- Freeradius-Users - lists.freeradius.org

need info on EAP-SIM,help
by doomyu 20 Apr '12

20 Apr '12

I am using Free Radius for EAP-SIM authentication. But some problems, When I run the example eapsim06,the server error is as follows: [eap] processing type sim eap-sim can not find sim-kc1 eap-sim can not find sim-kc2 eap-sim can not find sim-kc3 can not initiate sim,missing attributes Regards, jack -- View this message in context: http://freeradius.1045715.n5.nabble.com/need-info-on-EAP-SIM-help-tp5653902… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

MSSCHAP auth + LDAP authorizaton
by Andres Septer 20 Apr '12

20 Apr '12

I have working radius - AD authentication via winbind (MSCHAP challnge-response). But I do not want to give all domain users ability to use VPN. I want to use special AD group. I have considered LDAP authorization. I've read this manual http://wiki.freeradius.org/Rlm_ldap and configured correct ldap bind values but now I'm pretty much lost How to tell freeradius, that after successful MSCHAP auth against AD it must browse AD via LDAP and check that te username belongs to specified group? Any suggestions of documentation that will help, would be appriciated. Andres Septer

4 4

How to grant access to a network regardless of the username/password?
by Henrik Karlsson 20 Apr '12

20 Apr '12

Hi, I have a dial-in system that use freeRADIUS as radius server. I have figured out how to log username and password from access requests in a SQL database. My next goal is to be able to keep on logging Username and password but accept all users regardless of username/password. The user shall not need to be listed as a user in the RADIUS server. I want to grant access for all users that dial in for access to the network, hut I need to log the username and password that they send to the RADIUS server. Username and password are stored in a Mysql database and we use PAP. Is it possible to make this configuration and if it is possible how do I do it. /Henrik

2 1

Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails.
by Alan Buxey 20 Apr '12

20 Apr '12

Please read the mailing list archives, this very question and setup is often mentioned alan

5 10

Re:Freeradius-Users Digest, Vol 84, Issue 63
by 全球无线联盟 20 Apr '12

20 Apr '12

Alan, Thanks for your reply. Our FreeRadius server is servering the WLAN authentication. For some reason, we need know the result for each authentication request, pass or fail. We know the post-authentication query can do something which we know who is pass. We don't have a method to log the rejected request. Thanks! ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Fri, Apr 20, 2012 03:30 PM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 84, Issue 63 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Alan Buxey) 2. Re: Perl, MySQL & auth (Alan Buxey) 3. Re: Freeradius Access Requet ID (Alan DeKok) 4. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour) 5. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Fajar A. Nugraha) 6. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Wassim Zaarour) 7. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (Fajar A. Nugraha) ---------------------------------------------------------------------- Message: 1 Date: Fri, 20 Apr 2012 07:30:20 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: "wassim.zaarour(a)navlink.com" <wassim.zaarour(a)navlink.com>, "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <9339D497-E840-42EF-A2D5-779F77E0F5D9(a)lboro.ac.uk> Content-Type: text/plain; charset="utf-8" Please read the mailing list archives, this very question and setup is often mentioned alan -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420…> ------------------------------ Message: 2 Date: Fri, 20 Apr 2012 07:35:24 +0100 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: "fabrifloresg(a)gmail.com" <fabrifloresg(a)gmail.com>, "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Re: Perl, MySQL & auth Message-ID: <EEA07012-72B5-438B-B5CE-039B6D237BA0(a)lboro.ac.uk> Content-Type: text/plain; charset="utf-8" Hi, Some interesting system problems. Did you compile FR with PERL support....or if using distros version do they have additional packages you need to install eg freeradius-perl ? We use PERL here...FR compiled with it supported and just 'use DBI;' at the top of the PERL script....no need to do ANYTHING with system libs or running parameters alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420…> ------------------------------ Message: 3 Date: Fri, 20 Apr 2012 08:50:56 +0200 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius Access Requet ID Message-ID: <4F910750.7040104(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 ?????? wrote: > What is the parameter name for freeradius access requet ID? > > For example, > Called-Station-Id = "46-E7-CF-62-78-11" > Called-Station-Id is the parameter name for NAS MAC address. You can't look at the access request ID. It doesn't mean anything, and there's no reason to look at it. Alan DeKok. ------------------------------ Message: 4 Date: Fri, 20 Apr 2012 10:09:18 +0300 From: Wassim Zaarour <wassim.zaarour(a)navlink.com> To: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk>, "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CBB6E5E1.ECFF%wassim.zaarour(a)navlink.com> Content-Type: text/plain; charset="us-ascii" Hi Alan, I went through the archives and did some changes but still getting the error, appreciate of you can help me a bit here. I think I read that the ldap request must be proxied to the inner tunnel for it work, is that true? How can we do that? Thanks Wassim. From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Date: Friday, April 20, 2012 9:30 AM To: Wassim Zaarour <wassim.zaarour(a)navlink.com>, "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Please read the mailing list archives, this very question and setup is often mentioned alan -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120420…> ------------------------------ Message: 5 Date: Fri, 20 Apr 2012 14:15:59 +0700 From: "Fajar A. Nugraha" <list(a)fajar.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CAG1y0scEv7ZrF9OkB5-FKEyJuKOiGW=mmAUQNjt=5AS6j4OnHw(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Fri, Apr 20, 2012 at 2:09 PM, Wassim Zaarour <wassim.zaarour(a)navlink.com> wrote: > Hi Alan, > > I went through the archives and did some changes but still getting the > error, appreciate of you can help me a bit here. > > I think I read that the ldap request must be proxied to the inner tunnel for > it work, is that true? How can we do that? Short version: you won't be able to get PEAP-MSCHAPv2 (i.e. what windows use) to work with your LDAP. Period. Long version: MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either: - Cleartext-Password or NT-Hash available (in LDAP, sql, users file whatever), OR - an active directory If you don't have either, then it won't work. -- Fajar ------------------------------ Message: 6 Date: Fri, 20 Apr 2012 10:22:30 +0300 From: Wassim Zaarour <wassim.zaarour(a)navlink.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CBB6E904.ED05%wassim.zaarour(a)navlink.com> Content-Type: text/plain; CHARSET=US-ASCII On 4/20/12 10:15 AM, "Fajar A. Nugraha" <list(a)fajar.net> wrote: >On Fri, Apr 20, 2012 at 2:09 PM, Wassim Zaarour ><wassim.zaarour(a)navlink.com> wrote: >> Hi Alan, >> >> I went through the archives and did some changes but still getting the >> error, appreciate of you can help me a bit here. >> >> I think I read that the ldap request must be proxied to the inner >>tunnel for >> it work, is that true? How can we do that? > >Short version: you won't be able to get PEAP-MSCHAPv2 (i.e. what >windows use) to work with your LDAP. Period. > >Long version: >MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either: >- Cleartext-Password or NT-Hash available (in LDAP, sql, users file >whatever), OR >- an active directory > >If you don't have either, then it won't work. Hi Farja, Passwords are stored as clear text in my LDAP, that should make MSCHAPv2 work right? Wassim ------------------------------ Message: 7 Date: Fri, 20 Apr 2012 14:30:42 +0700 From: "Fajar A. Nugraha" <list(a)fajar.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <CAG1y0sch+7s+r9+G5Gp5oxhca6wAjbek=j9L6_4gqDWU_sEztg(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-1 On Fri, Apr 20, 2012 at 2:22 PM, Wassim Zaarour <wassim.zaarour(a)navlink.com> wrote: > On 4/20/12 10:15 AM, "Fajar A. Nugraha" <list(a)fajar.net> wrote: >>Long version: >>MSCHAPv2 (which also means PEAP-MSCHAPv2) needs either: >>- Cleartext-Password or NT-Hash available (in LDAP, sql, users file >>whatever), OR >>- an active directory >> >>If you don't have either, then it won't work. > > Hi Farja, > > Passwords are stored as clear text in my LDAP, that should make MSCHAPv2 > work right? Yes, if FR can find them. This part of the log says it can't: [ldap] performing search in o=navbey.com, dc=navbey,dc=com, with filter (uid=pk) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? You might need to play around with the user used to login to LDAP, as some systems only give out passwords to admin accounts. Testing manual LDAP lookup using command line tool (e.g. ldapsearch) helps. If you CAN get your ldap server to return cleartext password with ldapsearch, then you should be able to configure FR to get that as well. -- Fajar ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 84, Issue 63 ************************************************

2 1

Re:Freeradius Access Requet ID
by 全球无线联盟 20 Apr '12

20 Apr '12

Hello, What is the parameter name for freeradius access requet ID? For example, Called-Station-Id = "46-E7-CF-62-78-11" Called-Station-Id is the parameter name for NAS MAC address. Thanks! Tom ------------------ Original ------------------ From: "freeradius-users"<freeradius-users-request(a)lists.freeradius.org>; Date: Fri, Apr 20, 2012 08:12 AM To: "freeradius-users"<freeradius-users(a)lists.freeradius.org>; Subject: Freeradius-Users Digest, Vol 84, Issue 60 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Perl, MySQL & auth (Fabricio Flores) 2. Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. (alan buxey) 3. Re: Perl, MySQL & auth (alan buxey) 4. Re: using windows 8's builtin eap-ttls... Windows 8 bug (Matthew Newton) 5. Re: using windows 8's builtin eap-ttls... Windows 8 bug (alan buxey) 6. Re: Perl, MySQL & auth (Fabricio Flores) ---------------------------------------------------------------------- Message: 1 Date: Thu, 19 Apr 2012 10:48:28 -0500 From: Fabricio Flores <fabrifloresg(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Perl, MySQL & auth Message-ID: <CAJfLZm94kTamUafQf5QNxs95yOti9zEEy3bQNNvb4zPdw4dAnQ(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi... I worked in my perl script... i did the conection to the web service and it works... I configure freeradius (add perl and sql) in auth section, I made a debug with freeradius -X but I don?t know if freeradius read the perl script before work with mysql... i have this output: rad_recv: Access-Request packet from host 127.0.0.1 port 45894, id=120, length=62 User-Name = "1104015936" User-Password = "fabricio1" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "usuario", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop rlm_perl: Added pair User-Name = usuario rlm_perl: Added pair User-Password = clave rlm_perl: Added pair NAS-Port = 1812 rlm_perl: Added pair NAS-IP-Address = 127.0.1.1 ++[perl] returns ok [sql] expand: %{User-Name} -> 1104015936 [sql] sql_set_user escaped user --> 'usuario' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'usuario' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'usuario' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User usuario not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> usuario attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 120 to 127.0.0.1 port 45894 Waking up in 4.9 seconds. Cleaning up request 1 ID 120 with timestamp +410 Ready to process requests. El 9 de abril de 2012 16:49, Fajar A. Nugraha <list(a)fajar.net> escribi?: > On Mon, Apr 9, 2012 at 10:49 PM, Fabricio Flores <fabrifloresg(a)gmail.com> > wrote: > > is possible to use the perl and mysql in authorization section? in > > As I've already said, yes. > > -- > Fajar > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- Fabricio A. Flores G. Egresado en Ingenier?a en Sistemas MSN: fabri_floresg(a)hotmail.com Google: fabrifloresg(a)gmail.com Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/> -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120419…> ------------------------------ Message: 2 Date: Thu, 19 Apr 2012 16:53:42 +0100 From: alan buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: LDAP-FreeRadius-Cisco Switch-802.1x Fails. Message-ID: <20120419155342.GD1845(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii hi, quick look seems to show that you dont have a suitable authorise section in the inner tunnel. the tunnel gets started...your client rejects the default md5 the server sent - and EAP-TTLS gets done...the username/password gets sent but has nothing to go against.... so I suggest you add 'ldap' to the inner-tunnel virtual server (in same way that ldap and LDAP are defined in default server...) alan ------------------------------ Message: 3 Date: Thu, 19 Apr 2012 16:56:10 +0100 From: alan buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Perl, MySQL & auth Message-ID: <20120419155610.GE1845(a)lboro.ac.uk> Content-Type: text/plain; charset=utf-8 Hi, > Hi... I worked in my perl script... i did the conection to the web service > and it works... I configure freeradius (add perl and sql) in auth section, > I made a debug with freeradius -X but I don?t know if freeradius read the > perl script before work with mysql... i have this output: the logs show the perl being called before the sql...and the sql failing with usuario userid not being found alan ------------------------------ Message: 4 Date: Thu, 19 Apr 2012 19:53:13 +0100 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: aman.arneja(a)microsoft.com Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: using windows 8's builtin eap-ttls... Windows 8 bug Message-ID: <20120419185313.GC10911(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=us-ascii Hi Aman, (I'm copying freeradius-users to feedback to the thread, but as it's not really a FR issue I'm happy for you to take this off-list if you want any more details/testing). On Mon, Mar 05, 2012 at 08:19:15PM +0000, Alan Buxey wrote: > right. interesting. I've just been looking into Windows 8 and I found > that if I chose a non-EAP method with TTLS (eg PAP or MSCHAP) then it > didnt work. but if I chose an EAP method with TTLS - eg EAP-MSCHAPv2 then > it worked fine. so more needs to be looked at there. We've been digging into this a bit more and testing the TTLS support with Windows 8. Really nice to see more options than just PEAP at last :-) There seems to be a bug in the Windows 8 TTLS ACK, which means that EAP-TTLS/MS-CHAPv2 doesn't work (EAP-TTLS/MSCHAP and EAP-TTLS/EAP-MSCHAP-V2 are OK). Having received an Access-Accept from the inner tunnel (after the mschap module succeeded), FreeRADIUS sends an Access-Challenge back to the NAS. See src/modules/rlm_eap/types/rlm_eap_ttls/ttls.c:675. The end device should respond to the challenge with a TTLS ACK. RFC 5281 s9.2.3 says: "An Acknowledgement packet is an EAP-TTLS packet with no additional data beyond the Flags octet, and with the L, M, and S bits of the Flags octet set to 0. (Note, however, that the V field MUST still be set to the appropriate version number.)" (this is correctly handled in FR src/modules/rlm_eap/libeap/eap_tls.c:375) The EAP-Message in the resulting Access-Request from Win8 is: EAP-Message = 0x020b000a158000000000 Which is Response / id 11 / length 10 / type TTLS, then: flags 0x80 ('length included') followed by a length of 00000000. Note the RFC says that no additional data beyond Flags, and L/M/S all set to 0 - here, L is set to 1, so it's not a correctly formed ACK (albeit looking like one with Length set to 0), so FR bombs out with: [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 0 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] SSL_read Error [ttls] Error in fragmentation logic [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. eapol_test with EAP-TTLS/MSCHAP-v2 works fine, and sends the TTLS ACK back as: EAP-Message = 0x020800061500 which is fine - flags all 0, no TTLS length supplied. Windows 8 with EAP-TTLS/MSCHAP is also fine, as there is no Access-Challenge sent; it's a direct Access-Accept with EAP-Message 0x030a0004 (Success). As Alan noted, EAP-TTLS/EAP-MSCHAP-V2 also seems fine. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ Message: 5 Date: Thu, 19 Apr 2012 22:02:27 +0100 From: alan buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cc: "aman.arneja(a)microsoft.com" <aman.arneja(a)microsoft.com> Subject: Re: using windows 8's builtin eap-ttls... Windows 8 bug Message-ID: <20120419210227.GA2768(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > We've been digging into this a bit more and testing the TTLS > support with Windows 8. Really nice to see more options than just > PEAP at last :-) thanks for the further testing/verification Matthew :-) alan ------------------------------ Message: 6 Date: Thu, 19 Apr 2012 19:12:36 -0500 From: Fabricio Flores <fabrifloresg(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Perl, MySQL & auth Message-ID: <CAJfLZm88gdUSMR8bNZhmiKuP_Hp2QT3Jm6ODyLQmhL2K6LMgAA(a)mail.gmail.com> Content-Type: text/plain; charset="utf-8" ok i start the freeradius with freeradius -x and i have this error: Can't load '/usr/lib/perl5/auto/DBI/DBI.so' for module DBI: /usr/lib/perl5/auto/DBI/DBI.so: undefined symbol: PL_memory_wrap at /usr/lib/perl/5.12/DynaLoader.pm line 192. I read in another post that is an error because i use dbi of perl... so i started freeradius with: LD_PRELOAD=/usr/lib/libperl.so.5.12.4 freeradius -X in this way freeradius daemon starts but in the freeradius log i have this: Thu Apr 19 18:27:55 2012 : Info: Loaded virtual server inner-tunnel Thu Apr 19 18:27:55 2012 : Error: rlm_perl: perl_parse failed: /etc/freeradius/example.pl not found or has syntax errors. Thu Apr 19 18:27:55 2012 : Error: /etc/freeradius/modules/perl[7]: Instantiation failed for module "perl" Thu Apr 19 18:27:55 2012 : Error: /etc/freeradius/sites-enabled/default[265]: Failed to load module "perl". Thu Apr 19 18:27:55 2012 : Error: /etc/freeradius/sites-enabled/default[265]: Failed to parse "perl" entry. Thu Apr 19 18:27:55 2012 : Error: Failed to load virtual server <default> i test the perl script without freeradius variables and it works El 19 de abril de 2012 10:56, alan buxey <A.L.M.Buxey(a)lboro.ac.uk> escribi?: > Hi, > > > Hi... I worked in my perl script... i did the conection to the web > service > > and it works... I configure freeradius (add perl and sql) in auth > section, > > I made a debug with freeradius -X but I don?t know if freeradius read > the > > perl script before work with mysql... i have this output: > > the logs show the perl being called before the sql...and the sql failing > with > usuario userid not being found > > > alan > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- Fabricio A. Flores G. Egresado en Ingenier?a en Sistemas MSN: fabri_floresg(a)hotmail.com Google: fabrifloresg(a)gmail.com Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/> -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120419…> ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 84, Issue 60 ************************************************

2 1

Re: Perl, MySQL & auth
by Alan Buxey 20 Apr '12

20 Apr '12

Hi, Some interesting system problems. Did you compile FR with PERL support....or if using distros version do they have additional packages you need to install eg freeradius-perl ? We use PERL here...FR compiled with it supported and just 'use DBI;' at the top of the PERL script....no need to do ANYTHING with system libs or running parameters alan -- This smartphone has free WiFi worldwide with eduroam, now that IS smart

1 0

LDAP-FreeRadius-Cisco Switch-802.1x Fails.
by Wassim Zaarour 20 Apr '12

20 Apr '12

Hi List, I have set up Freeadius 2.1.10 to authenticate with ldap. I have a cisco switch and using my Mac Laptop to connect. If I try to connect using ldap credentials the authentication fails, though the same credentials work if I use them with radtest on the localhost If I try to connect using a username defined as clear text in the users file, the authentication succeeds. As I understood that ldap will only accept clear text passwords, I am wondering why the radtest succeeds while connecting from the Mac OS fails, is the Mac OS not sending the password in clear text? I appreciate any help understanding this. Wassim C. Zaarour Systems & Network Engineer NavLink (an AT&T Affiliated company) www.navlink.com ³The information contained in this e-mail is confidential. This e-mail is intended only for the stated addressee. If you are not an addressee, you must not disclose, copy, circulate or in any other way use or rely on the information contained in this e-mail. If you have received this e-mail in error, please inform us immediately and delete it and all copies from your system.²

3 8

Perl, MySQL & auth
by Fabricio Flores 20 Apr '12

20 Apr '12

Hi everyone.. I have a little problem... I have users with a web service but I need to store the accounting in a mysql database because I use daloradius. So I have an authentication with SQL module but I need to add users before authorization. So I think if is possible to use the perl module in the authorization section to add users to MySQL database and after freeradius do an authorization with the mysql database. -- Fabricio A. Flores G. Egresado en Ingeniería en Sistemas Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/>

3 6

using windows 8's builtin eap-ttls w/ freeradius
by Brian Gold 19 Apr '12

19 Apr '12

We've been using SecureW2's client with our Freeradius server using EAP-TTLS/PAP authentication. From doing some very preliminary testing with the Windows 8 consumer preview, I've noticed that MS is now including EAP-TTLS support directly in windows. Unfortunately, I haven't had any luck getting this working yet. From looking over the radius logs, everything appears to be authenticating correctly, but then windows sits at "Checking network requirements" for a few minutes before dying. Below are the steps I have taken to configure windows to connect to our network so far. Has anyone else had luck with this yet? 1. Open the "Network and Sharing Center" either through the control panel or by right clicking the network icon in your tray 2. Click "Set up a new connection or network" 3. Click "Manually connect to a wireless network" 4. Enter the network name and choose WPA2-Enterprise for Security Type, then click Next 5. Click "Change connection settings" 6. Go to the security tab and choose "Microsoft EAP-TTLS" from the "Network Authentication Method" dropdown 7. Click "Settings" and uncheck "Enable identity privacy" 8. Click OK twice 9. Click the wifi icon in your tray and choose your secure wireless network 10. You will now be prompted for your username & password Brian Gold System Administrator Bard College at Simon's Rock

5 6