- Freeradius-Users - lists.freeradius.org

Multiple Databases
by Abdul Qadir 20 Jun '07

20 Jun '07

Hi, I am using freeradius with SER and oracle. Currently i have one domain for my SER. I want my SER to support another domain and separate database for second domain. Is it possible to configure Radius server to connect with two databases and perform queries based on URI or some other criteria eg. user(a)domainA.com should go to domainA database and user(a)domainB.com should go to domainB database. Thanking you all in advance. Best Regards, Abdul Qadir --------------------------------- Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV.

2 1

Frreradius PAP and CHAP
by lisa laam 20 Jun '07

20 Jun '07

Hi, I configured Freeradius to use PAP method with users file. The password is stored in clear text is stored in clear text in the user file and it works well. Now I want to use other mode of user storing with PAP method. (exemple MD5 with the user file locatedt in /freeradius-1.1.6/src/tests/digest-auth-MD5) 1- How to tell frreeradius that the user password is stored in clear text, or digest, or MD5 hashed, etc ?? I tried to copy the content of "digest-auth-MD5" in the "users" file and I got this errror : Errors reading /opt/freeradius/etc/raddb/users radiusd.conf[1067]: files: Module instantiation failed. radiusd.conf[1852] Unknown module "files". radiusd.conf[1788] Failed to parse authorize section. I want to test also CHAP method, how to tell radius to use this method in stead of PAP? thanks

6 9

Re: Server dies
by Hugh Messenger 19 Jun '07

19 Jun '07

Alan Dekok <aland(a)deployingradius.com> said > Yes. For simplicity: > > $ script valgrind.log > $ valgrind radiusd -xxx > ... > $ <ctrl-c> > $ exit Okie Dokie. I was going to use --log-file witrh valgrind, but 'script' works. Done. So far the only errors I'm seeing are these: ==29820== Thread 2: ==29820== Invalid write of size 1 ==29820== at 0x4819294: strNcpy (misc.c:187) ==29820== by 0x4CC43F3: sqlippool_postauth (rlm_sqlippool.c:527) ==29820== by 0xD469: modcall (modcall.c:236) ==29820== by 0xDA73: call_one (modcall.c:269) ==29820== by 0xD701: modcall (modcall.c:324) ==29820== by 0xC8F7: indexed_modcall (modules.c:469) ==29820== by 0x5865: rad_postauth (auth.c:430) ==29820== by 0x6101: rad_authenticate (auth.c:1029) ==29820== by 0xF6D4: rad_respond (radiusd.c:1669) ==29820== by 0x13240: request_handler_thread (threads.c:570) ==29820== by 0x3B4370: start_thread (in /lib/tls/libpthread-2.3.4.so) ==29820== by 0x208FFD: clone (in /lib/tls/libc-2.3.4.so) ==29820== Address 0x4A87AA2 is 0 bytes after a block of size 10 alloc'd ==29820== at 0x4804405: malloc (vg_replace_malloc.c:149) ==29820== by 0x1AA02F: strdup (in /lib/tls/libc-2.3.4.so) ==29820== by 0x4CC42AF: sqlippool_instantiate (rlm_sqlippool.c:486) ==29820== by 0xC5DE: find_module_instance (modules.c:358) ==29820== by 0xDD9C: do_compile_modsingle (modcall.c:1005) ==29820== by 0xCD6E: setup_modules (modules.c:580) ==29820== by 0x103E1: main (radiusd.c:965) There are typically three or four similar events for each authentication, a mix of invalid writes and reads. They are always out of sqlippool_postauth. > Alan DeKok. -- hugh

3 2

Re : Disabling EAP-TLS while keeping EAP-PEAP
by Eshun Benjamin 19 Jun '07

19 Jun '07

sounds interesting can you post your tls section config ================================================== ----- Message d'origine ---- De : "Reimer Karlsen-Masur, DFN-CERT" <karlsen-masur(a)dfn-cert.de> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 18 Juin 2007, 11h09mn 31s Objet : Re: Disabling EAP-TLS while keeping EAP-PEAP Hi! By commenting the CA_file parameter in the eap->tls section: # CA_file = ${raddbdir}/certs/trusted-ca-cert-list.pem *and* by setting CA_path parameter in the eap->tls section to an *empty* directory CA_path = ${raddbdir}/certs/trustedCAs should do the trick. No trusted CAs mean no trusted client certificates :-) Martin Gadbois wrote: > When enabling EAP-PEAP with FreeRADIUS, module EAP-TLS is required. > > How can I disable EAP-TLS while using EAP-PEAP? > > I agree that if the client does not have a client key, EAP-TLS will not > work. But how to restrict EAP-TLS in any case? -- Beste Gruesse / Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

UNSUBSCRIBE
by Florian Reinholz 19 Jun '07

19 Jun '07

UNSUBSCRIBE

2 1

Freeradius PEAP and Wireless
by Cody Jarrett 19 Jun '07

19 Jun '07

I'm trying to setup freeradius with ldap for use with a wireless network. I don't want to have to deal with tls and certificates if possible, I would just like for users to use their username and password to connect. The radius config for ldap is pretty easy, but I'm having a problem when trying to enable peap as my default eap type. I've done so in my eap.conf which I've included and a section of debug when trying to start radiusd. Appreciate any info. When trying to start radiusd: Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Unable to load EAP-Type/peap, as EAP-Type/TLS is required first. radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1939] Unknown module "eap". radiusd.conf[1886] Failed to parse authenticate section. eap.conf basically, everything else is commented out. eap { default_eap_type = peap peap { default_eap_type = mschapv2 } mschapv2 { } } -- Cody Jarrett IT Freedom cody.jarrett(a)itfreedom.com Office: 512.419.0070 Fax: 512.419.0080

6 8

Attribute "User-Password" is required for authentication
by Cody Jarrett 19 Jun '07

19 Jun '07

I found a few topics on this issue but nothing quite informative enough. I'm trying to get freeradius auth working with pam and peap. When I test my config with radtest, I get Access-accept. When I use a windows XP supplicant with a 3com access point, I get: rlm_pam: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "pam" returns invalid for request 4 modcall: leaving group authenticate (returns invalid) for request 4 auth: Failed to validate the user. Is the 3com not sending User-Password attributes in the packets, or is something else wrong?

6 10

freeradius performance , requests per second
by deepak kumar 19 Jun '07

19 Jun '07

Hi I am using freeradius 1.1.6 on Suse Linux 10 , and mysql for database. My processor is Intel Pentium 4, 3.40 Ghz, RAM is 512 MB and hard disk is 80 GB. On this configuration how many requests , freeraradius can handle per second. Is there any tool which can test the performance of freeradius. Can you please tell me the average number of authentication requests that freeradius can process per second. can it handle 1 lac requests per second. thanks deepak

4 3

Freeradius w/ mikrotik - blank password issue
by Jay Banks 19 Jun '07

19 Jun '07

Hello everyone, I have a problem I have worked on for a couple of days now and just can't get it to work. Searched the forum really good and actually found a fix for one issue I was having. I have also searched the Mikrotik forum as well as the web from one end to the other. Nothing seems to be able to answer this one question, though. Here is the deal. I have a working FreeRadius server (latest version). It works with Mikrotik to authenticate with user name / password using PAP. Mikrotik can authenticate by MAC address, but it's docs says it sends a blank password. What they also don't tell you in their weak documentation, is that the colons in the MAC address will foobar freeradius authentication. I fixed that problem by adding this to radiusd.conf: attr_rewrite mac_colons { attribute = User-Name searchin = packet searchfor = ":" replacewith = "" ignore_case = yes new_attribute = no max_matches = 10 append = no } This appears to work fine. If someone would help me with this one last issue, I would be a happy camper. The Mikrotik documentation (weak) says that it sends a "blank password" when authenticating by MAC. I have looked up one side and down the other, but I can't get FreeRadius to accept no password. I tried this, but it fails: attr_rewrite blank_password { attribute = User-Password searchin = packet searchfor = "" replacewith = "password" ignore_case = yes new_attribute = no max_matches = 10 append = no } And then I added something like this to the "users" file: 00095B23389F User-Password := "password" If there is a password, the above works. For instance, I can change "password" to "password1" using the above script, and it will authenticate. But if there is no password, it gets this error: rlm_attr_rewrite: Could not find value pair for attribute User-Password Well guys, I'm an extreme newbie with freeradius, but there has to be something I'm missing somewhere in order to authenticate by mac address through mikrotik. Other people are doing it. I'm just missing some little something somewhere, I know. I have also seen other wireless equipment that sends a blank password when authenticating by MAC...and people use freeradius with it. Any help would be greatly appreciated. Thanks, Jay Banks

3 5

Disabling EAP-TLS while keeping EAP-PEAP
by Martin Gadbois 18 Jun '07

18 Jun '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When enabling EAP-PEAP with FreeRADIUS, module EAP-TLS is required. How can I disable EAP-TLS while using EAP-PEAP? I agree that if the client does not have a client key, EAP-TLS will not work. But how to restrict EAP-TLS in any case? Thanks! - -- ============== +---------------------------------------------+ Martin Gadbois | "Please answer by yes or no. | Sr. SW Designer | Uncooperative user waste precious CPU time" | Colubris Networks Inc. | -- The Andromeda Strain, M. Crichton, 1969 | -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGYGSw9Y3/iTTCEDkRAiawAJ9hANUDvgjJTDDwAfiQkDR/NUKH1ACghRNW O1DdJnCymFB8hsiiIUMc9Ks= =1OR5 -----END PGP SIGNATURE-----

5 6