January 2008 - Freeradius-Users - lists.freeradius.org

Different outgoing then ingoing IP when proxying
by Jørn Kostøl 29 Jan '08

29 Jan '08

Hi, I have a 2.0.1 server running as proxy, with a virtual server handling the proxied requests. However a firewall, which cannot be changed, does not let me send packets from the external IP to the localhost on which the virtual server is listening. Is it possible to have Freeradius listen on one IP for the NAS, but proxy on a different IP (localhost) ? Cheers, Jørn

3 2

Enterasys gear and freeradius
by Kent Nasveschuk 29 Jan '08

29 Jan '08

Anyone using freeradius with Enterasys switches/routers for mac authentication with openldap backend? Currently using SBR with some problems that can only be fixed by upgrading to the GEE edition $$. Radius system: CentOS 5 Linux Freeradius 1.1.3 OpenLDAP server: CentOS 5 Linux OpenLDAP 2.3.39 Already using RADIUS-LDAPv3.schema with SBR Regards, Kent

1 0

users file matching rules
by theSnail 29 Jan '08

29 Jan '08

hi, i have a problem with the users file rules. I can use "NAS-IP-Address", "User-Name", "NAS-Port-Type" field in order to filter the packet and make different type of authentication inside users file. for example DEFAULT NAS-Port-Type == Wireless-802.11 , Autz-Type := wireless , Auth-Type := wireless this rule matches the packet and start wireless auth-type etc etc... but if i use DEFAULT Called-Station-Id == "0A-11-22-33-44-55:ssid" , Autz-Type := wireless , Auth-Type := wireless with or without double quotes this rule doesn't match the packet. I'm using EAP-TTLS+pap , maybe there's a problem with the session inside the tunnel and the one outside the tunnel? the simple question is, why if i see that field i 'm not able to use it? where's my misconfiguration? of course radiusd -X gives rad_recv: Access-Request packet from host 192.168.123.251.:1365, id=69, length=744 User-Name = "testuser" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "0A-11-22-33-44-55:ssid" Calling-Station-Id = "00-00-11-11-11-55" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" (i didn't send the whole radiusd -X output because i thought it was useless) arjuna -- View this message in context: http://www.nabble.com/users-file-matching-rules-tp15156740p15156740.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Authentication Problem with EAP-PEAP
by debug afone 29 Jan '08

29 Jan '08

Hi, I've got a new problem when I try to authenticate a Windows Vista client with Freeradius. Vista sends to the radius a User-Name like DOMAIN\USER. When I use nt_domain_hack or the realm ntdomain, the domain disappear from the User-Name attribute. The authentication goes on, the login/password match in LDAP database but EAP fails. Here's a trace : rlm_ldap: user nsouleman authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 3 modcall: leaving group authenticate (returns invalid) for request 3 auth: Failed to validate the user. As you can see, ldap module returns OK but I have this message just after : rlm_eap: Identity does not match User-Name, setting from EAP Identity. Does anybody help me ? Thanks. Nicolas SOULEMAN.

6 8

radclient from xtradius always fail?
by Stephane Bortzmeyer 28 Jan '08

28 Jan '08

I configured a FreeRadius server and tested it with FreeRadius' radclient. It works. However, when I try the radclient from xtradius, I always get an access denied. I think that FreeRadius is supposed to work with other Radius implementations :-) so there is something strange. With FreeRadius's radclient: % echo "User-Name = bortzmeyer\nUser-Password = theuserpassword" | radclient jezabel auth mysharedsecret Received response ID 181, code 2, length = 44 Service-Type = Framed-User Framed-Protocol = PPP ... With xtradius' radclient, same client machine: % echo "User-Name = bortzmeyer\nUser-Password = theuserpassword" | radclient jezabel auth mysharedsecret Sending request to server jezabel, port 1812. Warning: Received invalid reply digest from server radrecv: Packet from host 10.1.82.2 code=3, id=13, length=20 Access denied. And, on the FreeRadius server, when it fails: rad_recv: Access-Request packet from host 10.1.82.1:32774, id=13, length=50 User-Name = "bortzmeyer" User-Password = "\274\016N\002\363\206\206a&.P06\270\363\335" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "bortzmeyer", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bortzmeyer at line 52 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "pap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password ¼?N?ó??a&.P06¸óÝ rlm_pap: Using clear text password "theuserpassword". rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: leaving group PAP (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! The clients.conf config: client lilith.generic-nic.net { secret = mysharedsecret shortname = lilith nastype = other }

2 4

Question about forum
by Marinko Tarlac 28 Jan '08

28 Jan '08

I saw that freeradius project has his own chat channel but what about forum? I read all emails in this list and some of these mails should be available on some kind of forum so we can share experience. What do you think?

10 16

RE: Creating rpm problem
by Laurent RAYSSIGUIER 28 Jan '08

28 Jan '08

Ok, with the explainations of Joe I do this : tar xvfz freeradius-server-2.0.1.tar.gz mv freeradius-server-2.0.1 freeradius-2.0.1 tar cvfz freeradius-2.0.1.tar.gz freeradius-2.0.1 cp freeradius-2.0.1.tar.gz /usr/src/redhat/SOURCES echo "%_incdir /usr/include" >>.rpmmacros rpmbuild -ta freeradius-2.0.1.tar.gz And Now, the rpm will be created correctly. Thank You Joe, and anyone who has try to answer :-) Bye Laurent

1 0

rpmbuld errors 2.0.1
by Andrew Long 28 Jan '08

28 Jan '08

Hello: I am trying to build the rpm for 2.0.1 on CentOS 5. The first oddity is that the source now comes as freeradius-server-2.0.1.tar.gz; starting the rpmbuild with $ rpmbuild -bb freeradius.spec yields an error that SOURCES/freeradius-2.0.1.tar.gz does not exist. I tried renaming freeradius-server-2.0.1.tar.gz to freeradius-2.0.1.tar.gz, and now the build starts, but it always ends with the following error: + STATUS=0 + '[' 0 -ne 0 ']' + cd freeradius-2.0.1 /var/tmp/rpm-tmp.71302: line 29: cd: freeradius-2.0.1: No such file or directory error: Bad exit status from /var/tmp/rpm-tmp.71302 (%prep) Here is the block from the rpm-tmp file: set -x umask 022 cd /home/along/rpmbuild/BUILD cd /home/along/rpmbuild/BUILD rm -rf freeradius-2.0.1 /bin/gzip -dc /home/along/rpmbuild/SOURCES/freeradius-2.0.1.tar.gz | tar -xvvf - STATUS=$? if [ $STATUS -ne 0 ]; then exit $STATUS fi cd freeradius-2.0.1 <----------------------------------------------LINE 29 [ `/usr/bin/id -u` = '0' ] && /bin/chown -Rhf root . [ `/usr/bin/id -u` = '0' ] && /bin/chgrp -Rhf root . /bin/chmod -Rf a+rX,u+w,g-w,o-w . I am not an expert with rpmbuild, so I apologize if this is a bit off-topic. I preceded the build with $ rpmbuild --clean freeradius.spec as I had previously build 1.1.7 on the same host. - Andrew

3 8

Re: Administering with MySQL DB
by Andy Smith 28 Jan '08

28 Jan '08

Hi, thanks, Ive looked at this and its a good guide to initial install but doesnt seem to provide any detailed info on how to administer the data in the tables. IE there is a sample of some data from a test system but this doesnt even mention the "NAS" table, how are other people administering their systems? thanks! Andy. > FreeRadius Wiki is a good starting point. SQL Howto

6 9

Re: Administering with MySQL DB
by Andy Smith 28 Jan '08

28 Jan '08

Hi All, thanks for the assistance from everyone on this. My prob was not even knowing which nas table field you were meant to put the IP address of the device in due to the naming standard. I've installed daloradius, which was very quick and easy to install on a system already configured for mysql, apache and php and I can add nas entries via the GUI and now see the correct formatting for adding others via SQL commands if I should need to. cheers Andy.

2 1