- Freeradius-Users - lists.freeradius.org

Re: radiusd -X solaris eap error
by Urugn 13 May '09

13 May '09

Hello again I finally got the freeradius build 2.1.5 to initialize under SunOS 5.10 Generic_138889-02 i86pc i386 i86pc. Here is the data 1. Got mysql from blastwave via pkg-get 2. Got openssl from blastwave via pk-get install openssl 3. downloaded freeradius-server-2.1.4.tar.gz from freeradius.org 4. tar -xvfz freeradius-server-2.1.4.tar.gz 5. mv freeradius-server-2.1.4 /usr/src/freeradius 6. cd /usr/src/freeradius 7. ./configure --with-openssl-includes=/opt/csw/include/openssl --with-openssl-libraries=/opt/csw/lib 8. gmake 9. gmake install 10. cd /usr/local/etc/raddb/certs created the following openssl script from the Makefile 11. vi radss.sh #!/bin/bash # # Diffie-Hellman parameters # openssl dhparam -out dh 1024 # # Create a new self-signed CA certificate # openssl req -new -x509 -keyout ca.key -out ca.pem -days 3660 -config ./ca.cnf openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der openssl req -new -out server.csr -keyout server.key -config ./server.cnf openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key whatever -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:whatever -passout pass:whatever openssl pkcs12 -in server.p12 -out server.pem -passin pass:whatever -passout pass:whatever # #Verify Server Certificate # openssl verify -CAfile ca.pem server.pem # # # Create a new client certificate, signed by the the above server # certificate. # # openssl req -new -out client.csr -keyout client.key -config ./client.cnf openssl ca -batch -keyfile server.key -cert server.crt -in client.csr -key whatever -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -passin pass:whatever -passout pass:whatever openssl pkcs12 -in client.p12 -out client.pem -passin pass:whatever -passout pass:whatever cp client.pem urugn(a)support.com.pem 12. chmod +x radssl 13 ./radssl manually executed the following command thats included in the Makefile 14. date > ./random; Finally ran radiusd -X 15. radiusd -X Lots of debug with the following output Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Well i think under solaris the auto build process is not finished hopefully this will be fixed in the 2.1.6 release. Next i will be interested in solaris router to act as the radius client. One thing very confusing is solaris router a NAS/RAS and how can i get it to authenticate LAN subnets to the radius? Any info or links will be appreciated. Thanks in advance. On Wed, May 13, 2009 at 10:27 AM, Urugn <urugn.tony(a)gmail.com> wrote: > Thanks Alan > > debud mode would be radiusd -x or radiusd -xx or the extendd debug mode > radiusd -X > > i have tried radiusd -xx and still got the following error and the server > does not start > > /usr/local/etc/raddb/certs/bootstrap: make: not found > /usr/local/etc/raddb/certs/bootstrap: test: unknown operator == > > > > On Tue, May 12, 2009 at 3:09 PM, Alan DeKok <aland(a)deployingradius.com>wrote: > >> tony(a)urugn.com wrote: >> > Errors initializing modules >> > I thot may be ad trace the problem and directly executed >> > /usr/local/etc/raddb/certs/bootstrap Here is the output >> > sh: test: argument expected >> > *** Error code 1 >> > The following command caused the error: >> > if [ -e /dev/urandom ] ; then \ >> > dd if=/dev/urandom of=./random count=10 >/dev/null 2>&1; \ else >> \ >> > date > ./random; \ >> > fi >> > make: Fatal error: Command failed for target `random' >> > ./bootstrap: test: unknown operator == >> >> Just re-run the server in debug mode. There's a typo in the script >> that will be fixed in 2.1.6. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >

1 0

User in multiple groups with different login time
by Pramada Batchu 13 May '09

13 May '09

Hi, I am trying to assign one user to multiple groups and each group has a different login time. Is it possible to check the user against each group's login time and allow access if anyone of them matches. I tried using DEFAULT and matching GROUP-NAME in users file with fall-through option. But the last matching entry overwrites the Login-time to its value. Is there a way that we can concatenate Login time values from all matching entries or is there any other way we can achieve this? Thanks, Pramada

2 1

Re: authentication failed because sqlcounter...
by Nizar Zulmi 13 May '09

13 May '09

the problem solved it just because 30 second less than one minute, i've tried using Max-All-Sesion:=3600 and it works.. --- On Sat, 5/9/09, Nizar Zulmi <siapa_bilang_emailku_panjang(a)yahoo.com> wrote: From: Nizar Zulmi <siapa_bilang_emailku_panjang(a)yahoo.com> Subject: Re: authentication failed because sqlcounter... To: tnt(a)kalik.net, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Saturday, May 9, 2009, 2:03 PM i am using freeradius 1.1.7, not that old rite??? i've tried using := operator and cleartext-password but still doesn't work..this bellow is my radcheck table.. +----+----------+--------------------+----+--------+ | id | UserName | Attribute | op | Value | +----+----------+--------------------+----+--------+ | 1 | nizar | Password | == | nizar | | 2 | nizar1 | Password | == | nizar1 | | 6 | tes | Max-All-Session | == | 90 | | 4 | tes | Password | == | tes | | 7 | denizaro | Cleartext-Password | := | 123456 | | 8 | denizaro | Max-All-Session | := | 30 | +----+----------+--------------------+----+--------+ 6 rows in set (0.00 sec) i try to log in with user denizaro first time before i add attribute max-all-session its succesfully logged in, but after i adding max-all-session attribut its failed.. whats happen?? --- On Sat, 5/9/09, Ivan Kalik <tnt(a)kalik.net> wrote: From: Ivan Kalik <tnt(a)kalik.net> Subject: Re: authentication failed because sqlcounter... To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Saturday, May 9, 2009, 2:51 AM > mm confusing..i just enable the sqlcounter in radiusd.conf. i just let it > as default no change i made in noresetcounter module. then i adding > noresetcounter in authorize and instantiate section. > i have defined 1user named tes and password tes has loged in normally > before i add attribut max-all-session in the table radcheck just like > this. > +----+----------+-----------------+----+--------+ > | id | UserName | Attribute | op | Value | > +----+----------+-----------------+----+--------+ > | 1 | nizar | Password | == | nizar | > | 2 | nizar1 | Password | == | nizar1 | > | 6 | tes | Max-All-Session | == | 90 | > | 4 | tes | Password | == | tes | > +----+----------+-----------------+----+--------+ > after i adding the attribut max-all-session the user tes cannot login > anymore. i do running freeradius in debug mode and the following si the > result.. := not ==. And that password attribute Password is deprecated for many years. How old is your freeradius version? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----Inline Attachment Follows----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PAP password
by Doug Hardie 13 May '09

13 May '09

V 2.1.5. I am having a problem with PAP not using the proper user id. IF the user id is just a plain <user_id> then it works properly. However, I have some realms setup that have prefixes and suffixes e.g., DUB+<user_id>@lafn. PAP is trying to find the user_id DUB+<user_id>@lafn rather than the stripped user id <user_id> and hence it doesn't find a password for the user. Everything works just fine if I add Auth-Type := Accept to the users file, but thats not a great way to run a railroad. Obviously I missed something. hints has: DEFAULT Prefix == "DUB+", Suffix == "@lafn", Strip-User-Name = Yes Hint = "SlipStream" What have I missed?

3 6

MySQL radacct backup
by sub 13 May '09

13 May '09

Hello everybody, I've a full working freeradius server on an Ubuntu server. My accounting table grows and grows so I'd like to backup my data in any way; before I write my own procedure, does the server (freeradius) provide any utility? I've looked in the config but I've not found anything useful. Basically, this would be something different from a simple MySQL Database backup as I'll have to keep info about the total AcctSessionTime of every user. Thanks! -- sub

5 5

radius client on fedora 10 ?
by François Mehault 13 May '09

13 May '09

Hi, I would like to know is there any radius client on fedora 10 ? pam_radius ? other ? Regards, François

2 1

IPSEC-tunnell from FreeRadius to WLC Cisco
by Saleh Abuzid 13 May '09

13 May '09

Our university college (HiST) is trying to establish an IPSec tunnel between a FreeRadius server using Openswan OpenSwan 2.4.12 and a Cisco WLC running 4.2.173.00. To start the IPSec negotiation we need RSA-keys at both ends of the tunnel ( freeradius, WLC Cisco), or Pre-shared keys (PSK). Case 1: On the Freeradius Server we two pairs of keys on the command line as follows: - Keypair for the FreeRadius-server: Freradiushost# ipsec newhostkey --hostname "FreeRadius" -output /etc/ipsec.secrets -bits 1024. - Keypair for the wlc: Freradiushost# ipsec newhostkey -hostname "wlcname" -output "RSAKeyFileName" -bits 1024 However, the WLC doesn't accept the RSA keys generated. The file produced looks like this: : RSA { # RSA 1024 bits "wlcname" etc. # for signatures only etc. #pubkey=xxxxxxx Modulus: xxxx PublicExponent: xxx #everything after this point is secret PrivateExponent: xxx Prime1: xxxx Prime2: xxxx Exponent1: xxxx Exponent2: xxxx Coefficient: xxxx } We try to paste the wlc's keys into the web interface under the menu Security, Advanced, CA Certificate, IPSec Certs. But, to no avail, the page at "ip-number of wlc" says: Error in setting Certificate". How should we generate the RSA keys in OpenSwan in order to get them into the Cisco WLC? Case 2: We have also tried to use Pre-shared keys. But alas, the Cisco WLC doesn't respond to the request from Freeradius Server. How should these PSK's be formed and what settings should be used? Any configuration examples of IPSEC on the OpenSwan, or generic explanations would be welcome as well. Shared Secret Format: ASCII Shared Secret: <same as on OpenSwan> Key Wrap: <not used> Port Number: 1812 Server Status: Enabled Support for RFC 3576 : Enabled Server Timeout: 2 seconds Network User: Enable Management: Enable IPSec Enable IPsec Parameters IPSec: HMAC SHA1 IPSEC Encryption: AES CBS (Shared Secret will be used as the Preshared Key) IKE Phase 1 Aggressive (tried main as well, with corresponding settings in OpenSwan) Lifetime (seconds) 28800 IKE Diffie Hellman Group Group 2 (1024 bits) Remarks: I would like to mention two tings: The path is open between FreeRadius server and WLC Cisco. The FreeRadius server was tested with other Linux IPSec tunnels, and this worked flawlessly. The setup of the FreeRadius is changed in each case to correspond with settings on the WLC. Looking forward to getting help from you! P.S.: It seems that IPSEC tunnels vs. WLCs is not what's easy to get help with; we've contacted several major Norwegian consulting firms with little or no response. Regards Saleh Abuzid Dept. engineer, Dept. of servers- and networks, HiST - Sor-Trondelag University College (www.hist.no <http://www.hist.no/> ) Phone: ++47 73559672 E-mail: Saleh.Abuzid(a)hist.no Saleh Abuzid Gunnerus gate 1 Høgskolen i Sør-Trøndlag (HiST) SPO-IKT Avdelingsingeniør tlf: 73559672 E-mail: Saleh.Abuzid(a)hist.no

2 1

Re: Upgrading freeradius from source
by Ming-Ching Tiew 13 May '09

13 May '09

--- On Tue, 5/12/09, John Dennis <jdennis(a)redhat.com> wrote: > > I think you'll save yourself a lot of headaches if you > stick with RPM > based packages. If the version of FreeRADIUS is not > available as an RPM > for the version of the distro you're using then you can > find > instructions for how to download, build and install the > *RPM* for a > current version here: > > http://wiki.freeradius.org/Red_Hat_FAQ > > I can't find a SOURCE RPM for 2.1.4 yet for fedora. I tried one of those 2.1.3 rpm, it works perfectly on my older fedora distro, even though it seem to indicate that they are for newer fedora. So I guess I have to wait a little longer. Regards.

4 3

FreeRadius and logwatch
by Matthieu Lazaro 13 May '09

13 May '09

Hello forum, Just wondering if someone found or had written perl scripts for logwatch so that we can send the logs all tidy?? Asking this in case I missed something or if someone had this in it's drawer! I'm going to post this as well to the logwatch mailing. Best regards, Matt

1 1

Re: Upgrading freeradius from source
by Ming-Ching Tiew 13 May '09

13 May '09

--- On Wed, 5/13/09, Ivan Kalik <tnt(a)kalik.net> wrote: > From: Ivan Kalik <tnt(a)kalik.net> > Subject: Re: Upgrading freeradius from source > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Date: Wednesday, May 13, 2009, 9:06 AM > 2.1.4/2.1.5 release had identity > crises. 2.1.8. will be available in > matter of days. It's on pre-release testing. > > Catching up with releases is always a never ending game, and each version can take up a lot of resources to prove to be stable for production use. Are there major defects with 2.1.4 which resulting in quick subsequent new releases ? Regards.

1 0