- Freeradius-Users - lists.freeradius.org

pseudo-newbie exec scripts and session-time
by Charles Gregory 16 Jun '09

16 Jun '09

Greetings! I've been cruising the archives and pages and don't quite see what I am looking for. I am hoping someone can point me to a nice simple HOWTO or MAN page for specifying an 'exec' script in radiusd.conf that will set the Session-Timeout and return it to the NAS. I'm thinking: Session-Timeout := %{exec:timecalc} Or something like that. Also, where exactly should this go in the 'authorize' section? I'm presuming at the end, but have found no examples.... Our dialups have a couple of diffrent time parameters, including a user-option file, so while I appreciate any info on the radius 'counter' function, I don't think it will meet all my needs. Hmmm. While I'm here, if I set Session-Timeout to ZERO, what will happen? Thanks in advance! - Charles

7 46

Failover fails in proxy.conf
by Santiago Balaguer García 16 Jun '09

16 Jun '09

Hi, I am using in my AAA servers the freeradius 2.1.3 version. I am configuring the failover for the myrealm.com in proxy.conf. For myrealm.com realm I have two AAA servers: 1.2.3.4 and 1.2.3.5 ############################################################ home_server primary_server { type = auth+acct ipaddr = 1.2.3.4 port = 1812 secret = mysecret require_message_authenticator = no response_window = 5 zombie_period = 60 revive_interval = 5 status_check = status-server check_interval = 60 num_answers_to_alive = 3 } home_server secondary_server { type = auth+acct ipaddr = 1.2.3.5 port = 1812 secret = mysecret require_message_authenticator = no response_window = 5 zombie_period = 60 revive_interval = 5 status_check = status-server check_interval = 60 num_answers_to_alive = 3 } home_server_pool roam_pool { type = fail-over home_server = primary_server home_server = secondary_server } realm myrealm.com { nostrip pool = roam_pool } ################################################# With the primary server everything works fine, but my problem is when I force to switch to fallover server (I switch off IP 1.2.3.4 machine) my freeradius server does not change to request 1.2.3.5 server. I try the fowoling configuration: ################################################3 home_server primary_server { ... } home_server secondary_server { ... } home_server_pool roam_pool { type = fail-over home_server = primary_server } realm myrealm.com { nostrip pool = roam_pool } home_server_pool roam_pool2 { type = fail-over home_server = secondary_server } realm myrealm.com { nostrip pool = roam_pool2 } ############################################3 With the same result --> does not work. Any suggestion? _________________________________________________________________ Nuevo Windows Live, un mundo lleno de posibilidades. Descúbrelo. http://www.microsoft.com/windows/windowslive/default.aspx

3 4

Access Challenge in freeRadius server
by kpani 16 Jun '09

16 Jun '09

Hi, I am new to freeRadius server. I am trying to authorize the ssh and telnet login users of my Redhat Linux machine using freeRadius server. I am able to test Access-Accept and Access-Reject with right and wrong credentials respectively by configuring the file '/etc/pam.d/sshd' with entry pam_radius_auth.so. But I do not know how to achieve and test the Access-Challenge concept. I mean what type of input will result in Access Challenge (I know it happens when we provide partial login information but not sure how to achieve with login in real time)? Please help me with some solutions in achieving Access Challenge. Thanks in advance. Regards, Dhandapani -- View this message in context: http://www.nabble.com/Access-Challenge-in-freeRadius-server-tp24025860p2402… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 7

Re: SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
by john 16 Jun '09

16 Jun '09

On Sat, Jun 13, 2009 at 7:08 AM, Ivan Kalik<tnt(a)kalik.net> wrote: >> I used the Makefile to generate the certs. I then exported ca.der and >> client.p12 and installed them on the XP box. Did I get the wrong >> files? > > No, those are correct files. Is ca OK but you get errors for client > certificate? Try using included Makefile (rename old Makefile to > Makefile.old and this one to Makefile). It will create client certificates > signed by the ca certificate. > > Ivan Kalik > Kalik Informatika ISP Hi Ivan, The makefile you sent me allowd me to generate a correct client.p12 which cleared up the error reported by windows. Thanks very much. So it looks like windows may prefer personal certs signed by the CA rather than the server? I can sucessfully use the client cert with the "Smart Card or other Certificate" options on Windows XP/SP3 (which uses EAP-TLS I believe). However it didn't fix my issue with trying to use a cert and PEAP or TTLS. So I am stumped still on that one. Any other ideas? Thanks for your help! John

2 3

Problems with Cisco switch and authorization.
by Jeff Davis 15 Jun '09

15 Jun '09

Sorry - I'm a n00b to this project. Trying to get OpenLDAP-based authentication working (well the auth DOES work) but cannot seem to get authorization working. Googling has so far failed me. Perhaps someone on this list can clue me in... users file has the following: DEFAULT Service-Type == NAS-Prompt-User Service-Type := NAS-Prompt-User, Cisco-AVPair += "shell:priv-lvl=15" -- Jefferson K Davis Technology & Information Systems Manager Standard School District 1200 North Chester Ave Bakersfield, CA 93308 USA 661.392.2110 ext 120

4 7

mod_auth_radius
by Thomas Noppe 15 Jun '09

15 Jun '09

Hi, Has anyone compiled the mod_auth_radius module for apache 2.x on windows? Wheren can I download the binary? Kind regards --------------------------------------------------------------------------------------------- Thomas Noppe Dienst Informatiesystemen - S&O thomas.noppe(a)uzleuven.be<mailto:thomas.noppe@uzleuven.be> +32 16 34 79 87 +32 16 34 78 01 UZ Leuven | campus Gasthuisberg | Herestraat 49 | B - 3000 Leuven | www.uzleuven.be<http://www.uzleuven.be>

1 0

Freeradius and Alvarion
by Jairos Jackson 15 Jun '09

15 Jun '09

Hi, I have a problem with MAC Authentication on an Alvarion Wimax base station. I use freeradius 1.1.7 with Radius Manager 3.6. Currently I am running pppoe authentication with a Mikrotik router at the backend of the Alvarion Wimax and its working fine but I need to change to MAC authentication. I have not done MAC authentication before. Thank you in advance..

4 9

Cleartext password between NAS and Radius Server
by kpani 15 Jun '09

15 Jun '09

Hi, I am using PAP for radius authentication. I have a general question here. When we use PAP for user authentication, the password will be passed from user to NAS(radius client) as cleartext password. But how it is transmitted from NAS to Radius server. 1) As clear text password? or 2) The password is encrypted using the secret keyword(used in both radius client & server) and decrypted using secret key in server. Please correct me. I am seeing different answers in web pages. Regards, Dhandapani -- View this message in context: http://www.nabble.com/Cleartext-password-between-NAS-and-Radius-Server-tp24… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

build error on Solaris (undefined symbol)
by Ihsan Dogan 15 Jun '09

15 Jun '09

Hello, I'm trying to build FreeRADIUS on Solaris (versions 9 and 10) and I'm getting this error: ----------------------------------------------------------------- rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT /opt/csw/gcc4/bin/gcc .libs/radiusdS.o -mcpu=v8 -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -L/opt/csw/gcc4/lib/. -L/opt/csw/lib /home/ihsan/gar/csw/mgar/pkg/freeradius/trunk/work/build-isa-sparcv8/freeradius-server-2.1.6/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypt -lltdl -lssl -lcrypto -R/opt/csw/lib Undefined first referenced symbol in file lt__PROGRAM__LTX_preloaded_symbols .libs/modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd gmake[6]: *** [radiusd] Error 1 gmake[6]: Leaving directory `/home/ihsan/gar/csw/mgar/pkg/freeradius/trunk/work/build-isa-sparcv8/freeradius-server-2.1.6/src/main' ----------------------------------------------------------------- Configure runs fine. I've tried to build FreeRADIUS with Sun Studio 12 and GCC 4.3.3 and both show the same error. Ihsan -- ihsan(a)dogan.ch http://blog.dogan.ch/

2 4

Missing Realm when entering second authorization group
by Xiwen Cheng 15 Jun '09

15 Jun '09

Version & OS: Freeradius-2.0.5 Gentoo It appears that during the second iteration in authorize section, the Realm has become NULL. We rely on checking the Realm to choose the appropriate Auth-Type to authenticate local users and proxy everybody else to an external network. ... +- entering group authorize ++[preprocess] returns ok rlm_realm: Looking up realm "math.leidenuniv.nl" for User-Name = "testuser(a)math.leidenuniv.nl" rlm_realm: Found realm "math.leidenuniv.nl" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Adding Realm = "math.leidenuniv.nl" rlm_realm: Proxying request from user testuser to realm math.leidenuniv.nl rlm_realm: Preparing to proxy authentication request to realm "math.leidenuniv.nl" ++[suffix] returns updated rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop users: Matched entry DEFAULT at line 292 ++[files] returns ok ... +- entering group pre-proxy ... +- entering group authorize ++[preprocess] returns ok ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject ... NOTE: ... means stripped normal behaviour/output. From the verbose output, the first part is correct. The request is proxied to the correct server. But when it arrives in the authentication server it fails to extract the Realm from the proxied request. In ``users'' we have: DEFAULT Realm == "math.leidenuniv.nl", Auth-Type := PAM Reply-Message = "math here", Fall-Through = no But as the log says, which is correct, there's no Auth-Type for that Realm. If the Realm == "math.leidenuniv.nl" condition is removed, which results in Auth-Type = PAM for everybody, authentication succeeds for local users; which is to be expected. Our config worked perfectly in freeradius-1.1.7. Now I wonder, why is the Realm equal to NULL? I see suffix updated the request, why isn't the second iteration seeing that update? Best regards, Xiwen -- -- Xiwen Cheng System Administrator ;" Enthusiasm is contagious, Mathematical Institute ; but hype is a disease. " Leiden University ;E-mail: xcheng(a)math.leidenuniv.nl Niels Bohrweg 1 K210 ;Office: (+31) 715277134 2333 CA Leiden ;Mobile: (+31) 611119991 The Netherlands ;GPG Key id: 194F572B ++

3 5