- Freeradius-Users - lists.freeradius.org

radclient problem
by Umar 01 Sep '08

01 Sep '08

Dear User! I have Freeradius running on FreeBSD. How i can kill or get a status of connected user?. I am trying radclient but its not working for me. echo "User-Name = umar" | radclient -x 127.0.0.1:1812 status <secret> the above command didn't work for me. Please help in this regards. Umar Draz -- View this message in context: http://www.nabble.com/radclient-problem-tp19239639p19239639.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Simultaneous-Use ..
by Alexandre J. Correa - Onda Internet 31 Aug '08

31 Aug '08

Hello, how i can setup freeradius to disconnect previous session of user that has Simultaneous-Use = 1 ?! thanks -- Sds. Alexandre Jeronimo Correa Onda Internet - http://www.ondainternet.com.br OPinguim Hosting - http://www.opinguim.net Linux User ID #142329 UNOTEL S/A - http://www.unotel.com.br

2 1

Re: Fwd: MSCHAP module returns OK, authentication fails.. (SOLVED)
by James Yale 30 Aug '08

30 Aug '08

2008/8/29 James Yale <jim(a)thebiggame.org>: > 2008/8/28 <A.L.M.Buxey(a)lboro.ac.uk>: >> hi, >> >> whats wrong with that debug? looked fine here - that should >> end with a happy connection. ntlm_auth got the correct >> response. >> >> alan > > The problem is that when that log ends the WPA supplicant gets: > > -- EAP-MSCHAPV2: Invalid authenticator response in success request > > And the authentication fails. The full logs of the failure are at: > > http://jim.geezas.com/stuff/radius-debugging/eapol-ntlmuser-failure.log > for the supplicant and: > > http://jim.geezas.com/stuff/radius-debugging/radius-ntlmuser-failure.log > for radiusd. > > I'm going to try afew different distributions/versions of FreeRadius > and Samba, perhaps compile from source - presumably this configuration > is fairly common and working elsewhere, so it should work with some > combination (if I find one I'll post it up). > > Thanks, > > James > To update this, Alan DeKok was right about the issue being with Samba, but rather than using an newer version of Samba an older version was required. I compiled Samba 3.0.32 from source and EAP/MSCHAP authentication now works perfectly on FC9 with the packaged version of FreeRadius 2.0.5. Thanks to both Alans for the help :) James

1 0

compiling freeradius with oracle support
by Alexandre Chapellon 30 Aug '08

30 Aug '08

Hi I manage to compil freeradius (2.0.5) with oracle support and so i installed the oracle instantclient (11_1) and its sdk... all this in /opt/oracle When launching compilation (using the dpkg-builpackage wrapper and rules files modified to enable oracle) i get a problem: The rlm_sql_oracle driver compilation is silently skip whereas i did specify the appropriate (well i guess they are appropriate): --with-rlm-sql-oracle=yes --with-oracle-home-dir=/opt/oracle --with-oracle-lib-dir=/opt/oracle/instantclient_11_1/ --with-oracle-include-dir=/opt/oracle/instantclient_11_1/sdk/include It says headers (oci.h) are not found, but this file realy is in the specified include path. So i decided to start the dirty stuff and set $oracle_include_dir as an environment variable doing manual configure (don't know if i can do it with dpkg-buildpackage) oracle_include_dir=/opt/oracle/instantclient_11_1/sdk/include ./configure ..... this made the header test successfull but i can't still make it find libs which are in /opt/oracle/instantclient: ~$ ls /opt/oracle/instantclient_11_1/ adrci genezi libclntsh.so.11.1 libocci.so libociei.so ojdbc5.jar sdk BASIC_README libclntsh.so libnnz11.so libocci.so.11.1 libocijdbc11.so ojdbc6.jar Does anyone have a clue what i could do?

3 20

FreeRadius not sending access-deny
by Ryan Kramer 29 Aug '08

29 Aug '08

Hello, I recently discovered that my Freeradius 1.1.7 install is no longer sending access-deny messages for bad passwords. This causes the device to mark the radius server as down and move on to the next one, or just marks it as down. I know its probably something I did in the config, but for the life of me can't figure out how I managed to cause that. Everything else on the install works great, just for the exception of no access-deny packets ever move. Any ideas? Ryan

3 4

Compile problems
by David Blood 29 Aug '08

29 Aug '08

I am trying to install freeradius from source and cannot seem to get it to install correctly. 1. I am installing on a centos 4.5 box and would like freeradius to install the config file in the correct place (i.e. /etc/raddb) setting the prefix='' ( or sysconfdir='/etc/raddb') in the configure script does not tell the radiusd executable to look in /etc/raddb for its configuration files. It still looks in /usr/local/etc/raddb 2. The configure script cannot find the libgdbm library and thus cannot configure some of the rlm_modules. I have tried setting the --with-rlm-counter-lib-dir='/usr/lib' which is where the gdbm library is looked to get rlm_couter to configure but it still fails. 3. I says it can't locate check-radiusd-config . I wish I knew where it was looking. Here is the configure command I last used with the error output received. ./configure --prefix='' --exec-prefix='/usr' --includedir='/usr/include' --datadir='/usr/share' --libdir='/usr/lib' --sysconfdir='/etc/raddb' --with-rlm-counter-lib-dir='/usr/lib' -q appending configuration tag "CXX" to libtool appending configuration tag "F77" to libtool config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting chmod: cannot access `check-radiusd-config': No such file or directory configure: WARNING: silently not building rlm_counter. configure: WARNING: FAILURE: rlm_counter requires: libgdbm. configure: WARNING: FAILURE: rlm_dbm requires: (ndbm.h or gdbm/ndbm.h or gdbm-ndbm.h) (libndbm or libgdbm or libgdbm_compat). configure: WARNING: silently not building rlm_dbm. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: creating ./config.status config.status: creating Makefile checking for OpenSSL support... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged configure: WARNING: silently not building rlm_ippool. configure: WARNING: FAILURE: rlm_ippool requires: libgdbm. configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r ldap.h. configure: WARNING: silently not building rlm_pam. configure: WARNING: FAILURE: rlm_pam requires: libpam. configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: sql.h. David

3 7

freeradius, proxy and packet loss
by Evgeniy Kozhuhovskiy 29 Aug '08

29 Aug '08

Hi all! I have a freeradius 2.0.5 installed and configured to authorize to realms (for example @a and @b) First realm - @a - authorizes locally (via rlm_sql) Second - @b - is proxying to remote server. The trouble looks so (we take this with with tcpdump): - my freeradius 2.0.5 server sends auth-req -- remote server gets it and process -- remote server sends answer -- it reach our server -- ~95% replyes goes to NAS'es, but sometimes my server says that "Rejecting request 4490 due to lack of any response from home server xx.xx.xx.xx port 1812" (but in fact this response arrives to the interface of the computer with freeradius installed - i see this with sniffer, but there is nothing in freeradius logs about this packet) -- With best regards, Evgeniy Kozhuhovskiy, Leader of Services team, Minsk State Phony Network, RUE Beltelecom.

4 6

FW: [RTX] POPS in Brasil
by José Soler 29 Aug '08

29 Aug '08

Stig, Jonathan, Have you moved on this one? Regards, jose From: José Soler Sent: 28 August 2008 11:14 To: 'Stig Skaugvoll' Cc: Claus Futtrup; Jonathan Schutte Subject: FW: [RTX] POPS in Brasil Stig, Can you take AP1 below and contact T-Systems /DTAG? RTX needs this information asap since it will determine what is the best location to install the core of the system. Thanks, jose From: José Soler Sent: 27 August 2008 17:18 To: 'jsr(a)rtx.com'; 'dvi(a)rtx.com'; 'mbd(a)rtx.com'; 'cto(a)rtx.com'; Claus Futtrup; 'Stig Skaugvoll'; Jonathan Schutte Cc: 'elias(a)emlacie.com.br' Subject: [RTX] Minutes technical meeting 270808- GoIPInt premises Participants: - RTX: Dalia Vitkauskaite, Morten Bundgaard, Carsten Toft, (Jørgen S Rosenkilde). (Elias + Palle in conference) - GoIPInt: Claus Futtrup, José Soler, (Peter Futtrup, Jonathan Schutte, Stig Skaugvoll) Action points and responsible company (RTX / GoIP) person listed (initials) below. è GoIPInt to request DT availability and location of POP (for international termination) in Brasil and forward to RTX (AP1: js/cf). è Number Portability issues: RTX to provide to GoIPInt information regarding regulative conditions in Brasil and inter operator procedures for number portability .(AP2:Elias) è Collect Call: RTX to provide GoIPInt information of how the Collect Call service is implemented in Maraba for the Nortelpa/Midas solution. (AP3: Elias). Additionally, GoIPInt to provide RTX with details of necessary conditions/requirements to implement service in GoIPInt platform (AP4: js/cf) è Billing: RTX to provide deeper details of interface with Servcom billing system.(AP5: Elias). Additionally GoIP to send details/example of feeds from GoIPInt rating system towards a likely Billing system. (AP6: cf). è Test setup (Anatel's): GoIP to provide feedback by 28th August regarding possibility of server purchase in Dk, preconfiguration and shipping to Brasil (Canaa) together with travelling person and proforma bill (for customs) (AP7: ss/jsc). è RTX to send to GoIPInt details of HTTP-based interface for customer creation in HLR (AP8: dvi). è Other services where mentioned in call with Elias (i.e. calling card like top-up functionality). A complete description of the features desired in the system needs to be settled-agreed as base for discussion and to realistically estimate implementation costs and schedules. GoIPInt to present a complete functionality / features description of the system (AP9: ss/ jsc). RTX to provide a complete description of desired functionality: call-related, administration operation related, customer access related, etc. (AP10: cto) è GoIP to confirm available voice codecs in DEC bases. GoIP platform can work with the following unlicensed ones: G711, G726, GSM, iLBC, Speex, and the following licensed ones: G723, G729.(AP11:dvi) è It was confirmed after discussion that local gateway redundancy will NOT be part of the solution if it is not a legal/regulative requirement. Alternative centralized redundant solutions might be considered. RTX to confirm this. (AP12: elias/cto) è RTX and GoIPInt to perform further tests on signaling for different cases during week 36. (AP13: cf/dvi/mbd) No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.9/1636 - Release Date: 26/08/2008 19:09 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.9/1636 - Release Date: 26/08/2008 19:09 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.10/1638 - Release Date: 27/08/2008 19:06 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.12/1640 - Release Date: 28/08/2008 18:58

1 0

Hafiz Pussah recommends FastWeb to find scholarship money
by hafizpus＠yahoo.com 29 Aug '08

29 Aug '08

Hey! Hafiz Pussah knows you?re looking for money for college and wants you to find it on FastWeb. What can you get from becoming a member of FastWeb? ? Find scholarships just for you ? Search for colleges ? Get financial aid advice ? Locate internship and part-time job opportunities FastWeb has a ton of other great tools. And the best part? It?s all free. Visit FastWeb to find cash for college today! http://www.fastweb.com/ib/vmremuinew-1f/DWGTXBLGMJ4O -- FastWeb respects your online time and privacy. If you do not wish to receive future emailed opportunities to join FastWeb, simply click on the following link to let us know: http://www.fastweb.com/o3/vmremuinew/FREERADIUS%2dUSERS%40LISTS%2eFREERADIU… Copyright 2008 FastWeb, LLC All rights reserved. FastWeb, LLC, 444 N. Michigan Avenue, Suite 3000, Chicago, IL 60611

1 0

Fwd: MSCHAP module returns OK, authentication fails..
by James Yale 29 Aug '08

29 Aug '08

>> EAP-MSCHAPV2: Invalid authenticator response in success request > > Upgrade Samba. If you're not using at least 3.2.1, upgrade to that. > >> http://jim.geezas.com/stuff/radius-debugging/ *-failure.log), the >> message authenticator does seem to be invalid, > > No. eapol_test is saying that the MSCHAP response is invalid. > >> Has anyone seen this problem before, or am I looking in the wrong place? > > Others have seen exactly the same thing in the past weeks. Upgrading > Samba fixed it. > > Alan DeKok. > - I've upgraded to the testing version of samba for FC9, 3.2.1 which unfortunately didn't resolve the issue - still getting the 'Invalid authenticator response in success request' problem. jim@florence:~$ /usr/sbin/winbindd -V Version 3.2.1-18.fc9 Is there a known good version of Samba, or could the problem lie elsewhere? I've included the server output from the MSCHAP module trying the authentication for reference. +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for jim2 with NT-Password expand: --username=%{mschap:User-Name:-None} -> --username=jim2 rlm_mschap: No NT-Domain was found in the User-Name. expand: --domain=%{mschap:NT-Domain:-CURRICULUM} -> --domain=CURRICULUM mschap2: ee expand: --challenge=%{mschap:Challenge:-00} -> --challenge=c48639cf15fbe669 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0b4b18f4afaa63f4147e4250c8c907f3248ba67e7ee976a0 Exec-Program output: NT_KEY: 1847BA6C5854C261219362F18B4923E4 Exec-Program-Wait: plaintext: NT_KEY: 1847BA6C5854C261219362F18B4923E4 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d39313431454342383036383441464346413533303131384242454445363435373037323941383039 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40622130416a3b8e9b04d3d502f1f161 PEAP: Processing from tunneled session code 0xa13a0d0 11 EAP-Message = 0x010800331a0307002e533d39313431454342383036383441464346413533303131384242454445363435373037323941383039 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40622130416a3b8e9b04d3d502f1f161 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 7 to 127.0.0.1 port 35048 EAP-Message = 0x0108005b19001703010050a25e02bf01a7f7f6ca355df2cec89e3c2508b47b180497a05669336d0ac233f14b38ed612205594956295de1abbda4f5e4f8f03753d57524e01a42e5d29cabcf7996143335211d76065176783a7bb8ec Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5899ddd95f91c4e2ae146201bfc3a1be Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 0 with timestamp +5 Cleaning up request 1 ID 1 with timestamp +5 Cleaning up request 2 ID 2 with timestamp +5 Cleaning up request 3 ID 3 with timestamp +5 Cleaning up request 4 ID 4 with timestamp +5 Cleaning up request 5 ID 5 with timestamp +5 Cleaning up request 6 ID 6 with timestamp +5 Cleaning up request 7 ID 7 with timestamp +5 Ready to process requests. Thanks, James

3 3