- Freeradius-Users - lists.freeradius.org

Perl_Tstack_sp_ptr
by Oguzhan Kayhan 02 Aug '08

02 Aug '08

Hello, Im trying to install a server with debian with perl module. When i enable rlm_perl i got the following error. modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/bin/login.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } freeradius: symbol lookup error: /usr/lib/perl5/auto/DBI/DBI.so: undefined symbol: Perl_Tstack_sp_ptr uname -a Linux radian 2.6.18-6-686 #1 SMP Tue Jun 17 21:31:27 UTC 2008 i686 GNU/Linux radian:/# perl -v This is perl, v5.8.8 built for i486-linux-gnu-thread-multi freeradius -v freeradius: FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Aug 1 2008 at 10:58:39 We compiled freeradius and perl again but no luck.. The problem occurs after rlm_perl loads.. if needed we can send the trace logs too. What might cause the error?

3 3

Vista Issue
by nf-vale 01 Aug '08

01 Aug '08

Alan, Do you have any news on the Vista EAP issue? For anyone having troubles with Vista there's this supplicant that works and its free: http://wire.cs.nthu.edu.tw/wire1x/ Nelson Vale

3 5

Proxy FallBack
by Marcelo Henique Cabral Ariza 01 Aug '08

01 Aug '08

Hi everybody! I am using freeradius 2.0.5, and i have a problem whith the proxy option default_fallback, my server do proxy to 3 providers and i have a default realm configured to fallback, but when home servers die the proxy set them died, but don`t do the fallback. Anyone have a sugestion? Thanks! Marcelo

1 0

RE: Pattern Matching in users file
by Garber, Neal 01 Aug '08

01 Aug '08

> You can use the "hints" file to do what you want. It does *not* say > you can only use prefix & suffix matching. I was referring to the following in the sample hints file: # Matching can take place with the the Prefix and Suffix # attributes, just like in the "users" file. # These attributes operate ONLY on the username, though. And this in the doc/README file: Customize the /etc/raddb/hints file. This file is used to give users a different login type based on a prefix/suffix of their loginname. For example, logging in as "user" may result in a rlogin session to a Unix system, and logging in as "Puser" could start a PPP session. Is there another document that describes matching on other attributes and how to add new attributes to the request. I think these paragraphs need updating. Are you saying I can do this in hints: DEFAULT Cisco-AVPair == "", My-Group := "RadioIP-MAU" DEFAULT Cisco-AVPair == "ssid=(.*)", My-Group := "Wireless %{1}" DEFAULT My-Group := "Unknown source" That is, does hints work just like the users file, except it adds any new attributes to the request? If so, this is exactly what I need! If the syntax or usage is off, can you correct me. Thanks Alan.

4 4

Re: Seek through several RADIUS severs without realms
by Alan DeKok 01 Aug '08

01 Aug '08

Ronen Kfir wrote: > I'm looking for alternative ways to differ among authenticated users, other > then realms. Groups. See "man rlm_passwd" for examples. Alan DeKok.

1 0

PEAP mschapv2 using xp native supplicant
by Ryan Setiawan H 01 Aug '08

01 Aug '08

Hi all, I'm using eap for authentication on wired connection ( using freeradius 2.0.5 and LDAP backend ), most of our clients are windows machine so there's little choice for using eap, that is eap-MD5 and PEAP mschapv2. Using EAP-MD5 there isn't any problem, the problem begin with PEAP mschapv2 the debug : ----------------------------------------------------------------- rlm_ldap: Bind was successful rlm_ldap: performing search in ou=dialup,dc=xxx,dc=com, with filter (uid=testing) rlm_ldap: checking if remote access for testing is allowed by uid rlm_ldap: Added User-Password = Testing10 in check items --------------------------------------------------------------- clearly freeradius can see the password and also it clear text :) below i also add samba schema that contain LM and NT password --------------------------------------------------------------- rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute radiusLoginTime as RADIUS attribute Login-Time == "Wk0800-1800" rlm_ldap: LDAP attribute ntPassword as RADIUS attribute NT-Password == 0x54657374696e6731 rlm_ldap: LDAP attribute lmPassword as RADIUS attribute LM-Password == 0x54657374696e6731 rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute radiusTunnelPrivateGroupId as RADIUS attribute Tunnel-Private-Group-Id:0 = "101" rlm_ldap: LDAP attribute radiusTunnelMediumType as RADIUS attribute Tunnel-Medium-Type:0 = IEEE-802 rlm_ldap: LDAP attribute radiusTunnelType as RADIUS attribute Tunnel-Type:0 = VLAN rlm_ldap: LDAP attribute radiusFramedProtocol as RADIUS attribute Framed-Protocol = PPP rlm_ldap: LDAP attribute radiusServiceType as RADIUS attribute Service-Type = Framed-User rlm_ldap: user testing authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ------------------------------------------------------------------- mschap module say no clear text pasword and also can't create LM and NT password ------------------------------------------------------------------- +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testing with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [testing/<via Auth-Type = EAP>] (from client dotix port 0) PEAP: Tunneled authentication was rejected. anyone can help?Thanks Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

3 3

Are there more logs than "radiusd -X" ??
by Cristian Novac 01 Aug '08

01 Aug '08

Hello all, May you tell me if there is a more detailed log than what I get while running freeradius with -X argument ? I would like to see more about what caused this error: rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert read:fatal:decrypt error TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:1409441B:SSL routines:SSL3_READ_BYTES:tlsv1 alert decrypt error rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [{3}0017c4274f2c(a)asb.com/<via Auth-Type = EAP>] (from client localhost port 0 cli 00-17-C4-27-4F-2C) Delaying reject of request 4 for 1 seconds Thank you! BR, Cristian Novac.

2 2

Jeff W Phillips/BII is out of the office.
by jwphillips＠Beckman.com 01 Aug '08

01 Aug '08

I will be out of the office starting 07/31/2008 and will not return until 08/11/2008. I will respond to your message when I return. The server made the following annotations --------------------------------------------------------------------------------- This message contains information that may be privileged or confidential and is the property of Beckman Coulter, Inc. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. ---------------------------------------------------------------------------------

1 0

Proxy default-fallback
by Marcelo Henique Cabral Ariza 31 Jul '08

31 Jul '08

Hi everybody! I am using freeradius 2.0.5, and i had a problem whith the proxy option default_fallback, my server do proxy to 3 providers and i have a default realm configured to fallback, but when home servers die the proxy set them died, but don`t do the fallback. Anyone have a sugestion? Thanks! Marcelo

1 0

EAP-MSChapV2 Question
by Garber, Neal 31 Jul '08

31 Jul '08

Is it possible to use PEAP/EAP-MSChapV2 (e.g., from a WinXP supplicant) and authenticate with a local user (i.e., defined in the "users" file with a Cleartext-Password). I'm thinking this isn't supported, but I thought I'd ask to be sure.. Thanks..

3 6