anyone provide exact instructions on how to go from 1.0.5 to 1.1.4 without changing the config files? Thanks.

3 3

how to install n configure freeradius on suse 10.1
by Pojan Junior 06 Mar '07

06 Mar '07

hi, my name pojan. i have a problem about "how to install n configure freeradius on suse 10.1" and i want test the server freeradius with the Pc (Personal Comp) (LAN, Cross Cable). please help me!! thanx, Pojan --------------------------------- Any questions? Get answers on any topic at Yahoo! Answers. Try it now.

1 0

Re: one passwd to many users
by Sam Schultz 05 Mar '07

05 Mar '07

You could add an entry like "User-Password == <your_password_here>" to a default entry in freeradius' users file (/etc/raddb/users, usually), or do something similar using a group if you have some user accounts that will need to have different passwords. In that case, you'd need to use "Group == <your_group_name>" for each user entry that would use the shared password, and the group entry itself would contain the "User-Password == <your_password_here>" line. On Mon, 05 Mar 2007 12:38:53 -0500 Eddy Marcos Rebolledo Velez <emarcos(a)inutil.com.mx> wrote: >Hi > >I need to configure one password for many users, how can i do it? >because I want to change the passsword for example every week, but >not one by one > > >I have my freeradius with mysql > >regards > >Cordialmente > >Eddy Marcos Rebolledo >IT Support >Tel. Oficina (52) 1164 1178 >Tel. Home (52) 5380 9378 >Tel Movil 04455 5506 7823 >http://www.hoteldemexico.com -- Click to publish your book fast with high quality presses http://tagline.hushmail.com/fc/CAaCXv1IpqiCMyykA8Do4m7huQZvigqZ/

1 0

Login-Time
by Joseba Beltrán 05 Mar '07

05 Mar '07

Hi all, Im testing a new conf. using Login-Time. It works fine until I try to define 2 timespans for a day. For example if I define a new user, called "test" with this radcheck data: mysql> select * from radcheck where UserName='test'\G *************************** 1. row *************************** id: 320 UserName: test Attribute: Login-Time op: := Value: Mo0001-0940,Mo0952-2359 1 row in set (0.00 sec) I can login ok between the first timespan (00:01 to 09:40), but it's impossible during the second one (09:52 to 23:59). Maybe there is someting incorrect in the time string. Any help? All the best! Joseba

2 3

one passwd to many users
by Eddy Marcos Rebolledo Velez 05 Mar '07

05 Mar '07

Hi I need to configure one password for many users, how can i do it? because I want to change the passsword for example every week, but not one by one I have my freeradius with mysql regards Cordialmente Eddy Marcos Rebolledo IT Support Tel. Oficina (52) 1164 1178 Tel. Home (52) 5380 9378 Tel Movil 04455 5506 7823 http://www.hoteldemexico.com

1 0

guest acces?
by Matt Ashfield 05 Mar '07

05 Mar '07

Hi, I'm using EAP-TTLS-PAP aginst LDAP, however I want to provide guest access to users without adding these users to the LDAP directory. I know I could add them as local users to the /etc/raddb/users file, but that would involve a SIGHUP, and I'd prefer to avoid that if I could. Instead, what I'd like to do is create a user account on the radius server itself (with nologin, and an expiry, no rights, etc..). This could be done "on-the-fly" and therefore require no such SIGHUP. Now I know Alan does not recommend DEFAULT Auth-Type, but for here, I think it might be necessary. So in my users file, I added the following: DEFAULT Auth-Type := System Fall-Through = Yes Thinking that would allow my users who have accounts on the server to login. However, that is not working because in the logs in debug mode I see: Debug: modcall: group authorize returns ok for request 0 Debug: rad_check_password: Found Auth-Type System Debug: auth: type "System" Debug: ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. Debug: auth: Failed to validate the user. I'm sure it's something small I'm missing, but can't find it. That or this is not possible and I'm missing the reason why for that too! Any advice is appreciated. Thanks Matt mda(a)unb.ca

2 4

/dev/shm aware?
by Charles Tompkins 05 Mar '07

05 Mar '07

I am running the RHEL rpm version of freeradius 1.0.1 on CentOS 4.4 and I was wondering if freeradius is /dev/shm "aware" or if it needs to be configured to use it? Thanks, -Charles ------------ Master timed out! Holding election... I am declaring myself the master! CONFIDENTIAL NOTICE: This email including any attachments, contains confidential information belonging to the sender. It may also be privileged or otherwise protected by work product immunity or other legal rules. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on the contents of this emailed information is strictly prohibited. If you have received this email in error, please immediately notify us by reply email of the error and then delete this email immediately.

2 1