May 2010 - Freeradius-Users - lists.freeradius.org

sending Access-request, Access-Reject
by dorra aa 12 May '10

12 May '10

hi can someone help me in that i add a users : abc cleartext-password:="123" and i run freeradius -X after that i do: root@pfe-laptop:/home/pfe# radtest abc 123 localhost 1812 testing123 Sending Access-Request of id 48 to 127.0.0.1 port 1812 User-Name = "abc" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=48, length=20 and this is the output of deamon: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:41804, id=48, length=55 User-Name = "abc" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "abc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry abc at line 216 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 48 to 127.0.0.1 port 41804 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 48 with timestamp 4beb3ff9 Nothing to do. Sleeping until we see a request. _________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969

2 1

RE: framedipaddress
by Paweł Pogorzelski 12 May '10

12 May '10

Listen we've already bought complete meru sytem to eduroam project and there is no turning back. There are many great feature which only meru have. Right now i must find solution for this sytem. -- Pozdrawiam/Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

5 4

RE: framedipaddress
by Paweł Pogorzelski 12 May '10

12 May '10

Unfortunately Meru claims that the client IP address is not sent to the radius in any other attribute either. -- Pozdrawiam/Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

4 3

How to demonize 'radiusd -s'
by Коньков Евгений 11 May '10

11 May '10

Hi, FreeRadius. Is this posible to demonize 'radiusd -s' ? -- Eugen Konkov mailto:kes-kes@yandex.ru

1 0

Adding a signed certificate from a signing authority
by Iain Grant 11 May '10

11 May '10

Apologies I seem to be hogging this today. My radius server is working fine, so now I want to add a signed certificate from a certificate authority. Are there any pointers on how to do this. I have found and carried out the steps on the wiki site around using "snake oil" certificates and then creating your own producution certificates. But I now would like to add the externally signed certificate for added security. Thanks again Iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

2 1

Simultneous-Use + SQL + Checkrad
by Galatóczki István 11 May '10

11 May '10

Hi All! I use Freeradius 2.0.4(deb pack) with Mysql 5.0.51. The online users check not work in the NAS with checkrad script my network. I read the list and forums but not founded solution. Question: working the checkrad script without radutmp? my config: radcheck- Simultaneous-Use: =1 accounting ( sql sqlippool ) session ( sql ) uncomment: simul_count_query... in dialup.conf include: sql.conf etc.. in the radiusd.conf Best Regards Steve ps: sorry my english

1 0

RE: framedipaddress
by Paweł Pogorzelski 11 May '10

11 May '10

Than You sunhualing for advice. I'm waiting for answer from Meru. -- Pozdrawiam/Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

1 0

Freeradius 2.1.7 mschap2 depreciated condition
by Iain Grant 11 May '10

11 May '10

I am trying to build a radius server on a Licencesed RedHat ES 5.5 with the stock Freeradius 2.1.7 rpms. The problem is %{Stripped-User-Name} does not seem to be working properly. If I run radius -X I can see the following [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for OURUSER(a)scri.ac.uk with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> OURUSER(a)scri.ac.uk [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=OURUSER(a)scri.ac.uk [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] expand: --domain=%{%{mschap:NT-Domain}:-OURDOMAIN} -> --domain=OURDOMAIN [mschap] mschap2: 04 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=13b2ecc29de42369 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=f55853d43f231f154755ce89ca3136f13929f36d728dbfd9 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Note : I've changed the username and domain name in the above. Is this fixable with a configuration file ? I have already got a working Centos 5.5 server using freereadius 2.1.8, but I want to move it to RedHat too match all the other infrastructure servers. Also I'm writing a build document for the system so that someone else has a document to follow in the future. Thanks iain Iain Grant Linux System Administrator Scottish Crop Research Institute Invergowrie Dundee DD2 5DA Tel : 01382 562731 x 2605 ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

2 2

Freeradius 2.1.7 mschap2 depreciated condition
by Iain Grant 11 May '10

11 May '10

Solved it, I had not added my realms to the bottom of proxy.conf. Once changed everything is working. Thanks iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

1 0

RE: Freeradius-Users Digest, Vol 61, Issue 37
by Iain Grant 11 May '10

11 May '10

>> The problem is %{Stripped-User-Name} does not seem to be working properly. >here was a chhange to conditional expansions some time back....the output you see is just a warning....if you 'man >unlang' you can see how such a condition should be written.....the default config that ships with 2.1.8 should have >this fixed....but just check your modules/* files for where this is used... mschapv2 or ntlm_auth from memory This is strange as I have compared the modules/mschap files on both systems ( radius 2.1.8 on centos and radius 2.1.7 on RH ES 5.5 ) and they are identical !!! In fact I even cut and pasted the ntlm line from the working radius to the redhat radius server. Has someone else built a RedHat radius 2.1.7 server to point to an Windows ADS ?? Thanks Iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

2 1