- Freeradius-Users - lists.freeradius.org

Unable to find module....
by Bryan Graham 07 Apr '09

07 Apr '09

I'm using freeradius 2.1.4, hand compiled, and running on Solaris 10, in a zone. I have attr_rewrite in my authorize { } section of the sites-enabled/default. A raidusd -X shows the following (relevant) lines: including configuration file /opt/csg/etc/raddb/modules/attr_rewrite . . conns: 87848 /opt/csg/etc/raddb/sites-enabled/default[198]: Failed to find module "attr_rewrite". /opt/csg/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. } Errors initializing modules Now, the attr_rewrite libraries ARE in /opt/csg/lib with the other modules, and I should mention that I have been using ldap and kerberos just fine before this, so I doubt that this is a generic library location issue. Any ideas why it can't find this specific module? thanks, Bryan Graham

2 1

need help & advice getting started with freeradius
by daniel knox 06 Apr '09

06 Apr '09

Hello everyone, this is my first time getting started with freeradius. I implement ICT at a local school and I would like to improve our wireless from a WPA pre-share key to a radius based system. We have an openldap server already with all our users and groups and use them to authticate them into our clients. I would like to extend this username and password requirement to our wireless systems rather than having to give out our wireless key. Our wireless users have a variety of Windows, OSX and Linux machines. Free-radius therefore seems to be the idea solution to this. First up i have read this guide: http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch31_:_Cent… get me started on the idea of ldap and radius. Next up ive read this guide: http://ubuntuforums.org/archive/index.php/t-478804.html which works on the idea of PEAP. In my scenario I would like to use PEAP if possible but not require the user client to have a certificate, just the radius-server (which is why i believe the TTLS solution will be in-efficient here as i would have to deal with handy out client certificates to hundreds of users). And to be asked thern their username and password to authticate onto our wireless. Would combining these two guides work to get these two intial sets up and running? Second up how can i then extend this system so that i can ban specific users and groups from the wireless system. Obviously i could remove them from ldap but I would like to be able to have the flexibility to prevent a user using the wireless but to still be able to log onto one of our terminals. I believe in your FAQ article the section How do I deny access to a specific user, or group of users? would do this definatly for the user. If i make sure I add the user specifically before it goes onto the ldap auth. However how can i get it to deny access to ldap groups from this? Any help / guides online which you think will help me get pointed in the right direction would be super. Many Thanks.

5 10

RE: Problems in redudant ldap and authorization.
by Ville Leinonen 06 Apr '09

06 Apr '09

Hi, I try to stop authorization proccess if user is not found in ldap. If it's found then eap-tls is allowed. Br, Ville -----Original Message----- From: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 06/04/2009 14:45 To: FreeRadius users mailing list Subject: Re: Problems in redudant ldap and authorization. Ville Leinonen wrote: > I have a little problem in my radius configuration in my > redudant ldap section rad ver is 2.1.5. > > redundant { > ldap-srv1 > ldap-srv2 > notfound = reject > } That is not the correct format. It does not follow any of the examples or documentation. > Any suggestion what is wrong in my configuration? What are you trying to do? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

[Wimax TTLS with Alcatel - Lucent ASN GW]
by Thomas Fagart 06 Apr '09

06 Apr '09

Hello, First thanks again for this new release that adds very interesting features for debug, specially raddebug and radmin. Using basic setup, Freeradius successfully authenticate request coming from CPE Wimax through ASN Alcatel GW (called WAC) using EAP/TTLS Fri Apr 3 01:05:10 2009 : Auth: Login OK: [00210400E0D7(a)test.fr/<via Auth-Type = EAP>] (from client wimax port 0 cli 00-21-04-00-E0-D7) Fri Apr 3 01:05:19 2009 : Auth: Login OK: [cpe2-lab(a)test.fr/<via Auth-Type = mschap>] (from client wimax port 0 via TLS tunnel) I now have 2 issues to fill properly the access accept with correct attribute. (This needs might be weird, but it is the way this ASN GW works) 1. I would like that the outer access accept contains attributes coming from the inner access accept So I tried to use the update outer.reply on post-auth section of the inner-tunnel virtual server update outer.reply { #User-Name = "%{request:User-Name}" WiMAX-Packet-Data-Flow-Id = "%{request:WiMAX-Packet-Data-Flow-Id}" } But as I understand, you can only use "request" from the inner tunnel, but not the attribute contained in the reply of the inner tunnel. Is that true ? Is there a way to do that. To be more precise this is the reply in the inner tunnel Fri Apr 3 01:13:33 2009 Packet-Type = Access-Accept WiMAX-Packet-Data-Flow-Id = 1 WiMAX-Service-Data-Flow-Id = 1 WiMAX-Service-Profile-Id = 1 WiMAX-Direction = Bi-Directional WiMAX-QoS-Id = 1 WiMAX-Media-Flow-Type = Robust-Browser WiMAX-Schedule-Type = Best-Effort WiMAX-Traffic-Priority = 0 WiMAX-Maximum-Sustained-Traffic-Rate = 512000 MS-CHAP2-Success = 0xdf533d37443041423038393133393032414333353841304630414336383132453546434243364130323046 MS-MPPE-Recv-Key = 0x1d7c9b57392b589e2849640bad969199 MS-MPPE-Send-Key = 0x4aa107e5fa9573846af44d21c5080749 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 and the one in the outer tunnel Fri Apr 3 01:13:34 2009 Packet-Type = Access-Accept MS-MPPE-Recv-Key = 0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395 MS-MPPE-Send-Key = 0x009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b EAP-MSK = 0x6b185c55d7785700e6f52c9ae0160945476aa4ab9e5b699dc6cffb5427c06395009d98e233e6911f97346381a77e90d01b7d41b3aa82dbf6ce56f54bb9b2598b EAP-EMSK = 0xc5f48626093f9313c5090254ffc375d4594bf6570025a260801e4b8d0ff852167d0748bd50b27d214b0ee67c1bbe1a4395faf094a8cb56663177fa8f32586f40 EAP-Message = 0x03f00004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00210400E0D7(a)test.fr" I would like the reply of the outer tunnel to contain all the Wimax Attribute I got in the inner. 2. For some weird reason again, Alcatel ASN needs to receive two times the same attribute with differente value (Actually this WiMAX-QoS-Descriptor (TLV Attribute)) I guess this is not very compliant with RFC, but is there a way to send 2 times the same attribute in the same reply. I've tried that but without surprise this send only the first part of the attribute cpe2-lab(a)test.fr Cleartext-Password := "xxx" WiMAX-Packet-Data-Flow-Id=1, WiMAX-Service-Data-Flow-Id=1, WiMAX-Service-Profile-Id=1, WiMAX-Direction=Bi-Directional, WiMAX-QoS-Id=01, WiMAX-Media-Flow-Type=Robust-Browser, WiMAX-Schedule-Type=BEST-EFFORT, WiMAX-Traffic-Priority=0, WiMAX-Maximum-Sustained-Traffic-Rate=512000, WiMAX-QoS-Id=02, WiMAX-Media-Flow-Type=Robust-Browser, WiMAX-Schedule-Type=BEST-EFFORT, WiMAX-Traffic-Priority=0, WiMAX-Maximum-Sustained-Traffic-Rate=512000 Maybe using perl module in the post-auth ? Thanks Thomas Fagart

3 4

1.1.7 with CHAP and Mysql
by Benjamin Marvin 06 Apr '09

06 Apr '09

Good day,I inherited a system running two Freeradius 1.1.7 servers with CHAP and Mysql. They run seemingly fine, but I am trying to add a third (and a fourth eventually, planning to use the fourth as a testbed for a newer Freeradius version). So I installed Mysql and Freeradius 1.1.7. The Mysql database is replicated from the existing servers. I tried to configure FreeRadius from scratch and finally tried copying the config files from a working machine. In both cases I've received the error: rlm_chap: Could not find clear text password for user testuser(a)mydomain.com It's clear in the preceding Debug lines that SQL is being called and that the proper select statements are being run. In fact, up until this point in the debug the debug looks exactly the same as a debug on my working servers. When I run the select statements manually, the output is identical to the results of the working servers. As I mentioned, the Debug for the working servers deviate only at this point, and on the working server the line reads: rlm_chap: Using clear text password "mypassword" for user testuser(a)mydomain.com authentication. I'm fairly confident that Freeradius is interacting with the Mysql server because when I forward accounting to the server, the accounting is stored to the Mysql tables. I was interested in seeing what the Freeradius server thinks the select queries are returning that it can't find a clear text password. I had thought maybe sqltrace = yes would enable me to see this, but this option appears to do nothing (in -X and -x and with no arguments. Also no sql appears in the radius.log file either). Next I got the idea to use radtest with a non chap password to test. radtest works just fine, calls the SQL and everything: rlm_pap: login attempt with password mypassword rlm_pap: Using clear text password. rlm_pap: User authenticated succesfully Haven't gotten much sleep thanks to this, and I'm not sure where to go next. So thank you all in advance for any advice/recommendations. -Benjamin Marvin _________________________________________________________________ Curiosità, trucchi e consigli per il tuo Messenger! http://www.messenger.it

2 1

Limit user by Time and Bandwidth
by Sunday Olutayo 06 Apr '09

06 Apr '09

Please, I just install it with Freeradius and SQL. How can I limit user by time of the day? And how do I limit user to maximum bandwidth?

2 1

VS: Chap auhtentication against LDAP
by Ville Leinonen 06 Apr '09

06 Apr '09

Hi, So i cannot do this about using freeradius, but i can make it using IAS (see link)? http://h40060.www4.hp.com/procurve/includes/application-notes/index.php?cc=… Br, Ville -----Alkuperäinen viesti----- Lähettäjä: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org puolesta: Alan DeKok Lähetetty: pe 3.4.2009 16:10 Vastaanottaja: FreeRadius users mailing list Aihe: Re: Chap auhtentication against LDAP Ville Leinonen wrote: > Does Freeradius 2.1.5 support chap authentication against ldap? No RADIUS server supports this. It's impossible. Instead, have FreeRADIUS pull the clear-text password from LDAP. FreeRADIUS can then do CHAP. If you don't have a clear-text password in LDAP, it's impossible. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Problems in redudant ldap and authorization.
by Ville Leinonen 06 Apr '09

06 Apr '09

Hi, I have a little problem in my radius configuration in my redudant ldap section rad ver is 2.1.5. redundant { ldap-srv1 ldap-srv2 notfound = reject } Gives this error message: /usr/local/etc/raddb/sites-enabled/default[167]: Entry with no value is invalid /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. Any suggestion what is wrong in my configuration? If i use individual configuration eg. ldap-srv1{ notfound = reject } Then it works. Br, Ville

2 1

FreeRadius 1.x Or 2.x
by AHMED KHIDR 06 Apr '09

06 Apr '09

Dear All, I use freeradius 1.1.7 and I am thinking of migrate to new ver. 2.x so i want to ask which ver is better ?

2 1

What can cause the "Exiting normally" without prompting
by switchport＠hotmail.com 06 Apr '09

06 Apr '09

hi, i am testing freeradius 2.1.X by radclient , when the number of requests arrive 6million+, freeradius will "Exiting normally" without prompting. the testing freeradius have pgsql module. thanks.

4 7