- Freeradius-Users - lists.freeradius.org

RE: Help About Peap
by Julio Villacis Guevara 23 Jul '09

23 Jul '09

Hi I have a problem with PEAP-RADIUS-AD. I follow the configuration that find in this link http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO Samba configuration ok and test (wbinfo u) Kerberos ok and test (kinit user) Radius install and configuration in Solaris SPARC the version is 1.1.7 download of sunfreeware with all depences ( <http://sunfreeware.com/programlistsparc10.html#openssl098> openssl-0.9.8k, <http://sunfreeware.com/programlistsparc10.html#netsnmp> netsnmp, <http://sunfreeware.com/programlistsparc10.html#gdbm> gdbm, <http://sunfreeware.com/programlistsparc10.html#openldap> openldap, <http://sunfreeware.com/programlistsparc10.html#mysql> mysql, <http://sunfreeware.com/programlistsparc10.html#zlib> zlib, <http://sunfreeware.com/programlistsparc10.html#sasl> sasl, <http://sunfreeware.com/programlistsparc10.html#libtool> libtool, <http://sunfreeware.com/programlistsparc10.html#libgcc34> libgcc-3.4.6) installed Radius radtest ok When the XP try login respond radius login incorrect. Attach messages of the radius server files. Thanks in advance Ing. Julio Villacís G. Ingeniero de Servicios Comware S.A. (593 4) 2690170 Ext. 4500 www.comware.com.ec Guayaquil-Ecuador

2 2

CPU selection for highest performance
by Padam J Singh 23 Jul '09

23 Jul '09

3 3

using (finding) mysql
by Rakotomandimby Mihamina 23 Jul '09

23 Jul '09

(some MTA problems... re send) Hi, I would like my freeradius to use PG SQL (no UNIX /etc/passwd nor users flat file) in /etc/freeradius/sites-enabled/default [...] # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module in radiusd.conf. # # unix # Read the 'users' file files # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd [...] The file containing the 'sql' module: /etc/freeradius/sql.conf When I launch "freeradius -X" I got about finding the 'sql' module...: radius20:/etc/freeradius# freeradius -X FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Sep 7 2008 at 17:42:33 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql/postgresql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 4 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 41.204.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "quarante_un_deux_cent_quatre" nastype = "livingston" login = "!root" password = "someadminpas" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } /etc/freeradius/sites-enabled/default[153]: Failed to find module "sql". /etc/freeradius/sites-enabled/default[62]: Errors parsing authorize section. } } Errors initializing modules -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 1

freeradius2 using ldap/users file
by fous 23 Jul '09

23 Jul '09

hi i'm using radiusd: FreeRADIUS Version 2.1.6, for host i386-portbld-freebsd7.2 server configured with ldap. this works fine. we've got few users which would like to authorize via users file. but my radius always searches for the password in the ldap. is this behaviour normal? (these users have account in ldap and also in users file, but with different passwords) is there any way to go through? :) (i couldn't find anything) thaks for help fous -- View this message in context: http://www.nabble.com/freeradius2-using-ldap-users-file-tp24589272p24589272… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Re: Freeradius-Users Digest, Vol 51, Issue 100
by jaswinder kaur 23 Jul '09

23 Jul '09

Hello Ivan, Yes, It is a Upcoming project. I would appreciate whatever help I get from you or any reference to where I can get more information from. We have our users on the aaaa.example.com domain and are in edirectory environment. But our users are going to share a big part of the building with another company who are a totally different domain controlled by active directory. Our management wants us to create a radius infrastructure so that a user irrespective of their company, plug their laptop in a available socket, and gets put into the right domain and all the other network services based on their login credentials. Many Thanks, Jas Message: 4 Date: Thu, 23 Jul 2009 10:14:59 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: Freeradius With edirectory and Active directory To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <53179.194.176.105.44.1248340499.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Is it possible to have freeradius integrated in a environment with two > totally different domains, one controlled by edirectory and the other by > active directory? Yes. You will need to create two mschap instances (one with ntlm_auth and one without) and failover in Auth-Type MS-CHAP. Auth-Type MS-CHAP { mschap_default { reject = 2 } if(reject) { mschap_ad } } Where mschap_default is a copy of default mschap module while mschap_ad has ntlm_auth line enabled. This applies to AD + anything else (ldap, sql, users file stored passwords). If you are going to have pap requests as well you should add failover to ntlm_auth after pap: if(!Auth-Type) { update control { ntlm_auth } } Is there interest for this? I can write a guide how to combine authentication of AD stored accounts with those stored elsewhere (ldap, sql, users file). Ivan Kalik Kalik Informatika ISP ------------------------------ Yahoo! recommends that you upgrade to the new and safer Internet Explorer 8. http://downloads.yahoo.com/in/internetexplorer/

1 0

using (finding) mysql
by Rakotomandimby Mihamina 23 Jul '09

23 Jul '09

Hi, I would like my freeradius to use PG SQL (no UNIX /etc/passwd nor users flat file) in /etc/freeradius/sites-enabled/default [...] # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module in radiusd.conf. # # unix # Read the 'users' file files # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd [...] The file containing the 'sql' module: /etc/freeradius/sql.conf When I launch "freeradius -X" I got about finding the 'sql' module...: radius20:/etc/freeradius# freeradius -X FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Sep 7 2008 at 17:42:33 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql/postgresql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 4 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 41.204.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "quarante_un_deux_cent_quatre" nastype = "livingston" login = "!root" password = "someadminpas" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } /etc/freeradius/sites-enabled/default[153]: Failed to find module "sql". /etc/freeradius/sites-enabled/default[62]: Errors parsing authorize section. } } Errors initializing modules -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 2

mysqld connecting problem
by shivashankar 23 Jul '09

23 Jul '09

hi, miboss3# /usr/sfw/sbin/mysqld Fatal error: Please read "Security" section of the manual to find out how to run mysqld as root! 090723 7:23:37 Aborting 090723 7:23:37 /usr/sfw/sbin/mysqld: Shutdown Complete please help me -- View this message in context: http://www.nabble.com/mysqld-connecting-problem-tp24620450p24620450.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Freeradius With edirectory and Active directory
by jaswinder kaur 23 Jul '09

23 Jul '09

Hello All, Is it possible to have freeradius integrated in a environment with two totally different domains, one controlled by edirectory and the other by active directory? Thanks, Sam See the Web's breaking stories, chosen by people like you. Check out Yahoo! Buzz. http://in.buzz.yahoo.com/

2 1

Guide: Upgrading to version 2
by Alan DeKok 23 Jul '09

23 Jul '09

I've written a 40 page guide on how to upgrade from version 0.X to the latest version of the server. It is currently available to customers of Network RADIUS who have purchased support agreements. The document covers all of the configuration items in radiusd.conf, and also the common modules. It documents when the configuration first appeared, and how its behavior changed over time. For configurations that have been deprecated or removed, it documents suggested replacements. It talks about how to manage the upgrade process, along with potential downgrades if something goes wrong. If anyone else is interested in the document, please email me privately: aland(a)networkradius.com I need to decide what else to do with the document. Knowing how many people are interested in it is a first step. Alan DeKok.

2 2

FR1 -> FR2: authenticate_query
by Rakotomandimby Mihamina 23 Jul '09

23 Jul '09

I am in the process of migrating from freeradius v1.4 to v2 I am running Debian Lenny, all installed from packages. I am first trying to merge the configuration. I use Postgresql behind. In the v1: ####################################################################### # Authentication Query ####################################################################### #authenticate_query = "SELECT Value,Attribute FROM ${authcheck_table} \ # WHERE UserName = '%{User-Name}' AND ( Attribute = 'User-Password' OR Attribute = 'Crypt-Password' ) \ # ORDER BY Attribute DESC" authenticate_query = "We put ours here....." # Postauth query # postauth_query = "INSERT INTO radreply (username, attribute,op,value) VALUES ('%{SQL-User-Name}', 'Session-Timeout', '=','100')" I did not find 'authenticate_query' in the v2 default 'postegressql/dialup.conf' file. Have I just to add what we have in v1? -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 1