June 2008 - Freeradius-Users - lists.freeradius.org

radrelay.conf in freeradius 2.0.5
by Sanjeeva Rao 26 Jun '08

26 Jun '08

Hi, We are newbie to free radius. We have done some exploration with 1.1.7. Now we have moved from freeradius 1.1.7 to freeradius 2.0.5. As per the documentation (doc/radrelay), there should be radrelay.conf in /usr/local/etc/raddb. But this file is not present in our setup. Moreover , after reading "man radrelay.conf", we tried $./radiusd -X -n radrelay The output we got : Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radrelay.conf Unable to open file "/usr/local/etc/raddb/radrelay.conf": No such file or directory Errors reading /usr/local/etc/raddb/radrelay.conf. Please let us know if we are messing up the something here or is there any configuration related parameter to generate these files. We are stuck on this. Any pointers are welcome. Regards, Sanjeev

4 13

about eap_handler
by blue_11j＠yahoo.co.jp 26 Jun '08

26 Jun '08

Hi, I'm sorry that I am not good at English because I'm Japanese... I have a question about eap_handler. I understand that... if radiusd recieved EAP-Identify packet, eap_handler is allocated and added to eaplist. if radiusd will be not received next EAP packet(except EAP-Identiry) forever, When is the eap_handler deleted from the eaplist and freed ? will radiusd use too large memory by 'Dos attack using EAP-Identiry' ? -------------------------------------- GANBARE! NIPPON! Chance to win 50,000 Yahoo! Points! http://pr.mail.yahoo.co.jp/ganbare-nippon/

3 14

problems with building freeradius on solaris 10
by Ubale, Abhishek Amarnath 26 Jun '08

26 Jun '08

Hi Everyone, Im trying to build freeradius on a solaris10 sparx box. im only interested in rlm_perl modules of freeradius and I face no issues with "configure" ./configure --prefix=/usr/local/radius --without-threads --with-static-modules="rlm_perl" --without-rlm_sql --without-rlm_eap --without-rlm_ldap --without-rlm_krb5 --without-rlm_python --without-rlm_counter --without-rlm_ippool --without-rlm_otp but my make is erroring out with following error: In file included from /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/libradius.h:41, from crypt.c:24: /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/token.h:27: warning: `used' attribute directive ignored In file included from /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/libradius.h:42, from crypt.c:24: /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/hash.h:28: warning: `used' attribute directive ignored In file included from /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/libradius.h:54, from crypt.c:24: /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/md4.h:13: warning: `used' attribute directive ignored In file included from /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/libradius.h:466, from crypt.c:24: /var/tmp/freeradius-server-2.0.4/src/freeradius-devel/packet.h:28: warning: `used' attribute directive ignored gcc -g -O2 -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/freeradius-server-2.0.4/src -DHOSTINFO=\"sparc-sun-solaris2.10\" -DRADIUSD_VERSION=\"2.0.4\" -DNO_OPENSSL -c crypt.c -o crypt.o >/dev/null 2>&1 /var/tmp/freeradius-server-2.0.4/libtool --mode=compile gcc -g -O2 -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/freeradius-server-2.0.4/src -DHOSTINFO=\"sparc-sun-solaris2.10\" -DRADIUSD_VERSION=\"2.0.4\" -DNO_OPENSSL -c exec.c gcc -g -O2 -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/freeradius-server-2.0.4/src -DHOSTINFO=\"sparc-sun-solaris2.10\" -DRADIUSD_VERSION=\"2.0.4\" -DNO_OPENSSL -c exec.c -fPIC -DPIC -o .libs/exec.o exec.c:226: macro `rad_fork' used without args gmake[4]: *** [exec.lo] Error 1 gmake[4]: Leaving directory `/var/tmp/freeradius-server-2.0.4/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/var/tmp/freeradius-server-2.0.4/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/var/tmp/freeradius-server-2.0.4/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/var/tmp/freeradius-server-2.0.4' make: *** [all] Error 2 Please help. thanks Abhishek

1 1

accsessionid in SQL schemas is too short
by Giovanni Lovato 25 Jun '08

25 Jun '08

In SQL schemas, accsessionid as VARCHAR(32) is too short, some NAS (e.g. Juniper ERX) send to RADIUS long Acct-Session-Id (up to 48 chars). I manually set it to VARCHAR(64) and now it seems to work correctly.

1 0

About ipaddr
by ELOM ETSE 25 Jun '08

25 Jun '08

Hi! I installed and configured the server freeRADIUS. When i didn't fill the ipaddr field or fill it with 127.0.0.1, all seem going well. But when i specify this field with an address of 192.168.1.0 network, i have this result: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.2.1 port = 1812 ERROR: Failed to open socket: cannot bind socket: Cannot assign requested address /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 192.168.2.1 port 1812 Please Where is the problem? Can i use localhost address for ipaddr field? or fill with *? With what can i fill the acess point security field? Please help me because i'am installing this server since saturday but no good result. Thanks _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

I need to cancel or to active a user with a new attrib "Canceled" that I have added to radcheck table, in the authenticate stage.
by Jose Maira Iranzo Marin 25 Jun '08

25 Jun '08

I need to cancel or to active a user with a new attrib Canceled that I have added to radcheck table, in the authenticate stage. But I dont know if this method is the correct. Can you help me? Un saludo ------------------------------------------------------------ Jose María Iranzo Marín ---------- HYPERLINK "mailto:jmiranzo@simauria.net"jmiranzo(a)simauria.net ------------------------------------------------------------ Simauria Networks - HYPERLINK "http://www.simauria.net"www.simauria.net C/ Velázquez, 24 bajo. 46018 Valencia Tlf: +34 902.877.206 - Fax: +34 902.929.028 ------------------------------------------------------------- No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.4.0/1509 - Release Date: 19/06/2008 8:00

2 2

Bill Gates on using WiFi on Windows.
by Alan DeKok 25 Jun '08

25 Jun '08

The following article about Bill Gates trying to install software has a gem near the bottom: http://blog.seattlepi.nwsource.com/microsoft/archives/141821.asp The lack of attention to usability represented by these experiences blows my mind. I thought we had reached a low with Windows Network places or the messages I get when I try to use 802.11. (don't you just love that root certificate message?) i.e. The wireless networking experience is a "low" for Windows. So for everyone on this list fighting with Windows: It's not just you. Bill Gates has the exact same problems. Alan DeKok.

1 0

Web-based OTP authentication
by Jaishankar J 25 Jun '08

25 Jun '08

Hi, I have a server which can authenticate a phone-generated counter-based OTP using a web-service (http or https). Can anyone suggest the easiest method for integrating that authentication method with the latest version of FreeRadius? I have looked at PAM and rlm_otp, but was wondering if there is a way in which I can call the web-service from a tool using exec-wait. My idea is to use the FreeRadius at the edge to receive the RADIUS requests and then pass the username and OTP using the web-service for authentication. Thanks in advance, Jai

2 1

Limiting Wifi Access
by Roy Kartadinata 25 Jun '08

25 Jun '08

Hi guys, We're trying to centralize our corporate wifi authentication using freeradius. So far, I was able to get user to authenticate based on NAS IP (I got access to multiple NAS working as well) and Mac Address. Is it possible to also limit their access per SSID? The reason for this is because one of our locations, our HQ, has 3 SSID and only certain people have access to certain SSID but I'm not sure if this will conflict with already working NAS checking. Our HQ is using Cisco Wireless LAN Controller so all 3 SSID will connect to radius using the same NAS IP. Cheers, Roy Kartadinata

4 4

Goodbye SNMP, hello statistics.
by Alan DeKok 24 Jun '08

24 Jun '08

I've commited some code (~1K LoC) to CVS head that will go into 2.0.6. In short, there's no point in using SNMP any more. The good news is that the Status-Server packet is overloaded to get all sorts of statistics that weren't available in SNMP. For more information, see: share/dictionary.freeradius Some comments: - the statistics can ONLY be queried from localhost. This will not be changed. - You can ask for ALL auth statistics (across all "listen" sockets) - Or, specify a socket IP/port, and it will return the stats for that socket. - You can do this for auth/acct sockets independently - you can query statistics for one client, and optionally specify the server IP/port (if the "listen" section has it's own clients) - you can ask for total auth/acct packets that are proxied to home servers - you can ask for total auth/acct packets that are sent to individual home servers. - you can tell when a home server was marked dead / alive, and how many requests have been sent, but not responded to. - you can ask for stats on the internal queues in the server (e.g. if it's busy, there will be many packets waiting, and all of the child threads will be doing work) The end result is that it's simpler to implement than SNMP, has fewer issues, and returns more data than the SNMP statistics would return. Enjoy. Alan DeKok.

6 12