- Freeradius-Users - lists.freeradius.org

Re: detail configuration file: how to save lines
by Alan DeKok 04 Sep '10

04 Sep '10

Stefan A. wrote: > I have a detail configuration file, which has several sections for different > files, to be handled by different listener > > As the NASses are GGSNs, which are sending more than 40 attributes, I will > save space on HD and will remove unneeded attributes using suppress. > Do I have to put every attribute in every detail-x configuration area or is > there a kind of template to do this? read raddb/templates.conf Alan DeKok.

2 1

Configure PEAP on FreeRadius using openssl.
by Stephane Brodeur 03 Sep '10

03 Sep '10

Hi, I am trying to configure FreeRADIUS for the PEAP authentication method. I am using the following link to set up the FreeRADIUS server: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO This documents indicates that the file radiusd.conf should include the following entry: authtype = MS-CHAP It also refers to the utilization of the CA.all script The version of FreeRADIUS running on version 5.5 does not have any entry for authtype = MS-CHAP in radiusd.conf file and does not have CA.all script. Is there anybody kind enough to tell me if it is possible that my version of FreeRADIUS, do not know how to find it, does not need the authtype = MS-CHAP entry in radiusd.conf file I also would like to know if we can used something equivalent to CA.all script and how can we modify eap.conf accordingly. Any information on what CA.all script or any equivalent is all about would also be really helpful. Thanks Stephane

2 1

..::Block username after 3 failed authentications::..
by Alfonso Alejandro Reyes Jiménez 03 Sep '10

03 Sep '10

Hi Everyone. I was wondering if there's some way to block the brute force attack. for example block the username after 3 invalid password attempts. This could be possible? if it's possible how? Thanks in advance. Regards. Alfonso.

2 2

Freeradius Authentication
by jorge88 03 Sep '10

03 Sep '10

Good afternoon, I wanted to make the following question to see if someone can help me. Is it possible to configure freeradius to consult users in two different tables within the same database? Otherwise, is it possible to associate a user name to a NAS so it will not be logging in from another NAS differently? Thank you very much -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-Authentication-tp2802389… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

..::Huntgroup Issues::..
by Alfonso Alejandro Reyes Jiménez 03 Sep '10

03 Sep '10

Hi, I'm trying to use the huntgroup feature on the freeradius software with out luck. I think I'm missing something that's why I'm sending this email maybe you can help me. Right now I have the following files: huntgroups file at the end: squid NAS-IP-Address == 127.0.0.1 users file at the end: alfonso Auth-Type := Local, User-Password == "testing", Huntgroup-Name == "squid" clients.conf at the end: client 127.0.0.1 { secret = xxxxxxxxxxx shortname = squid } When I try with the radtest to log in, I get an access-reject. Here's the client side response: [root@mscitum raddb]# radtest alfonso testing localhost 10 xxxxxxx Sending Access-Request of id 134 to 127.0.0.1 port 1812 User-Name = "alfonso" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 Here's the output of the debug, it seems that it doesn't find the config file. rad_recv: Access-Request packet from host 127.0.0.1:36858, id=134, length=59 User-Name = "alfonso" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "alfonso", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 134 to 127.0.0.1 port 36858 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 134 with timestamp 4c7319f1 Nothing to do. Sleeping until we see a request. May be I'm missing to enable some feature, thanks in advance for your help. Regards Alfonso.

3 4

Problem with rlm_perl
by Nasser Heidari 03 Sep '10

03 Sep '10

Dear Folks, Apologies for previous unwanted / half complete email, We are using a perl module to record and save clients MAC address to DB. In situations that cisco-av-pair is not included in RADIUS packet, We are replacing it with 0000.0000.0000. Everything is working just fine in test environment but when running on production servers the recorded MAC address for those clients without cisco-av-pair attribute in their packet is not 0000.0000.0000 but it's a wrong MAC which belongs to another packet received seconds ago. We even captured all the RADIUS traffic sent form NASes and replayed it in our test environment but everything was working fine again. The only difference is our test environment is 32bit and production is 64bit. We suspect even something wrong with 32/64 bit or a threading issue with perl module on 64 bit platform. Anyone seen something like this before or anything special regarding 64bit / perl multi-threading? Current version: radiusd: FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Mar 31 2010 at 00:14:28 We also have perl compiled with multi-threading support : v5.8.8 built for x86_64-linux-thread-multi best regards,

1 0

Re: Freeradius-Users Digest, Vol 65, Issue 8
by t.drollinger＠i-motion.de 03 Sep '10

03 Sep '10

Ich bin von Freitag den 03.09.2010 bis Freitag den 24.09.2010 nicht im Haus und kann Ihre Nachricht erst am Montag den 27.09.2010 bearbeiten. In dringenden Fällen wenden Sie sich bitte an meinen Kollegen Herrn Böhm (E-Mail: r.boehm(a)i-motion.de) Mit freundlichen Grüßen Tobias Drollinger

1 0

Error compiling over Solaris
by Fernando Calvelo Vazquez 02 Sep '10

02 Sep '10

Hi folk: I'm trying to compile 'freeradius-2.1.9' over Solaris 10 platform. No errors during './configure' execution But I get this messages when I execute 'gmake' command gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -L/usr/lib/ -L/usr/local/libexec/openldap/ -L/usr/local/lib/ -L/opt/csw/lib/ -L/opt/csw/lib/engines/sparcv9/ -L/lib/ /usr/local/source/freeradius-server-2.1.9/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypt /opt/csw/lib/libltdl.so -lncurses -lsunmath -lm /opt/csw/lib/libintl.so -L/opt/csw/lib -lc -ldl -L/usr/openwin/lib /opt/csw/lib/libiconv.so -R/usr/local/freeradius-2.1.7/lib -R/opt/csw/lib -R/usr/lib/ -R/usr/local/libexec/openldap/ -R/usr/local/lib/ -R/opt/csw/lib/ -R/opt/csw/lib/engines/sparcv9/ -R/lib/ Undefined first referenced symbol in file ERR_clear_error .libs/threads.o OPENSSL_add_all_algorithms_noconf .libs/threads.o CRYPTO_set_locking_callback .libs/threads.o CRYPTO_num_locks .libs/threads.o CRYPTO_set_id_callback .libs/threads.o ERR_remove_state .libs/threads.o lt__PROGRAM__LTX_preloaded_symbols .libs/modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src/main' gmake[3]: *** [main] Error 2 gmake[3]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/usr/local/source/freeradius-server-2.1.9' gmake: *** [all] Error 2 Any clues with library could be causing the crash? Cheers, Swatzy.

2 2

ldap group lookup help
by Walter Gould 02 Sep '10

02 Sep '10

Group, We are having problems with ldap group lookups... Here's our environment. Using Freeradius 2.1.8 to authenticate wireless users against our AD servers and perform ldap group membership lookups. Using WPA2-AES-PEAP-MSCHAPv2. When radiusd is started, initially the lookups work fine and we see successful auth's in our radius logs. But, after some period of time, we eventually begin to see bunches of "Invalid user:" radius logs. The only thing that seems to fix this is to remove the ldap group lookups from the freeradius config. In our ldap module, the basedn we specify is dc=auburn,dc=edu (as we have multiple user ou's). Not sure if that might be causing an issue or not..? One thing I have noticed is there are 3 ldap group lookups that each say "rlm_ldap::ldap_groupcmp: User found in group xxxx". I have read posts about configuring the ldap module to us the inner-tunnel - which I have done. Is there anyway to reduce the number of group lookups to only one? Not sure if the extra lookups are causing unneeded traffic which may be causing issues? Also, I see 10 Access-Request packets and about the same number of Access-Challenge packets.. Is this normal? Just wondering if excessive unneeded traffic is what is overloading the AD/ldap servers? Any help or suggestions will be appreciated. Thanks, Walter Gould Auburn University

1 0

Simultaneous use
by Tom Cooper 02 Sep '10

02 Sep '10

hi all, I have to implement Simultaneous-Use on my freeraduis. Running freeradius-2.1.9-2 on CentOS 5.4 64 bit. I have followed all the steps listed here: http://www.how2forge.org/authentication-authorization-and-accounting-with-f… I also uncommented the SQL queries that check for simultaneous use. Unfortunately I did not get past first base. Can anybody give me a few pointers, please? Thanks, Tom To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 1