May 2010 - Freeradius-Users - lists.freeradius.org

(no subject)
by Zheng, Jiajia 13 May '10

13 May '10

Hi, I hope it is the right place to ask questions about EAP-TLS with radius server. I installed freeradius-2.1.6 rpm package on my Fedora 10 system. EAP_PEAP, EAP_TTLS_CHAP, TTLS_MD5, TTLS_MSCHAP, etc. work fine. However, EAP-TLS handshake failed. Here are my steps to implement EAT-TLS with radius server. 1. on server: yum install freeradius 2. on server: cd /etc/raddb 3. on server: edit users and clients.conf (see attachments) 4. on server: radiusd -X 5. I configured the AP which is wired connected to the server using WPA-TKIP 6. copy ca.pem from server to my wireless machine. 6. I tried EAP_PEAP, EAP_TTLS_CHAP, TTLS_MD5, TTLS_MSCHAP on my wireless machine, which all worked fine. 7. on server: cd /etc/raddb/certs 8. on server: make client.pem 9. copy client.pem from server to my wireless machine 10. run wpa_supplicant on my wireless machine: wpa_supplicant -Dwext -iwlan0 -c WPA_EAP_TLS.conf WPA_EAP_TLS.conf as below, ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel network={ ssid="ASUS-2.4G" scan_ssid=1 key_mgmt=WPA-EAP eap=TLS identity="root" ca_cert="./ca.pem" client_cert="./client.pem" private_key="./client.pem" private_key_passwd="whatever" } 11. EAP-TLS failed, see the attached tls.log for the output of radiusd Could you help me out on this issue? Is there anything I did wrong? Let me know if you need more debugging info. Thanks, jiajia

3 6

freeradius with mysql failed
by dorra aa 13 May '10

13 May '10

hi i installed mysql. and i modify in /etc/freeradius/sql.conf: readclients=yes also, i decommented in /etc/freeradius/radiusd.conf: accounting {.... sql} authorize {... sql} i run again freeradius -X: but it seems failed because of sql: this is the output [...] sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius rlm_sql_mysql: Mysql error 'Access denied for user 'root'@'localhost' (using password: YES)' # but i check it and it's ok i have in sql.conf: sql{server = "localhost" login = "root" password = "rootpass"} rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. #but i begin with installing mysql-server and i add a user in the database rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 rlm_sql (sql): generate_sql_clients() returned error rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1860] Unknown module "sql". radiusd.conf[1789] Failed to parse authorize section. _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

1 0

free NAS ?
by VU VAN HUNG 13 May '10

13 May '10

Hi all, I just wonder that are there any open source software that have same functionalities like Network Access Server ? Because I see that there's Asterisk, which 's like a PBX. Best, Hung,

6 7

Access request-access reject
by dorra aa 13 May '10

13 May '10

> users: Matched entry DEFAULT at line 153 > > users: Matched entry abc at line 216 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns ok) for request 0 > > rlm_pap: Found existing Auth-Type, not changing it. > > rad_check_password: Found Auth-Type System > > modcall[authenticate]: module "unix" returns notfound for request 0 > > It shouldn't be using an auth-type of "System", that means to lookup the > user in the /etc/passwd (/etc/shadow) file. But you don't have a user on > your system named "abc" so the not found result makes sense, right? > > Why is it trying to find "abc" amongst the unix users on your system? > The answer is right above, look at the lines labeled "users:", that's > your users file, also look at the line that says "Found Auth-Type, not > changing it". So somthing in your users file forced the user "abc" to > have an Auth-Type of "system" or "unix", it also tells you which lines > in the users files it matched. Go fix your users file so it doesn't do that. I found in users file that line: DEFAULT Auth-Type = System i decommented it but same problem. i think i must change it to other attribut? > I'm guessing in your attempts to get things working you may have mangled > the example users file, you might want to start with the unaltered users > file and just add your test user. > > All this is documented in the link I sent you a week ago: > http://deployingradius.com/documents/configuration/pap.html > > -- > John Dennis <jdennis(a)redhat.com> _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 4

i found two freeradius
by dorra aa 13 May '10

13 May '10

yestaerday i create that file: cd ~ apt-get source freeradius and i woked in the users of: cd freeradius-1.1.7/ but now i find another freeradius in: /etc/freeradius. I don't know how it is created there? and does it have any influence in my radius, because i do mychanges in file: users of cd freeradius-1.1.7/. may i delete the second freeradius that i do not created?? _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 2

Query regarding update reason
by Vijay Badola 13 May '10

13 May '10

Hi, I have a query regarding Update-Reason field in PPAQ attribute of Access-Request for prepaid case. According to WiMax specification the size of this AVP is 4 byte(including tag and length). And according to dictionary.wimax supplied by freeradius size of Update-Reason field is 4 byte means total size of AVP is 6 byte. Can we change the size of Update-Reason field to 2 byte in dictionary.wimax to make over all AVP size 4 byte, to decode this AVP at server properly (when incoming Access-Request has 4 byte for update-reason AVP)? Or What is other way to achieve it? Please correct me if my understading is wrong? , * P We have responsibility to the environment. Before printing this e-mail or any other document, let's ask ourselves whether we need a hard copy.

2 1

Simultneous-Use + SQL + Checkrad
by Galatóczki István 13 May '10

13 May '10

Hi All! I use Freeradius 2.0.4(deb pack) with Mysql 5.0.51. The online users check not work in the NAS with checkrad script my network. I read the list and forums but not founded solution. I have read and followed the step of below comment: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg58506.… my config: radcheck table: Simultaneous-Use: =1 -sites-enabled/default- accounting ( sql sqlippool ) session ( sql ) uncomment: simul_count_query... in dialup.conf include: sql.conf etc.. in the radiusd.conf Question: working the checkrad script without radutmp? Steve

2 1

When to ldap?
by Dean, Barry 13 May '10

13 May '10

I am working on a new radius config and have been trying to avoid the lookup in LDAP I have been seeing for the outer identity. I have moved to 2.1.8 with the inner-tunnel virtual host enabled. I have an authorise section for the relevant virtual server that has: authorize { preprocess auth_log chap mschap suffix eap { ok = return } files if (!EAP-Message) { ldap } expiration logintime pap } The "if(!EAP-Message)" works a treat at preventing an LDAP lookup for the outer identity, but if I want to send a basic User-Name/User-Password type auth request after checking with LDAP and returning "Remote access is permitted", I then see: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user What am I missing to tell the "authenticate" section below what I want to do next? authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } Auth-Type EAP { eap } eap } I presume: if (!EAP-Message) { ldap } Fails to set Auth-Type LDAP? ---------------------- Barry Dean Principal Programmer/Analyst Networks Group Computing Services Department Tel: 0151 795 9540

2 6

SAMBA Version
by Colin Byelong 13 May '10

13 May '10

Hi, I was reading the archives and saw that some of the later versions of SAMBA had a bug so it couldn't be used for ntlm_auth/Eap-PEAP. Does anyone know if this is now fixed ? We are running Fedora core 12 and it ships with SAMBA 3.4.7 Thanks Colin -- ----------------------------------------------------------------------- Colin Byelong Email: C.Byelong(a)ucl.ac.uk Senior Network Development Officer Network Group Information Systems Division University College London Gower Street Phone: 020 7679-2572 London WC1E 6BT ------------------------------------------------------------------------

1 0

Clark Wang has invited you to Dropbox
by Dropbox 12 May '10

12 May '10

We're excited to let you know that Clark Wang has invited you to Dropbox! Clark Wang has been using Dropbox to sync and share files online and across computers, and thought you might want it too. Visit http://www.dropbox.com/link/20.Nk89gKs-aB/NjE2MzQ0ODgxNw to get started. - The Dropbox Team ____________________________________________________ To stop receiving invites from Dropbox, please go to http://www.dropbox.com/bl/28952efc12b9/freeradius-users%40lists.freeradius.…

2 1