- Freeradius-Users - lists.freeradius.org

Re: Load testing tool recommendation
by Anders Holm 14 May '08

14 May '08

Hmm.. I *am* referencing the radius server with FQDN ... Lemme flip that switch and see what I get to play with ... Good catch .. It's letting me ship some more packets through per second.. no final figures yet, but starting to hit 5k pkts/sec, though the radius server is still not sweating nearly as much as I want it to (sitting between 12-15% CPU, and client system is maxing itself out trying to keep up, and the clients is a bigger machine than the server) ... //anders ----- Original Message ----- From: "A L M Buxey" <A.L.M.Buxey(a)lboro.ac.uk> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, May 13, 2008 2:55:56 PM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: Load testing tool recommendation Hi, > Nope, no wireless involved. > > Good thought though! :) its not doing DNS lookups each time is it? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Re: A way to use LDAP only for authentication
by Alan DeKok 14 May '08

14 May '08

Konstantin KABASSANOV wrote: > Using PEAP/mschapv2 with openldap through freeradius, I'd like to know if > there is a way to allow all users in the authorize section of radiusd.conf > (without doing ldap requests) and make the ldap request only in the > authenticate section. It is useful for instance to avoid multiple ldap > requests during authorization process in particular when a number of > radius-request/challenges are exchanged between Access points and radius > server. In 2.0.4, you can run the LDAP module only for the inner tunneled request. See raddb/sites-enabled/inner-tunnel. Alan DeKok.

1 0

rpmbuild error freeradius-client-1.1.6.tar.bz2
by city perl 14 May '08

14 May '08

Hello Fedora core 5 rpm -Uvh freeradius-client-1.1.6-0.i386.rpm /var/tmp/rpm-tmp.72946: line 1: fg: no job control error: %post(freeradius-client-1.1.6-0.i386) scriptlet failed, exit status 1 rpm -e freeradius-client /var/tmp/rpm-tmp.45576: line 1: fg: no job control error: %postun(freeradius-client-1.1.6-0.i386) scriptlet failed, exit status 1 --------------------------------------------- radiusclient.spec 1.rename freeradius-client-snapshot freeradius-client 2.marking #%doc doc/* BUGS COPYRIGHT README README.radexample rpmbuild -bb radiusclient.spec --------------------------------------------- Summary: FreeRADIUS Client Software Name: freeradius-client Version: 1.1.6 Release: 0 Obsoletes: radiusc radiusclient radiusclient-ng Group: Productivity/Networking/Radius/Clients License: Artistic License Packager: Peter Nixon URL: http://www.freeradius.org/ Source0: %{name}-%{version}.tar.bz2 BuildRoot: %{_tmppath}/%{name}-%{version}-build Prefix: %{_prefix} Requires: %{name}-libs = %{version}-%{release} %description A portable, easy-to-use and standard compliant library suitable for developing free and commercial software that need support for a RADIUS protocol (RFCs 2128 and 2139). %package libs Summary: A portable, easy-to-use and standard compliant library for RADIUS protocol (RFCs 2128 and 2139). Group: Development/Libraries %description libs The package contains the shared library of FreeRADIUS Client %package devel Summary: Header files, libraries and development documentation for %{name}. Group: Development/Libraries Requires: %{name}-libs = %{version}-%{release} %description devel This package contains the header files, static libraries and development documentation for %{name}. You need to install %{name}-devel if you want to develop applications using %{name}. %if 0%{?suse_version} > 930 %debug_package %endif %prep %setup -q %build %define localstatedir /var/lib rm missing %if 0%{?suse_version} > 900 %{suse_update_config -f} %endif libtoolize --force aclocal automake -ac autoconf CFLAGS="$RPM_OPT_FLAGS -Wall" \ CXXFLAGS="$RPM_OPT_FLAGS -Wall -fmessage-length=0" \ %configure \ --localstatedir=%{localstatedir} \ --enable-shadow \ --with-secure-path make %install [ "%{buildroot}" != "/" ] && rm -rf %{buildroot} make "DESTDIR=$RPM_BUILD_ROOT" install rm -f $RPM_BUILD_ROOT/%{_sbindir}/login.radius rm -f login.radius/Makefile* rm -f login.radius/migs/Makefile* rm -f %{buildroot}%{_libdir}/*.la %post %{run_ldconfig} %postun %{run_ldconfig} %clean [ "%{buildroot}" != "/" ] && rm -rf %{buildroot} %files %defattr(-, root, root) #%doc doc/* BUGS COPYRIGHT README README.radexample %dir %{_sysconfdir}/radiusclient %{_sysconfdir}/radiusclient/dictionary %{_sysconfdir}/radiusclient/dictionary.* %config(noreplace) %{_sysconfdir}/radiusclient/radiusclient.conf %config(noreplace) %{_sysconfdir}/radiusclient/issue %config(noreplace) %{_sysconfdir}/radiusclient/port-id-map %config(noreplace) %{_sysconfdir}/radiusclient/servers %{_sbindir}/* %files libs %defattr(-, root, root) %{_libdir}/*.so.* %{_libdir}/*.so %files devel %defattr(-, root, root) %{_libdir}/*.a %{_includedir}/*.h %changelog * Sun Jan 06 2008 Peter Nixon - Update to match upcoming freeradius-client release * Sun Nov 19 2006 Peter Nixon - Converted spec from radiusclient package to work with FreeRADIUS Client - Split out separate -devel and -libs packages * Wed Jan 25 2006 - mls(a)suse.de - converted neededforbuild to BuildRequires * Thu Nov 18 2004 - ro(a)suse.de - fixed file list * Sat Jan 10 2004 - adrian(a)suse.de - add %%defattr * Thu Jul 31 2003 - mjancar(a)suse.cz - use %%run_ldconfig * Thu May 29 2003 - mjancar(a)suse.cz - remove Makefiles from documentation * Wed May 28 2003 - mjancar(a)suse.cz - update to 0.3.2 - move localstatedir to /var/lib - remove unpackaged files from buildroot * Wed Apr 02 2003 - ro(a)suse.de - fixed patch radiusclient-0.3.1-fix.dif * Tue Apr 02 2002 - postadal(a)suse.cz - fixed to compile with autoconf-2.53 * Wed Mar 20 2002 - postadal(a)suse.cz - secfix (VU#589523 -buffer overflow in the function that calculates message digests) - fixed login.expamle, README.SuSE * Thu Jan 10 2002 - cihlar(a)suse.cz - use %%{_libdir} * Tue Nov 06 2001 - cihlar(a)suse.cz - fixed to compile with automake 1.5 * Wed Jun 06 2001 - cihlar(a)suse.cz - fixed to compile with new libtool * Mon Mar 26 2001 - cihlar(a)suse.cz - moved whole files from dif - fixed to compile * Wed Nov 29 2000 - smid(a)suse.cz - renamed: raduisc => radiusclient * Wed May 24 2000 - cihlar(a)suse.cz - fixed to compile - added BuildRoot * Sun Apr 09 2000 - bk(a)suse.de - added suse update config macro * Mon Sep 13 1999 - bs(a)suse.de - ran old prepare_spec on spec file to switch to new prepare_spec. * Thu Jun 10 1999 - kukuk(a)suse.de - Remove %%dir for doc tree * Sun Mar 01 1998 - tmg(a)suse.de - README.SuSE again * Tue Feb 10 1998 - tmg(a)suse.de - initial spec file - fixed paths in radiusclient.conf - login.example - simplistic example login.radius script - README.SuSE

1 0

Re: A way to use LDAP only for authentication
by Ivan Kalik 13 May '08

13 May '08

Yes. List ldap only in inner-tunel. Ivan Kalik Kalik Informatika ISP Dana 13/5/2008, "Konstantin KABASSANOV" <Konstantin.Kabassanov(a)lip6.fr> piše: >Hello, > >Using PEAP/mschapv2 with openldap through freeradius, I'd like to know if >there is a way to allow all users in the authorize section of radiusd.conf >(without doing ldap requests) and make the ldap request only in the >authenticate section. It is useful for instance to avoid multiple ldap >requests during authorization process in particular when a number of >radius-request/challenges are exchanged between Access points and radius >server. > >Thanks. > >Konstantin >_____________________________________________________________________ > >Konstantin KABASSANOV >LIP6/CNRS >104, avenue du Président Kennedy, 75016 Paris, France >Phone: +33 (0) 1 44 27 71 26 Fax: +33 (0) 1 44 27 74 95 > >E-mail: konstantin(a)kabassanov.com Web: http://www.kabassanov.com >Certificate: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html >_____________________________________________________________________ > > >

1 0

error freeradius-client-1.1.6.tar.bz2
by Deep Purple 13 May '08

13 May '08

Hello Fedora core 5 rpm -Uvh freeradius-client-1.1.6-0.i386.rpm /var/tmp/rpm-tmp.72946: line 1: fg: no job control error: %post(freeradius-client-1.1.6-0.i386) scriptlet failed, exit status 1 rpm -e freeradius-client /var/tmp/rpm-tmp.45576: line 1: fg: no job control error: %postun(freeradius-client-1.1.6-0.i386) scriptlet failed, exit status 1 --------------------------------------------- radiusclient.spec 1.rename freeradius-client-snapshot freeradius-client 2.marking #%doc doc/* BUGS COPYRIGHT README README.radexample rpmbuild -bb radiusclient.spec --------------------------------------------- Summary: FreeRADIUS Client Software Name: freeradius-client Version: 1.1.6 Release: 0 Obsoletes: radiusc radiusclient radiusclient-ng Group: Productivity/Networking/Radius/Clients License: Artistic License Packager: Peter Nixon URL: http://www.freeradius.org/ Source0: %{name}-%{version}.tar.bz2 BuildRoot: %{_tmppath}/%{name}-%{version}-build Prefix: %{_prefix} Requires: %{name}-libs = %{version}-%{release} %description A portable, easy-to-use and standard compliant library suitable for developing free and commercial software that need support for a RADIUS protocol (RFCs 2128 and 2139). %package libs Summary: A portable, easy-to-use and standard compliant library for RADIUS protocol (RFCs 2128 and 2139). Group: Development/Libraries %description libs The package contains the shared library of FreeRADIUS Client %package devel Summary: Header files, libraries and development documentation for %{name}. Group: Development/Libraries Requires: %{name}-libs = %{version}-%{release} %description devel This package contains the header files, static libraries and development documentation for %{name}. You need to install %{name}-devel if you want to develop applications using %{name}. %if 0%{?suse_version} > 930 %debug_package %endif %prep %setup -q %build %define localstatedir /var/lib rm missing %if 0%{?suse_version} > 900 %{suse_update_config -f} %endif libtoolize --force aclocal automake -ac autoconf CFLAGS="$RPM_OPT_FLAGS -Wall" \ CXXFLAGS="$RPM_OPT_FLAGS -Wall -fmessage-length=0" \ %configure \ --localstatedir=%{localstatedir} \ --enable-shadow \ --with-secure-path make %install [ "%{buildroot}" != "/" ] && rm -rf %{buildroot} make "DESTDIR=$RPM_BUILD_ROOT" install rm -f $RPM_BUILD_ROOT/%{_sbindir}/login.radius rm -f login.radius/Makefile* rm -f login.radius/migs/Makefile* rm -f %{buildroot}%{_libdir}/*.la %post %{run_ldconfig} %postun %{run_ldconfig} %clean [ "%{buildroot}" != "/" ] && rm -rf %{buildroot} %files %defattr(-, root, root) #%doc doc/* BUGS COPYRIGHT README README.radexample %dir %{_sysconfdir}/radiusclient %{_sysconfdir}/radiusclient/dictionary %{_sysconfdir}/radiusclient/dictionary.* %config(noreplace) %{_sysconfdir}/radiusclient/radiusclient.conf %config(noreplace) %{_sysconfdir}/radiusclient/issue %config(noreplace) %{_sysconfdir}/radiusclient/port-id-map %config(noreplace) %{_sysconfdir}/radiusclient/servers %{_sbindir}/* %files libs %defattr(-, root, root) %{_libdir}/*.so.* %{_libdir}/*.so %files devel %defattr(-, root, root) %{_libdir}/*.a %{_includedir}/*.h %changelog * Sun Jan 06 2008 Peter Nixon - Update to match upcoming freeradius-client release * Sun Nov 19 2006 Peter Nixon - Converted spec from radiusclient package to work with FreeRADIUS Client - Split out separate -devel and -libs packages * Wed Jan 25 2006 - mls(a)suse.de - converted neededforbuild to BuildRequires * Thu Nov 18 2004 - ro(a)suse.de - fixed file list * Sat Jan 10 2004 - adrian(a)suse.de - add %%defattr * Thu Jul 31 2003 - mjancar(a)suse.cz - use %%run_ldconfig * Thu May 29 2003 - mjancar(a)suse.cz - remove Makefiles from documentation * Wed May 28 2003 - mjancar(a)suse.cz - update to 0.3.2 - move localstatedir to /var/lib - remove unpackaged files from buildroot * Wed Apr 02 2003 - ro(a)suse.de - fixed patch radiusclient-0.3.1-fix.dif * Tue Apr 02 2002 - postadal(a)suse.cz - fixed to compile with autoconf-2.53 * Wed Mar 20 2002 - postadal(a)suse.cz - secfix (VU#589523 -buffer overflow in the function that calculates message digests) - fixed login.expamle, README.SuSE * Thu Jan 10 2002 - cihlar(a)suse.cz - use %%{_libdir} * Tue Nov 06 2001 - cihlar(a)suse.cz - fixed to compile with automake 1.5 * Wed Jun 06 2001 - cihlar(a)suse.cz - fixed to compile with new libtool * Mon Mar 26 2001 - cihlar(a)suse.cz - moved whole files from dif - fixed to compile * Wed Nov 29 2000 - smid(a)suse.cz - renamed: raduisc => radiusclient * Wed May 24 2000 - cihlar(a)suse.cz - fixed to compile - added BuildRoot * Sun Apr 09 2000 - bk(a)suse.de - added suse update config macro * Mon Sep 13 1999 - bs(a)suse.de - ran old prepare_spec on spec file to switch to new prepare_spec. * Thu Jun 10 1999 - kukuk(a)suse.de - Remove %%dir for doc tree * Sun Mar 01 1998 - tmg(a)suse.de - README.SuSE again * Tue Feb 10 1998 - tmg(a)suse.de - initial spec file - fixed paths in radiusclient.conf - login.example - simplistic example login.radius script - README.SuSE ________________________________________________________ 180도 달라진 야후! 메일 - 두둥! 새로운 야후! 메일에서는 메시지를 여기저기 끌어다 놓을 수 있답니다. http://kr.content.mail.yahoo.com/cgland

1 0

A way to use LDAP only for authentication
by Konstantin KABASSANOV 13 May '08

13 May '08

Hello, Using PEAP/mschapv2 with openldap through freeradius, I'd like to know if there is a way to allow all users in the authorize section of radiusd.conf (without doing ldap requests) and make the ldap request only in the authenticate section. It is useful for instance to avoid multiple ldap requests during authorization process in particular when a number of radius-request/challenges are exchanged between Access points and radius server. Thanks. Konstantin _____________________________________________________________________ Konstantin KABASSANOV LIP6/CNRS 104, avenue du Président Kennedy, 75016 Paris, France Phone: +33 (0) 1 44 27 71 26 Fax: +33 (0) 1 44 27 74 95 E-mail: konstantin(a)kabassanov.com Web: http://www.kabassanov.com Certificate: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html _____________________________________________________________________

1 0

OpenSSL Security in Debian & Ubuntu since 2006
by Alan DeKok 13 May '08

13 May '08

If you have generated SSL certificates on Debian or Ubuntu since 2006, you should seriously consider re-creating them. http://lists.debian.org/debian-security-announce/2008/msg00152.html https://lists.ubuntu.com/archives/ubuntu-security-announce/2008-May/000705.… This applies to SSH keys, too. Alan DeKok.

2 2

stripping domain from username (for wifi authentication on Windows XP)
by Ryan Pugatch 13 May '08

13 May '08

Hello everyone, I am using freeradius to have my wifi network use my LDAP credentials for authentication. However, Windows has this glorious default setting that automatically passes the domain username and password to the radius server to authenticate for wifi access. While I can easily uncheck a box to make that behavior not happen, it would be great if I could just have radius accept those credentials. The windows domain and radius both use the same LDAP directory. The only issue is Windows sends the username as DOMAIN\\username. Is it possible to have freeradius ignore the DOMAIN\\ part of the username? Thanks in advance. Ryan Pugatch

3 4

Regarding: FreeRADIUS sending Access-Reject if no response to proxied Access-Request
by Joakim Bentholm 13 May '08

13 May '08

> Doug Hardie <bc979(a)lafn.org> wrote: >> > Why? What's so problematic about the Access-Rejects? >> >> Because the NAS will not switch over to the alternate radius server >> which is probably working properly. > > Ok... so does the proxying server mark *all* home servers as dead? > > The problem is that if the NAS is using the same RADIUS server for > other purposes, (i.e. packets which are't proxied), then it can fail > over to the backup, even though parts of the server still work... > > If there's *no* way for the server to authenticate *any* packets, > then that's reasonable grounds for pretending to be dead. Any other > partial "live" system means that your local site will have to > determine what packets to reply to, and why. > > I'm willing to add a patch where a module can mark a packet "no > reply". It's then up to you to have a site-local module to mark some > packets. But that knowing *when* to do that is up to you, and is > *very* site-specific. Adding patches to the server core to support > one site's configuration is problematic. > > Alan DeKok. Link to the thread above. http://lists.cistron.nl/pipermail/freeradius-users/2004-April/030887.html Hello, Anyone who knows if and where the patch mentioned above can be. I found this discussion thread, but I do not know where and how to find the the patch, if available. This would solve our problem with an unresponsive user resource management server accessed through a customised module in FreeRadius. FreeBSD version 6.3 FreeRADIUS Version 1.1.7 Best Regards, Joakim Bentholm

2 1

Multiple instances of attribute in tunnelled reply
by Konstantin KABASSANOV 13 May '08

13 May '08

Hi, I think that I have a similar problem when freeradius has to send Access-Accept with multiple Cisco-AVPair="ssid=..." entries. Do you think it will be fixed in the near future ? Thanks. Konstantin _____________________________________________________________________ Konstantin KABASSANOV LIP6/CNRS 104, avenue du Président Kennedy, 75016 Paris, France Phone: +33 (0) 1 44 27 71 26 Fax: +33 (0) 1 44 27 74 95 E-mail: konstantin(a)kabassanov.com Web: http://www.kabassanov.com Certificate: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html _____________________________________________________________________

1 0