- Freeradius-Users - lists.freeradius.org

postgresqlippool
by Maxim Sirenko 04 Aug '08

04 Aug '08

Hi, All! Could you answer the question on the basis of your experience? Since what version of freeradius you was successfull in using rlm_sqlippool with postgresql and what little fixes you had to do to make it work? I have 1.1.7_3 port on FreeBSD 6.2 and I'm unsuccessfull in forcing to assign an IP from sql pool rather from NAS configuration pool. In docs we encouraged to use 2.0.x to have this feature working. I cannot upgrade to 2.0.x now because my radius is under 24*7 load and I don't have spare server to test it. So I want to find out whether anyone had success with sqlippool+pgsql on 1.1.x Real successfull configs would be nice to see. Thanks. Maxim Sirenko.

4 4

No authenticate method (Auth-Type)??
by Oguzhan Kayhan 04 Aug '08

04 Aug '08

Hello, Im trying to use virtual server config for the freeradius. But i got the following error when i test the config. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user My config for the sites-enables is: ----------------------- listen { ipaddr = * port = 1821 type = auth } server one { authorize { preprocess files perl } authenticate { Auth-Type Perl { perl } } accounting { unix radutmp } session { radutmp } } server two { } client 139.179.14.250 { shortname = example-client secret = testing123 virtual_server = one } -------------------------------------- Also added the following under the modules section of radiusd.conf -------------- perl { module = /usr/local/bin/login.pl func_authenticate = authenticate func_authorize = authorize } --------------- this is the ouput of the radiusd -X. rad_recv: Access-Request packet from host 139.179.14.250 port 36926, id=31, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 139.179.14.250 NAS-Port = 10 server one { +- entering group authorize ++[preprocess] returns ok ++[files] returns noop perl_pool: item 0x88af708 asigned new request. Handled so far: 1 found interpetator at address 0x88af708 rlm_perl: Added pair User-Name = test rlm_perl: Added pair User-Password = test rlm_perl: Added pair NAS-Port = 10 rlm_perl: Added pair NAS-IP-Address = 139.179.14.250 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x88af708 ++[perl] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. } # server one Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 31 to 139.179.14.250 port 36926 PS: the same perl script works fine with single freerad config.

3 5

Freeradius proxy accounting
by Mailing List 04 Aug '08

04 Aug '08

Hi, I have freeradius (A) up and running that proxies accounting messages to another freeradius (B) . Is it possible to configure (A) in such a way that it will always will acknowedge towards the NAS even when (B) is not responding to an proxied accounting message coming from (A). Now, If (B) is down, (A) will also not respond back to the NAS and the NAS keeps on retrying. (A) is configured to put the accounting in a mysql database. Basically, I want that (A) always sends an ACK back to the NAS regardless the state of (B). Thx, Kurt

3 3

Perl_Tstack_sp_ptr
by Oguzhan Kayhan 02 Aug '08

02 Aug '08

Hello, Im trying to install a server with debian with perl module. When i enable rlm_perl i got the following error. modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/bin/login.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } freeradius: symbol lookup error: /usr/lib/perl5/auto/DBI/DBI.so: undefined symbol: Perl_Tstack_sp_ptr uname -a Linux radian 2.6.18-6-686 #1 SMP Tue Jun 17 21:31:27 UTC 2008 i686 GNU/Linux radian:/# perl -v This is perl, v5.8.8 built for i486-linux-gnu-thread-multi freeradius -v freeradius: FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Aug 1 2008 at 10:58:39 We compiled freeradius and perl again but no luck.. The problem occurs after rlm_perl loads.. if needed we can send the trace logs too. What might cause the error?

3 3

Vista Issue
by nf-vale 01 Aug '08

01 Aug '08

Alan, Do you have any news on the Vista EAP issue? For anyone having troubles with Vista there's this supplicant that works and its free: http://wire.cs.nthu.edu.tw/wire1x/ Nelson Vale

3 5

Proxy FallBack
by Marcelo Henique Cabral Ariza 01 Aug '08

01 Aug '08

Hi everybody! I am using freeradius 2.0.5, and i have a problem whith the proxy option default_fallback, my server do proxy to 3 providers and i have a default realm configured to fallback, but when home servers die the proxy set them died, but don`t do the fallback. Anyone have a sugestion? Thanks! Marcelo

1 0

RE: Pattern Matching in users file
by Garber, Neal 01 Aug '08

01 Aug '08

> You can use the "hints" file to do what you want. It does *not* say > you can only use prefix & suffix matching. I was referring to the following in the sample hints file: # Matching can take place with the the Prefix and Suffix # attributes, just like in the "users" file. # These attributes operate ONLY on the username, though. And this in the doc/README file: Customize the /etc/raddb/hints file. This file is used to give users a different login type based on a prefix/suffix of their loginname. For example, logging in as "user" may result in a rlogin session to a Unix system, and logging in as "Puser" could start a PPP session. Is there another document that describes matching on other attributes and how to add new attributes to the request. I think these paragraphs need updating. Are you saying I can do this in hints: DEFAULT Cisco-AVPair == "", My-Group := "RadioIP-MAU" DEFAULT Cisco-AVPair == "ssid=(.*)", My-Group := "Wireless %{1}" DEFAULT My-Group := "Unknown source" That is, does hints work just like the users file, except it adds any new attributes to the request? If so, this is exactly what I need! If the syntax or usage is off, can you correct me. Thanks Alan.

4 4

Re: Seek through several RADIUS severs without realms
by Alan DeKok 01 Aug '08

01 Aug '08

Ronen Kfir wrote: > I'm looking for alternative ways to differ among authenticated users, other > then realms. Groups. See "man rlm_passwd" for examples. Alan DeKok.

1 0

PEAP mschapv2 using xp native supplicant
by Ryan Setiawan H 01 Aug '08

01 Aug '08

Hi all, I'm using eap for authentication on wired connection ( using freeradius 2.0.5 and LDAP backend ), most of our clients are windows machine so there's little choice for using eap, that is eap-MD5 and PEAP mschapv2. Using EAP-MD5 there isn't any problem, the problem begin with PEAP mschapv2 the debug : ----------------------------------------------------------------- rlm_ldap: Bind was successful rlm_ldap: performing search in ou=dialup,dc=xxx,dc=com, with filter (uid=testing) rlm_ldap: checking if remote access for testing is allowed by uid rlm_ldap: Added User-Password = Testing10 in check items --------------------------------------------------------------- clearly freeradius can see the password and also it clear text :) below i also add samba schema that contain LM and NT password --------------------------------------------------------------- rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute radiusLoginTime as RADIUS attribute Login-Time == "Wk0800-1800" rlm_ldap: LDAP attribute ntPassword as RADIUS attribute NT-Password == 0x54657374696e6731 rlm_ldap: LDAP attribute lmPassword as RADIUS attribute LM-Password == 0x54657374696e6731 rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusTunnelPrivateGroupId as RADIUS attribute Tunnel-Private-Group-Id:0 = "101" rlm_ldap: LDAP attribute radiusTunnelMediumType as RADIUS attribute Tunnel-Medium-Type:0 = IEEE-802 rlm_ldap: LDAP attribute radiusTunnelType as RADIUS attribute Tunnel-Type:0 = VLAN rlm_ldap: LDAP attribute radiusFramedProtocol as RADIUS attribute Framed-Protocol = PPP rlm_ldap: LDAP attribute radiusServiceType as RADIUS attribute Service-Type = Framed-User rlm_ldap: user testing authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ------------------------------------------------------------------- mschap module say no clear text pasword and also can't create LM and NT password ------------------------------------------------------------------- +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testing with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [testing/<via Auth-Type = EAP>] (from client dotix port 0) PEAP: Tunneled authentication was rejected. anyone can help?Thanks Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

3 3

Are there more logs than "radiusd -X" ??
by Cristian Novac 01 Aug '08

01 Aug '08

Hello all, May you tell me if there is a more detailed log than what I get while running freeradius with -X argument ? I would like to see more about what caused this error: rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert read:fatal:decrypt error TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:1409441B:SSL routines:SSL3_READ_BYTES:tlsv1 alert decrypt error rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [{3}0017c4274f2c(a)asb.com/<via Auth-Type = EAP>] (from client localhost port 0 cli 00-17-C4-27-4F-2C) Delaying reject of request 4 for 1 seconds Thank you! BR, Cristian Novac.

2 2