December 2011 - Freeradius-Users - lists.freeradius.org

Re: Multi-valued LDAP attribute
by Adam Track 23 Dec '11

23 Dec '11

Aaaaah.. thanks! Wouldn't have figured that out on my own... A.

1 0

(no subject)
by McSparin, Joe 23 Dec '11

23 Dec '11

Keep getting this error message when running "make" in my /raddb/certs directory I reinstalled openssl but to no avail. Any thoughts? /usr/bin/openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf Using configuration from ./server.cnf ERROR: loading the config file 'xpextensions' 1149:error:02001002:system library:fopen:No such file or directory:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/b io/bss_file.c:126:fopen('xpextensions','rb') 1149:error:2006D080:BIO routines:BIO_new_file:no such file:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/bio/bs s_file.c:129: 1149:error:0E078072:configuration file routines:DEF_LOAD:no such file:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/conf/c onf_def.c:197: *** Error code 1 Stop in /usr/local/etc/raddb/certs. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

5 6

[PATCH] Fix debug output in auth.c
by Brian Julin 23 Dec '11

23 Dec '11

The attached patch fixes a parameter juxtaposition and a couple broken RDEBUG statements in auth.c that were trying to print vp_strvalue of a VALUE_PAIR of type integer. I haven't looked but there could very well be other instances of this over in the accounting area, and the Session-Type in auth.c may also need a similar fix. I don't use those codepaths.

2 1

Action on disconnet
by gvalzolgher＠fastalp.it 23 Dec '11

23 Dec '11

Hi All, i'm news of newsletter, hope to use it well. I'm studing about freeradius and i've installed a test machine, i would to known if it is possible to define actions to do when radius detects a user disconnections. (I'm thinking about to write some value to a second databases, but question is more general than write something to other db). Could you give me an advice ? Thank you best regards Tornado -- View this message in context: http://freeradius.1045715.n5.nabble.com/Action-on-disconnet-tp5096641p50966… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

ntlm_auth return value
by MKondrin 22 Dec '11

22 Dec '11

Hello! I am writing custom script substituting ntlm_auth program which authenticates users of our subnet using freeradius and mschap module. But I do not quite understand what is the expected return value of the ntlm_auth program. I think that my script should return the string NT_KEY: xxx. where xxx is a NT-hash of user's password. But when I made my script return this value then only TTLS/MSCHAPV1 authentication works, but not TTLS/MSCHAPV2 and PEAP/MSCHAPV2 which both hangs on the second phase. Looking into the source code of freeradius-server-2.1.12/src/modules/rlm_mschap/rlm_mschap.c (lines No. 753 vs.691) I have found that rlm_mschap module rather expects from the ntlm_auth not the NT-hash itself but rather a MD4 hash of the NT-hash. It is not hard for me to change my script accordingly, but I wonder is this an intended behavior or a bug? Thank you in advance. M.Kondrin

2 1

name change
by Travis Dimmig 21 Dec '11

21 Dec '11

freeRadius doesn't start when I change the server name in radiusd.conf The line is radiusd.conf now looks like: # name of the running server. See also the "-n" command-line option. name = sessionRadius I have in the log: Wed Dec 21 16:43:08 2011 : Error: Failed binding to //var/run/sessionRadius/sessionRadius.sock: No such file or directory Why is freeRadius unable to create that socket when I change the name? Travis Dimmig Software Development Specialist Impulse Point www.impulse.com<http://www.impulse.com>

3 4

Winbind client not authorized!
by Erick Rojas Bastidas 21 Dec '11

21 Dec '11

I did dwrx-x--- 2 root winbindd_priv 4096 dic 20 13:59 winbindd_privileged, and now winbindd responds, I run the command ntlm_auth and responds with: NT_STATUS_OK:Succes (0x0) But in the output debug freeradius said: Exec-program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on var/run/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/run/samba/winbindd_privileged are set correctly. (0xc0000022) I should do in this case? Would be nice if add the user 'freerad' to the group 'winbindd_priv'? Enviado desde mi dispositivo movil BlackBerry® de Digitel.

2 1

RV: certificate compatibility
by Erick Rojas Bastidas 21 Dec '11

21 Dec '11

I did certificates with xpextensions and install the CA cert in the client.. But the debug output of freeradius displays a warning of compatibility certificate.. This may be the problem?? Enviado desde mi dispositivo movil BlackBerry® de Digitel. -----Original Message----- From: erickj_rojasb(a)hotmail.com Date: Wed, 21 Dec 2011 14:24:28 To: <freeradius-users(a)lists.freeradius.org> Reply-To: erickj_rojasb(a)hotmail.com Subject: Acces-Accept, but connectivity is almost zero Hi all, thanks for your help! I have the CA certificate installed on the client, and freeradius -X responded with an 'Acces-Accept', but connectivity is almost zero, received packets are very few.. This could be due to problems of the certificate?? Enviado desde mi dispositivo movil BlackBerry® de Digitel.

2 1

Acces-Accept, but connectivity is almost zero
by Erick Rojas Bastidas 21 Dec '11

21 Dec '11

Hi all, thanks for your help! I have the CA certificate installed on the client, and freeradius -X responded with an 'Acces-Accept', but connectivity is almost zero, received packets are very few.. This could be due to problems of the certificate?? Enviado desde mi dispositivo movil BlackBerry® de Digitel.

2 1

Free Radius Nak List Issue
by Aman Arneja 21 Dec '11

21 Dec '11

Hi FreeRadius Users We seem to be facing a problem while using EAP with free radius. If the client is proposing a list of methods in the NAK message being sent in response to server method proposal, it seems free radius is just looking at the first entry rather than parsing the list. Is this a known issue? Any workarounds or patches? Thanx Aman Arneja

2 2