- Freeradius-Users - lists.freeradius.org

Invitation to connect on LinkedIn
by Sergio Belkin via LinkedIn 03 Jul '11

03 Jul '11

LinkedIn ------------ Sergio Belkin requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Sergio Accept invitation from Sergio Belkin http://www.linkedin.com/e/f5ihn8-gpobvdyd-2f/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… View invitation from Sergio Belkin http://www.linkedin.com/e/f5ihn8-gpobvdyd-2f/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijR… ------------------------------------------ Why might connecting with Sergio Belkin be a good idea? Sergio Belkin's connections could be useful to you: After accepting Sergio Belkin's invitation, check Sergio Belkin's connections to see who else you may know and who you might want an introduction to. Building these connections can create opportunities in the future. -- (c) 2011, LinkedIn Corporation

1 0

AUTO: Neal Howard is out of the office (returning 07/05/2011)
by Neal.Howard＠wichitafallstx.gov 30 Jun '11

30 Jun '11

1 0

./configure/make in subdir?
by Phil Mayers 30 Jun '11

30 Jun '11

Does anyone know if it's possible to persuade ./configure to work from within subdirs? I keep flipping back and forth between master and v2.1.x and it would be nice to be able to re-use builds without having to have two git repos & associated hassles. I've seen syntax like this work on some projects. git checkout v2.1.x cd build-v21x ../configure --prefix=/opt/fr21x make make install cd .. git checkout master cd master ../configure --prefix=/opt/frmaster make make install ...but this seems to fail on (the accursed!) libltdl subdir "configure" which is apparently jumping back up into the top-level source directory. I suspect it would similarly fail on the module configure scripts too.

2 2

Re: LDAP redundant with LDAP-Group within users file
by up＠3.am 30 Jun '11

30 Jun '11

> Just a gap of our users file, we have 18 default lines and additional 4 for a > local/PAP user: > > > DEFAULT Auth-Type := LDAP, Huntgroup-Name == consoleserver, LDAP-Group == > "<LDAP-GROUP-Team-a>" > Login-Service = Telnet > FWIW, since it's the LDAP-Group attribute that you're having trouble with, we are doing LDAP auth with POSIX style LDAP auth data and I believe it gets around this by simply using the old "Group" attribute from before we migrated from PAP/unix (but still gets from LDAP): DEFAULT Group == acme, Pool-Name :="acme_pool", Auth-Type = Ldap This is a smaller network with 1 fallback LDAP server, and I know that the fallback is working and I'm pretty sure it passes on the proper group info to assign the correct IP pool in this case. It may not work with non-POSIX LDAP groups though...

1 0

patch files for pam_radius - adding an 'Always Prompt' option for one-time passcodes
by Nick Owen 30 Jun '11

30 Jun '11

We recently had a customer that wanted to check a password against AD via kerberos and then an one-time passcode against a WiKID Strong Authentication server via radius. We found that PAM passed the AD password to our OTP server, which failed. We have added a pam option "always prompt" in the attached code. This will force a "WiKID passcode:" prompt regardless of any previous password entry. The /etc/pam.d/sshd file looks like: Here's the /etc/pam.d/sshd: #%PAM-1.0 auth required /lib/security/pam_krb5.so auth requisite /lib/security/pam_radius_auth.so always_prompt account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so No changes to system-auth were made. The /etc/ssh/sshd_config looks like: Protocol 2 SyslogFacility AUTHPRIV PasswordAuthentication yes ChallengeResponseAuthentication yes GSSAPIAuthentication yes UsePAM yes AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT AcceptEnv LC_IDENTIFICATION LC_ALL X11Forwarding yes UseDNS no Subsystem sftp /usr/libexec/openssh/sftp-server The key change is that ChallengeResponseAuthentication is yes. Hopefully, others will find this of use. Nick -- Nick Owen WiKID Systems, Inc. 404.962.8983 http://www.wikidsystems.com Commercial/Open Source Two-Factor Authentication

3 2

Re: LEAP Authentication?
by Alan Buxey 30 Jun '11

30 Jun '11

Client not responding to the access challenge, client issue alan

6 9

freeradius and IdenticalClients
by Franz Angeli 30 Jun '11

30 Jun '11

Hi i'm trying to migrate my radiator server to freeradius, i have to use something like "IdenticalClients" on radiator: # TEST <Client 10.1.131.1> # Specifies a list of other clients that have an identical setup. # You can use this parameter to avoid having to create separate # Client clauses for lots of otherwise identical clients IdenticalClients X.X.X.X Y.Y.Y.Y Z.Z.Z.Z # Secret is the shared secret between client and this server # Any number of characters, any character except newline # You must set a secret in every Client clause. Secret somesecret # Use this to set a default realm for requests that dont # already have one. This can trigger a specific Realm # statement for users who log in to this NAS without a # realm DefaultRealm FQDN </Client> can i replicate this configuration on freeradius? Thanks in advance Franz

3 2

Re: LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 30 Jun '11

30 Jun '11

> I will try to test this. Thank you very much! >What OS are you on, and what LDAP libraries & version of those libs are you using? RHEL Server 5.6 (64 bit), Kernel 2.6.18-238.5.1.el5 # rpm -qa | grep -i ldap php-ldap-5.1.6-27.el5_5.3 openldap-clients-2.3.43-12.el5_6.7 openldap-2.3.43-12.el5_6.7 python-ldap-2.2.0-2.1 mozldap-6.0.5-1.el5 freeradius2-ldap-2.1.7-7.el5 nss_ldap-253-37.el5 nss_ldap-253-37.el5 openldap-2.3.43-12.el5_6.7 #

1 0

Re: Re: LDAP redundant with LDAP-Group within users file
by Jan.Gnepper＠t-systems.com 29 Jun '11

29 Jun '11

>> Problem: radius is using always the same ldap server for group extends. >> If this (one!) server fails, radius authentication is not possible. >> Very bad, because we have "redundancy" configured, and expected to have zero outage. >Sorry. The "ldap" module and FreeRADIUS do not work that way. >"LDAP-Group" is a virtual attribute, that is registered by the first >LDAP module to be created; it can't "fail over". It doesn't know about >"redundant {}" or similar. OK, thanks for detailed answer. I read in other threads ansers that already point to that fact. >> Defining all three server whithin one section in modules/ldap >> >> ldap { >> server = "<IP ldap-1> <IP ldap-2> <IP ldap-3>" >> .} >> >> And setting just "ldap" within authorize and authenticate: >> >> With this config an other ldap server is choosen, if the one that has handelt the communication for ldap group extends fails. But failover took 15 minutes. Thats much too long for us. >> (1-3 minutes at most will be acceptable, "zero outage" gorgeous/expected) >It should not take 15 minutes. >What is your "net_timeout" set to? net_timeout = 1 timelimit = 2 timeout = 4 For testing i added a hostroute to an other gateway (=host unreachable) >Unfortunately, when you supply >1 LDAP server, this is handled >internally by libldap, and libldap tries the LDAP servers in series, not >in parallel. So there will always be some outage. As i wrote in my first post, short outage would be ok, but 15 minutes was too much. I added the hostroute to the server that opend the first connection when a request came in (i thought that this is the call regarding ldap-group). That was normaly the last from the list (server=...). I made serveral requests, but all end with "server unreachable / reject". But i could see in tcpdump, that after 15 minutes a lot of connections to an other ldap server were opend. >From this moment, all new requests were successfull, to an other ldap. >FreeRADIUS does not currently have connection pools, and they're a bit >hard with LDAP because libldap doesn't have a great API. >> >> I found mails regarding similar problems within the archive, but no suitable solution. >> (e.g http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg23408.… from 2006) >> >> Is there a solution for reducing the outage and having loadbalancing for our case? >At the moment, the "ldap" module does not have the kind of instant >failover you're looking for. You will need some kind of IP loadbalancing >solution in front of your LDAP servers to achieve this. Not as easy as it sounds ;-) 12 radius pairs (singe server with the same config) at 10 locations, 3 ldap server at 3 different locations For countervail lost of one or two locations, loadbalancing will be very complex.

3 2

Error with Thread
by Jean Carlos Oliveira Guandalini 29 Jun '11

29 Jun '11

Hello, i'm using version 1.1.8, my OS is Linux (Gentoo). My server stop and log this: Error: FATAL: Thread create failed: Resource temporarily unavailable Before this log, have: Wed Jun 29 00:16:13 2011 : Error: Dropping conflicting packet from client client1:41250 - ID: 195 due to unfinished request 155365 Wed Jun 29 00:16:13 2011 : Error: Dropping conflicting packet from client client2:59253 - ID: 235 due to unfinished request 155374 My config for start server is: start_servers = 200 max_servers = 200 min_spare_servers = 10 max_spare_servers = 200 max_requests_per_server = 0 The server only returns if I restart the service Thanks Jean

2 4