- Freeradius-Users - lists.freeradius.org

How to get FreeRadius 2.0 running?
by Jack Daniels 27 Aug '07

27 Aug '07

Hello, I've downloaded from CVS the latest snapshot of FreeRadius 2.0 for testing purposes, but to my surprise, i haven't yet succeeded in getting it to run.The error message I get is the following:Mon Aug 27 15:49:14 2007 : Error: Listening on IP authentication address * port 1812 but no server has been definedMon Aug 27 15:49:14 2007 : Error: Errors setting up modulesCould please somebody assist me? I know this version is not yet finished, but I'd like to have it running to see its new features.Jack D _________________________________________________________________ Make every IM count. Download Windows Live Messenger and join the i’m Initiative now. It’s free. http://im.live.com/messenger/im/home/?source=TAGWL_June07

2 1

How to get FreeRadius 2.0 running?
by Jack Daniels 27 Aug '07

27 Aug '07

Hello, I've downloaded from CVS the latest snapshot of FreeRadius 2.0 for testing purposes, but to my surprise, i haven't yet succeeded in getting it to run.The error message I get is the following:Mon Aug 27 15:49:14 2007 : Error: Listening on IP authentication address * port 1812 but no server has been definedMon Aug 27 15:49:14 2007 : Error: Errors setting up modulesCould please somebody assist me? I know this version is not yet finished, but I'd like to have it running to see its new features.Jack D _________________________________________________________________ Play free games, earn tickets, get cool prizes! Join Live Search Club. http://club.live.com/home.aspx?icid=CLUB_wlmailtextlink

2 1

User login
by Michael Ziemann 27 Aug '07

27 Aug '07

Hi People! Today I've another problem with freeradius. The user has his own password and can login by himself, no problem. But how can I avoid a second user logging in with the same user / pwd? Is it a problem of the NAS or RADIUS ??? I didn't find any configuration examples on the web, so please be patient :-) greets Michael

2 1

13 LDAP queries for one authorize!
by Turbo Fredriksson 27 Aug '07

27 Aug '07

I'm working on fine tuning my radiusd.conf file, and found that I get 13 authorize request to the LDAP server for one XXX (client, request, logon?!). I have 802.1x (RADIUS) enabled on my WiFi router, and when requesting a network on my client, there's 13 authorize requests... Using multilog which logs exactly when every line is done, all 13 requests is done during the same second, but it still seem to be 13 requests... ? The thing that strikes me is that first it returns 'notfound' then on the line below it returns 'updated'... Including my radiusd.conf, the 'users' file (stripped of comments and no sensitive info) (192.168.1.254 is the WiFi Router). Also, in the ldap filter, I have '(!(accountStatus=disabled))' which don't seem to work as expected.. I DO get a failure in the authorization section, but the EAP is still done (and succeedes, hence no failures): Logfile 1 is without the 'accountStatus' attribute, and logfile 2 is with the account disabled... In the disabled state, I get 'only' 12 authorize request for some reason... ? On the other hand (looking closer on a "grep '^ modcall' logoutput") shows that there are NINE requests... ? And that it's enough if ONE authorization module succeeds for the authorization to be OK... ? Attatchments to bug, so the files in question is now on http://bayour.com/problems/freeradius/.

5 10

windows XP computer WPA, TKIP, PEAP, EAP-MSCHAP v2 has "No User-Password or CHAP-Password attribute in the request"
by PoWah Wong 25 Aug '07

25 Aug '07

My freeradius client is a windows XP SP2 computer running 802.11 WPA, TKIP, PEAP, EAP-MSCHAP v2 and trying to connect to the linux Fedora Core 2 wireless server. I run the freeradius server in debugging mode # radiusd -sfxxyz -l stdout This is the output. How to fix this problem? rad_recv: Access-Request packet from host 127.0.0.1:52001, id=38, length=134 Framed-MTU = 1380 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "wifictrl" User-Name = "test" NAS-Port-Id = ":2:2" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 Called-Station-Id = "00-f0-00-06-67-a8" Calling-Station-Id = "00-20-a6-57-7a-e9" EAP-Message = 0x020100090174657374 Message-Authenticator = 0x737afc3b6c1fb17ad13ee348ca5fbf4b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched test at 90 radius_xlat: 'Hello, test' modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 38 to 127.0.0.1:52001 Reply-Message = "Hello, test" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 38 with timestamp 43d1500d Nothing to do. Sleeping until we see a request. # radiusd -v radiusd: FreeRADIUS Version 1.0.1, for host , built on Apr 15 2005 at 11:57:29 # uname -a Linux wifictrl 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux __________________________________________________________ Find your next car at http://autos.yahoo.ca

8 15

configuration for realm with prefix and suffix
by Mike Cisar 24 Aug '07

24 Aug '07

Running FreeRADIUS 1.1.3, usernames are in 'username' format in a unix passwd file. Our dialup users are proxied to us in 'username(a)suffix.com' format and to this point everything has been working just fine. Now the tougher part... We've gained access to some additional POPs and although the suffix is the same, we are proxied these with a prefix as well... so what we get is in the form prefix/username(a)suffix.com I'm having trouble wrapping my head around how to configure our server to deal with these. Any thoughts or pointers are appreciated. Cheers, >>>>> Mike <<<<<

2 2

Authentication question: Eap/peap + Switch + freeRADIUS + Lutos LDAP server
by Hangjun He 24 Aug '07

24 Aug '07

Hi, Eap/peap + Switch + freeRADIUS(1.1.6) + Lutos LDAP server. Can this architecture work well? Can anyone give me some advice? Thanks a lot. John. --------------------------------- 雅虎邮箱，以安全著称，是值得信赖的邮箱专家！

1 0

nas table and users.conf
by Genis Pujol Hamelink 24 Aug '07

24 Aug '07

Hello, Apparently the radiusd is not loading the nas list from the nas table but from the users.conf...anyone knows how to tell freeradius to load the list from the mysql table and skip the users.conf file? cheers, Genís.

3 5

Check items in rlm_files
by Paul Khavkine 23 Aug '07

23 Aug '07

Hi. Is it possible to access check items from the users file that were added to the request by previous modules ? I have rlm_ldap adding some items in authz section that I want to check later on in the users file. Or is there a way to map attributes from LDAP to the request pairs instead ? Thanx Paul

2 1

RE: Help configuring FreeRadius with PPPD and ntlm_auth
by Bruce Marriner 23 Aug '07

23 Aug '07

I wish I could be very specific here. But I fixed it. I reinstalled PPP and I looked very close at all its options and the config for XL2TP and removed every option that wasn't required (didn't break my non-radius connection). I tried the connection again. Wasn't even talking to radius so I edited the /etc/ppp/radius/servers file. It started talking to radius! This time it actually said it was doing mschap auth. Then complained about security on the winbindd_privileged folder. Now I'm not sure what user it's running as. The radiusd user has writes to that folder. But for testing I just changed it to 777 and now it's working. So I'm down to my very last step is this whole thing. I'll dig on the internet and manuals for this as well. But I'd like to ask here too :) I need to select what IP Pool specific users are given. So for our general users (field sales) we could allow access to all the email/intranet servers. Then our special users who do maintenance work on some machines in the shop would only have access to those machines. If I can assign different IP pool I can handle the access in netfilter. So is there a method of pulling a ip pool from Active Directory? If not, what options are there? Thanks. I'm documenting most of this :) and working on writing a howto on the whole thing. Since I couldn't really find any that currently exist. Once done it will exist at http://sqls.net/?s=article&id=6 (just in case someone ends up finding this while searching for how to do this) -----Original Message----- From: Bruce Marriner Sent: Monday, August 20, 2007 9:30 AM To: 'freeradius-users(a)lists.freeradius.org' Subject: Help configuring FreeRadius with PPPD and ntlm_auth

2 2