- Freeradius-Users - lists.freeradius.org

virtual server configuration
by usawebbox＠fastmail.fm 11 Mar '08

11 Mar '08

>> I want to run two virtual servers on different ports, where one server >> allows PEAP-MSCHAPV2 and the other doesn't. It seems that only one >> eap.conf can be used. > > No. You can have multiple instances of the EAP module, just like >anything else: > > eap foo { > ... > } > > eap bar { > ... > } > >> I can see how to separate the Authorize and >> Authenticate sections, but I haven't seen any documentation on the >> syntax to select or reject auth types - let alone individual EAP types - >> within that file. I tried to make blocks for each server within >> eap.conf, but it didn't work. Is there a doc on the details of this >> feature, or some good examples online. > > Configure two different eap modules. Then refer to "foo" or "bar", >and not 'eap". The problem will solve itself. > > Alan DeKok. I was stuck for a long while. I created two modules, eap_main and eap_gtc. My server1 and server2 virtual servers referred to each one respectively. The server would start, but authentication would fail: auth: type "EAP" WARNING: Unknown value specified for Auth-Type. The problem was solved when I changed my authenticate sections, adding: Auth-Type EAP { eap_main } the default authenticate just had an unqualified 'eap' line. I'm not sure why it's required after I virtualize. I'm still having trouble with the eap_gtc section, because when I remove TLS or empty it or try to return reject, the server won't start. Is removing the section the right way to not support an eap type on one virtual server? Thanks for the reply. It was helpful. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - One of many happy users: http://www.fastmail.fm/docs/quotes.html

2 1

Problems with 1.0.6-2.0.1 connecting to OpenLDAP 2.3.33
by Zach Lowry 10 Mar '08

10 Mar '08

I'm running FreeRadius 2.0.1 on OpenBSD 4.2 on sparc64. I've also tried versions 1.0.6 and 1.1.6. I'm using OpenLDAP 2.3.33 with rlm_ldap. It works for the first request, then returns the following: From FreeRadius: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 2362, id=66, length=56 User-Name = "zach" User-Password = "*****" NAS-IP-Address = 192.168.2.11 NAS-Port = 1812 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "zach", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for zach WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=zach) expand: o=zachlowry.net,c=US -> o=zachlowry.net,c=US rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=zachlowry.net,c=US, with filter (uid=zach) rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [zach/*****] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> zach attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 66 to 127.0.0.1 port 2362 Waking up in 4.9 seconds. Cleaning up request 2 ID 66 with timestamp +113 Ready to process requests. From OpenLDAP: Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=4 SRCH base="o=zachlowry.net,c=US" scope=2 deref=0 filter="(uid=zach)" Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=4 SRCH attr=radiusNASIpAddress radiusExpiration acctFlags sambaNtPassword sambaLmPassword ntPassword lmPassword radiusCallingStationId radiusCalledStationId radiusSimultaneousUse radiusAuthType radiusCheckItem radiusReplyMessage radiusLoginLATPort radiusPortLimit radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork radiusFramedAppleTalkLink radiusLoginLATGroup radiusLoginLATNode radiusLoginLATService radiusTerminationAction radiusIdleTimeout radiusSessionTimeout radiusClass radiusFramedIPXNetwork radiusCallbackId Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=4 SRCH attr=radiusCallbackNumber radiusLoginTCPPort radiusLoginService radiusLoginIPHost radiusFramedCompression radiusFramedMTU radiusFilterId radiusFramedRouting radiusFramedRoute radiusFramedIPNetmask radiusFramedIPAddress radiusFramedProtocol radiusServiceType radiusReplyItem userPassword Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 1 10:25:01 tweedledum slapd[9985]: conn=8483 op=5 ABANDON msg=5 I can't find where the ABANDON is sent to the LDAP server. The "increase the timeout" error is found easily enough in rlm_ldap.c, but I can't figure out what timeout to increase. I think there's a deeper issue afoot, however. Thanks, --Zach

2 11

Re: is it possible: PEAP and TTLS on one SSID?
by William Bulley 10 Mar '08

10 Mar '08

Much appreciate your reply. According to A.L.M.Buxey(a)lboro.ac.uk: > > > For Windows supplicants, we will use PEAPv0/MS-CHAPv2. > > > > For non-Windows supplicants, we would use EAP/TTLS and > > MD5 as the inner method. > > > > I am confused as to how to configure FreeRADIUS 2.0.1 > > to accomplish this simultaneous behaviour. What causes > > me to be confused is this directive in the EAP module: > > > > default_eap_type = peap > > > > which could equally be this directive: > > > > default_eap_type = ttls > > > > but not at the same time since there can be only one > > default_eap_type (hence the word "default"). Is this > > even possible? And, if yes, why then does FreeRADIUS > > have the default_eap_type configuration item? Thanks. > > its causes no problem - just set the default type to be the one > you'll see most(!) - the daemon is quite happy at recognising > the other types that get thrown at it - be it TTLS, LEAP etc Thanks! Regards, web... -- William Bulley Email: web(a)umich.edu

1 0

is it possible: PEAP and TTLS on one SSID?
by William Bulley 10 Mar '08

10 Mar '08

For Windows supplicants, we will use PEAPv0/MS-CHAPv2. For non-Windows supplicants, we would use EAP/TTLS and MD5 as the inner method. I am confused as to how to configure FreeRADIUS 2.0.1 to accomplish this simultaneous behaviour. What causes me to be confused is this directive in the EAP module: default_eap_type = peap which could equally be this directive: default_eap_type = ttls but not at the same time since there can be only one default_eap_type (hence the word "default"). Is this even possible? And, if yes, why then does FreeRADIUS have the default_eap_type configuration item? Thanks. Regards, web... -- William Bulley Email: web(a)umich.edu

3 2

mod_auth_radius
by Charnjit Sidhu 10 Mar '08

10 Mar '08

Help, Not sure wether this is the right place to email an issue. I have configured mod_auth_radius to work on my apache 2 webserver as a client, the authentication works with the Radius Server, however after authentication a blank page is displayed and the only error I get in my error_log is "exit signal Segmentation fault after authentication" I'm pulling my hair out, I have tried it on two different web servers, one Redhat Linux and the other Centos. I know the authentication is working as an error is displayed if I enter wrong user credentials. I have followed your online instruction's, to configure my httpd.conf and .htaccess. Can anyone help Charnjit Charnjit Sidhu Computing Officer Birmingham University Imaging Centre School of Psychology University of Birmingham Tel: +44 (0)121 4143857 E-mail: c.sidhu(a)bham.ac.uk <mailto:c.sidhu@bham.ac.uk>

4 6

virtual server configuration
by usawebbox＠fastmail.fm 09 Mar '08

09 Mar '08

I want to run two virtual servers on different ports, where one server allows PEAP-MSCHAPV2 and the other doesn't. It seems that only one eap.conf can be used. I can see how to separate the Authorize and Authenticate sections, but I haven't seen any documentation on the syntax to select or reject auth types - let alone individual EAP types - within that file. I tried to make blocks for each server within eap.conf, but it didn't work. Is there a doc on the details of this feature, or some good examples online. I could solve the problem by running two instances and changing the global paths, but I'd like to use the new 2.0 feature if it is intended for this purpose. -- usawebbox(a)fastmail.fm -- http://www.fastmail.fm - Access all of your messages and folders wherever you are

2 1

Problems with using Customize table schema
by johnson elangbam 08 Mar '08

08 Mar '08

hi, I've been asking for the same questions from the past few days about using my customized table schema and executing stored procedures in Ms Sql 2000 with free radius server 2.0, but I didn't find the exact solution till now. I've tried all the alternatives that is replied in the Maling list by Ivan Kalik, Alan Dekok and some other guys, unfortunately my requirements doesn't match their replies. I am stating the problem here, I appreciate any kind of advice. 1. Using my customized table of my own in Ms Sql 2000 rather than the default (ie radcheck) with free radius 2 through Perl script. 2. Executing stored procedures of Ms Sql 2000 through Perl script. I've put "perl" in the authorization section in the sites-enabled/default directory I've put Auth-Type perl { perl } in the authenticate section And I've put a section of perl module in the modules section in the radiusd.conf, the radiusd -X works fine and reads all the perl module while running the radius in debugging mode, My confusion is that how do I fetch the username and the password from my own customized table which contains only username and password and authenticate through perl script. Secondly how do I execute the stored procedures written in Ms Sql 2000 through perl script. Thanks and Regards Elangbam Johnson

2 1

Problems with using Customize table schema
by johnson elangbam 07 Mar '08

07 Mar '08

hi, The only thing I want to do is to used my customize table schema of my own. I am confused whether I used the sql.conf or the perl module.Pleaseadvice which i should used. And if i used the perl module, please tell me how should I write the connection parameters and the sql queries for connecting to the Ms Sql. And if i used the sql.conf please tell me how to used my own customized table which contain only username and password. With Regards Elangbam Johnson

3 2

compile
by Frost, Benjamin M. 07 Mar '08

07 Mar '08

Hello, I'm trying to compile freeradius 1.1.7 on a redhat 7.1 box w/gcc 3.4.3 and am getting the following error; creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -pie -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/exec.o .libs/files.o .lib s/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/nas.o .libs/proxy.o .libs/radiusd.o .libs/radius_snmp.o .libs/request _list.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/timestr.o .libs/xlat.o - Wl,--export-dynamic -lnsl -lresolv -lpthread ../lib/.libs/libradius.so -lcrypt /usr/lib/libltdl.so -ldl -Wl,--rpath -Wl,/usr/local/lib .libs/threads.o: In function `request_handler_thread': /home/freerad/freeradius-1.1.7/src/main/threads.c:590: undefined reference to `ERR_remove_state' /home/freerad/freeradius-1.1.7/src/main/threads.c:590: undefined reference to `ERR_remove_state' .libs/threads.o: In function `thread_pool_init': /home/freerad/freeradius-1.1.7/src/main/threads.c:210: undefined reference to `CRYPTO_num_locks' /home/freerad/freeradius-1.1.7/src/main/threads.c:216: undefined reference to `CRYPTO_num_locks' /home/freerad/freeradius-1.1.7/src/main/threads.c:220: undefined reference to `CRYPTO_set_id_callback' /home/freerad/freeradius-1.1.7/src/main/threads.c:221: undefined reference to `CRYPTO_set_locking_callback' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/home/freerad/freeradius-1.1.7/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/freerad/freeradius-1.1.7/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/freerad/freeradius-1.1.7/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/freerad/freeradius-1.1.7' make: *** [all] Error 2 Does anyone know what package I need to upgrade/install? Thanks, Ben

2 1

nat translation on apache 2 webserver on Linux
by Charnjit Sidhu 07 Mar '08

07 Mar '08

Another question. We can only get our radius authentication to work on our webserver when it is outside of our internal firewall ie it has a static ip address of what is specified on the radius server. The current setup is that it is behind a firewall which translates the external ip address with the internal ip address of the linux apache web server on an internal local network, this allows for other internal operations to take place, however this causes authentication to fail with a 401 error reported on the webpage. is there any further configuration I can do on my linux web server to translate authentication from the external ipaddress of the web server to the internal ip address. or any rules extra rules I need to add to my firewall. hope this makes sense. Charnjit Charnjit Sidhu Computing Officer Birmingham University Imaging Centre School of Psychology University of Birmingham Tel: +44 (0)121 4143857 E-mail: c.sidhu(a)bham.ac.uk <mailto:c.sidhu@bham.ac.uk>

2 1