- Freeradius-Users - lists.freeradius.org

How to cleanup cisco dhcp inserted attributes ?
by Jarkko Torppa 11 Apr '09

11 Apr '09

What would be good way to cleanup attributes that are generated by cisco's dhcp snooping/inserting ? User-Name = "\001\026harjuniitty-ftth-sw1_6" ADSL-Agent-Circuit-Id = "\001\026harjuniitty-ftth-sw1_6" ADSL-Agent-Remote-Id = "\001\024harjuniitty-ftth-sw1" Id like to strip that type 0x01 and length from data so that I would have "harjuniitty-ftth-sw1_6" for user-name. I did'nt see anything obivous in unlang that could do this, and created hack in rlm_preprocess.c As a background, cisco switch snoops dhcp-packet and inserts it's name and port into Option82 of dhcp-packet which is then forwarded to dhcp- relay that first authenticates that request via radius server.

2 1

RE: Dear freeradius-users@list.xs4all.nl Pharmacy Message 2693120
by VIAGRA � Official Site 11 Apr '09

11 Apr '09

About this mailing: You are receiving this e-mail because you subscribed to MSN Featured Offers. Microsoft respects your privacy. If you do not wish to receive this MSN Featured Offers e-mail, please click the "Unsubscribe" link below. This will not unsubscribe you from e-mail communications from third-party advertisers that may appear in MSN Feature Offers. This shall not constitute an offer by MSN. MSN shall not be responsible or liable for the advertisers' content nor any of the goods or service advertised. Prices and item availability subject to change without notice. ©2009 Microsoft | Unsubscribe at http://newmeek.com | More news at http://newmeek.com | Prvacy at http://newmeek.com Microsoft Corporation, One Microsoft Way, Redmond, WA 98052

1 0

freeradius-server-2.1.4 make fails
by Thor Spruyt 10 Apr '09

10 Apr '09

Hi, I'm trying to compile freeradius-server-2.1.4 on CentOS 4.6 32-bit Configure command: ./configure --prefix=/opt/freeradius-2.1.4 --with-mysql --with-postgresql --with-openldap --without-snmp --without-openssl --without-krb5 --without-vmps But make fails: /home/thor/freeradius-server-2.1.4/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/thor/freeradius-server-2.1.4/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.5\" -DNO_OPENSSL -c listen.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/thor/freeradius-server-2.1.4/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.5\" -DNO_OPENSSL -c listen.c -fPIC -DPIC -o .libs/listen.o listen.c: In function `client_listener_find': listen.c:126: warning: passing arg 1 of pointer to function discards qualifiers from pointer target type listen.c:206: warning: assignment discards qualifiers from pointer target type In file included from listen.c:1053: command.c: In function `command_show_client_config': command.c:845: warning: passing arg 2 of `cf_section2file' discards qualifiers from pointer target type listen.c: In function `listen_init': listen.c:1795: error: `RAD_LISTEN_VQP' undeclared (first use in this function) listen.c:1795: error: (Each undeclared identifier is reported only once listen.c:1795: error: for each function it appears in.) gmake[4]: *** [listen.lo] Error 1 gmake[4]: Leaving directory `/home/thor/freeradius-server-2.1.4/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/thor/freeradius-server-2.1.4/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/thor/freeradius-server-2.1.4/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/thor/freeradius-server-2.1.4' make: *** [all] Error 2 Any idea what's going wrong? Regards, Thor Spruyt

3 2

Sending Access-Challenge
by Laszlo Fekete 10 Apr '09

10 Apr '09

Hello! I'm new to this list and don't found archive or something where maybe somebody answered my question. So I want a radius server to wifi auth with eap-ttls/peap, ldap and not plain-text passwords. I downloaded 2.1.4 source and create debian package without modification, do some basic configuration and testing, radtest from local is fine, but radeapclient eap-md5 testing fail. I saw this on server side: rad_recv: Access-Request packet from host 127.0.0.1 port 52650, id=76, length=69 User-Name = "steve" NAS-IP-Address = 127.0.0.1 Message-Authenticator = 0xafa8ae1b1aaa6fb0a6cbd0719b507e94 NAS-Port = 0 EAP-Message = 0x02d2000a017374657665 +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "steve", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 210 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry steve at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 76 to 127.0.0.1 port 52650 Service-Type = Framed-User Framed-Protocol = SLIP Framed-IP-Address = 192.20.126.200 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x01d300160410b7703d97cfb88bff2835ec9a9aedde83 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xae48086bae9b0cd33d7dacc7cd15f18d Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 76 with timestamp +94 Ready to process requests. And this on client side (local): # radeapclient -s -X localhost auth testing123 About to send encoded packet: User-Name = "steve" Cleartext-Password = "testing" NAS-IP-Address = 127.0.0.1 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "steve" Message-Authenticator = 0x30 NAS-Port = 0 Received response ID 76, code 11, length = 131 Service-Type = Framed-User Framed-Protocol = SLIP Framed-IP-Address = 192.20.126.200 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x01d300160410b7703d97cfb88bff2835ec9a9aedde83 Message-Authenticator = 0xe65c832fea00201e76a340cc0e38cf37 State = 0xae48086bae9b0cd33d7dacc7cd15f18d <+++ EAP decoded packet: Service-Type = Framed-User Framed-Protocol = SLIP Framed-IP-Address = 192.20.126.200 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x01d300160410b7703d97cfb88bff2835ec9a9aedde83 Message-Authenticator = 0xe65c832fea00201e76a340cc0e38cf37 State = 0xae48086bae9b0cd33d7dacc7cd15f18d EAP-Id = 211 EAP-Code = Request EAP-Type-MD5 = 0x10b7703d97cfb88bff2835ec9a9aedde83 +++> About to send encoded packet: User-Name = "steve" Cleartext-Password = "testing" NAS-IP-Address = 127.0.0.1 EAP-Code = Response EAP-Id = 211 Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Type-MD5 = 0x106e2008d8fc099a16335131c045fc6df6 State = 0xae48086bae9b0cd33d7dacc7cd15f18d ^C # cat re.txt User-Name = "steve" Cleartext-Password = "testing" NAS-IP-Address = 127.0.0.1 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "steve" Message-Authenticator = 0 NAS-Port = 0 What's wrong with the configuration? Thank you: blackluck

3 5

freeradius crashes if can not connect to mysql
by Oguzhan Kayhan 10 Apr '09

10 Apr '09

Hello, I noticed that..if a network error or another connection problem occurs between freeradius and mysql server, freeradius service just exits... And sure service stops automatically. Is there any way to give a timeout value or retry number for mysql in freeradius configuration that prevents freeradius to exit abnormally in that case.. Thanks..

1 0

Freeradius server not starting!
by ramesh p 10 Apr '09

10 Apr '09

[root@localhost log]# /usr/local/fnmt/etc/init.d/radiusd start Starting FreeRADIUS:Fri Apr 10 05:52:13 2009 : Info: Starting - reading configuration files ... radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_exec: Wait=yes but no output defined. Did you mean output=none?) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql (sql): Attempting to connect to radius@localhost:/LWT) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #0) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #1) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #2) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #3) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (rlm_sql_mysql: Starting connect to MySQL server for #4) radiusd: Couldn't open /usr/local/fnmt/var/log/radius/radius.log for logging: Permission denied (Failed creating PID file /usr/local/fnmt/var/run/radiusd/radiusd.pid: Permission denied ) radiusd Please suggest me. Regards, Ramesh.

3 13

Install FreeRadius with Python enabled
by Leonardus Gazali 10 Apr '09

10 Apr '09

Hi All, I am trying to install FreeRadius with Python enabled. I do configure with parameter --with-experimental-modules and make + make install Install ended very well. But when I executed radiusd -XC, I can't find the radius load the rlm_python module. Is there anything that I missed? My Server Configuration: CentOS release 5 (Final) FreeRadius 2.1.4 Python 2.5.2 Thank you. Leo

3 3

of Mac and Men
by A.L.M.Buxey＠lboro.ac.uk 09 Apr '09

09 Apr '09

hi, taking some Steinbeck metaphor too far... oh, how I wish Lenny were a code name for MacOSX rather than Debian... anyway, or lovely friend Lenny or having a few issues compared to his friend George. Lenny wants to have the lovely Wifi...but cant. You see, Lenny has 'issues' and some of these issues wont be apparent until too late. anyway, a few choice quotes from some google searches and I am none the wiser. I know this Mac OSX seems to have some issues with Cisco Wireless kit in the LWAPP mode. Mac OSX seems to have some driver issues....especially since the same kit (Macbook Pro) running Vista has no wireless problems. hmm. however, a rather interesting log file from the RADIATOR release: "Improved compatibility with some EAP-TTLS clients that previously would have required EAPTTLS_NoAckRequired. Reported by Ian Forster." coupled with #This is added for Apple Macintosh Airport Extreme adapters EAPTTLS_NoAckRequired suggests that something more is afoot. so...how is MacOSX with you guys out there with FreeRADIUS? This 'issue with airport extreme' - is the code in FreeRADIUS also supporting of these ACK issues? the posse is closing these guys down. its only a matter of time. alan ("to kill a mockingbird" analogy next ;-) )

6 18

EAP/TTLS : Issue while trying to proxy inner request and to use post proxy filter
by Thomas Fagart 09 Apr '09

09 Apr '09

Hello, Sorry to post again for the same subject, but I guess I haven't been very clear in my last question to the list, so I'm trying to ask it differently. I've done some drawing that illustrate the settings I've tried and also provide the whole log, that could be seen here http://www.brozs.net/wimax/wimax-freeradius.png In Setup 1 (one radius with local authentication) everything is fine http://www.brozs.net/wimax/wimax.log In setup 2 (inner request proxy to ISP radius that will answer with Wimax Attribute) -> In that case Wholesale Radius will discard Wimax attributes contains in the access accept from the ISP radius during the proxification, so that the access accept does not have all the wanted access acccept. I'm trying to understand why. http://www.brozs.net/wimax/wimax-proxy1.log In setup 3 (which is the solution I would like to use, ie inner request proxy to ISP radius, and Wimax attributes are being added after receiving the access accept from ISP Radius) -> In that case Wholesale Radius will add some of the wanted attribute but not all the one that are in attrs I'm also trying to know why. http://www.brozs.net/wimax/wimax-proxy2.log Regards Thomas

3 4

cofiguration on client
by Basant Agarwal 09 Apr '09

09 Apr '09

Hello , I am trying to use freeradius1.1.7 with ldap . Now when i try to authenticate user from localhost , it works but when i try from laptop it does not work . . it shows User-Password attribute required .. I tried to remove AUTH TYPE = LDAP as alan suggested but i am not things work .. it shows error in even running the server ...!! Please help me ..Probably i could not understand the thing alan wanted me to do ..!! Please be more elaborate on the topic ...!!! Thanks and Regards,

2 1