March 2007 - Freeradius-Users - lists.freeradius.org

Re : OT: MAC OS X - wired 802.1x supplicant
by Eshun Benjamin 29 Mar '07

29 Mar '07

not a freeRADIUS problem but I hope that someone can help me. I have no problem with my ibook to connect to a wireless network via 802.1x but I can't find any possibility to make a connection to a 802.1x-secured wired network! Am I blind or is this not supported from OSX? Any other supplicants for OSX available? The link below will help http://docs.info.apple.com/article.html?artnum=303471 ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Michael Messner <michael.messner_edv(a)inode.at> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 28 Mars 2007, 13h45mn 51s Objet : OT: MAC OS X - wired 802.1x supplicant -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hey all, not a freeRADIUS problem but I hope that someone can help me. I have no problem with my ibook to connect to a wireless network via 802.1x but I can't find any possibility to make a connection to a 802.1x-secured wired network! Am I blind or is this not supported from OSX? Any other supplicants for OSX available? thanks for every info mIke -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGClVuyUY4xkIcFVQRAlJQAKDiVymIOJat407bwe4ox/yhY14NUgCeOeRu n1WQAIFuiE+PLLw14UZ8pjY= =XoAX -----END PGP SIGNATURE----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

LDAP + CHAP problem
by satish patel 29 Mar '07

29 Mar '07

Dear I have implement freeradius with LDAP + cisco VPDN my problem is my authentication working with PAP but when i try for authentication from CHAP it is not working error is password not clear text so i have read many document about it and ppl talking about store passwd in clear text but also i have ass passwd in clear text still it is not working $cat users.ldif dn: uid=example,ou=users,ou=radius,dc=tulipit,dc=com objectClass: person objectClass: inetOrgPerson cn: example sn: example uid: example userPassword: test but this is not work with my CHAP authentication so what is the problem can anyone explain me in detail i want to know resone about this problem also i have change password_header ="{clear}" in radius.conf file but still not working $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

3 5

RE: POD not work with radclient
by Cory Robson 29 Mar '07

29 Mar '07

Well I suppose would need to see what information you are sending it and what it is expecting. Nobody can see that except yourself so there is no way we can probably understand why it is not working. I would suggest you double check the ascend-session-key and not the unique session field. ________________________________________ From: freeradius-users-bounces+cory=cmi.net.au(a)lists.freeradius.org [mailto:freeradius-users-bounces+cory=cmi.net.au@lists.freeradius.org] On Behalf Of satish patel Sent: Thursday, 29 March 2007 2:58 PM To: FreeRadius users mailing list Subject: Re: POD not work with radclient but why this is not working for me everything is configure correctly but still error NO match session ??? Peter Nixon <listuser(a)peternixon.net> wrote: On Wed 28 Mar 2007 16:30, satish patel wrote: > Dear guys > > I am comming with new problem now i have enable POD packet > of disconnet on cisco router and now i m trying to disconnect user with > radclient command but i got this output -snip- > rad_recv: Disconnect-NAK packet from host 192.168.1.1:1700, id=115, > length=41 Reply-Message = "No Matching Session" Thats a pretty easy to understand error message sent back by your NAS... -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com ________________________________________ Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Coverity && FreeRADIUS press release
by Alan DeKok 28 Mar '07

28 Mar '07

http://newsvac.newsforge.com/newsvac/07/03/27/206203.shtml http://www.itweek.co.uk/itweek/news/2186700/coverity-project-fixes-open http://blogsearch.google.com/blogsearch?hl=en&client=news&q=coverity&ie=UTF8 Or go to http://news.google.com, and type in "coverity". A number of issues found by Coverity were included in 1.1.5, and the issues not fixed were audited for their impact. The core developers should be getting access to Coverity's web site in the next few days, for update-to-date scans. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

use realms to access different mysql tables
by Alexander Papenburg 28 Mar '07

28 Mar '07

Hi Freeradius-Mailing-List, does anyone of you differentiate sql database table with realms? E.g.: Auth-Requests for user1@realm1 will be checked against table db_radius1 Auth-Requests for user1@realm2 will be checked against table db_radius2 .....and so on. I already found out that it is possible to use multiple sql instances, but for what i understand is that they would be asked/checked one after another. That would be nice for failover scenarios but if there are about 20-30 realms to check it would be result in a very slow performance (depending on mysql host speed). So is there a better way to solve this Problem? All users in one database is at the time unfortunately no option... Thanks in advance Alex

2 2

Is anyone using dialup_admin with a PHP version newer than 4.2.0?
by Ethan Dicks 28 Mar '07

28 Mar '07

Hi, all, This is a refinement of my earlier request for information, honed after half a week of trying to untangle things. I've been grubbing through all the code for dialup_admin 1.80 (from the 20070320 CVS snapshot) and am entirely unconvinced that it works with version of PHP newer than 4.2.0. I'm using PHP 4.3.0, since that's what comes with RedHat Enterprise Linux 4. I've turned on register_globals, but I can't get the dialup_admin code to stop throwing warnings about variable names, etc. Let's take $login as an example. In config.php3, there's code to scrub "bad" characters out of it, and to strip the realm if requested. Unfortunately, in my environment, just going to the entry point of the dialup_admin application results in... [client 127.0.0.1] PHP Notice: Undefined variable: login in /usr/local/dialup_admin/conf/config.php3 on line 92, referer: http://localhost/dialup/ [client 127.0.0.1] PHP Notice: Undefined variable: login in /usr/local/dialup_admin/conf/config.php3 on line 95, referer: http://localhost/dialup/ (ignore the exact line numbers - they won't match the code in CVS because I have some debugging stuff further up right now). I realize that this is a "notice" level message and that messages can be turned off by twiddling error_reporting, but that's not the point - the point is not simply that there are hundreds of these 'notices' getting logged when I bounce around dialup_admin. The point is that these notices are caused by PHP trying to "do the right thing" and getting it wrong because the dialup_admin code is chock-a-block with $login rather than the now-accepted practice of $_GET['login], and in any case, because of how the URLs and PHP code interrelate, modules like config.php3 aren't always called from other modules that were invoked with a GET method with those exact elements, thus variables like $login and $find_user and any other variables which appear to be implicly created under older versions of PHP might or might not be defined, but the code is written as if they are always defined, albeit occasionally empty. I'm entirely willing to accept that I've missed a step in the installation, but I did try to follow the steps in the TODO file and don't believe I missed any. Do people just use the freeRADIUS server and manipulate the user database manually? Are there any dialup_admin users running on operating systems less than a year old? All I'm really after is a user management GUI - I don't really care if it's dialup_admin or not. If there's something that other people prefer, I'd love to hear about it. In terms of getting this all going, I'm about to start forcing variables to be something useful, as in... $login = ""; $max_results = ""; if (!empty($_GET)) { $login = $_GET['login']; $max_results = $_GET['max_results']; } ... just to quiet down the logged errors in the code so I can drill down to why I can't click on "new user" and get a page that lets me enter a new user. I'm also open to other suggestions to clean up the dialup_admin code and get it up to snuff w.r.t. presently-shipping versions of PHP. This will be an essential step to getting this code running under php5, as all of these globalisms have been deprecated because they lead to massive vulnerabilities. Thanks, -ethan

4 7

avaya with freeradius accounting
by satish patel 28 Mar '07

28 Mar '07

Dear is there possiblem avaya VOIP accounting with freeradius is there any support for avaya ??? $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 1

RE: MAC OS X - wired 802.1x supplicant
by Josh Howlett 28 Mar '07

28 Mar '07

See "Connecting to a network that requires 802.1X authentication" in System Preferences Help. josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Michael Messner > Sent: 28 March 2007 12:46 > To: FreeRadius users mailing list > Subject: OT: MAC OS X - wired 802.1x supplicant > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > hey all, > > not a freeRADIUS problem but I hope that someone can help me. > I have no problem with my ibook to connect to a wireless > network via 802.1x but I can't find any possibility to make a > connection to a 802.1x-secured wired network! > Am I blind or is this not supported from OSX? Any other > supplicants for OSX available? > > thanks for every info > > mIke > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.5 (Darwin) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iD8DBQFGClVuyUY4xkIcFVQRAlJQAKDiVymIOJat407bwe4ox/yhY14NUgCeOeRu > n1WQAIFuiE+PLLw14UZ8pjY= > =XoAX > -----END PGP SIGNATURE----- > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Authentication Problem
by abhishek kumar 28 Mar '07

28 Mar '07

Dear,I am using freeradius and database is MS-Sql Server i am executing the sp, and get this on radius............ad_recv: Access-Request packet from host 61.95.235.97:42297, id=167, length=123        Called-Station-Id = \"011919818971838\"        Calling-Station-Id = \"500\"        User-Name = \"500\"        NAS-Identifier = \"Asterisk\"        NAS-IP-Address = 61.95.235.97        NAS-Port = 5071        h323-conf-id = \"83228bc279144bb484aa12ddf9728b8b(a)61.95.235.100\"  Processing the authorize section of radiusd.confmodcall: entering group authorize for request 3  modcall[authorize]: module \"preprocess\" returns ok for request 3    users: Matched DEFAULT at 153  modcall[authorize]: module \"files\" retu! rns ok for request 3radius_xlat:  \'500\'rlm_sql (sql): sql_set_user escaped user --> \'500\'radius_xlat:  \'Execute  authradius  \'500\' \'rlm_sql (sql): Reserving sql socket id: 0radius_xlat:  \'\'radius_xlat:  \'Execute  authradius  \'500\',\'500\', \'011919818971838\',\'61.95.235.97\', \'83228bc279144bb484aa12ddf9728b8b(a)61.95.235.100\', \'\'\'radius_xlat:  \'\'rlm_sql (sql): Released sql socket id: 0  modcall[authorize]: module \"sql\" returns ok for request 3rlm_checkval: Item Name: Calling-Station-Id, Value: 500rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs  modcall[authorize]: module \"checkval\" returns notfound for request 3modcall: leaving group authorize (returns ok) for request 3  rad_check_password:  Found Auth-Type Accept  rad_check_password: Auth-Type = Accept, accepting the userLogin OK: [500/<no User-Password attribute>] (from client adoreser port ! 5071 cli 500)  Processing the post-auth section of radiusd.confmo dcall: entering group post-auth for request 3rlm_sql (sql): Processing sql_postauthradius_xlat:  \'500\'rlm_sql (sql): sql_set_user escaped user --> \'500\'  modcall[post-auth]: module \"sql\" returns noop for request 3modcall: leaving group post-auth (returns noop) for request 3Sending Access-Accept of id 167 to 61.95.235.97 port 42297        h323-return-code = \"h323-return-code=104\"        Reply-Message=\"No Balance in account\"Finished request 3Going to the next requestSending Asscess Accept id.........Poblem is that after getting the reply message,h323 attribute its send the access accept id to linux box and start packet become ready but at this situation call shuld be disconnected Please tell me where i am doing wrong.............ThanksAbhishek  Thanks

2 1

Which authentication system?
by Ian Truelsen 28 Mar '07

28 Mar '07

I am trying to figure out the various authentication systems available and decide what is best for my setup. I am looking for advice. Here is what I want to do: This is for the marina that I am at and a group of 10 of us wanted internet, invested in the hardware and want to be able to access the system without logging in or anything like that. For this group, I was thinking of EAP-TLS as client side certificates would not be a problem. Being a marina, we get people in from time to time - mostly in the summer - who are only going to be there for a week or so and just want to check email or whatever. For these, I don't want to be dealing with client side certs as this raises the amount of time that I have to be administering the system exponentially. I was thinking of something along the lines of chillispot, but I have never been able to get that going, and I don't know whether the two systems can co-exist on the same AP. So, does anyone have any thoughts on what would be the best auth system to go with? I should also mention that I already have a varied group of systems to deal with, including Mac OS X, Win XP, linux and a couple of Win ME systems, so support has to be pretty broad. Thanks in advance. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

2 1