March 2009 - Freeradius-Users - lists.freeradius.org

FW: Help to by a NAS
by Leonardo Mártyres 13 Mar '09

13 Mar '09

Hi, Could someone suggest some AP models to buy? I want to do account properly with freeradius. Thanks _________________________________________________________________ Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=/friends.aspx…

1 0

Re: Error in authentication
by Jaswinder Kaur 13 Mar '09

13 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi Alan, I have found the problem with my radius authentication. My CA certificate had expired, which was the root of the issue. But its been sorted now. Cheers, JK -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.9.0 (Build 472) Charset: US-ASCII wsBVAwUBSbpWVvsvZpRjP72bAQg+JwgAqfLJyQth+oNaZDadrTUT8M6GO1bFGF+g WDDvb3p9woJhyhg2opG63/i0MdVJBC2AAUI8NwBFCGCOKIf5G2szarF5PVN/cvRJ bWJjQm1fhUg3M8FS6EgMsg1C2KwKY0Gef5Qcd0NnW33MuOA+BwwAmCD+zRNbNVnv 9mfYjZZoifjBvLq1/p0VrKNszf3IrAoaxQVKN00qE9Wg73NwYoHJlMaxxYkZr56s FjoR9jGfR4r8uM1N1rYUH3wjKB+r3jpbts/xLkGCEVet1NY3c13bNAiy+hO3dzKL lRsjf7HPrg1HnvNECw2Rk+g5JDpo3lYdr14B+6bfNH5mDIMGq0Z7Jw== =Tgav -----END PGP SIGNATURE----- Access your county council services online 24 hours a day, 7 days a week at www.northyorks.gov.uk. WARNING Any opinions or statements expressed in this e-mail are those of the individual and not necessarily those of North Yorkshire County Council. This e-mail and any files transmitted with it are confidential and solely for the use of the intended recipient. If you receive this in error, please do not disclose any information to anyone, notify the sender at the above address and then destroy all copies. North Yorkshire County Council�s computer systems and communications may be monitored to ensure effective operation of the system and for other lawful purposes. Although we have endeavoured to ensure that this e-mail and any attachments are free from any virus we would advise you to take any necessary steps to ensure that they are actually virus free. If you receive an �out of office� notice from the person you are contacting and you wish to request information under either the Freedom of Information Act, the Data Protection Act or the Environmental Information Regulations please forward your request by e-mail to the Data Management Team (datamanagement.officer(a)northyorks.gov.uk) who will process your request. North Yorkshire County Council.

1 0

rlm_ldap: default_profile not expanded
by Giovanni Lovato 13 Mar '09

13 Mar '09

Is the default_profile setting in modules/ldap supposed to expand runtime variables? I tried to set: default_profile = "cn=default,ou=%{Realm},ou=profiles,dc=mc,dc=com" but on the logs I see: rlm_ldap: performing search in cn=default,ou=%{Realm},ou=profiles,dc=mc,dc=com rlm_ldap: object not found If I set: default_profile = "cn=default,ou=company,ou=profiles,dc=mc,dc=com" it works.

2 1

Re: radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol
by Peter Param 13 Mar '09

13 Mar '09

>>You have two different versions of OpenSSL installed. I'm really stumped by this. I'm replaced the default debian openssl libraries (as per... ldconfig -v | grep ssl) with openssl 0.9.8.j and am still getting the pesky error, radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol: SSL_CTX_set_info_callback Is libgnutls-openssl.so.13 referenced by freeradius? That's the only file I haven't been able to replace. What else can I do? Any help would be greatly appreciated! cheers Peter -X output: FreeRADIUS Version 2.1.3, for host i686-pc-linux-gnu, built on Mar 13 2009 at 09:54:32 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol: SSL_CTX_set_info_callback ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Accounting server reply
by rosect190＠yahoo.com 13 Mar '09

13 Mar '09

Hi, Does an accounting server reply to a NAS's accounting message? How does an NAS know that the accounting message is lost (due to accounting server failure)? Thanks.

2 1

Help to by a NAS
by Leonardo Mártyres 12 Mar '09

12 Mar '09

Hi, Could someone suggest some NAS models to buy? I want to do account properly. Thanks _________________________________________________________________ Show them the way! Add maps and directions to your party invites. http://www.microsoft.com/windows/windowslive/products/events.aspx

1 0

Re: Error in Authentication
by Jaswinder Kaur 12 Mar '09

12 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 My problem is that, I am not able to figure out, what wrong am I doing ? I shall be highly thankful, if you can point me what part of config I need to change? Many Thanks, JK Jaswinder Kaur wrote: > I am using freeradius 2.1.1 on Suse 10 SP1. I am trying to integrate Freeradius with edirectory, but somehow, I am not able to achieve the desired result, the client just sits while trying to authenticate, I can see the Radius server reading the username and password, but still its not authenticating it. > > Kindly Help. I am attaching the debug from radius server here: This is explained in the FAQ, and in the comments in eap.conf. Please read the existing documentation. Alan DeKok. -----BEGIN PGP SIGNATURE----- Version: PGP Universal 2.9.0 (Build 472) Charset: US-ASCII wsBVAwUBSblWe/svZpRjP72bAQgOaAf/Y0B9kpfry1PKnyQoxCM3iyEY38vgfaky 8G/IjsL0YnnXyEyWjbCZcWqUys2d+bpN6YKa+/mWmUDME+HMcS5QXJewHDSvRH9J ONWElOOl8BKasoU4Xs7kbjJZXGRdHIJjWiCMxuxl1XP5DaXOTEwE9vgMGmZKd88f YwOBmyrzVb7ohAYKgvOp40W49By1ZB+QLdq78uMmviYn9di61i5iORyoUCEHvAGs 18y0/4ewF+jmBYXSD0vrdrXxUSfUbxVpE7/DUG35lBwqQzxEKAdOMBxiZ8D+Sx4W NTLBoxoIdUD2i4DnaEi7f7PY0XaA/z024fmOpsme5oN92K9xffJWPg== =+pcE -----END PGP SIGNATURE----- Access your county council services online 24 hours a day, 7 days a week at www.northyorks.gov.uk. WARNING Any opinions or statements expressed in this e-mail are those of the individual and not necessarily those of North Yorkshire County Council. This e-mail and any files transmitted with it are confidential and solely for the use of the intended recipient. If you receive this in error, please do not disclose any information to anyone, notify the sender at the above address and then destroy all copies. North Yorkshire County Council�s computer systems and communications may be monitored to ensure effective operation of the system and for other lawful purposes. Although we have endeavoured to ensure that this e-mail and any attachments are free from any virus we would advise you to take any necessary steps to ensure that they are actually virus free. If you receive an �out of office� notice from the person you are contacting and you wish to request information under either the Freedom of Information Act, the Data Protection Act or the Environmental Information Regulations please forward your request by e-mail to the Data Management Team (datamanagement.officer(a)northyorks.gov.uk) who will process your request. North Yorkshire County Council.

2 1

Huntgroups and Network of Clients
by HRZ Konten 12 Mar '09

12 Mar '09

Hi all, I use Freeradius 1.1.7 (yes, sorry I know it is a little bit old but there is no time to upgrade :( I want that the requests from some servers are checked and authenticated through LDAP-Groups for example Requests from IP x.x.x.x should be authenticate only if the user is in ldap-group employee, tha same for IP y.y.y.y . Then I have some other servers with requests that don't need LDAP authorisation. I used the Huntgroups to define the first two servers als huntgroup "testldap" and the rest as huntgroup "all". That functions great for IP Addresses. The list ist long, but still ok. Only if I want to do that for network of clients this doesn't work. The problem is that I must list all of the servers that should gain access and I have a lot of PC-Pools which use radius to authenticate. In the client.conf they are written with the network addresses, that doesn't work in huntgroups file. I don't want to list all of the PC-Pool members in the Huntgroups because there are too many... Does Huntgroup support only IP-Addresses or I can fill up Network Addresses too? Or there is another workaround? Or maybe this issue is already changed in the new version 2.3.1? users -------- DEFAULT Huntgroup-Name==testldap, Ldap-Group == employee, Auth-Type := Pam Fall-Through = no DEFAULT Huntgroup-Name==all, Auth-Type := Pam Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message = "Please call the helpdesk." huntgroups ----------------- #Test LDAP testldap NAS-IP-Address == x.x.x.x testldap NAS-IP-Address == y.y.y.y #All Users all NAS-IP-Address == a.a.a.a .... all NAS-IP-Address == z.z.z.z/26 Greets, Meyes

2 5

Winbind errors
by Mike Diggins 12 Mar '09

12 Mar '09

Freeradius 2.1.3 winbindd version 3.0.33-3.7.el5 RedHat Linux 5, release 2 fully patched I know this isn't a FreeRadius issue, but is related. Has anyone running FreeRadius with Winbindd for windows authentication, found a solution to these error messages in the samba.log? [root@prad01 log]# tail samba.log [2009/03/12 09:28:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:33:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:33:33, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. [2009/03/12 09:38:35, 0] lib/util_sid.c:string_to_sid(242) string_to_sid: Sid S-0-0 is not in a valid format. I get several a minute. I've found many posts with the same complaint, but no solution. Is upgrading (or downgrading) likely to stop it? It seems to be a purely cosmetic issue, but I'd still like to find a solution. -Mike

1 0

How to allow nas'es to serve only groups of clients?
by Alexander Yu. Solodukhin 12 Mar '09

12 Mar '09

Hi. I have two types of nases: 1) hotspots 2) vpn servers. I need vpn nases authorize only vpn users and hotspot nases authorize only hotspot users. How can i divide users into several groups and reject vpn accounts to login through hotspot and vice versa? I think i must use huntgroups and unlang, but not cleanly understand how. -- ISP CrIS, Softwarium

5 9