- Freeradius-Users - lists.freeradius.org

2.0.3 - sites-enabled/inner-tunnel and sites-available/inner-tunnel
by David Wood 18 Mar '08

18 Mar '08

Hi there, I'm working on updating the FreeBSD net/freeradius2 port to 2.0.3. As always, this makes me scrutinise the changes between versions. In 2.0.3, raddb/Makefile now creates a for sites-enabled/inner-tunnel. However, sites-available/inner-tunnel, the destination of that link, isn't installed because it has been omitted from the definition of FILES in raddb/Makefile. Is this a mistake? If sites-available/inner-tunnel has been mistakenly omitted from FILES in raddb/Makefile, what about sites-available/copy-acct-to-home-server, sites-available/proxy-inner-tunnel, sites-available/buffered-sql and sites-available/vmps? Should they all be in FILES as well? If there's a problem here, I'll patch it in the FreeBSD port in anticipation of a FreeRADIUS fix in 2.0.4. Best wishes, David -- David Wood david(a)wood2.org.uk

2 1

Help me please (about freeradius+openldap+nas)
by Koko Kurniawan 18 Mar '08

18 Mar '08

i have trouble in configuration RADIUS for wireless LAN. NAS ( access point) never send User-Password to my Radius server. Can you tell me why it could be happened?? i try to use default configuration ( from freeradius), but itś still not working. i will give you my radiusd.conf and log file from radius server. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Freeradius + openldap + 802.1x
by Fabio Silva 17 Mar '08

17 Mar '08

Hi all, does someone have a howto about how to configure it?? I have already read this link http://wiki.freeradius.org/index.php/Rlm_ldap but i need some more information... I know that i must use the radius schema, its already configured in my slapd.conf i created a user with this ldif sample.. dn: cn=test,ou=users,dc=radius,dc=local objectClass: inetOrgPerson objectclass: radiusprofile objectClass: top givenName: test cn: teste uid: test I configured the clients.conf with the network that i want to use.. client 192.168.2.0/24 { secret = secret123 shortname = test } What else is needed to configure it? Someone help me? Regards, -- Fabio S. Silva Mail: fssilva(a)gmail.com

1 0

OT:securew2 problem with Vista
by Sergio Belkin 17 Mar '08

17 Mar '08

Hi, I was using with no problem securew2 3.3.3. on Windows XP but I have problems with laptops with Windows Vista, I installed the software and configured wireless network settings but login dialog box never appears, always the "fine" vista native box does it instead... Please, if someone is using this software and could get working Vista, tell me how you did it. Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 5

Rewriting Attributes with Freeradius
by mrhotstandby＠gmail.com 17 Mar '08

17 Mar '08

Hi there, i looked around and found nothing which really helped, so i'll ask you :) I want my freeradius to rewrite the vlan attributes for cetrain clients. Setup is like having all users in my ldap, with vlan etc. and all is working fine so far. Now i have an office which has other vlans due to an migration than the main office. Now i want my vlan IDs rewritten by freeradius for that office. >From what i have read, i can do it with rlm_perl or maybe with rlm_attr_rewrite, but i didn't found anything about how exactly... If someone could point me to a doc or so, would be really nice. Thanksalot! (especially for the freeradius itself :)

3 9

ntlm_auth
by Dean, Barry 17 Mar '08

17 Mar '08

I know this is not strictly a FreeRADIUS problem, but I am betting someone on this list has been here and got the tee shirt! I have joined my two RADIUS servers (FreeRADIUS 2.0.2, Solaris 10 x86, winbindd 3.0.25a) to our AD domain with the "net join" command. This worked (eventually!). Now when I test "ntlm_auth" I get the following odd goings on: Scenario A: Works Type: ntlm_auth --username=USER --password=PASSWORD --domain=DOMAIN Result: NT_STATUS_OK: Success (0x0) Scenario B: FAILS Type: ntlm_auth --username=USER --domain=DOMAIN password: <PASSWORD> Result: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) What's different about the password handling between A and B? The upshot is that the command issued by FreeRADIUS: ntlm_auth = "/usr/sfw/bin/ntlm_auth --request-nt-key --username= %{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} -- nt-response=%{mschap:NT-Response:-00}" Also fails. So my MSCHAPv2 auth is now broken. This worked with our Test AD environment fine. I am told the only difference between test/production is: 1) Production is in "native mode" 2) Production supports logins using both "USER\DOMAIN" and "USER@DOMAIN" forms. If the answer to my problem is "As the Samba list", I'll pop over there! Thanks in advance. --------------- Barry Dean Networks Team

1 0

Instability with 1.1.7 and Alcatel Wifi controllers
by Fabio Pedretti 17 Mar '08

17 Mar '08

I am using freeradius 1.1.7 at my University since some time and never had any problem. I recently added two Alcatel controllers (Alcatel 6000 and 4302) with their APs. Since that I noticed that freeradius sometimes (about once every week) hangs with 100% cpu usage or crashes after similar messages: Fri Mar 14 08:23:16 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Fri Mar 14 08:23:16 2008 : Auth: Login incorrect: [33505@students] (from client SF-alcatel-4302 port 1 cli 001302065FE2) Fri Mar 14 08:43:35 2008 : Auth: Login OK: [testpap] (from client alcatel-ext port 0 cli 000000000000) Fri Mar 14 08:51:26 2008 : Error: Discarding duplicate request from client SF-alcatel-4302:32794 - ID: 25 due to unfinished request 1155 or Tue Feb 26 09:38:46 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Tue Feb 26 09:38:46 2008 : Auth: Login incorrect: [host/fabry-722333783] (from client SC-alcatel-6000 port 1 cli 00130287CBCD) Tue Feb 26 09:39:57 2008 : Info: rlm_eap_mschapv2: Issuing Challenge Tue Feb 26 09:40:07 2008 : Error: Discarding duplicate request from client SC-alcatel-6000:32794 - ID: 85 due to unfinished request 2143 I am using a selfcompiled freeradius 1.1.7 deb package on a 64 bit Ubuntu 6.06 and I am using mysql and ldap backends. Have someone idea on what can be the problem? I'll try to compile with --enable-developer if core dumps are needed. Thanks, Fabio

3 2

FreeRadius 2.0.2
by srdjan mish 17 Mar '08

17 Mar '08

Hi, i am new, so let's go.... I have freeradius on 1 machine - ver 2.0.1-pre (radiusd -v) I need to install radius to another machine... I used SuSE repo, and it was installed succesfully.. 1. I cannot start it: it says that there is a problem with eap: Failed to link to module 'rlm_eap': libfreeradius-eap-2.0.2.so: cannot open shared object file: No Such File or Directory 2. I checked, libdir = /usr/lib/freeradius is OK, and it contains that file... 3. If i turn off eap it starts, but I get error on authorize start: modsingle[authorize]: calling chap (rlm_chap) for request 0 - Segmentation fault I think that server is not finding lib files at all... Why Please, help... Best Regards...

2 1

FreeRADIUS Server Version 2.0.3 has been released
by Alan T DeKok 17 Mar '08

17 Mar '08

There are a number of bug fixes, and a few small feature improvements. FreeRADIUS 2.0.3 ; $Date: 2008/03/14 08:44:24 $ , urgency=medium Feature improvements * Updated raddb/certs/ca.cnf with extensions to allow ca.der to be imported as a CA on Symbian and Windows Mobile devices. Closes bug #524 * Enable multiple matches in "hints" via Fall-Through = Yes. Closes bug #477 * Added preliminary SQLite driver, contibuted by Apple. Untested, with no sample configuration. This address bug #470. * Updated logging sub-system so that log messages from libfreeradius can go to the log file, and not stdout. * Added dictionary.rfc5176 * EAP module now checks for instance name, and uses that for authentication. This avoids the need to set Auth-Type when there are multiple instances of the EAP module. * Added Module-Return-Code attribute, which contains the value returned by the previous module (ok/fail/update/etc.) Bug fixes * Corrected typos in rlm_dbm. Closes bugs #521 and #522. * Detail file "listen" sections now work much better. * Don't allow old "log_*" to over-ride new format. Closes bug #525 * Initialize allocated memory in Oracle SQL driver. This fixes occasional crashes on some systems. Closes bug #518 * Call correct function in rlm_protocol_filter. This enables the module to build. Closes bug #512. * Added deprecated flag to build for rlm_krb5. This allows it to run on 64-bit systems. Closes bug #491 * Corrected error message when parsing invalid configurations so it doesn't crash. Closes bug #527 * Fix handling of timeouts in rlm_ldap that affected 64-bit systems. * Handle $INCLUDE's in "instantiate" section. Closes #528. * Format updates to "man" pages from Stephen Gran.

2 1

Login anoymous?
by Sergio Belkin 17 Mar '08

17 Mar '08

Hi, I am radius 2.0.2 that is working fine, I am using EAP with TTLS. I found a line that it worried a bit in the logs: Auth: Login OK: [whateveruser-1] Auth: Login OK: [whateveruser-2] Auth: Login OK: [whateveruser-so-on] Auth: Login OK: [anonymous] Why I get anonymous? (Users are authenticated against a LDAP server) That use_tunneled_reply=no has to do with it? Should I turn on yes? Is it a security risk? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 1