September 2008 - Freeradius-Users - lists.freeradius.org

Accounting Reporting Tools
by Sturgis, Grant 08 Sep '08

08 Sep '08

Greetings List, I am curious what people have done to report on the RADIUS accounting files. Are there packages out there that read and report on radacct files? Connections, denies attempts, etc? Thanks in advance, Grant -------------- Pardon this rubbish: This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

3 2

Unknown value specified for Post-Auth-Type
by Nataniel Klug 08 Sep '08

08 Sep '08

Hello all, I am running new 2.0.5 freeradius with mysql... This is running fine. I am trying to configure virtual servers but this is another question. I am testing this new version and I found this log (using radiusd -X): auth: Failed to validate the user. Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 138 to 127.0.0.1 port 44881 Mikrotik-Rate-Limit = "100k/200k 200k/400k 80k/160k 180/180 8 60k/120k" This only occurs when my client tries to authenticate using wrong password. The Mikrotik-Rate-Limit should only be sent when a client uses right calling-station-id, username and password. Anyone know how to make this option do not be sent when there is an error in client password? -- Att, NATANIEL KLUG nata(a)cnett.com.br LEIA O DIA-A-DIA DO NATA http://nataklug.blogspot.com/ Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290 "... também os sábios possuem coração tangível e podem, por vezes, usar da ciência como meio de demonstrar impressões sentimentais de que muitos não os julgam suscetíveis." Visconde de Taunay

2 3

Re: Freeradius Usage
by Jesse Stone 08 Sep '08

08 Sep '08

Would Freeradius be the correct technology for this? For example, Currently, for me to allow someone access to my OpenVPN server and Samba I have to first add them as a standard user with the useradd script. Then I have use smbpasswd -e to enable their account for Samba. If I wanted that user to also be able to SSH into another server I would have to repeat this process. After about 3 users I forgot who has access to what. This is the process I want to simply. I want 1 place/script that prompts for every app/server that I want to restrict access to: Samba, SSH, Shell access, X, ect. I want this infromation stored in a standard SQL type database though so I can easilly manipulate users once they've been created on the fly. Perferrably within 1 table like a provided in my last email for an example simple user management style. What do large companies that have many users/linux machines use to handle user administration? -Jesse On Fri, Sep 5, 2008 at 5:30 PM, Edvin Seferovic <edvin.seferovic(a)kolp.at>wrote: > It is a tricky concept, but it can be done with a lot of effort. Probably > not for all applications ( since it doesn't make any sense for some of them > ). Maybe you should consider making a real network DMZ. The concept of DMZ > allows you to define and allow/disallow access to services from the Internet > and those from the local LAN. You DO NOT make things or services available > "to the DMZ" ! > > > > Start simple ! > > > > Regards, > > E:S > > > > *From:* freeradius-users-bounces+edvin.seferovic=kolp.at@ > lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic<freeradius-users-bounces%2Bedvin.seferovic> > =kolp.at(a)lists.freeradius.org] *On Behalf Of *Jesse Stone > *Sent:* Samstag, 06. September 2008 01:50 > *To:* FreeRadius users mailing list > *Subject:* Re: Freeradius Usage > > > > Thank you for the quick response. I may not have mentioned this previously > but I am by no means a linux/networking expert. The company I work for is > pro-MS. Recently, I got the urge to get back into Linux and here I am. > > > > My thinking (in regards to network structure) was that I wanted > applications intended to the public as far away from my local lan as > posible. The local lan requires the app server though- OpenVPN, Samba (as > a PDC), misc other things so I wanted it available to the local lan but not > to the DMZ. > > > > My main questions though are with Freeradius. My setup is for "hobby" > purposes only and already I would have difficulty telling you exactly which > users have access to what. > > > > I want to using a technology like Freeradius or LDAP create 1 central place > on the app server that EVERYTHING would authenication to. In a perfect > world, the end result would be that I could type something like this: > > > > select %user% from permissionsDB > > > > and be returned something like this: > > > > SSH: NO, OpenVPN: YES, Samba: %Specific group% (which indicates shares > available), Shell Access: No, ect > > > > Basically, I want a setup where I can easilly scale upwards without having > to "teach" each new application how to use a DB. Freeradious also can > authenicate my wireless users when would also be great as for all I know, > half my bandwidth is being used by my neighbors. > > > > -Jesse > > On Fri, Sep 5, 2008 at 4:34 PM, Edvin Seferovic <edvin.seferovic(a)kolp.at> > wrote: > > Hi, > > > > excuse me for asking, but why dont you set up the AppServer in your DMZ ? > you could have ( what I call ) the T – structure > > > > >< --- INTERNET --> GATEWAY ( server1 ) <---> LOCAL LAN > > I > > I DMZ > > I > > SERVER2 + APPServer > > > > It depends how your users use the gateway and how are they suppose to > connect to the Internet. > > > > Regards, > > E:S > > > > > > *From:* freeradius-users-bounces+edvin.seferovic=kolp.at@ > lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic<freeradius-users-bounces%2Bedvin.seferovic> > =kolp.at(a)lists.freeradius.org] *On Behalf Of *Jesse Stone > *Sent:* Samstag, 06. September 2008 01:25 > *To:* FreeRadius users mailing list > *Subject:* Freeradius Usage > > > > Hi All, > > > > I am new to this mailing list and am about to ask a probably very silly > question. Please feel free to direct me to resources that'll help me answer > them. > > > > I want to setup the following: > > > > Gateway [server1] > > - nic1 = Internet > > - nic2 = DMZ [server2] > > - nic3 = Router w/ Wireless -> App Server [Server3] (FREERADIUS > SERVER HERE) -> Local Lan > > > > I read a lot about both Freeradius and LDAP and cannot determine if either > can accomplish my goals. > > > > What I want is: > > > > 1) 1 central place where all user authenication takes place: SSH, Shell > Access, Samba, OpenVPN, Mumble, Any other app that requires user > administration. > > 2) This information stored in a SQL type database so that I can build my > own custom apps to report on user usage, performance ect. > > 3) My router has wireless and I have enabled the security features. I > would still like authenication to take place before a wireless user is > allowed on the network. > > > > For example, > > > > Currently, I have this: Router w/ Wireless -> App Server [Server3] + Local > Lan > > > > I want this: Router w/ Wireless -> App Server [Server3] -> Local Lan > > > > Is Freeradius the best approach for my needs? Do I need anything else? > > > > -Jesse > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 6

Can´t compile version 2.1.0 !
by Jose Franco Jr 08 Sep '08

08 Sep '08

Hi, I downloaded the new version 2.1.0 but I cannot compile it. ./configure runs fine but when I run make I got the following error: gmake[4]: Entering directory `/usr/local/src/freeradius-server-2.1.0/src/main' /usr/local/src/freeradius-server-2.1.0/libtool --mode=link gcc -o radmin radmin.lo gcc -o radmin .libs/radmin.o .libs/radmin.o: In function `main': /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:117: undefined reference to `using_history' /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:118: undefined reference to `rl_insert' /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:118: undefined reference to `rl_bind_key' /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:176: undefined reference to `readline' /usr/local/src/freeradius-server-2.1.0/src/main/radmin.c:185: undefined reference to `add_history' collect2: ld returned 1 exit status gmake[4]: *** [radmin] Error 1 gmake[4]: Leaving directory `/usr/local/src/freeradius-server-2.1.0/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/freeradius-server-2.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/freeradius-server-2.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/freeradius-server-2.1.0' make: *** [all] Error 2 I´m using Linux Slackware 12.1. On this same machine I have version 2.0.5 working and compiling fine. I already try to compile in another machine and have the same error.

2 1

Freeradius not always denying invalid users
by Chris Moss 08 Sep '08

08 Sep '08

We've been running Freeradius for a long time without any issues. We typically turn a customer off by changing the password in the passwd file. We use the passwd file for authentication. The issue is intermittent the customer is DSL so they will try to log in for a couple of hours constantly before being allowed to connect. Once the connect reseting their dsl connection forces them to login again. It will fail at this point, like it's supposed to. First before I get into posting any configs or that detail, has anyone else had similar problems? Also, the logs sometimes show invalid shell with part of the passwd file. Not necessarily the actual shell portion though. It may show the home directory, or the shell, or even part of one of those such as "/bin/fal" -- Chris Moss

3 11

Re : CA certificates
by Jehan PROCACCIA 08 Sep '08

08 Sep '08

Eshun Benjamin a écrit : > Could please send your log message when the user with the > it-master-class1 in it's CA list tries to authenticate > > ================================================== > > Benjamin K. Eshun OK here are the logs in order to further investigate. first the radiusd start in debug mode: $ /usr/sbin/radiusd -X FreeRADIUS Version 2.0.3, for host i686-redhat-linux-gnu, built on Jun 3 2008 at 19:30:19 radiusd: #### Loading Virtual Servers #### ... server { ... Module: Instantiating eap eap { default_eap_type = "ttls" ... Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/radiux-pkiit-2008.key.pass.pem" certificate_file = "/etc/raddb/certs/radiux-pkiit-2008.pem" CA_file = "/etc/raddb/certs/ca-chain-institut-telecom_long.crt" private_key_password = "secret" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no check_cert_cn = "%{Stripped-User-Name:-%{User-Name}:-none}" cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "gtc" copy_request_to_tunnel = yes use_tunneled_reply = yes } ... } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Then, when a windows secureW2 users which checks certificates (cf .jpg attached) try to authenticate without success rad_recv: Access-Request packet from host 157.159.27.100 port 32768, id=225, length=209 User-Name = "anonymous(a)it-sudparis.eu" Calling-Station-Id = "00-1F-3C-59-5E-52" Called-Station-Id = "00-1F-9D-22-72-E0:eduroam" ... rlm_realm: Adding Realm = "it-sudparis.eu" rlm_realm: Authentication realm is LOCAL. ... ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS TLS Length 50 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06fc], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 226 to 157.159.27.100 port 32768 EAP-Message = 0x0104040015c000000759160301004a02000046030148c4d73e9a1754c3d2321f1820840f38a8e62c3e4ca0ef122375dc1f94f28bf92005603c95ef0eb1d835531cea0ffd11b033d8e8ff7ba7227a45460aed42b7e54b000a0016030106fc0b0006f80006f50006f2308206ee308204d6a00302010202014d300d06092a864886f70d01010505003081a2314330410603550403143a54454c45434f4d2026204d616e6167656d656e7420537564506172697320636c6173733320436572746966696361746520417574686f7269747931263024060355040b141d54454c45434f4d2026204d616e6167656d656e74205375645061726973312630240603 EAP-Message = 0x55040a141d54454c45434f4d2026204d616e6167656d656e74205375645061726973310b3009060355040613026672301e170d3038303532373135323931335a170d3039303532373135323931335a308186310b30090603550406130266723110300e060355040813074573736f6e6e65310d300b060355040713044576727931273025060355040a131e54656c65636f6d206574204d616e6167656d656e74205375645061726973310d300b060355040b130473326961311e301c060355040313157261646975782e69742d73756470617269732e657530819f300d06092a864886f70d010101050003818d0030818902818100c01f06db2f842d54 EAP-Message = 0x78a307eae5f0796e31384a4e9162a81923f9958d3dd20364727bae95f6f5edf404b2c767836906a705a409fe65d95826134c8f90d479939e51059634a503cc5b942c6df13a8e378c2979573b9e19d000e3d0ff37e3cc9621d3a08507d0c1e5b156ab2b0ec7f18641ccd15886b2571ed5d84d7005f835959b0203010001a38202cb308202c7301106096086480186f8420101040403020640300b0603551d0f0404030205e030130603551d25040c300a06082b06010505070301303e06096086480186f84201040431162f687474703a2f2f63612e69742d73756470617269732e65752f706b692f544d53505f43412f63726c2d76312e63726c301d06 EAP-Message = 0x03551d0e04160414e5b49fb229de0a48baf59832e0fbeecdba10a6ce3081a50603551d2304819d30819a8014c060d15966db10cb580bfc55a60cb9323c6be3a1a17fa47d307b313630340603550403132d496e7374697475742054454c45434f4d20636c6173733220436572746966696361746520417574686f7269747931193017060355040b1310496e7374697475742054454c45434f4d31193017060355040a1310496e7374697475742054454c45434f4d310b3009060355040613026672820101304906082b06010505070101043d303b303906082b06010505073002862d687474703a2f2f63612e69742d73756470617269732e65752f706b EAP-Message = 0x692f544d53505f43412f6974 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x93e1b6b492e5a31188c469ba2a413593 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 157.159.27.100 port 32768, id=227, length=204 User-Name = "anonymous(a)it-sudparis.eu" Calling-Station-Id = "00-1F-3C-59-5E-52" Called-Station-Id = "00-1F-9D-22-72-E0:eduroam" ... ... 2nd time !?, the same treatment I presume ? ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 227 to 157.159.27.100 port 32768 EAP-Message = 0x0105036d15800000075963612e63727430400603551d1f043930373035a033a031862f687474703a2f2f63612e69742d73756470617269732e65752f706b692f544d53505f43412f63726c2d76322e63726c30819c0603551d2004819430819130818e060429010101308185303406082b060105050702011628687474703a2f2f63612e69742d73756470617269732e65752f706b692f544d53505f43412f435053304d06082b0601050507020230411a3f4c696d69746564204c696162696c6974792c2073656520687474703a2f2f63612e69742d73756470617269732e65752f706b692f544d53505f43412f435055303d0603551d120436303481 EAP-Message = 0x1761646d696e706b694069742d73756470617269732e65758619687474703a2f2f7777772e69742d73756470617269732e6575301e0603551d11041730158113733269612d69737240696e742d6564752e6575300d06092a864886f70d010105050003820201009face565aceeac5212003ac162156be138cd6db700d4faa3113d50d0ea3f55e476817b9aaae953d8f832e1819f8469a9a5561f886f1aab1ffc9d48ffd39875546b3f59c7ccde6c165d454b190c439c89ee7e4ab5cdc5b1c138bb321428fa001e0fbb1a5a05f4ebba8300ff65ae797efa9f3b52a90a2b41b37243183a27d2ad8f0cb90f37e01cd3e4f4ac56e440b1a53cf73930d7ccc4 EAP-Message = 0x68822683b7c1f799223295c1c90ae1e9b993b7d30c9c53ae70bd64cd6d199f0da5c5ea995300bc53cf3f356650e79d304a59e32253e8e8ca93e284d8ae36e4976ed2db03ae165c9e01d850fff552a942f4391d05bb706279bcb1273e6d0e4355a50623e636403993f399fb758cb2bf5eb475e09dfc2a037b26a14514e714aab53398099386cb60a20b101eac27c82fe95b1cd4ab6426aaac13c1bbf0c3775d418e15c5996c8131831f30a0e1f3753ea7723ae15daaa17b20163a548a6adff64b77f5df43ca602bf2e0757736eb0641d483345f8fc0cdaecf0430f75eaf0f14708d692572f7f50da4c68bdd0215510601c7f9fed39a98995a6821a4be3e EAP-Message = 0x6896ec0b08a33450a6c348bbef00fcbd4d99de83b82cc4bdcd8e911d9e93591cac98600aff37f04ed6608d239a46f5b2ea7be3faaaec1448839e201c4c1b1a45fcc54e753ec11ff1c3f2399348cfb9b2a78afcc29604d0543cb496bd74c67e81ab8c20c2c3d58001cb0f801ec816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x93e1b6b491e4a31188c469ba2a413593 Finished request 8. Going to the next request Waking up in 4.9 seconds. ... Cleaning up request 6 ID 225 with timestamp +534 Cleaning up request 7 ID 226 with timestamp +534 Cleaning up request 8 ID 227 with timestamp +534 Ready to process requests. The client receives the second .jpg attached "received an invalide server certificate" . Again, I wonder on my eap.conf directives: certificate_file point to our radius SSL-server certificate => CN=radius.it-sudparis.eu but what the CA_file should point to in our case ? the it-master-class1 CA root certificate ? the it-ca-class3 CA which signed our radius server ? a bundle of the 3 CA (as it is now !) ? , in which order class1-2-3 ? class 3-2-1 ? in pem ? , der ? short or long CA files (by these I mean only what is between --BEGIN CERTIFICATE-- and --END CERTIFICATE-- or plus the "blabla" above ) ?. Perhaps only certificate_file = ${certdir}/radiux-pkiit-2008.pem could be used, but in that case radiux-pkiit-2008.pem should contain the radius server certificate + a bundle of the 3 CA, in which order ? short or long ? ... thanks for your help. > > > ----- Message d'origine ---- > De : jehan procaccia <jehan.procaccia(a)it-sudparis.eu> > À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Envoyé le : Vendredi, 5 Septembre 2008, 17h49mn 32s > Objet : CA certificates > > hello, > > we are running our own PKI with a 3 level hierarchy: > it-master-class1(self-signed) -> it-ca-class2 -> it-ca-class3. > > it-ca-class3 signed our radius server (radiux-pkiit-2008.pem) > In eap.conf file in the tls section I have > tls { > private_key_password = secret > private_key_file = ${certdir}/radiux-pkiit-2008.key.pass.pem > certificate_file = ${certdir}/radiux-pkiit-2008.pem > CA_file = ${certdir}/ca-chain-institut-telecom_long.crt > } > unfortunaltly, securew2 windows clients configure to check certificates > and having it-master-class1 in it's CA list don't accept our TLS > security :-( . It tells that it received a bad certificate from the > server !?. > > I wonder if I didn't made a misconfiguration in radiusd/eap/tls section > above . > certificate_file point to our radius SSL-server certificate > CN=radius.it-sudparis.eu > but what the CA_file should point what in our case ? the > it-master-class1 CA root certificate ? the it-ca-class3 CA which signed > our radius server ? a bundle of the 3 CA (as it is now !) ? , in which > order class1-2-3 ? class 3-2-1 ? in pem ? , der ? short or long CA > files (by these I mean only what is between --BEGIN CERTIFICATE-- and > --END CERTIFICATE-- or plus the "blabla" above ) ?. > Perhaps only certificate_file = ${certdir}/radiux-pkiit-2008.pem could > be used, but in that case radiux-pkiit-2008.pem should contain the > radius server certificate + a bundle of the 3 CA, in which order ? short > or long ? ... > > You see I have lots of possibilities and interogation !. > > I'am much more used to configure SSL in apache ssl.conf, to me it is > clear as the directive are self explained : > SSLCertificateFile /etc/pki/tls/certs/server-2008.pem > SSLCertificateKeyFile /etc/pki/tls/private/server-2008.key > SSLCertificateChainFile /etc/pki/tls/certs/ca-chain-institut-telecom.crt > SSLCACertificateFile /etc/pki/tls/certs/itrootca-class1.crt > in eap.conf I don't see any distinction between the httpd equivalents : > SSLCertificateChainFile and SSLCACertificateFile > I also use openssl s-client to test my servers certs setting > openssl s_client -host mutuel.it-sudparis.eu -port 443 > But I cannot do the same for radius ? openssl s_client -host > radius.it-sudparis.eu -port 1812 => socket: Connection refused :-( . > > Thanks for your help . > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

FR 2.1.0 rpmbuild error on SLES10SP1
by Graham Marsh 07 Sep '08

07 Sep '08

Hi, I understand an update to 2.1.0 will be out this week, but just letting you know that when running rpmbuild on the above platform, get the error as follows: Installed (but unpackaged) file(s) found: /usr/sbin/radmin Going by previous experience, I am guessing a tweak needs to be applied to the .spec file in the suse folder but I'd prefer to leave it to the experts as to exactly what. Regards GM

1 0

Re: Window domain (win server 2k3) ----- Free-Radius ----- NAS -------Access Point )))) ((((( STA
by Le Sang 07 Sep '08

07 Sep '08

Dear All, I'm sorry I forgot attach file debug-info. Here is the debugging output: [root@localhost ~]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Instantiated exec (ntlm_auth) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.200.100:32775, id=1, length=62 User-Name = "user" User-Password = "lab4man1" Message-Authenticator = 0x1631bbb58aed9a05ef6b72e282e28282 rad_recv: Access-Request packet from host 192.168.200.100:32775, id=1, length=62 Sending Access-Reject of id 1 to 192.168.200.100 port 32775 Can anybody help me on this behavior? Thanks. --- On Fri, 9/5/08, tnt(a)kalik.net <tnt(a)kalik.net> wrote: From: tnt(a)kalik.net <tnt(a)kalik.net> Subject: Re: Window domain (win server 2k3) ----- Free-Radius ----- NAS -------Access Point )))) ((((( STA To: freeradius-users(a)lists.freeradius.org Date: Friday, September 5, 2008, 1:18 PM >Can anybody please help me on this problem? > Not unless you post the debug. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 5

undefined symbol
by Alexandre Chapellon 07 Sep '08

07 Sep '08

I have a problem loading freeradius since i enabled sqlippool i get the following message: freeradius: symbol lookup error: /usr/lib/freeradius/rlm_sqlippool-2.0.5.so: undefined symbol: sql_get_socket here the result of an ldd against rlm_sqlippool: ldd /usr/lib/freeradius/rlm_sqlippool-2.0.5.so linux-gate.so.1 => (0xf57fe000) libfreeradius-radius-2.0.5.so => /usr/lib/freeradius/libfreeradius-radius-2.0.5.so (0xb7f54000) libnsl.so.1 => /lib/tls/i686/cmov/libnsl.so.1 (0xb7f37000) libresolv.so.2 => /lib/tls/i686/cmov/libresolv.so.2 (0xb7f23000) libpthread.so.0 => /lib/tls/i686/cmov/libpthread.so.0 (0xb7f0b000) libc.so.6 => /lib/tls/i686/cmov/libc.so.6 (0xb7dbc000) /lib/ld-linux.so.2 (0xb7f7b000) and none of the linked library contains any sql_get_socket symbol (in fact for most of thoose lib files nm returns no symbols) What the hell did I miss?

4 6

Windows Login
by Kirk Wallace 07 Sep '08

07 Sep '08

I have a fresh install of Freeradius 1.1.7build4 on my Ubuntu 8.04 system. I used this link to do the bob test: http://deployingradius.com/documents/configuration/pap.html which was successful. Then I created myself (kwallace) as a user and tested with radtest, again with success. Then I went to my Windows 2000 notebook with a wifi link through a WRT54GL and OpenWRT as a bridge, using the notebook's VPN connection feature and the same username and password and got "Error 691:Access was denied because the username and/or password was invalid on the domain." Below should be the relevant files. http://www.bumpernipple.com/freeradius-X http://www.bumpernipple.com/clients.conf http://www.bumpernipple.com/users Any hints on how correct this or better present my problem would be appreciated. Kirk

2 3