June 2008 - Freeradius-Users - lists.freeradius.org

freeradius password expiry
by yangcuilin 06 Dec '08

06 Dec '08

My requirement: 1. At FreeRADIUS (java) client side, judge the current user whether is password expiry in advance. If user password is expiry, prompt user to change password. My question: FreeRADIUS have an attribute of "Expiration" to judge whether the password is expiry, but can I get value of "Expiration" in advance? 2. User can send request (which is the FreeRADIUS attribute of "Expiration") to FreeRADIUS Server. My question: How do I change the value of FreeRADIUS attribute of "Expiration"? Two questions. Thanks in advance.

6 14

Freeradius error: "Discarding conflicting packet"
by jelle-e 27 Nov '08

27 Nov '08

Hi, I've enabled extensive logging and radiusd runs as daemon process (# /usr/local/sbin/radiusd). I have a medium sized network with about 25 Access Points (AP's) now (Linksys WAP54G). It runs with following encryption options: WPA-Enterprise, AES, PEAP, mschapv2, without using certificates. Everything seems to run smoothly but before every login attempt the logs say (something like): "Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28." After that the user logs in correctly. I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'. Does anybody have an idea? Thanks in advance! In the freeradius source I found the following regarding the error: gettimeofday(&when, NULL); when.tv_sec -= 1; /* * If the cached request was received * within the last second, then we * discard the NEW request instead of the * old one. This will happen ONLY when * the client is severely broken, and is * sending conflicting packets very * quickly. */ if (timercmp(&when, &request->received, <)) { radlog(L_ERR, "Discarding conflicting packet from " "client %s port %d - ID: %d due to recent request %d.", client->shortname, packet->src_port, packet->id, request->number); return 0; } -- View this message in context: http://www.nabble.com/Freeradius-error%3A-%22Discarding-conflicting-packet%… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 21

unlang?
by Dean, Barry 19 Nov '08

19 Nov '08

I am testing my current 1.1.7 config with version 2.0.0. I have 2 bits of config that are not quite right on 2.0.0 1) I have the line: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am not sure why, I inherited this setup and I am still trying to understand it. The LDAP server is eDirectory (FreeRADIUS compiled with -with-edir) The "-X" output says: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=user) expand: o=uol -> o=uol What is the replacement for ":-" given I don't know what it did in the first place for "man unlang" to be any help! 2) Rejecting a user I have a specific user account (call it "special") it was barred using: special Auth-Type := Reject Reply-Message = "Cannot use this user account" in the users file. Variants like " special", "Special" and "SPECIAL" etc get by this check, and out LDAP server allows them!, so I added: lower_user = before lower_pass = no nospace_user = before nospace_pass = no to radius.conf. These no longer seem to work. How do you achieve this with version 2.0.0? --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

6 8

freeradius for windows + mssql problem
by rodolfor 30 Oct '08

30 Oct '08

Hi all. I have installed freeradius for windows (www.freeradius.net) and it works well. Now I want to connect the service to an mssql database in the same machine. The error I receive (starting in debug mode) is (using mssql.conf): rlm_sql (sql): Could not link driver rlm_sql_unixodbc: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[10]: sql: Module instantiation failed. Could someone help me ? thanks -- View this message in context: http://www.nabble.com/freeradius-for-windows-%2B-mssql-problem-tf3731743.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Whether the FreeRADIUS supports switch 3Com 5500G-EI ?
by Gennadiy Redko 07 Aug '08

07 Aug '08

Hi,all. I wish to dispose authorization on the switch with the dynamic isolation VID on the port on the protocol of 802.1x on RADIUS Server. Stand: the switch of 3Com 5500-EI (Software Of version of 3Com OS Of v3.02.03s56), computer from OS Windows XP (SP2), RHEL 5 update 1, freeradius-1.1.3-1.2.el5,kernel 2.6.18-53.el5 #1 SMP. Technical support of the 3Com has advised to use here this document for adjustment: http://www.3com.com/products/en_US/result.jsp?selected=2&sort=effdt&order=d… DUA1725-0BAA02.pdf , page 415 The authorization to FreeRadius is passed at the given moment, but to port is not allotted necessary VID. FreeRADIUS does not support 3Com switches ?

5 25

RE: Pattern Matching in users file
by Garber, Neal 01 Aug '08

01 Aug '08

> You can use the "hints" file to do what you want. It does *not* say > you can only use prefix & suffix matching. I was referring to the following in the sample hints file: # Matching can take place with the the Prefix and Suffix # attributes, just like in the "users" file. # These attributes operate ONLY on the username, though. And this in the doc/README file: Customize the /etc/raddb/hints file. This file is used to give users a different login type based on a prefix/suffix of their loginname. For example, logging in as "user" may result in a rlogin session to a Unix system, and logging in as "Puser" could start a PPP session. Is there another document that describes matching on other attributes and how to add new attributes to the request. I think these paragraphs need updating. Are you saying I can do this in hints: DEFAULT Cisco-AVPair == "", My-Group := "RadioIP-MAU" DEFAULT Cisco-AVPair == "ssid=(.*)", My-Group := "Wireless %{1}" DEFAULT My-Group := "Unknown source" That is, does hints work just like the users file, except it adds any new attributes to the request? If so, this is exactly what I need! If the syntax or usage is off, can you correct me. Thanks Alan.

4 4

Solaris 10 - Zone Compiling FreeRadius 2.04
by thekat 19 Jul '08

19 Jul '08

Need some help compiling FreeRadius on Solaris 10 in a Sparse root zone. Goal My end goal to use an oracle 11G database that is installed and configured on the radius server. I have included all *hopefully* information needed.. - FreeRADIUS Version 2.04 - Sparc - Solaris 10 05/08 SunOS sm1gw1 5.10 Generic_127127-11 sun4v sparc SUNW,Sun-Fire-T200 Solaris SunFreeware installed packages -- coreutils-6.4 -- gcc-3.4.6 -- gdbm-1.8.3 -- libtool-1.5.24 -- libiconv-1.11 -- make-3.81 -- mysql-5.0.51 -- netsnmp-5.4.1 --openssl-0.9.8h -- sasl-2.1.21 -- zlib-1.2.3 PATH /local:/usr/local:/usr/local/bin:/bin:/usr/local/lib:/usr/libexec:/usr/local/libexec:/bin:/usr/bin:/usr/sbin:/usr/ucb:/usr/ccs/bin:/usr/sfw/bin Configure options: sm1gw1# pwd /export/packages/freeradius-server-2.0.4 ./configure \ --prefix=/usr/local \ --with-openssl=yes \ --with-openssl-dir=/usr/local/ssl \ --with-openssl-includes=/usr/local/ssl/include \ --with-mysql-dir=/usr/local/mysql \ --with-mysql-lib-dir=/usr/local/mysql/lib \ --with-oracle-home-dir=/usr/local/oracle/product/11G>config.out 2>&1 The output from config.out and config.log are too large for the list so I have posted here: http://kewlcat.com/config.out

2 8

freeradius with multiple ldap servers
by Sambuddho Chakravarty 07 Jul '08

07 Jul '08

Hello All Will creating multiple instances of the /etc/raddb/modules/ldap1 and /etc/raddb/modules/ldap2 each with different LDAP server addresses and database information work for having a user authenticate against either of the two LDAP servers. By that I mean that say our user 'try' tries to authenticate and sends the radius server an authentication request message, then, by having two files /etc/raddb/modules/ldap1 and /etc/raddb/modules/ldap2 cause the server to connect to both the servers and check for authentication ? If no then can anyone please suggest what is the way for doing this ? Thanks Sambuddho

5 31

Re: Certificate Error!
by Kwok Sianbin 07 Jul '08

07 Jul '08

Hi Ivan, The dates are ok (up-to-date). Here I attach the certificate ----- Original Message ---- From: Ivan Kalik <tnt(a)kalik.net> To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, June 10, 2008 12:00:33 AM Subject: Re: Certificate Error! >and then copy ca.der, client.p12 then I install the certificate into Windows XP. > >When click the client certificate and it shows > >"Windows doesn't have enough information to verify this certificate" > >Server cert in Trusted Root Cert > >"This certificate has expired or is not yet valid. > And below there is a line Valid from ... to ... - what are the dates? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 5

PopToP VPN + FreeRadius
by Victor Asavei 04 Jul '08

04 Jul '08

Hello, I am running a PopTop server with FreeRadius for authentification. I have configured FreeRadius to use Oracle and I can successfully authenticate the users that connect to the VPN. My questions is how can I after a certain-period of time or after a certain condition is true (for example a value in the db in a table reaches 0) to disconnect a certain user ? Reading the documentation from the site I understood that the NAS server is responsable with this. How can i then do this using PopTop & FreeRadius ? Any help or hint is appreciated ! Thank You

4 6