December 2008 - Freeradius-Users - lists.freeradius.org

python error in complie freeradius-2.1.3
by henry1412 10 Dec '08

10 Dec '08

I install freeradius-2.1.3 on redhat9, the python version is 2.2. When I make the freeradius, it reports many error in rlm_python.c file. I paste the error information below rlm_python.c: In function `python_error': rlm_python.c:163: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:163: (Each undeclared identifier is reported only once rlm_python.c:163: for each function it appears in.) rlm_python.c:163: parse error before "__gstate" rlm_python.c:181: warning: implicit declaration of function `PyGILState_Release' rlm_python.c:181: `__gstate' undeclared (first use in this function) rlm_python.c: In function `python_init': rlm_python.c:201: warning: passing arg 2 of `PyModule_AddIntConstant' discards qualifiers from pointer target type rlm_python.c: In function `python_function': rlm_python.c:338: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:338: parse error before "gstate" rlm_python.c:361: `gstate' undeclared (first use in this function) rlm_python.c:361: warning: implicit declaration of function `PyGILState_Ensure' rlm_python.c: In function `python_load_function': rlm_python.c:470: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:470: parse error before "gstate" rlm_python.c:472: `gstate' undeclared (first use in this function) rlm_python.c: In function `python_objclear': rlm_python.c:508: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:508: parse error before "__gstate" Is my python version too old ?

3 2

fr group howto
by Hegedus Gabor 10 Dec '08

10 Dec '08

Hi all! I have 802.1x authentication, which works. I want use dynamic vlan assignment: The radius authenticate the user (use ntlm_auth) and after this, it use ldap to get user indormation form database (username=samaccount name). ldap.attrmap changes the attributes and send to the switch, it is okay. It is not so confortable, I wanna try something else: 1. I create groups: vlan21, vlan333, and so on. expand the vlan schema with 3 attrib (you know VLAN, IEEE-802, and VLANID). I put users and computers to the groups. How can I get users vlan info, I can't create ldap query, cos : - i have samaccount name what is not the cn, and the "member", "member of" attribs are contains cn. i don't know how can i do a good query, the good attrib is in vlanXY group. - get vlan? ok but i have just samaccount name, no cn - get user? ok but the good attribs is in the vlan group how? 2. I don't expand the vlanXY schema, I get user info(by samaccname) contains "member of" attr, and in the freeradius user file I create group. If group in the users file equals "member of" attrib send back the vlan info to the switch: (i know it is not good yet) DEFAULT Ldap-Group == "cn=vlan10,ou=vlans,dc=test,dc=hu" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 10, Reply-Message = "You are in vlan 10" ldap modul: groupname_attribute = cn groupmembership_filter = "(&(memberof=cn=vlan10,ou=vlans,dc=test,dc=hu)(samaccountname=%{mschap:user-name}))" ## i know it is bad, but what is the good do you understand what i want? I test both prospect, pls help Thx Gabor

2 2

RE: (err=2)! (Shared secret is incorrect.)
by Jason Wittlin-Cohen 10 Dec '08

10 Dec '08

The shared secret is the password that clients use to connect to the RADIUS server. It's located in the "client.conf" file in your freeradius configuration directory. Note, that this shared secret is used to secure RADIUS traffic. User names and passwords of users which are authenticating via EAP are stored in the "users" file. -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

4 3

rad_recv: Access-Reject
by Ilya 10 Dec '08

10 Dec '08

hello! debugging freeRADIUS i met the problem like this: At the beginning I thought that the problem was in the users file but in radiusd.log I saw the message: rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/raddb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique what's wrong? could anybody help me plz? radiusd -X log , users file and cliens.conf is attached. have a good day, ilya ________________________________ ilya vishnyov billing department baykalwestcom 68, 2-zheleznodorozhnaya str., irkutsk, 664005, russia gsm: +7 9025 113 992 e-mail: ilya(a)bwc.ru icq #: 988-0-229 ________________________________

1 0

Re: EAP/TLS TLS_accept error
by henry1412 10 Dec '08

10 Dec '08

Under my freeradius and ap current configuration, I can be success authenticated by windows xp client, but failed by linux client of wpa_supplicant-0.4.8. What's wrong with my setting? Is my wpa_supplicant version too old or my wpa_supplicant config file has some problem?

2 1

EAP-AKA
by Fernando 10 Dec '08

10 Dec '08

Hi all, I'm trying to configure EAP-AKA using EAP2, where do I insert the quintets?.. in the same way as EAP-SIM? Thanks, Fernando.

1 0

Re:EAP/TLS TLS_accept error
by henry1412 10 Dec '08

10 Dec '08

>>I want to build a IEEE 802.1x authentication environoment and >>I have installed freeradius-1.0.2, > Why? It's outdated and has serious security flaws in EAP. I just do some testing with old version who had more documents. It seem the old version also can run well, but I cann't config them running. Can you give me some suggestion at these old version.

2 1

domain security problem
by Hegedus Gabor 10 Dec '08

10 Dec '08

hi, my configuration: radius 2.X , win 2003 AD, domain: TEST, 802.1x I have a problem: If the pc is in the domain(TEST) it can authenticate good. If it is not in domain it can't auth, it is good, BUT when i set the computer name to TEST and it is not in the domain(simple workgroup) it CAN authenticate. I use ntml_auth for the authentigation. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" How can I fix this risk? What are the solutions?

2 2

(err=2)! (Shared secret is incorrect.)
by Ilya 10 Dec '08

10 Dec '08

i've read FAQ Hello i've got Linux 2.6.9-22 and freeRADIUS server v.2.1.1. I have the following problem - when i start radius in debuging mode it returns me the next message: "rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=195, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) [root@sasocl1 ~]#" i tried to solve this problem by reading FAQ but without any success Because i can not find something like "Login failed [user/password] ." in log file (attached). Please can anyone help me? Great thanks in advance! have a good day, ilya ________________________________ ilya vishnyov billing department baykalwestcom 68, 2-zheleznodorozhnaya str., irkutsk, 664005, russia gsm: +7 9025 113 992 e-mail: ilya(a)bwc.ru icq #: 988-0-229 ________________________________

1 0

Regarding Dynamiv Vlan Association Via Radius Server
by duraivelanc Chockalingam 09 Dec '08

09 Dec '08

Hi This is Durai Velan C, from India. I would like to know about the Free Radius Version that supports, "Dynamic VLAN Association" for an User that is getting authenticated from Radius Server. Here by, I would require the Free Radius Server Configurations document to aid the Same. Requirements. 1.) My Radius Server IP auth = 172.21.185.142, acct = 172.21.185.142 2.) User = alcatel , Domain = adilab.com 3.) User password = alcatel 4.) Authentication: 8021.X , through MD5-Challenge. If possible, kindly provide me the Radius Server COnfiguration for the above mentioned, details Your help on the same would be great Regards Durai velan C

2 1