April 2007 - Freeradius-Users - lists.freeradius.org

OS X 10.4 server install
by Glen Page 02 Apr '07

02 Apr '07

I am new to FreeRadius. I have downloaded and installed FreeRadius on my 10.4 server machine and now need some pointers on getting it working. I downloaded the Radius installer (FreeRadius for OS X) from StellarRADIUS and ran the installer. Now I need pointers for where to go next. The machine that I have installed FreeRadius on is my OpenDirectory (LDAP) master. My hope is to be able to get FreeRadius to authenticate users against the LDAP so that I can control who uses our wireless network. TIA for the help, Glen Page Technology Systems Administrator ThetNet Well It looks like an ID10T Error

2 1

HUP in freeradius-1.1.5 + CVS results in process death.
by Arran Cudbard-Bell 02 Apr '07

02 Apr '07

I know theres a bug report for this already, but when I HUP the process freeradius doesn't die in the same place. I get.. Mon Apr 2 18:10:16 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Apr 2 18:10:16 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Apr 2 18:10:16 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon Apr 2 18:10:16 2007 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Mon Apr 2 18:10:16 2007 : Error: rlm_eap_tls: Error reading certificate file Mon Apr 2 18:10:16 2007 : Error: rlm_eap: Failed to initialize type tls Mon Apr 2 18:10:16 2007 : Error: radiusd.conf[10]: eap: Module instantiation failed. Mon Apr 2 18:10:16 2007 : Error: radiusd.conf[1925] Unknown module "eap". Mon Apr 2 18:10:16 2007 : Error: radiusd.conf[1873] Failed to parse authenticate section. TLS configured: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/freeradius-1.1.5_nas/etc/raddb/certs/radius.sussex.ac.uk.key" tls: certificate_file = "/usr/local/freeradius-1.1.5_nas/etc/raddb/certs/radius.sussex.ac.uk.crt" tls: CA_file = "/usr/local/freeradius-1.1.5_nas/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "(null)" tls: dh_file = "/usr/local/freeradius-1.1.5_nas/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain Doesn't look like the same bug, anyone else had this ? -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

2 1

Badusers?
by Internet-Wifi Operador 02 Apr '07

02 Apr '07

Hi, 2 simple question. Freeradius, know or do something with badusers file? What is the idea of badusers file? Thanks. Fabián _________________________________________________________________ Mortgage refinance is hot 1) Rates near 30-yr lows 2) Good credit get intro-rate 4.625%* https://www2.nextag.com/goto.jsp?product=100000035&url=%2fst.jsp&tm=y&searc…

2 3

modules' instantiation failing (files)
by Pedro Figueiredo 02 Apr '07

02 Apr '07

hi all, i need to send different lns configuration in a round-robin fashion. in order to do this, i added the following to modules: files rra { userfile = ${confdir}/users.rr1 acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } files rrb { userfile = ${confdir}/users.rr2 acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } and then in authorize: redundant-load-balance { rra rrb ok = 1 } freeradius is picking the right module, alternating between them on each request. the problem is in the instantiation of the modules, where i'm getting the following: Module: Instantiated files (rra) files: usersfile = "/etc/freeradius-dev/users" files: acctusersfile = "/etc/freeradius-dev/acct_users" files: preproxy_usersfile = "/etc/freeradius-dev/preproxy_users" files: compat = "no" Module: Instantiated files (rrb) files: usersfile = "/etc/freeradius-dev/users" files: acctusersfile = "/etc/freeradius-dev/acct_users" files: preproxy_usersfile = "/etc/freeradius-dev/preproxy_users" files: compat = "no" as you can see, it's not reading the files i told it to read. confirmed with strace, just to be on the safe side: write(1, "Module: Instantiated files (rra)"..., 34Module: Instantiated files (rra)) = 34 write(1, " files: usersfile = \"/etc/freera"..., 48 files: usersfile = "/etc/freeradius-dev/users") = 48 write(1, " files: acctusersfile = \"/etc/fr"..., 57 files: acctusersfile = "/etc/freeradius-dev/acct_users") = 57 write(1, " files: preproxy_usersfile = \"/e"..., 66 files: preproxy_usersfile = "/etc/freeradius-dev/preproxy_users") = 66 write(1, " files: compat = \"no\"\n", 22 files: compat = "no") = 22 open("/etc/freeradius-dev/users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=1880, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "# Simplify the Tunneling rules t"..., 4096) = 1880 read(6, "", 4096) = 0 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 open("/etc/freeradius-dev/acct_users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=532, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "#\n#\t$Id: acct_users,v 1.4 2003/0"..., 4096) = 532 read(6, "", 4096) = 0 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 open("/etc/freeradius-dev/preproxy_users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=1039, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "#\n# Configuration file for the "..., 4096) = 1039 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 write(1, "Module: Instantiated files (rrb)"..., 34Module: Instantiated files (rrb)) = 34 write(1, " files: usersfile = \"/etc/freera"..., 48 files: usersfile = "/etc/freeradius-dev/users") = 48 write(1, " files: acctusersfile = \"/etc/fr"..., 57 files: acctusersfile = "/etc/freeradius-dev/acct_users") = 57 write(1, " files: preproxy_usersfile = \"/e"..., 66 files: preproxy_usersfile = "/etc/freeradius-dev/preproxy_users") = 66 write(1, " files: compat = \"no\"\n", 22 files: compat = "no") = 22 open("/etc/freeradius-dev/users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=1880, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "# Simplify the Tunneling rules t"..., 4096) = 1880 read(6, "", 4096) = 0 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 open("/etc/freeradius-dev/acct_users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=532, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "#\n#\t$Id: acct_users,v 1.4 2003/0"..., 4096) = 532 read(6, "", 4096) = 0 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 open("/etc/freeradius-dev/preproxy_users", O_RDONLY) = 6 fstat(6, {st_mode=S_IFREG|0640, st_size=1039, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2a973c3000 read(6, "#\n# Configuration file for the "..., 4096) = 1039 read(6, "", 4096) = 0 close(6) = 0 munmap(0x2a973c3000, 4096) = 0 i couldn't find any references to this problem. this is freeradius 1.1.5 running on a debian box with 2.6.8-x4100-1. has anyone else noticed this? is there a workaround? thanks in advance, pedro -- This email and any attachments may be confidential and/or legally privileged. If you have received this e-mail and you are not a named addressee, please inform the sender of this email by sending a return email to the address above and then delete the e-mail and your response from your system. If you are not a named addressee you must not use, disclose, distribute, copy, print or rely on this e-mail. Any views or opinions presented are solely those of the author. Any statements made, or intentions expressed in this communication may not necessarily reflect the view of Easynet. No content herein will bind Easynet or any associated company unless confirmed by the execution of a formal contract by Easynet. Any figures or amounts given in this email are quotations only and are subject to change. Although Easynet routinely screens for viruses, addressees should scan this e-mail and any attachments for viruses. Easynet makes no representation or warranty as to the absence of viruses in this e-mail or any attachments. Please note that to ensure regulatory compliance and for the protection of our customers and business, we may monitor and read e-mails sent to and from our server(s). Easynet Limited a company incorporated and existing under the laws of England and Wales, with company number 2954343 and having its registered office at 44-46 Whitfield Street London, W1T 2RJ.

2 5

radutmp file problem with simultanous problem
by satish patel 02 Apr '07

02 Apr '07

Dear guys I have very strange problem i am useing freeradius with mssql database and it is working fine since 1 month without error but last week my radius server power switch off or due to any power reson my radius machine would shutdown now when it come back i run radwtmp there is list of users and when i goes or telnet on cisco NAS there is no one users and after it i check radius log i saw the max 1 login error means multiple users login problem so what is the problem i know the problem but this is not a way caz it caz happend any time then i delete /var/log/radius/radutmp file then again users able to login this is the simultaneous login problem i know caz checkrad first check radutmp and then check in to NAS i know logic behind this but this is not a proper solution then how can i resolve it is there any method to adovide this problem.. $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 1

packet of disconnect
by satish patel 02 Apr '07

02 Apr '07

I have problem of disconnecting user from radius or NAS so i am useind radclient command to disconnect users i have cisco NAS 3600 VPDN configuration it is supported packet of disconnect but problem is when i send disconnect request from my NAS i got error session not mached [root@radius tmp]# cat packet.txt User-Name=mlpm322 Acct-Session-Id=0000F034 [root@radius tmp]# cat packet.txt | radclient -x 192.168.1.1:1700 disconnect tulip786 Sending Disconnect-Request of id 161 to 192.168.1.1 port 1700 User-Name = "mlpm322" Acct-Session-Id = "0000F034" rad_recv: Disconnect-NAK packet from host 192.168.1.1:1700, id=161, length=41 Reply-Message = "No Matching Session" i got this error ??? so what is this why i got this error session not mached ??? i am find users session id from radwho -i command can you explain me why this happend ??? $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

more than one AVP from LDAP with same name is it possible ?
by Bodin Bruno 02 Apr '07

02 Apr '07

Hello, My problem is about Radius reply. With user file it's possible to reply some AVPs with same name like that : My-AVP += "name:robert", My-AVP += "age:38", My-AVP += "country:fr" most important it's possible to do that : Sip-AVP+= "username:%{User-Name}" But how it's possible to do something like that with ldap attribute ? because I use this : replyItem My-AVP username_radius but that work only one time, because when I do : replyItem My-AVP username_radius replyItem My-AVP age_radius it's only return the last attribute content ( 38, the age of Robert ). And when I type this : replyItem My-AVP username_radius,age_radius that return nothing ... Too bad, return 2 AVPs should be better :( there is any method to do this ? could it be a new feature ? thank for help

2 2

add realm to user based on NAS-IP
by Alexander Papenburg 02 Apr '07

02 Apr '07

Hi all, i wonder if it is possible to add a realm to a username based on the NAS-IP the request come from. For instance: - user "abc" logs on router 10.0.0.1 - router 10.0.0.1 asks a freeradius proxy for user "abc" - freeradius-proxy recognize the ip and add "@realm" to the username and proxy the request to another freeradius-server based on "realm"-entry in proxy.conf Unfortunatly I found many "solutions" in the past 2 hours (like proxy-to-realm, attr_rewrite, hints...), I cant't decide which is the right one for me. %) So help would be much appreciated. Thanks in advance Alexander

2 1

EAP-AKA patch for Freeradius 1.1.2
by awaneesh kumar 02 Apr '07

02 Apr '07

Hi All, I have downloaded patch from http://bugs.freeradius.org/show_bug.cgi?id=386. I have succesfully applied patch to Freeradius1.1.2. Few questions i have.. a) Does patch supports optional identity privacy support, optional result indications, and an optional fast re-authentication procedure. b) After receiving EAP-Request/AKA-Challenge from server, client should calculate AT_MAC and compares with the received one. If it matches it should send back the EAP-Response/AKA-Challenge with AT_RES and new AT_MAC. As per section 10.8 of RFC 4187, AT_RES should be encoded as follows. The value field of this attribute begins with the 2-byte RES Length,which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary Trace below is packet from client to server:- 0x024200301701000003050000d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d00b0500 000d6eb3a8082c9d2c0a031505b7a0fac0 c) As per section 3 (Figure 2) from RFC 4187, if server is unable to authenticate client if AT_MAC or AT_RES is incorrect, it should back the EAP-Request/AKA-Notification to client and client should respond back with EAP-Response/AKA-Notification. Then only server should send back EAP result as Failure. But Freeradius1.1.2 sends back the EAP Result (FAILURE) with Access-Reject. How ever success scenarion works perfectly. d) After receiving AKA-Challenge from Radius server, does patch supports the checking of Sequence No from AUTN parameter? Do we have any latest patch to support EAP-AKA? Thanks --------------------------------- Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta.

1 0

RE: Anyone using dd-wrt for AP?
by Aren Chua 01 Apr '07

01 Apr '07

Ian Truelsen you can try the hotspot(chillispot) under DD-WRT firmware to configure your AP to authenticate against the radius server. Regards, Aren Chua> Date: Sun, 1 Apr 2007 10:16:25 +0200> From: aland(a)deployingradius.com> To: freeradius-users(a)lists.freeradius.org> Subject: Re: Anyone using dd-wrt for AP?> > Ian Truelsen wrote:> >> > Hopefully that is not the case. The freeradius server is on an external> > machine. I am trying to get the AP to authenticate against that server,> > but I am having trouble sorting out how to get it to do this.> > There should be a RADIUS server configuration. But you'll have to> enable 802.1x authentication, too.> > Alan DeKok.> --> http://deployingradius.com - The web site of the book> http://deployingradius.com/blog/ - The blog> - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Your friends are close to you. Keep them that way. http://spaces.live.com/signup.aspx

1 0