December 2008 - Freeradius-Users - lists.freeradius.org

client certs
by Craig White 11 Dec '08

11 Dec '08

freeradius-2.1.1-2 (rebuild SRPM from Fedora on CentOS 5) followed instructions in certs/README perfectly - so I believe. server certs seem fine but generated client cert in Windows shows "Windows does not have enough information to verify" and yes, I have loaded the 'ca.der' file generated by the instructions on the Windows client and that installs in 'Trusted Root Authorities'. The 'client' cert seems to install in 'Other People', and does include the XPextensions stuff. So I'm trying to verify the client certificate... # openssl verify -CAfile ca.pem spare\(a)myorg.com.pem spare(a)myorg.com.pem: /C=US/ST=Arizona/O=MyOrg/CN=spare@myorg.com/emailAddress=spare@myorg.com error 20 at 0 depth lookup:unable to get local issuer certificate so I figured I would try to verify it against the server file... # openssl verify -CAfile server.pem spare\(a)myorg.com.pem spare(a)myorg.com.pem: /C=US/ST=Arizona/O=MyOrg/CN=Radius Server Certificate/emailAddress=craig(a)myorg.com error 2 at 1 depth lookup:unable to get issuer certificate but indeed the server file verifies... # openssl verify -CAfile ca.pem server.crt server.crt: OK # openssl verify -CAfile ca.pem server.pem server.pem: OK This would seem pretty simple (the directions make it seem simple) edited client.cnf changed input/output password values to the same, simple value changed the e-mail address and cn to the same value as shown above What am I doing wrong? Craig

3 6

Building FreeRadius
by Abdelmonam Kouka 11 Dec '08

11 Dec '08

Salem, I am new on FreeRadius, I tried to build it from sources on ubuntu 8.04, when I run ./configure all is OK, but when I run make I have got this error: /home/kouka/Desktop/freeradius-server-2.1.2/src/freeradius-devel/modpriv.h:9:18: error: ltdl.h: No such file or directory In file included from listen.c:29: Any idea? from where I can got this ltdl.h? Regards -- ------------------------------------------------ عبد المنعم كوكة Abdelmonam Kouka Software Engineer GNU/Linux user #450141 GPG Fingerprint: EC21 1E4E 5B0C E4E7 0D64 3305 0D62 75C9 2C15 16E0 ================================================ "Some people see things as they are and say why. I dream things that never were and say why not?" [George Bernard Shaw] ================================================ http://www.ubuntume.com/ http://arabeyes.org/ http://www.ubuntu-tn.org/

5 12

Need help on Acocunting Respond
by Do Nguyen Ha 11 Dec '08

11 Dec '08

Hi all i use the FreeRadius to work with Cisco Softswitch SIP Server i follow the instruction: http://freeradius.org/radiusd/man/rlm_attr_filter.html preacct Filters Accounting-Request packets. accounting Filters Accounting-Response packets. i edit the following file : site-enable/default : # Filter attributes from the accounting response. #attr_filter.accounting_response preprocess : with_cisco_vsa_hack = yes acct_users : DEFAULT User-Name := "%{Stripped-User-Name:-%{User-Name}}", h323-return-code := "h323-return-code=0" the problem i got in the Accounting respond : Sending Accounting-Response of id 139 to 172.26.0.8 port 1645 User-Name := "0873000001" h323-return-code := "h323-return-code=0" how do i run the sql query or do something to get the h323-return-code in the Accounting Request Thanks Ha`

2 1

Repeated accopunting packets
by Santiago Balaguer García 11 Dec '08

11 Dec '08

Hi, In a normal revision of detail file of radius logs I see: ----- Wed Dec 10 18:27:04 2008 Acct-Status-Type = Alive NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:15:AF:09:5E:B5" Called-Station-Id = "hs-AKIWIFI" NAS-Port-Id = "br-AKIWIFI" User-Name = "aadu0052" NAS-Port = 2149582184 Acct-Session-Id = "80200568" Framed-IP-Address = 10.5.50.88 Mikrotik-Attr-10 = 0x0a053258 Location-ID = "isocc=es,cc=34,ac=12004,network=AKIWIFI" Location-Name = "AKIWIFI,RteCarceller" Event-Timestamp = "Dec 10 2008 18:27:03 CET" Acct-Input-Octets = 112613 Acct-Output-Octets = 1037627 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 1034 Acct-Output-Packets = 1135 Acct-Session-Time = 1200 NAS-Identifier = "ESCS0020-HOTCAB001:RteCarceller" NAS-IP-Address = 192.168.10.2 Acct-Delay-Time = 0 Client-IP-Address = 195.53.203.127 Acct-Unique-Session-Id = "c3398d8d08896bc2" Timestamp = 1228930024 Wed Dec 10 18:27:07 2008 Acct-Status-Type = Alive NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:15:AF:09:5E:B5" Called-Station-Id = "hs-AKIWIFI" NAS-Port-Id = "br-AKIWIFI" User-Name = "aadu0052" NAS-Port = 2149582184 Acct-Session-Id = "80200568" Framed-IP-Address = 10.5.50.88 Mikrotik-Attr-10 = 0x0a053258 Location-ID = "isocc=es,cc=34,ac=12004,network=AKIWIFI" Location-Name = "AKIWIFI,RteCarceller" Event-Timestamp = "Dec 10 2008 18:27:03 CET" Acct-Input-Octets = 112613 Acct-Output-Octets = 1037627 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 1034 Acct-Output-Packets = 1135 Acct-Session-Time = 1200 NAS-Identifier = "ESCS0020-HOTCAB001:RteCarceller" NAS-IP-Address = 192.168.10.2 Acct-Delay-Time = 3 Client-IP-Address = 195.53.203.127 Acct-Unique-Session-Id = "c3398d8d08896bc2" Timestamp = 1228930027 Wed Dec 10 18:27:10 2008 Acct-Status-Type = Alive NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:15:AF:09:5E:B5" Called-Station-Id = "hs-AKIWIFI" NAS-Port-Id = "br-AKIWIFI" User-Name = "aadu0052" NAS-Port = 2149582184 Acct-Session-Id = "80200568" Framed-IP-Address = 10.5.50.88 Mikrotik-Attr-10 = 0x0a053258 Location-ID = "isocc=es,cc=34,ac=12004,network=AKIWIFI" Location-Name = "AKIWIFI,RteCarceller" Event-Timestamp = "Dec 10 2008 18:27:03 CET" Acct-Input-Octets = 112613 Acct-Output-Octets = 1037627 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Input-Packets = 1034 Acct-Output-Packets = 1135 Acct-Session-Time = 1200 NAS-Identifier = "ESCS0020-HOTCAB001:RteCarceller" NAS-IP-Address = 192.168.10.2 Acct-Delay-Time = 6 Client-IP-Address = 195.53.203.127 Acct-Unique-Session-Id = "c3398d8d08896bc2" Timestamp = 1228930030 --------------- Is it means that the NAS does not receive the answer from radius server? Yes, the NAS timeout = 3 seg during three times. _________________________________________________________________ Comparte hasta 500 fotos en un solo email con Windows Live http://download.live.com/

2 1

about the source code in version 2.1.3
by neoo 11 Dec '08

11 Dec '08

Hi,all I'm not clear about two things. 1) in the file freeradius-server-2.1.3/src/mainradiusd.c, at the line 103-105: 103 #ifdef OSFC2 104 set_auth_parameters(argc,argv); 105 #endif what's this checked for ? it's about security or something? 2) in the file freeradius-server-2.1.3/src/main/event.c at line 2874: why ,it check the pointer el and not pl ? 2859 /* 2860 * Externally-visibly functions. 2861 */ 2862 int radius_event_init(CONF_SECTION *cs, int spawn_flag) 2863 { 2864 rad_listen_t *this, *head = NULL; 2865 2866 if (el) return 0; 2867 2868 time(&fr_start_time); 2869 2870 el = fr_event_list_create(event_status); 2871 if (!el) return 0; 2872 2873 pl = fr_packet_list_create(0); 2874 *if (!el) return 0;* *why not check pl?* 2875 i am a newbie, thanks everyone!!!

2 1

Is 2.1.3 sqlippool fast enough?
by Dave 11 Dec '08

11 Dec '08

(repost, was posted as part of wrong thread) I have had a number of problems with 1.1.7 and sqlippool that its simply not able to process more than 10-20 connections at any one time. I will upgrade to 2.1.3 if its capable of handing 50-80 connections at one time? Does any one know? My server is a p4 dual core 3.0ghz and its also handing some load of emails for about 200 accounts. I tried to optimize my mysql installation, etc num_server but I could never get it fast enough. Anyone know of tricks, or if 2.1.3 freeradius is any better? or should I be looking at some other way to hand out IPs? I really like the sqlippool way of doing things. Thanks!

2 1

wimax support
by Ying DONG 11 Dec '08

11 Dec '08

Hi, I am using the freeradius server 2.1.1 as the Radius server in the network to authenticate a wimax user. It seems that it could support the wimax VSA, since I found the dictionary.wimax in the dictionary directory. However, in my application, in the Access Accept message, the freeradius server Include the attributes of vendor-id 311 (microsoft), not having the expected attributes of wimax (such as MSK attribute). I want to how the radius server determine which dictionary it should use to response the incoming request? What I should do to make the freeradius server set the wimax specified attribute in the access-accept msg? Thanks ASTRI - Hong Kong Applied Science and Technology Research Institute tel:+852 <tel:+852> 3406 2918 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message (including any attachments) is for the named addressee(s)'s use only. It may contain sensitive, confidential, private proprietary or legally privileged information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. Any use, disclosure, copying, or distribution of this message and/or any attachments is strictly prohibited. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 6

How to configure RADIUS on 2 IP address Server
by Pongsak Tawankanjanachot 11 Dec '08

11 Dec '08

Hi, I'm setting up RADIUS server to use with Wireless network 1) RADIUS server is Debian (eth0=192.168.25.254 (support all local computer, Access point) and eth1=192.168.2.45 (to Internet) 2) Access Point is LinkSys WAP54G (192.168.25.75) 3) Client is Dell Inspiron with Intel Broadcom wireless network card. My setting RADIUS server has 2 network cards. They are I started installing, ,setting, running ./radiusd -X with default configuration. Everything seems find. Server is running. ================================================================== On Server terminal, I test with radtest test test localhost 0 testing123 Debug message shows up: Sending Access-Request of id 102 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Request packet from host *192.168.2.45 *port 36272, id=102, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 then it ends with Sending Access-Accept of id 102 to* 192.168.2.45* port 36272 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Accept packet from host 192.168.2.45 port 1812, id=102, length=38 radclient: received response to request we did not send. (id=102 socket 3) Sending Access-Request of id 102 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 My question is why the Access-Accept is to 192.168.2.45 (It should be 192.168.25.254??) I also try to use RTRadPing Test Utility from local computer-WinXP SP3 ( 192.168.25.142) asking Authentication Request to 192.168.25.254 RTRadPing says no response from server, timeout. Seems like my ./radiusd runs on *192.168.2.45* ?? (eth1) ================================================================== On Server terminal, I try again with radtest test test 192.168.25.254 0 testing123 Sending Access-Request of id 162 to 192.168.25.254 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Request packet from host 192.168.25.254 port 36275, id=162, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 then it ends with Sending Access-Accept of id 162 to 192.168.25.254 port 36275 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Accept packet from host 192.168.25.254 port 1812, id=162, length=38 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 ================================================================== Then, I kill ./radiusd start with ./radiusd -i 192.168.25.254 -p 1812 -X & (I start it in background mode, fix IP+Port) It ends with... radiusd: #### Opening IP addresses and Ports #### Listening on authentication address 192.168.25.254 port 1812 Listening on accounting address 192.168.25.254 port 1813 Listening on proxy address 192.168.25.254 port 1814 Ready to process requests. Seems like RADIUS is listening on 192.168.25.254..... :D ================================================================== On Server terminal, I test with radtest test test localhost 0 testing123 Sending Access-Request of id 103 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 *There is no response at all....* if I try with radtest test test 192.168.25.254 0 testing123 It ends with Sending Access-Accept of id 88 to 192.168.25.254 port 36277 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Accept packet from host 192.168.25.254 port 1812, id=88, length=38 Framed-MTU = 1400 NAS-IP-Address = 192.168.25.77 NAS-Port = 15 It replies!! Seems like it is listening at eth0 192.168.25.254 port 1812 BUT when I use RTRadPing Test Utility from local computer-WinXP SP3 ( 192.168.25.142) asking Authentication Request to 192.168.25.254 RTRadPing says no response from server, timeout. What should I do next?? Somebody can suggest me? I think this is just the first step, then I need to install OpenSSL and test....a long way to go.. Best regards, Pongsak

2 1

Regarding Dynamic Vlan
by duraivelanc Chockalingam 11 Dec '08

11 Dec '08

Hi This is Durai Velan C, from India. I would like to know about the Free Radius Version that supports, "Dynamic VLAN Association" for an User that is getting authenticated from Radius Server. Here by, I would require the Free Radius Server Configurations document to aid the Same. Requirements. 1.) My Radius Server IP auth = 172.21.185.142, acct = 172.21.185.142 2.) User = alcatel , Domain = adilab.com 3.) User password = alcatel 4.) Authentication: 8021.X , through MD5-Challenge. If possible, kindly provide me the Radius Server COnfiguration for the above mentioned, details Your help on the same would be great Regards Durai velan C

2 1

FreeRadius and Ubuntu 8.10
by Matthew Carriere 11 Dec '08

11 Dec '08

I am also about to install FreeRadius, anyone have experience with installing on Ubuntu 8.10 Server 32 Bit? -- Matthew Carriere matthew(a)blackninjasoftware.com

3 3