- Freeradius-Users - lists.freeradius.org

EAP: client certificates and double authentication messages
by Florian Prester 24 Oct '06

24 Oct '06

Hi, I am using freeradius successfully, but I still have some questions. Fistly, how can I disable to verify client certificates? Mon Sep 5 12:17:12 2005 : Error: TLS_accept:error in SSLv3 read client certificate A I mean I have disabled the comand in the config-file. But still I get the error above. Secondly, how comes I always see a successfull authentication twice, when using eap: Mon Sep 5 12:17:16 2005 : Auth: Login OK: [unrzwlan5] (from client localhost port 0) Mon Sep 5 12:17:16 2005 : Auth: Login OK: [unrzwlan5] (from client airbrush port 0 cli 00-11-09-0B-01-4D) Thanks Florian Prester -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

2 1

RE: Decreasing connection time (Session-Timeout)
by Jonathan De Graeve 24 Oct '06

24 Oct '06

> Now, how could I subtract the elapsed time from the original Session- > Timeout time? So that the user will, at the next login, only have > 40minutes left. > SQLcounter is the module you need. J. -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98

5 7

EAP-TTLS success
by Rafiqul Ahsan 24 Oct '06

24 Oct '06

Hi all, I found the issue for below error "EAP-request timed out OR EAP-response to an unknown EAP-request" --- NAS was not responding with the state attribute received from radius server. As soon as we fixed this at NAS, it went through all the steps required to authenticate an user using TTLS-MSCHAPV2. My plaform was Solaris 10, with freeradius version 1.1.3 Thanks all for your valuable input. Rafi

1 0

RE: freeradius+hpidm+cisco
by Jonathan De Graeve 24 Oct '06

24 Oct '06

> All, > We have an hp infrastructure and use identity driven management to enforce > some additional rights to users(as forcing vlan assignment). > We have a mixed wireless environment with hp procurve and cisco(1200) > For hp access points we don't have any problem, but when trying with cisco > devices freeradius crasches with a segmentation fault. > The segmentation fault happens when accessing the module hpidm.post- > auth.conf which is loaded through radius.conf. > (if i comment out this module i don't get the error, but then vlan > assignment does't work for the hp's). > It would be usefull to debug and to post whats in the hpidm.post-auth.conf J. -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98

3 5

cvs issue
by Guilherme Franco 24 Oct '06

24 Oct '06

Hello, I'm only seeing cistron on the cvs: FTP directory /pub/radius/CVS-snapshots/ at ftp.freeradius.org________________________________ Up to higher level directory 10/23/2006 09:10 201,051 radiusd-cistron-1.6-snapshot-20061023.tar.gz ________________________________

1 0

Hints, Attr_rewrite - Add session timeout with Framed IP
by Breuer Nicolas 24 Oct '06

24 Oct '06

Hello all, Any others suggestions ? I've made a small script into the rlm _sqlippool to add the session time-out attribue... ------- Forwarded message follows ------- From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> To: freeradius-users(a)lists.freeradius.org Subject: Hints, Attr_rewrite - Add session timeout with Framed IP? Send reply to: Nicolas.Breuer(a)BelCenter.biz Date sent: Mon, 23 Oct 2006 12:02:03 +0200 Hello I'm looking for a solution to add in the accept packets a session timeout value when framed ip address is assigned in the users file. I tried to add "hints" rules but doesn't seems to work. I also tried to rewrite the packet : not works. Can you help me to do this ? ------- End of forwarded message -------

1 0

Re: SNMP with Freeradius - Again
by Velikanov 24 Oct '06

24 Oct '06

>SNMP/SMUX support should not affect the rlm_sql module in any way. > >See doc/bugs for steps to debug the segfault issue and identify where the >program is actually failing. Good Day. I did all the steps in doc/bugs, and this is the result: [root@test freeradius-1.1.3]# gdb /usr/local/sbin/radiusd GNU gdb Red Hat Linux (6.3.0.0-1.96rh) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"...Using host libthread_db library "/lib/tls/libthread_db.so.1". (gdb) set logging file gdb-radiusd.log (gdb) set logging on Copying output to gdb-radiusd.log. (gdb) run Starting program: /usr/local/sbin/radiusd [Thread debugging using libthread_db enabled] [New Thread -1208568128 (LWP 6866)] Tue Oct 24 09:25:22 2006 : Info: Starting - reading configuration files ... Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1208568128 (LWP 6866)] 0x0804e816 in cf_expand_variables (cf=0x8065a9e "?", lineno=0x9fd2d38, outercs=0x9fd2d30, output=0xbff15700 "\001", input=0x8061711 "") at conffile.c:233 233 for (parentcs = outercs; (gdb) Is it usefull information? May be i must do something else? Thanks.

1 0

[RE]Freeradius-Users Digest, Vol 18, Issue 98
by Kartthik Raghunathan 23 Oct '06

23 Oct '06

1 0

ssl header file skips from test
by Kartthik Raghunathan 23 Oct '06

23 Oct '06

1 0

Server stopped responding, throwing multiple SSL-related errors
by Ben Beuchler 23 Oct '06

23 Oct '06

I'm running FreeRADIUS 1.1.2 on Ubuntu. This morning one of the two servers stopped answering requests. The radius log contained thousands of lines like these: Mon Oct 23 12:32:56 2006 : Error: TLS Alert write:fatal:illegal parameter Mon Oct 23 12:32:56 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 23 12:32:56 2006 : Error: rlm_eap: SSL error error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size Mon Oct 23 12:32:56 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 23 12:33:02 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 23 12:33:02 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 23 12:33:02 2006 : Error: TLS Alert write:fatal:bad record mac Mon Oct 23 12:33:02 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 23 12:33:02 2006 : Error: rlm_eap: SSL error error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Mon Oct 23 12:33:02 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 23 12:33:02 2006 : Error: TLS Alert write:fatal:illegal parameter Mon Oct 23 12:33:02 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 23 12:33:02 2006 : Error: rlm_eap: SSL error error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size Mon Oct 23 12:33:02 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 23 12:33:16 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Restarting radiusd fixed it. My build of FreeRADIUS was built from source, the SSL library is the Ubuntu system openssl (v. 0.9.7). Any idea what might have gone wrong? -Ben

3 3