- Freeradius-Users - lists.freeradius.org

Accounting Software
by Just E. Mail 10 Dec '08

10 Dec '08

Hello: My first try on freeRADIUS. I am going to setup a test freeRADIUS server with CentOS 5.2 & mySQL for learning about RADIUS server. Questions: 1. Is there a GUI application to setup freeRADIUS? 2. Is there a free accounting package (must interface with mySQL) I can use? Thanks. Sam

2 1

ldap question
by Craig White 10 Dec '08

10 Dec '08

still a few issues so I upgraded to 2.1.1 and in debug mode (and I have enabled ldap), I see this... [ldap] checking if remote access for $SOME_USER is allowed by uid [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x... rlm_ldap: sambaLmPassword -> LM-Password == 0x... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user $SOME_USER authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP should I just disable pap? (I can't think of anything that I need to use it for) OR... considering that the LDAP 'userPassword' is essentially the same password that is contained in sambaNTPassword and sambaLMPassword, do I just somehow enable # password_attribute = "userPassword" as it talks about in rlm_ldap doc file? Craig

1 0

RE: No log destination specified.
by Marcel Grandemange 10 Dec '08

10 Dec '08

|->>I have a problem where I upgraded v1 to v2 of freeradius and now I can only |->start it with mode radius -X , if I try use script is simply does following. |-> |-> |-> |->>/usr/local/etc/rc.d]# ./rc.radiusd start |->>Starting FreeRADIUS:radiusd: Error: No log destination specified. |->>Radius |-> |-> |->>Any advise? |-> |->FYI - I have now made a startup script to the following. |-> |->/usr/local/sbin/radiusd -X & > /dev/null 2>&1 |-> |->To Run Freeradius as this is a production machine. >It is complaining that you have not specified a place to write a log file. >====== >logdir = /var/log ># ># The logging messages for the server are appended to the ># tail of this file. ># >log_file = ${logdir}/radius.log >====== >This is from my radiusd.conf file. Radius writes log file messages (few >and far between) to /var/log/radius.log >Fix that and you wont have to use the redirect to /dev/null, which I would >not use anyway as you want log files to know if something is going wrong. This is the beginning of my radius.conf, it seems the entry is indeed there and valid as it's same as old installation. prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log >HTH, >Keith

3 2

EAP-SIM
by Leigh Martell 10 Dec '08

10 Dec '08

Hey, This may be a stupid question, but if I don't have access to a carriers HLR. Can I still do EAP-SIM if I have a sim reader. Sorry for this question I am just having trouble finding a definitive answer. Thanks, Leigh

1 0

version 2.1.3 available for Fedora 10 and Fedora 9
by John Dennis 10 Dec '08

10 Dec '08

The new version of FreeRADIUS, 2.1.3, is available in the testing repositories for Fedora 10 and Fedora 9. Please note they are in the testing repositories and have not been pushed to stable yet. If you have questions or issues please consult the FreeRadius Red Hat FAQ (http://wiki.freeradius.org/Red_Hat_FAQ) first. If you have success with it I would appreciate knowing that because that will be the key for me to push it to stable and a wider audience. Comments to this effect can be added to the package release on Bohdi, the Fedora Update System (https://admin.fedoraproject.org/updates) -- John Dennis <jdennis(a)redhat.com>

1 0

python error in complie freeradius-2.1.3
by henry1412 10 Dec '08

10 Dec '08

I install freeradius-2.1.3 on redhat9, the python version is 2.2. When I make the freeradius, it reports many error in rlm_python.c file. I paste the error information below rlm_python.c: In function `python_error': rlm_python.c:163: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:163: (Each undeclared identifier is reported only once rlm_python.c:163: for each function it appears in.) rlm_python.c:163: parse error before "__gstate" rlm_python.c:181: warning: implicit declaration of function `PyGILState_Release' rlm_python.c:181: `__gstate' undeclared (first use in this function) rlm_python.c: In function `python_init': rlm_python.c:201: warning: passing arg 2 of `PyModule_AddIntConstant' discards qualifiers from pointer target type rlm_python.c: In function `python_function': rlm_python.c:338: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:338: parse error before "gstate" rlm_python.c:361: `gstate' undeclared (first use in this function) rlm_python.c:361: warning: implicit declaration of function `PyGILState_Ensure' rlm_python.c: In function `python_load_function': rlm_python.c:470: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:470: parse error before "gstate" rlm_python.c:472: `gstate' undeclared (first use in this function) rlm_python.c: In function `python_objclear': rlm_python.c:508: `PyGILState_STATE' undeclared (first use in this function) rlm_python.c:508: parse error before "__gstate" Is my python version too old ?

3 2

fr group howto
by Hegedus Gabor 10 Dec '08

10 Dec '08

Hi all! I have 802.1x authentication, which works. I want use dynamic vlan assignment: The radius authenticate the user (use ntlm_auth) and after this, it use ldap to get user indormation form database (username=samaccount name). ldap.attrmap changes the attributes and send to the switch, it is okay. It is not so confortable, I wanna try something else: 1. I create groups: vlan21, vlan333, and so on. expand the vlan schema with 3 attrib (you know VLAN, IEEE-802, and VLANID). I put users and computers to the groups. How can I get users vlan info, I can't create ldap query, cos : - i have samaccount name what is not the cn, and the "member", "member of" attribs are contains cn. i don't know how can i do a good query, the good attrib is in vlanXY group. - get vlan? ok but i have just samaccount name, no cn - get user? ok but the good attribs is in the vlan group how? 2. I don't expand the vlanXY schema, I get user info(by samaccname) contains "member of" attr, and in the freeradius user file I create group. If group in the users file equals "member of" attrib send back the vlan info to the switch: (i know it is not good yet) DEFAULT Ldap-Group == "cn=vlan10,ou=vlans,dc=test,dc=hu" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 10, Reply-Message = "You are in vlan 10" ldap modul: groupname_attribute = cn groupmembership_filter = "(&(memberof=cn=vlan10,ou=vlans,dc=test,dc=hu)(samaccountname=%{mschap:user-name}))" ## i know it is bad, but what is the good do you understand what i want? I test both prospect, pls help Thx Gabor

2 2

RE: (err=2)! (Shared secret is incorrect.)
by Jason Wittlin-Cohen 10 Dec '08

10 Dec '08

The shared secret is the password that clients use to connect to the RADIUS server. It's located in the "client.conf" file in your freeradius configuration directory. Note, that this shared secret is used to secure RADIUS traffic. User names and passwords of users which are authenticating via EAP are stored in the "users" file. -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

4 3

rad_recv: Access-Reject
by Ilya 10 Dec '08

10 Dec '08

hello! debugging freeRADIUS i met the problem like this: At the beginning I thought that the problem was in the users file but in radiusd.log I saw the message: rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/raddb rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique what's wrong? could anybody help me plz? radiusd -X log , users file and cliens.conf is attached. have a good day, ilya ________________________________ ilya vishnyov billing department baykalwestcom 68, 2-zheleznodorozhnaya str., irkutsk, 664005, russia gsm: +7 9025 113 992 e-mail: ilya(a)bwc.ru icq #: 988-0-229 ________________________________

1 0

Re: EAP/TLS TLS_accept error
by henry1412 10 Dec '08

10 Dec '08

Under my freeradius and ap current configuration, I can be success authenticated by windows xp client, but failed by linux client of wpa_supplicant-0.4.8. What's wrong with my setting? Is my wpa_supplicant version too old or my wpa_supplicant config file has some problem?

2 1