December 2009 - Freeradius-Users - lists.freeradius.org

Re: That's my AAA model
by C. Diego Raffaelli A. 02 Dec '09

02 Dec '09

Hi all Page linked by Johnny R says: "The photo doesn't exist anymore." i would like to see the model greetings Carlos

3 4

scripts for freeradius
by Mike Marseglia 02 Dec '09

02 Dec '09

Hi, We started implementing freeradius2.0 on Debian Squeeze recently and I crafted a couple of scripts to help me install/mange it. I thought they might be useful to someone else and maybe I could get some good feedback. freeradiusDaemontools script to configure freeradius under daemontools on Debian radiusPassword script for users to selfservice RADIUS password stored in postgresql database You will find them on our git repository: http://projects.oshean.org Mike Marseglia, OSHEAN w. 401-886-0887 x208 c. 401-248-4867 e. mike(a)oshean.org

1 0

MPD : mpd-drop-user
by cktan 02 Dec '09

02 Dec '09

Dear all, Is anyone try this attribute /*mpd-drop-user*/ in freeradius with Mysql? MPD support this attribute to check the status of account during it update the accounting and if the value for this attribute become non-zero, it will disconnect the session for the user. We use MPD to setup a PPPoE server with freeradius to provide authentication to users and we have come across to drop the session if the user's account suspended but we have no luck to make it work. Currently we try to put this attribute in radreply table and it doesn't work for us. Looking for your kind information in this matter. Thanks in advance. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 12

RE: FreeRADIUS and PostgresSQL
by John Gardner 02 Dec '09

02 Dec '09

> I might point out here that whilst you're paying good money for > support for old software you are getting FREE support from an > internet mailing list populated by dedicated users/developers > of the product :-| > Alan I do appreciate I am getting support from a free mailing list, and I also appreciate the help everyone is giving me... But I didn't take out the support contract :-( I however do have to do the work on the coal face. Anyway, I may very well contemplate using the version 2 RPMS, if I can get it past my line manager. Thanks for the help John This email and any files transmitted with it are intended solely for the named recipient and may contain sensitive, confidential or protectively marked material up to the central government classification of ?RESTRICTED" which must be handled accordingly. If you have received this e-mail in error, please immediately notify the sender by e-mail and delete from your system, unless you are the named recipient (or authorised to receive it for the recipient) you are not permitted to copy, use, store, publish, disseminate or disclose it to anyone else. E-mail transmission cannot be guaranteed to be secure or error-free as it could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses and therefore the Council accept no liability for any such errors or omissions. Unless explicitly stated otherwise views or opinions expressed in this email are solely those of the author and do not necessarily represent those of the Council and are not intended to be legally binding. All Council network traffic and GCSX traffic may be subject to recording and/or monitoring in accordance with relevant legislation. South Tyneside Council, Town Hall & Civic Offices, Westoe Road, South Shields, Tyne & Wear, NE33 2RL, Tel: 0191 427 1717, Website: www.southtyneside.info

1 0

Freeradius EAP authentication
by Diego Chovares Moreno 02 Dec '09

02 Dec '09

Hello everyone, I am installing a RADIUS server on a ubuntu server with freeradius. All tests are working properly except when I try to connect through an access point. This is the debug that I get: rad_recv: Access-Request packet from host 192.168.1.1 port 1084, id=1, length=206 Message-Authenticator = 0x789bf39c8f59de88701888fc6ed3a2f2 Service-Type = Framed-User User-Name = "diego\000" Framed-MTU = 1488 State = 0x734ffec0734ee45437bb08e87fc6420c Called-Station-Id = "00-15-E9-A3-01-CE:radius" Calling-Station-Id = "00-15-AF-9F-8D-E0" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020100060319 NAS-IP-Address = 192.168.1.1 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "diego", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> diego [sql] sql_set_user escaped user --> 'diego' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'diego' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'diego' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'diego' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> diego [sql] sql_set_user escaped user --> 'diego' expand: %{User-Password} -> expand: %{Chap-Password} -> expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}[image: Silbando despreocupadamente]%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'diego', '', 'Access-Reject', '2009-11-27 17:33:06') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'diego', '', 'Access-Reject', '2009-11-27 17:33:06') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok expand: %{User-Name} -> diego attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 1 to 192.168.1.1 port 1084 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 0 with timestamp +53 Waking up in 0.9 seconds. Cleaning up request 1 ID 1 with timestamp +53 Ready to process requests. I think the error occurs here: [eap] EAP NAK [eap] NAK asked for unsupported type 25 [eap] No common EAP types found. [eap] Failed in EAP select But I do not know how to fix it ... if anyone can help I would be extremely grateful, as I have tried many things, but not fix. Thanks in advance and greetings

4 4

Problem to start radiusd -x
by C. Diego Raffaelli A. 02 Dec '09

02 Dec '09

Hi all: I had install Debian lenny. later, mysql, later apache and later, download freeradius freeradius-server-2.1.7.tar.gz, untar and ./configure, make and make install. the errors like "checking for gcc... no" was solved. now, i tried to run famous "radiusd -x" but i have the follow error message: debian:~/freeradius-server-2.1.7# radiusd -X radiusd: error while loading shared libraries: libfreeradius-radius-2.1.7.so: cannot open shared object file: No such file or directory debian:~/freeradius-server-2.1.7# radiusd -x radiusd: error while loading shared libraries: libfreeradius-radius-2.1.7.so: cannot open shared object file: No such file or directory debian:~/freeradius-server-2.1.7# radtest test test localhost 0 testing123 /usr/local/bin/radclient: error while loading shared libraries: libfreeradius-radius-2.1.7.so: cannot open shared object file: No such file or directory debian:~/freeradius-server-2.1.7# i do everything logged as root from a ssh session by Putty why error? any idea? i will search in doc or wiki, but help will be grateful. Carlos

6 6

PEAP with MSCHAPv2
by Peter Carlstedt 02 Dec '09

02 Dec '09

Hello everyone. Im trying to understand how the certificates work in Freeradius. Last time I asked about why I need to install a root certificate on all the windows clients I got the answer that it is because PEAP works that way. But when I read about it on other sites it says that EAP-TTLS and PEAP was created so that you wont need client-side certificates? Is there a difference in client-side certificates and the root certificate? The PEAP0 I want to use is EAP-MSCHAPv2 since that one should not require client-side certificates if I have understood it correctly. Best Regards/ Peter Carlstedt _________________________________________________________________ Windows Live: Friends get your Flickr, Yelp, and Digg updates when they e-mail you. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

Re:6. Problem to start radiusd -x
by C. Diego Raffaelli A. 02 Dec '09

02 Dec '09

Hi all in effect, with a simple Idpatch the problem was solved. and about radiusd -X already running, sorry. its my first installation :) now i have this: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Now, lets install phpradmin for webadmin and mysql (first). later, i will be accounting pppoe and dial up users :) i hope :P thaks all.

1 0

RE: FreeRADIUS and PostgresSQL
by John Gardner 02 Dec '09

02 Dec '09

Thanks Stefan >It's not the HOWTO that's out of date, it's your server version being >ancient. I can only strongly urge you to use the 2.x releases, they are >so much more convenient and feature-rich. Especially if you are setting >up a brand new instance, it's a very bad idea to start with this >outdated version 1.1.3. I'm sorry I assumed it was the HOWTO that was wrong, but the HOWTO did say, "...I tested this instructions on CentOS 5.0 and CentOS 5.1. CentOS 5.x came with FreeRadius 1.1.3..." As we are using OEL 5.4 I thought this would be OK. >And that's where the misery of ancientness kicks in: 1.1.3 did not know >about "Cleartext-Password" yet. If you really want to stick with this >old version, you could use "User-Password" instead. But again: please >don't. Use 2.x. Ah! That is good news. The problem is that I'm working under constraints of a support agreement that will only allow us to install the packages that come with OEL 5.x, so at the moment, 1.1.3 is the only thing I can work with :-( >All attributes are defined in the dictionary (and all the files which >are included by raddb/dictionary). These are hundreds. But it's not >usually necessary to read them - the HOWTOs get you through the config, >so long as the versions they refer to are halfways in sync. I will have a look at the dictionary. Thanks again. John This email and any files transmitted with it are intended solely for the named recipient and may contain sensitive, confidential or protectively marked material up to the central government classification of ?RESTRICTED" which must be handled accordingly. If you have received this e-mail in error, please immediately notify the sender by e-mail and delete from your system, unless you are the named recipient (or authorised to receive it for the recipient) you are not permitted to copy, use, store, publish, disseminate or disclose it to anyone else. E-mail transmission cannot be guaranteed to be secure or error-free as it could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses and therefore the Council accept no liability for any such errors or omissions. Unless explicitly stated otherwise views or opinions expressed in this email are solely those of the author and do not necessarily represent those of the Council and are not intended to be legally binding. All Council network traffic and GCSX traffic may be subject to recording and/or monitoring in accordance with relevant legislation. South Tyneside Council, Town Hall & Civic Offices, Westoe Road, South Shields, Tyne & Wear, NE33 2RL, Tel: 0191 427 1717, Website: www.southtyneside.info

4 3

Failed to link to module 'rlm_exec'
by Yagnesh Dave 02 Dec '09

02 Dec '09

Hi All, I am getting this error while starting the radius (free radius 1.1.7). Please help me to resolve the problem. The error is /usr/local/etc/raddb/modules/exec[24]: Failed to link to module 'rlm_exec': ld.so.1: radiusd: fatal: /usr/local/lib/rlm_exec.a: unknown file type Thanks and Regards, Yagnesh Dave.

1 0