December 2009 - Freeradius-Users - lists.freeradius.org

mutual certificate authentication combined with 2nd factor inner authentication
by Essen, Hartwig von 02 Dec '09

02 Dec '09

Due to a limitation also described in 2006 by Matt Brown http://www.mattb.net.nz/blog/2006/09/22/requiring-client-certificates-fo r-eap-ttls-with-freeradius/ we are not able to use - mutual certificate authentication between the server and the client in EAP-TTLS - in combination with a second factor using inner authentication eg. EAP-OTP/MSCHAP etc... According to a suggestion by Matt Brown (link above) a slight change would correct this. Was this suggestion ever communicated to the freeradius project ? We also plan to use the described combination and would prefer, when that slight change could be integrated rather than doing a patch. Hartwig ve

2 1

Re: Problem with rlm_realm
by kachin Agarwal 02 Dec '09

02 Dec '09

Hey i m new to freeradius-server. i m quiet confused with it. so i dont know wat configuration files u r talking about. wat should i edit in the configuration files? my authenticatoin rate is low. so i thought there might be some problem with the radius-server. The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

1 0

Re: Problem with rlm_realm
by kachin Agarwal 02 Dec '09

02 Dec '09

Hi, I ve not edited any configuration files. I m just using this radius-server on the switch for authentication. i m buliding it without these modules : --without-rlm_attr_filter --without-rlm_digest \ --without-rlm_expr --without-rlm_krb5 --without-rlm_pam --without-rlm_preprocess \ --without-rlm_sim_files --without-rlm_unix \ --without-rlm_cram --without-rlm_fastusers --without-rlm_python --without-rlm_smb \ --without-rlm_x99_token --without-rlm_acct_unique \ --without-rlm_example --without-rlm_passwd --without-rlm_radutmp \ --without-rlm_sql --without-rlm_always --without-rlm_checkval --without-rlm_detail \ --without-rlm_exec --without-rlm_ippool --without-rlm_dbm --without-rlm_ns_mta_md5 --without-rlm_perl --without-rlm_realm --without-rlm_sqlcounter --without-threads --without-rlm_eap_ikev2 --without-rlm_eap_tnc does authentication rate depend on the speed of the processor and all..?? bcoz normally when i run the radius server in my unix box it is pretty fast. but when i run it on a switch it is slow. i m not able to do the performance testing also on my unix system. it show " invalid shell [/dev/null]" how do i add "/dev/null" to /etc/shells?? when i give cat /etc/shells it shows nothing. Thanx & Reagrds, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1

Re: Problem with rlm_realm
by kachin Agarwal 02 Dec '09

02 Dec '09

Hi, I ve not edited any configuration files. I m just using this radius-server on the switch for authentication. i m buliding it without these modules : --without-rlm_attr_filter --without-rlm_digest \ --without-rlm_expr --without-rlm_krb5 --without-rlm_pam --without-rlm_preprocess \ --without-rlm_sim_files --without-rlm_unix \ --without-rlm_cram --without-rlm_fastusers --without-rlm_python --without-rlm_smb \ --without-rlm_x99_token --without-rlm_acct_unique \ --without-rlm_example --without-rlm_passwd --without-rlm_radutmp \ --without-rlm_sql --without-rlm_always --without-rlm_checkval --without-rlm_detail \ --without-rlm_exec --without-rlm_ippool --without-rlm_dbm --without-rlm_ns_mta_md5 --without-rlm_perl --without-rlm_realm --without-rlm_sqlcounter --without-threads --without-rlm_eap_ikev2 --without-rlm_eap_tnc does authentication rate depend on the speed of the processor and all..?? bcoz normally when i run the radius server in my unix box it is pretty fast. but when i run it on a switch it is slow. i m not able to do the performance testing also on my unix system. it show " invalid shell [/dev/null]" how do i add "/dev/null" to /etc/shells?? when i give cat /etc/shells it shows nothing. Thanx & Reagrds, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

1 0

Re: Problem with rlm_realm
by kachin Agarwal 02 Dec '09

02 Dec '09

Hi, Ya i tried to build it using --without-rlm_realm, but then too it is building. wat might be the problem?? and ya it takes a very long time when i run the radius server in debugging mode.. what might be the problem for the low authentication rate? how much auth rate approx should i get with freeradius-server 2.1.7? Thanx & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1

User REALMS and PAP rejected when using MySQL based accounts
by James Hankins 01 Dec '09

01 Dec '09

Greetings All: I am standing up a new radius server for pass through auth. I'm struggling with accounts that are mysql based (which I have to use for the my automated billing system). Using NTRadPING Test Utility. I can authenticate using PAP and REALMS if the user is just located in USERS file I can authenticate without a REALM and with CHAP when using MySQL but I CAN'T authenticate using realms or using PAP when using accounts in MySQL. in users: test2 Auth-Type:=Local,User-Password == "password" (works everytime with all combinations) radcheck ------------ UsernName Attribute op Value test3 User-Password == password usergroup --------- UserName GroupName Priority test3 Dialin 1 radgroupcheck ------------------ id GroupName Attribute op Value 1 Dialin Auth-Type := Local

1 1

PAP Authentication Not Working ??
by James Hankins 01 Dec '09

01 Dec '09

Greetings, I've got a 1.1-3 FreeRadius server and trying to figure out what to do to enable PAP authentication. CHAP is working when I use Radius Ping but if I change the Password to User-Password which if I understand it is supposed to enable PAP. When I do this, I get a Access-Reject. Is there something else I need to do to enable PAP or force it? Thanks! Jim

2 2

Re:6. Problem to start radiusd -x (C. Diego Raffaelli A.)
by C. Diego Raffaelli A. 01 Dec '09

01 Dec '09

Hi all ... i found: *Author: *Salim Engin *Date: *2009-09-17 02:46 -400 *To: *FreeRadius users mailing list *Subject: *Re: Upgrading from 2.1.6 to 2.1.7 Just try to execute "ldconfig" and retry... i did it, and i get something that i think is debug info... then i did radtest and i have a response. unaccepted but its a response: please look my radiusd -X <<< uncomplete>>> Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 *Failed binding to authentication address * port 1812: Address already in use* /usr/local/etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 debian:~/freeradius-server-2.1.7# radtest test test localhost 0 testing123 Sending Access-Request of id 93 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 1.2.3.4 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=93, length=20 I would like to know if its normal this: Failed binding to authentication address * port 1812: Address already in use *and this:* *rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=93, length=20* thanks a lot Carlos * *

2 1

Idle Time-out- Session time-out/ Aacct start-stop packet
by Sylvain De Muynck 01 Dec '09

01 Dec '09

Dear all, I would like my user to get a session time-out of 20 minutes. While looking at the debug, I noticed that my users matched the default entry [12] attrs.accounting.response and get authenticate every 10 minutes (in fact, this even take over the session time-out attribute that I could attribute to a specific user) So, basically, I don't know how to control it. DEFAULT Vendor-Specific =* ANY, Message-Authenticator =* ANY, Proxy-State =* ANY I thank that was the file that I could configure to get all my users re-authenticate after 20 minutes. Then, I had a look to the attrs file I noticed that the Idle-time out was of 10 minutes..So, I decided to put the Idle time of 1200 instead of the regular 600 who was written in this file. DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, MS-CHAP-MPPE-Keys =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 1200, Port-Limit <= 2 Unfortunately, that did not work and now, I am still stuck to figure out how could I do that. To sum up this issue, I got Alvarion NAS, from my users, I can see accounting start and accounting stop packet, every 10 minutes, I got an accounting packet stop from my users with everytime the same termination cause = lost-carrier. Thanks in advance for you help. Let me know if you need more details. Regards Sylvain

2 1

Could not link driver rlm_sql_mysql:
by Yagnesh Dave 01 Dec '09

01 Dec '09

Hi All, While trying to run the FreeRadius I got this error. Please let me know what should be done to overcome this. While checking it on FreeRadius emails, i found the same problem has been encountered by others too, but did`nt get to see the solution, thus posting it. ERROR: Could not link driver rlm_sql_mysql: ld.so.1: radiusd: fatal: rlm_sql_mysql.so: open failed: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[161]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. Errors initializing modules root@cn# Thanks and Regards, Yagnesh Dave.

3 2