- Freeradius-Users - lists.freeradius.org

freeradius-server-2.1.8
by dorra aa 14 May '10

14 May '10

I installed on a server machine: freeradius-server-2.1.8 I wrote in the terminal: radiusd-X & Now I want to test a remote access client with radtest, is what the client must be equipped with He commend freeradius-server-2.1.8 or not? what I should do in the client side _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. https://signup.live.com/signup.aspx?id=60969

8 9

(no subject)
by Zheng, Jiajia 14 May '10

14 May '10

Hi, I hope it is the right place to ask questions about EAP-TLS with radius server. I installed freeradius-2.1.6 rpm package on my Fedora 10 system. EAP_PEAP, EAP_TTLS_CHAP, TTLS_MD5, TTLS_MSCHAP, etc. work fine. However, EAP-TLS handshake failed. Here are my steps to implement EAT-TLS with radius server. 1. on server: yum install freeradius 2. on server: cd /etc/raddb 3. on server: edit users and clients.conf (see attachments) 4. on server: radiusd -X 5. I configured the AP which is wired connected to the server using WPA-TKIP 6. copy ca.pem from server to my wireless machine. 6. I tried EAP_PEAP, EAP_TTLS_CHAP, TTLS_MD5, TTLS_MSCHAP on my wireless machine, which all worked fine. 7. on server: cd /etc/raddb/certs 8. on server: make client.pem 9. copy client.pem from server to my wireless machine 10. run wpa_supplicant on my wireless machine: wpa_supplicant -Dwext -iwlan0 -c WPA_EAP_TLS.conf WPA_EAP_TLS.conf as below, ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel network={ ssid="ASUS-2.4G" scan_ssid=1 key_mgmt=WPA-EAP eap=TLS identity="root" ca_cert="./ca.pem" client_cert="./client.pem" private_key="./client.pem" private_key_passwd="whatever" } 11. EAP-TLS failed, see the attached tls.log for the output of radiusd Could you help me out on this issue? Is there anything I did wrong? Let me know if you need more debugging info. Thanks, jiajia

3 6

freeradius with mysql failed
by dorra aa 13 May '10

13 May '10

hi i installed mysql. and i modify in /etc/freeradius/sql.conf: readclients=yes also, i decommented in /etc/freeradius/radiusd.conf: accounting {.... sql} authorize {... sql} i run again freeradius -X: but it seems failed because of sql: this is the output [...] sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius rlm_sql_mysql: Mysql error 'Access denied for user 'root'@'localhost' (using password: YES)' # but i check it and it's ok i have in sql.conf: sql{server = "localhost" login = "root" password = "rootpass"} rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. #but i begin with installing mysql-server and i add a user in the database rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 rlm_sql (sql): generate_sql_clients() returned error rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1860] Unknown module "sql". radiusd.conf[1789] Failed to parse authorize section. _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

1 0

free NAS ?
by VU VAN HUNG 13 May '10

13 May '10

Hi all, I just wonder that are there any open source software that have same functionalities like Network Access Server ? Because I see that there's Asterisk, which 's like a PBX. Best, Hung,

6 7

Access request-access reject
by dorra aa 13 May '10

13 May '10

> users: Matched entry DEFAULT at line 153 > > users: Matched entry abc at line 216 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns ok) for request 0 > > rlm_pap: Found existing Auth-Type, not changing it. > > rad_check_password: Found Auth-Type System > > modcall[authenticate]: module "unix" returns notfound for request 0 > > It shouldn't be using an auth-type of "System", that means to lookup the > user in the /etc/passwd (/etc/shadow) file. But you don't have a user on > your system named "abc" so the not found result makes sense, right? > > Why is it trying to find "abc" amongst the unix users on your system? > The answer is right above, look at the lines labeled "users:", that's > your users file, also look at the line that says "Found Auth-Type, not > changing it". So somthing in your users file forced the user "abc" to > have an Auth-Type of "system" or "unix", it also tells you which lines > in the users files it matched. Go fix your users file so it doesn't do that. I found in users file that line: DEFAULT Auth-Type = System i decommented it but same problem. i think i must change it to other attribut? > I'm guessing in your attempts to get things working you may have mangled > the example users file, you might want to start with the unaltered users > file and just add your test user. > > All this is documented in the link I sent you a week ago: > http://deployingradius.com/documents/configuration/pap.html > > -- > John Dennis <jdennis(a)redhat.com> _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 4

i found two freeradius
by dorra aa 13 May '10

13 May '10

yestaerday i create that file: cd ~ apt-get source freeradius and i woked in the users of: cd freeradius-1.1.7/ but now i find another freeradius in: /etc/freeradius. I don't know how it is created there? and does it have any influence in my radius, because i do mychanges in file: users of cd freeradius-1.1.7/. may i delete the second freeradius that i do not created?? _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 2

Query regarding update reason
by Vijay Badola 13 May '10

13 May '10

Hi, I have a query regarding Update-Reason field in PPAQ attribute of Access-Request for prepaid case. According to WiMax specification the size of this AVP is 4 byte(including tag and length). And according to dictionary.wimax supplied by freeradius size of Update-Reason field is 4 byte means total size of AVP is 6 byte. Can we change the size of Update-Reason field to 2 byte in dictionary.wimax to make over all AVP size 4 byte, to decode this AVP at server properly (when incoming Access-Request has 4 byte for update-reason AVP)? Or What is other way to achieve it? Please correct me if my understading is wrong? , * P We have responsibility to the environment. Before printing this e-mail or any other document, let's ask ourselves whether we need a hard copy.

2 1

Simultneous-Use + SQL + Checkrad
by Galatóczki István 13 May '10

13 May '10

Hi All! I use Freeradius 2.0.4(deb pack) with Mysql 5.0.51. The online users check not work in the NAS with checkrad script my network. I read the list and forums but not founded solution. I have read and followed the step of below comment: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg58506.… my config: radcheck table: Simultaneous-Use: =1 -sites-enabled/default- accounting ( sql sqlippool ) session ( sql ) uncomment: simul_count_query... in dialup.conf include: sql.conf etc.. in the radiusd.conf Question: working the checkrad script without radutmp? Steve

2 1

When to ldap?
by Dean, Barry 13 May '10

13 May '10

I am working on a new radius config and have been trying to avoid the lookup in LDAP I have been seeing for the outer identity. I have moved to 2.1.8 with the inner-tunnel virtual host enabled. I have an authorise section for the relevant virtual server that has: authorize { preprocess auth_log chap mschap suffix eap { ok = return } files if (!EAP-Message) { ldap } expiration logintime pap } The "if(!EAP-Message)" works a treat at preventing an LDAP lookup for the outer identity, but if I want to send a basic User-Name/User-Password type auth request after checking with LDAP and returning "Remote access is permitted", I then see: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user What am I missing to tell the "authenticate" section below what I want to do next? authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } Auth-Type EAP { eap } eap } I presume: if (!EAP-Message) { ldap } Fails to set Auth-Type LDAP? ---------------------- Barry Dean Principal Programmer/Analyst Networks Group Computing Services Department Tel: 0151 795 9540

2 6

SAMBA Version
by Colin Byelong 13 May '10

13 May '10

Hi, I was reading the archives and saw that some of the later versions of SAMBA had a bug so it couldn't be used for ntlm_auth/Eap-PEAP. Does anyone know if this is now fixed ? We are running Fedora core 12 and it ships with SAMBA 3.4.7 Thanks Colin -- ----------------------------------------------------------------------- Colin Byelong Email: C.Byelong(a)ucl.ac.uk Senior Network Development Officer Network Group Information Systems Division University College London Gower Street Phone: 020 7679-2572 London WC1E 6BT ------------------------------------------------------------------------

1 0