- Freeradius-Users - lists.freeradius.org

rlm_eap: SSL error
by Bruno Costacurta 27 Nov '06

27 Nov '06

Hello, I receive the following errors : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) .. Error: Trying to look up name of unknown client 127.0.0.1. .. (please see hereafter more complete log) I'm confused by the fact that this config was working fine few days. Apparently only an upgrade of linux distribution (Fedora 5-->6) was made since last succesful login. Thanks for any clue / idea. Cheers, Bruno ... Info: rlm_eap_tls: Loading the certificate file as a chain Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Info: rlm_sql (sql): Attempting to connect to root@localhost:/radius Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Info: Ready to process requests. Error: TLS_accept:error in SSLv3 read client certificate A Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Info: rlm_eap_md5: Issuing Challenge Error: Trying to look up name of unknown client 127.0.0.1. Auth: Login OK: [acer9100/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 0) Auth: Login OK: [acer9100/<no User-Password attribute>] (from client Olitec402SG port 1 cli 00-12-F0-21-1A-B6) ... -- Register Linux User 353844 http://counter.li.org/ --

1 0

RE: Radius Help
by Darrell Fuquay 27 Nov '06

27 Nov '06

Christopher, Thanks for the response. We can monitor the connections using netstat on the Oracle port, but I'm not sure that is what you mean. Darrell -----Original Message----- From: Christopher Carver [mailto:ccarver0@gmail.com] Sent: Monday, November 27, 2006 10:11 AM To: dfuquay(a)hbfgroup.com; FreeRadius users mailing list Subject: Re: Radius Help When you monitor network activity on the server that runs the oracle DB are the connection requests being received? Christopher Carver ----- Original Message ----- From: Darrell Fuquay <mailto:dfuquay@hbfgroup.com> To: freeradius-users(a)lists.freeradius.org Cc: thall(a)hbfgroup.com Sent: Monday, November 27, 2006 10:32 AM Subject: Radius Help We are having trouble getting our radius server to connect to Oracle. It was connected last week and we stopped the process due to excessive database connections (an unrelated application issue) and now when we attempt to start it the last logged statement is "rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0". Any ideas on how to see what's hanging up at this point? The database is on a remote server but I can ping that server with the host name used in the radius configuration. Thanks, Darrell _____ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Radius Help
by Darrell Fuquay 27 Nov '06

27 Nov '06

We are having trouble getting our radius server to connect to Oracle. It was connected last week and we stopped the process due to excessive database connections (an unrelated application issue) and now when we attempt to start it the last logged statement is "rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0". Any ideas on how to see what's hanging up at this point? The database is on a remote server but I can ping that server with the host name used in the radius configuration. Thanks, Darrell

1 0

very long regular expression...
by Norbert Grochal 27 Nov '06

27 Nov '06

I have FreeRADIUS Version 1.1.0 I want to disallow login to access points for every hosts that are not in my network. So at the end of /usr/local/etc/raddb/users file I put regular expression that checks if Calling-Station-Id IS NOT in list of my hosts... DEFAULT Auth-Type := REJECT, Calling-Station-Id !~ "008012323244|002938475473|<and many other macs...>" but it is about 2300 chars in one line and my freeradius says: /usr/local/etc/raddb/users[330]: Parse error (check) for entry DEFAULT: Expected end of line or comma Errors reading /usr/local/etc/raddb/users radiusd.conf[1050]: files: Module instantiation failed. radiusd.conf[1796] Unknown module "files". radiusd.conf[1730] Failed to parse authorize section. how long can be regular expression and is there any other way to solve this problem? Norboro

5 10

Using the attrs concept but filtering it on incoming attributes?
by Jarrod Sayers 27 Nov '06

27 Nov '06

I have tried to Google this and and have come up with nothing thus far so I am going to throw this one out there to see if anyone can shed some light on this unique problem. I look after a number of FreeRADIUS 1.1.3 hosts basically acting as big proxies. One of the destination realms, in this example some.fake.realm.com.au and NULL, returns Tunnel-Private-Group-Id:1 that I trust for our access points, but when the request is proxied off to another authenticator, we strip that attribute and inject it in the post-proxy phase - all standard stuff there. I have hit a snag that is that while I trust Tunnel-Private-Group-Id: 1 from those two realms (which are the same realm really), I need that attribute stripped off when the requests are coming from other clients. Ideally I need those two top realms in my attrs file to only be processed from particular clients, but according to attrs.sample you can't add filters to the line containing the realm. The long and the short of it is that this realm is backed onto a Cisco Secure ACS server that uses Network Access Profiles to simply not return those attributes when the NAS-Identifier is not set ones I know about but it appears not to be applying the profile anymore (patch or something, I don't know...) so I would like to shift that responsibility to FreeRADIUS. Below is a conceptual example of what I am trying to achieve: >>> some.fake.realm.com.au NAS-Identifier == "SOME-AP-123" Tunnel-Private-Group-Id:1 =* ANY, Fall-Through = Yes NULL NAS-Identifier == "SOME-AP-123" Tunnel-Private-Group-Id:1 =* ANY, Fall-Through = Yes DEFAULT Tunnel-Type:1 == VLAN, ... <<< The current attrs file: >>> some.fake.realm.com.au Tunnel-Private-Group-Id:1 =* ANY, Fall-Through = Yes NULL Tunnel-Private-Group-Id:1 =* ANY, Fall-Through = Yes DEFAULT Tunnel-Type:1 == VLAN, Tunnel-Medium-Type:1 == IEEE-802, Framed-IP-Address == 255.255.255.255, Proxy-State =* ANY, State =* ANY, EAP-Message =* ANY, MS-MPPE-Send-Key =* ANY, MS-MPPE-Recv-Key =* ANY, Reply-Message =* ANY, Cisco-AVPair =* ANY, Session-Timeout > 0, Class =* ANY, Message-Authenticator =* ANY <<< Anyone with a crazy idea that might work? Jarrod.

1 0

Problem with 3Com-User-Access-Level and rlm_perl
by Krzysztof Olędzki 27 Nov '06

27 Nov '06

Hello, It seems there is something wrong with RAD_REPLY handling. With 3Com-User-Access-Level set to 3Com-Manager/3Com-Monitor freeradius finally sends 3Com-Administrator: My code looks like thos: $RAD_CHECK{'Auth-Type'} = 'Accept'; $RAD_REPLY{'3Com-User-Access-Level'} = '3Com-Manager'; # radiusd -X (...) rlm_perl: Added pair 3Com-User-Access-Level = 3Com-Manager rlm_perl: Added pair Auth-Type = Accept (...) Sending Access-Accept of id 68 to 192.168.139.254 port 2048 3Com-User-Access-Level = 3Com-Administrator (...) But if I set it to 2: $RAD_REPLY{'3Com-User-Access-Level'} = 2; then: # radiusd -X (...) rlm_perl: Added pair 3Com-User-Access-Level = 2 rlm_perl: Added pair Auth-Type = Accept (...) Sending Access-Accept of id 69 to 192.168.139.254 port 2048 3Com-User-Access-Level = 3Com-Manager BTW, there is no problem with other attributes like for example: $RAD_REPLY{'Tunnel-Medium-Type'} = 'IEEE-802'; Tested with freeradius-1.1.2 and 1.1.3. Best regards, Krzysztof Olędzki

2 8

New "look and feel" for the web site.
by Alan DeKok 27 Nov '06

27 Nov '06

After almost 5 years with the previous look & feel, we've updated the web site with a new style, and slightly re-arranged content. It now looks a lot flashier, and should still load quickly for most people. Users with text-based browsers or Internet Explorer may still have issues (lots of links or no transparent PNG's), but we should have most of those straightened out in the next week. We've also changed the slogan on the main page, from "Building the perfect RADIUS server", to "The worlds most popular RADIUS server". The link in the menu bar on the right gives some detailed survey results, and explains why we think it's the worlds #1 RADIUS server. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Re: FreeRadius working as proxy Radius for RSA ACE Server
by David Mitton 26 Nov '06

26 Nov '06

On 11/23/2006 11:34 AM, Alan DeKok wrote: >Luis wrote: > > Hi there, > > > > Is there anyone with experience with FreeRadius working as proxy for the > > RSA ACE Server? > > Yes. RSA ACE is just a re-branded Funk server. > > Alan DeKok. Careful here. The RSA SecurID Server, (aka the ACE Server or more properly the Authentication Manager) that holds the SecurID user and token database, and authenticates the token codes, proper doesn't speak RADIUS but a proprietary secured protocol. The API to this protocol's client module is documented. Versions 5.6 and 6.0 of the ACE Server include an optional RADIUS server that accepts PAP requests with a SecurID passcode (PIN + tokencode) and proxies them to the ACE Server. This server is based on the original Livingston RADIUS server code. This server did not support EAP protocols. The Windows version of the server includes a Windows EAP module that supports our SecurID EAP method. This module works directly with the Windows RAS and VPN servers, or via the Microsoft IAS RADIUS Server. Version 6.1 of the Auth Manager Server includes an custom version of SBR that accepts RADIUS requests and only proxies them to the Auth Manager. It supports PAP/SecurID, EAP-GTC, EAP-SecurID, and EAP-Protected OTP. And with TTLS, PEAPv0, and PEAPv1 support. It's supported on Windows and several UNIX platforms. It does not support any other form of authentication. The Windows EAP DLL is still provided and now supports EAP-POTP as well. Any of these RADIUS requests could be proxied by any reasonable RADIUS proxy. There's nothing special about the RADIUS aspects of these requests, just the authentication content. Dave.

3 2

Simultaneous login
by HSS-NOC 26 Nov '06

26 Nov '06

In the radcheck table, Fill Username, attribute, op & value as your_uasername, Simultaneous-Use, :=, 1 respectively. This will not allow more than one simultaneous use for this user. You need to configure session as follows to enable simultaneous query. Session { radtump sql } Regards Muhammed Ali NOC -----Original Message----- Message: 1 Date: Fri, 24 Nov 2006 13:15:42 +0100 From: "Nicolas Viers - Univ. Limoges" <nicolas.viers(a)unilim.fr> Subject: Simultaneous login To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4566E26E.4020105(a)unilim.fr> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hello, how to deny simultaneous login with same username on freeradius ? Thanks a lot -- ____________________________________________________________ Nicolas Viers | Service Commun Informatique Mil: nicolas.viers(a)unilim.fr | 123, avenue Albert Thomas | 87060 Limoges cedex Tel: 05-55-45-77-09 | Fax: 05-55-45-75-95 http://www.unilim.fr/sci ____________________________________________________________

1 0

FreeRadius and MySQL boot problem
by HSS-NOC 26 Nov '06

26 Nov '06

Change the line RADIUSD=/usr/src/sbin/radiusd & CONFIG=/path/to/your/radiusd.conf in your rc.radiusd Regards Muhammed Ali NOC -----Original Message----- Message: 3 Date: Sat, 25 Nov 2006 22:09:54 -0800 (PST) From: olisa <rinab01(a)yahoo.com> Subject: Re: FreeRadius and MySQL boot problem To: freeradius-users(a)lists.freeradius.org Message-ID: <7545147.post(a)talk.nabble.com> Content-Type: text/plain; charset=us-ascii I check it freeradius scripts rc.radiusd .it is same as /usr/local/sbin/rc.radiusd. I am using operating system fedora core 4 and chillispot is chillispot-1.0.i386.rpm and freeradius is freeradius-1.1.0.tar.gz . and whenever i reboot the radiusd server there is the error in radiusd log file like Sun Nov 26 11:00:51 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Sun Nov 26 11:00:51 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Sun Nov 26 11:00:51 2006 : Error: radiusd.conf[10] Failed to link to module 'rlm_eap': /usr/local/lib/rlm_eap-1.1.0.so: cannot restore segment prot after reloc: Permission denied Sun Nov 26 11:00:51 2006 : Error: radiusd.conf[1749] Unknown module "eap". Sun Nov 26 11:00:51 2006 : Error: radiusd.conf[1696] Failed to parse authenticate section. and when i start the radiusd by typing /usr/src/sbin/radiusd , radiusd server run and it has radiusd log file like Sun Nov 26 11:46:10 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Sun Nov 26 11:46:10 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Sun Nov 26 11:46:10 2006 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Sun Nov 26 11:46:10 2006 : Info: rlm_sql (sql): Attempting to connect to root@localhost:/mypaid Sun Nov 26 11:46:10 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Sun Nov 26 11:46:11 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Sun Nov 26 11:46:11 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Sun Nov 26 11:46:11 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Sun Nov 26 11:46:11 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Sun Nov 26 11:46:11 2006 : Info: Ready to process requests. so , how to run this radiusd server at boot time not by manully starting everytime when server is restart. regards rina Hernan Antolini wrote: > > Check the scripts dir that came with the freeradius source; there is a > rc.radiusd file to do that. > regards > Hernan Antolini > > freeradius-users-bounces+antolini=ar.ibm.com(a)lists.freeradius.org wrote on > 11/24/2006 03:52:53 AM: > >> >> hello >> i configure chillispot and freeradius and it is working. But >> whenever i reboot this radiusd server i have to run manually all the > time. >> So how to run this radiusd server at boot time. >> chillispot ,apche and mysql all run at boot time but radiusd > is >> not.i try it by writing script in /etc/rc.local and also directly copy >> /usr/local/sbin/radiusd file to /etc/rc.d/init.d but it don't work . So >> please give me any ideas to start radiusd server at boot time. >> >> regards >> rina >> >> >> >> Diniz Da Rocha wrote: >> > >> > HI, >> > >> > I have currently setup FreeRadius 1.0.4 with ldap authentication and >> > authorization as well as mysql authorization and its all working fine. > My >> > only problem is that when I boot the server (Fedora Core 4) and > radiusd >> > starts up there is a rlm_sql_mysql error: >> > >> > Wed Feb 15 18:38:51 2006 : Info: rlm_sql (sql): Trying to (re)connect >> > unconnected handle 4.. >> > Wed Feb 15 18:38:51 2006 : Info: rlm_sql_mysql: Starting connect to > MySQL >> > server for #4 >> > Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Couldn't connect > socket >> > to >> > MySQL server radius_client@myip:radius >> > Wed Feb 15 18:38:51 2006 : Error: rlm_sql_mysql: Mysql error 'Can't >> > connect >> > to MySQL server on 'myip' (13)' >> > Wed Feb 15 18:38:51 2006 : Error: rlm_sql (sql): Failed to connect DB >> > handle >> > #4 >> > >> > >> > The MySQL server is on another server with ip "myip" I initially > thought >> > it >> > was a firewall block but even with no firewall I get this error. But > once >> > the server has started and I run "service radiusd restart" from a > terminal >> > the connect to the MySQL server works fine and has no problems. I even >> > tried >> > running the service from rc.local but it still fails did anyone have > this >> > problem??? is anyone running the MySQL server on another machine???? > Is >> > there a fix for this??? >> > >> > thanks >> > >> > diniz >> > >> > - >> > List info/subscribe/unsubscribe? See >> > http://www.freeradius.org/list/users.html >> > >> >> -- >> View this message in context: http://www.nabble.com/FreeRadius-and- >> MySQL-boot-problem-tf1191658.html#a7518565 >> Sent from the FreeRadius - User mailing list archive at Nabble.com. >> >> - >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- View this message in context: http://www.nabble.com/FreeRadius-and-MySQL-boot-problem-tf1191658.html#a7545 147 Sent from the FreeRadius - User mailing list archive at Nabble.com. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 19, Issue 88 ************************************************

1 0