- Freeradius-Users - lists.freeradius.org

13 Sep '06

Hi, I have seen these errors when primary radius server goes offline and the secondary takes over: All requests are coming via Redback SE400: Wed Sep 13 07:51:34 2006 : Error: Dropping conflicting packet from client redback:1812 - ID: 1 due to unfinished request 1051 285 Wed Sep 13 07:51:35 2006 : Error: Dropping conflicting packet from client redback:1812 - ID: 2 due to unfinished request 1051 286 This happens on both servers and after an hour it seemed to sort itself out. Setup is as follows: 2xfreeradius server 2xmysql cluster API nodes each FR server is pointed to a different node, so when we take one node offline, the secondary defined freeradius server should kick in and talk to its API. When the primary radius server came back after its mysql API was brought back after a planned outage, the primary and secondary radius servers got confused. They both started to drop connections with the above errors and no users could authenticate. Is this issue a known issue, is there a fix, has anyone got any further info on when this would happen. Restarting the primary radius server fixed the issue however this solution is meant to be a resiliant and redundant solution capable of working through either radius or mysql node failures. any info or assistance would be helpful for my RFO here. cheers -- andy andy(a)shady.org ----------------------------------------------- Never argue with an idiot. They drag you down to their level, then beat you with experience. -----------------------------------------------

1 0

Re: Freeradius-Users Digest, Vol 17, Issue 47
by ego seek 13 Sep '06

13 Sep '06

thank you for yor reply. do you know if i can use NT-PASSWORD using windowsXP client? do I have only modify the table insert "NT-PASSWORD" instead "PASSWORD"? how then I can make the sistem work? what I have to put in the radiusd.conf? thank you. Best regards 2006/9/12, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org>: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the > comunication----------------------------------- (Rob Shepherd) > 2. Re: FreeRadius suport IPv6 ??????????????/ (Alan DeKok) > 3. Re: Probs with pppoe-server + radius (Alan DeKok) > 4. Re: rautmp not working.. (Alan DeKok) > 5. Re: Question about rlm modules (Alan DeKok) > 6. Re: STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the > comunication----------------------------------- (Alan DeKok) > 7. Re: Question about rlm modules (Alan DeKok) > 8. Re: Re: Re: IAS e Openser (Artur Hayne) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 12 Sep 2006 15:09:46 +0100 > From: Rob Shepherd <rob(a)techniumcast.com> > Subject: Re: STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the > comunication----------------------------------- > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4506BFAA.5060803(a)techniumcast.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > ego seek wrote: > > > > > > Does Anybody know HOW I can make radius WORK with md5-stored password in > > the db? > > > > I use EAP-PEAP-MSCHAPv2, and if the system works great if the pwds are > > in clear in the mysqlDB > > > > > You can't. See > http://deployingradius.com/documents/protocols/compatibility.html > > Store an 'NT-Password' value as a config ':=' attribute in the radcheck > table. > > NT password hashes can be generated in most programming languages. > > Rob > > -- > Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ > rob(a)techniumcast.com | 01248 675024 | 077988 72480 > > > ------------------------------ > > Message: 2 > Date: Tue, 12 Sep 2006 10:21:38 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: FreeRadius suport IPv6 ??????????????/ > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142138.F266216E1C(a)mail.nitros9.org> > > Christian Hahn <hahn(a)berkom.de> wrote: > > Do you mean IPv6 transport or support for IPv6 attributes (RFC3162)? > > RFC3162 is supported by freeradius 2.0.0-pre0 (CVS), IPv6 transport as > > far as I know is not supported. > > The CVS version also supports IPv6 transport. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 3 > Date: Tue, 12 Sep 2006 10:23:15 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: Probs with pppoe-server + radius > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142315.586D516E31(a)mail.nitros9.org> > > Ali Jawad <alijawad1(a)gmail.com> wrote: > > The info above is to help you guys in helping me pinpoint my prolem, my > > real problem is that I can dial into my server using pppoe and simple > > chap and/or pap authenication. However once I use radius to authenicate > > the pppoe-dialup requests into the server. I get the following output in > > pppd.log > > And in all of this you are carefully avoiding the one tool that > will help you solve the problem: running the server in debugging mode. > > See the README, FAQ, INSTALL. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 4 > Date: Tue, 12 Sep 2006 10:25:37 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: rautmp not working.. > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142537.9FD8616E1C(a)mail.nitros9.org> > > Collen Blijenberg <collen(a)mail.hermanjordan.nl> wrote: > > but no radutmp file is created, and if created by hand it stay's 0 > bytes... > > > > dunno my guesses tells me i forgot something... ??? > > Send the server accounting packets. radutmp is created when the NAS > agrees that the user has logged in, not when the server tells the NAS > to let the user in. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 5 > Date: Tue, 12 Sep 2006 10:26:24 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: Question about rlm modules > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142624.1F05B16E1C(a)mail.nitros9.org> > > Shankar Ganesh C <shankarganesh(a)tataelxsi.co.in> wrote: > > Could you let me know how did u capture the vendor specfic attributes in > the > > rlm_module ? > > Read the source code to rlm_files. VSA's are just normal > attributes. You can refer to them by name. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 6 > Date: Tue, 12 Sep 2006 10:27:33 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the > comunication----------------------------------- > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142733.AC4BF16E1C(a)mail.nitros9.org> > > "ego seek" <egoseek(a)gmail.com> wrote: > > Does Anybody know HOW I can make radius WORK with md5-stored password in > the > > db? > > > > I use EAP-PEAP-MSCHAPv2, and if the system works great if the pwds are > in > > clear in the mysqlDB > > http://deployingradius.com/documents/protocols/compatibility.html > > What you want to do is impossible. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 7 > Date: Tue, 12 Sep 2006 10:28:08 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: Question about rlm modules > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142808.646DA16E1C(a)mail.nitros9.org> > > "Ali Majdzadeh" <ali.majdzadeh(a)gmail.com> wrote: > > What is(are) the coresponding function pointer(s) for start and stop > packets > > in an rlm module? (Something like xxx_authenticate) > > The "accounting" sections handle accounting packets. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 8 > Date: Tue, 12 Sep 2006 11:41:22 -0300 (ART) > From: Artur Hayne <arturhayne(a)yahoo.com.br> > Subject: Re: Re: Re: IAS e Openser > To: freeradius-users(a)lists.freeradius.org > Message-ID: <20060912144122.13065.qmail(a)web61213.mail.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > Olá a todos, > > Como faço para transformar o Freeradius num cliente do IAS? Existe algum > tutorial, ou artigo? > Se for sem passar pelo servidor freeradius eu já configurei o radiusclient > para ir direto ao IAS, mas não deu certo, nada acontece, e o pior de tudo > que não tenho nem como debugar o problema e o arquivo de log do IAS é muito > fraco. > > |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| > Da pra fazer isso? Como faço isso? > > Alguma idéia? > > Obrigado. > ----------------------------- > > Marcos escreveu: > > > > > > > > > > > > > > > > > > > > > > > > > Pessoal, facam o seguinte: > > - instale o IAS no windows - esse software atua como > um radius server > - configure o freeradius para atuar como um radius > client, usando o IAS como radius server. > > pronto, assim fica mais facil. > infelizmente o windows nao eh 100% LDAP. > o AD do windows 2003 eh mais LDAP que o AD do windows > 2000, mas mesmo assim nao sao 100% compativeis com o > padrao LDAP. > > []s > > Marcos > > --- Marcelo Costa escreveu: > > > Arthur, > > > > qual ? a pesquisa que o freeradius est? fazendo no > > ldap? > > o que tem no users.conf? > > > > eu f? utilizei freeradius+ldap sem problemas. > > > > []s > > Marcelo Costa > > > > Em 20/8/2006, "Artur Hayne" > > escreveu: > > > > >Ol? a todos, > > > > > > Eu tenho um problema que parece n?o haver > > solu??o. Tenho um servidor openser que deve > > autenticar os usu?rios no servidor ldap Active > > Directory atrav?s do FreeRadius. Consigo estabelecer > > uma se??o do Freeradius com o AD, porem quando o > > usu?rio tenta se autenticar atraves de um > > softphone, passando pelo FreeRadius, aparece um > > erro. > > > > > > Vejam aqui o debug do Radius: > > > > > > radius_xlat: 'ou=bli,dc=blo,dc=blu,dc=br' > > > rlm_ldap: ldap_get_conn: Checking Id: 0 > > > rlm_ldap: ldap_get_conn: Got Id: 0 > > > rlm_ldap: performing search in > > ou=bli,dc=blo,dc=blu,dc=br, with filter (uid=jab) > > > rlm_ldap: object not found or got ambiguous > > search result <---------- essa linha!!! > > > rlm_ldap: search failed <---------- essa linha!!! > > > rlm_ldap: ldap_release_conn: Release Id: 0 > > > modcall[authorize]: module "ldap" returns > > notfound for request 47 <---------- essa linha!!! > > > modcall: leaving group authorize (returns ok) for > > request 47 > > > rad_check_password: Found Auth-Type DIGEST > > > auth: type "digest" > > > Processing the authenticate section of > > radiusd.conf > > > modcall: entering group authenticate for request > > 47 > > > rlm_digest: Configuration item "User-Password" or > > MD5-Password is required for authentication. > > <---------- essa linha!!! > > > modcall[authenticate]: module "digest" returns > > invalid for request 47 <---------- essa linha!!! > > > modcall: leaving group authenticate (returns > > invalid) for request 47 > > > auth: Failed to validate the user. <---------- > > essa linha!!! > > > > > > Eu vi alguns tutoriais mostrando como autenticar > > no dominio utilizando a ferramneta ntlm_auth, mas > > ela parece que so funciona com o protocolo mschap, > > sendo que o Openser utiliza o digest para > > autenticar. > > > No radiusd.conf o digest e o ldap est?o > > descomentados tanto para autentica??o como para > > autoriza??o. > > > ? necess?rio fazer alguma configura??o nos > > aquivos users ou em outro? > > > Eu ainda estou tentando entender um pouco mais do > > Freeradius. > > > > > > Obrigado. > > > > > > > > > > > >--------------------------------- > > > O Yahoo! est? de cara nova. Venha conferir! > > >__ > > >masoch-l list > > >https://eng.registro.br/mailman/listinfo/masoch-l > > __ > > masoch-l list > > https://eng.registro.br/mailman/listinfo/masoch-l > > > > > > > > > > > > > > --------------------------------- > Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu > celular. Registre seu aparelho agora! > > > --------------------------------- > Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. > Registre seu aparelho agora! >

2 1

(no subject)
by Kshitij Korde 13 Sep '06

13 Sep '06

Hi I want to manage freeradius server remotely . How do I do that on Solaris 8 box. I have SNMP package "ucd-snmp-4.1.2". I configured it. But when I try to run the snmp deamon it gives me error init_kmem: kvm_open failed: Permission denied. Thanks Kshitij ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

1 0

Using CVS, Unknown host cvs.freeradius.org. why happen error?
by 나종현 13 Sep '06

13 Sep '06

2 1

Re: Re: Re: IAS e Openser
by Artur Hayne 13 Sep '06

13 Sep '06

Olá a todos, Como faço para transformar o Freeradius num cliente do IAS? Existe algum tutorial, ou artigo? Se for sem passar pelo servidor freeradius eu já configurei o radiusclient para ir direto ao IAS, mas não deu certo, nada acontece, e o pior de tudo que não tenho nem como debugar o problema e o arquivo de log do IAS é muito fraco. |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| Da pra fazer isso? Como faço isso? Alguma idéia? Obrigado. ----------------------------- Marcos escreveu: Pessoal, facam o seguinte: - instale o IAS no windows - esse software atua como um radius server - configure o freeradius para atuar como um radius client, usando o IAS como radius server. pronto, assim fica mais facil. infelizmente o windows nao eh 100% LDAP. o AD do windows 2003 eh mais LDAP que o AD do windows 2000, mas mesmo assim nao sao 100% compativeis com o padrao LDAP. []s Marcos --- Marcelo Costa escreveu: > Arthur, > > qual ? a pesquisa que o freeradius est? fazendo no > ldap? > o que tem no users.conf? > > eu f? utilizei freeradius+ldap sem problemas. > > []s > Marcelo Costa > > Em 20/8/2006, "Artur Hayne" > escreveu: > > >Ol? a todos, > > > > Eu tenho um problema que parece n?o haver > solu??o. Tenho um servidor openser que deve > autenticar os usu?rios no servidor ldap Active > Directory atrav?s do FreeRadius. Consigo estabelecer > uma se??o do Freeradius com o AD, porem quando o > usu?rio tenta se autenticar atraves de um > softphone, passando pelo FreeRadius, aparece um > erro. > > > > Vejam aqui o debug do Radius: > > > > radius_xlat: 'ou=bli,dc=blo,dc=blu,dc=br' > > rlm_ldap: ldap_get_conn: Checking Id: 0 > > rlm_ldap: ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in > ou=bli,dc=blo,dc=blu,dc=br, with filter (uid=jab) > > rlm_ldap: object not found or got ambiguous > search result <---------- essa linha!!! > > rlm_ldap: search failed <---------- essa linha!!! > > rlm_ldap: ldap_release_conn: Release Id: 0 > > modcall[authorize]: module "ldap" returns > notfound for request 47 <---------- essa linha!!! > > modcall: leaving group authorize (returns ok) for > request 47 > > rad_check_password: Found Auth-Type DIGEST > > auth: type "digest" > > Processing the authenticate section of > radiusd.conf > > modcall: entering group authenticate for request > 47 > > rlm_digest: Configuration item "User-Password" or > MD5-Password is required for authentication. > <---------- essa linha!!! > > modcall[authenticate]: module "digest" returns > invalid for request 47 <---------- essa linha!!! > > modcall: leaving group authenticate (returns > invalid) for request 47 > > auth: Failed to validate the user. <---------- > essa linha!!! > > > > Eu vi alguns tutoriais mostrando como autenticar > no dominio utilizando a ferramneta ntlm_auth, mas > ela parece que so funciona com o protocolo mschap, > sendo que o Openser utiliza o digest para > autenticar. > > No radiusd.conf o digest e o ldap est?o > descomentados tanto para autentica??o como para > autoriza??o. > > ? necess?rio fazer alguma configura??o nos > aquivos users ou em outro? > > Eu ainda estou tentando entender um pouco mais do > Freeradius. > > > > Obrigado. > > > > > > > >--------------------------------- > > O Yahoo! est? de cara nova. Venha conferir! > >__ > >masoch-l list > >https://eng.registro.br/mailman/listinfo/masoch-l > __ > masoch-l list > https://eng.registro.br/mailman/listinfo/masoch-l > --------------------------------- Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. Registre seu aparelho agora! --------------------------------- Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. Registre seu aparelho agora!

2 1

Proxy Control
by Josh 12 Sep '06

12 Sep '06

I have a VPN appliance authenticating users (~20 users) against my freeradius server. I have another radius server running on a windows box authenticating users on local and trusted domains (250+ users). For technical reasons I can't point the VPN appliance to the windows radius server. However, I'm setting up a proxy on the freeradius server to redirect auth requests to the windows radius server (to authenticate VPN users with active directory). The problem now is all 250+ users can essentially authenticate on the VPN. I'm wondering if there is a way to control which users (the ~20 users) in freeradius can be proxied to the windows radius server? Almost like a list of valid proxy users? Josh __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 4

FreeRadius suport IPv6 ??????????????/
by 나종현 12 Sep '06

12 Sep '06

3 3

Probs with pppoe-server + radius
by Ali Jawad 12 Sep '06

12 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Guys Iam using freeradius on a debian sarge box. I use the following : noccbox:~# freeradius -v freeradius: FreeRADIUS Version 1.1.2, for host , built on Jul 2 2006 at 11:19:11 noccbox:~# uname -a Linux noccbox 2.6.8-3-686 #1 Sat Jul 15 10:32:25 UTC 2006 i686 GNU/Linux I have dialup-admin installed and configured sql.conf accordingly. I have downloaded NTRadping and added my windows machine to the /etc/raddb/clients file. Then I sent an authenication request using my root password "WITH CHAP TURNED OFF". It was successfull and I got the following reply. Sending authenication request to server 192.168.1.1:1812 Transmitting packet, code=1 id=12 length=44 receied reponse from server in 16 milliseconds reply packet code=2 id = 12 length=20 reponse: Access-Accept Then I did the same test with "CHAP TURNED ON" the test failed and returned the following: Sending authenication request to server 192.168.1.1:1812 Transmitting packet, code=1 id=13 length=45 receied reponse from server in 2000 milliseconds reply packet code=3 id = 13 length=20 reponse: Access-Reject The info above is to help you guys in helping me pinpoint my prolem, my real problem is that I can dial into my server using pppoe and simple chap and/or pap authenication. However once I use radius to authenicate the pppoe-dialup requests into the server. I get the following output in pppd.log Using interface ppp0 Connect: ppp0 <--> /dev/pts/1 rc_read_mapfile: can't read /etc/radiusclient/port-id-map: No such file or directory RADIUS: Can't read map file /etc/radiusclient/port-id-map Peer root failed CHAP authentication Connection terminated. pppoe: read (asyncReadFromPPP): Session 4: Input/output error Terminating on signal 15 Using interface ppp0 Connect: ppp0 <--> /dev/pts/1 Terminating on signal 15 Connection terminated. Modem hangup pppoe: read (asyncReadFromPPP): Session 5: Input/output error Any help would be welcome. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFBl7rkgA8mKGs24MRAjgCAKChmFQ5NRD3v06cz22AKLe9INM2gACeK/ja teE0/8nQfY7xagP3BJ2CT7o= =+Vfz -----END PGP SIGNATURE-----

2 2

STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the comunication-----------------------------------
by ego seek 12 Sep '06

12 Sep '06

Does Anybody know HOW I can make radius WORK with md5-stored password in the db? I use EAP-PEAP-MSCHAPv2, and if the system works great if the pwds are in clear in the mysqlDB best regards. Nicola

4 3

FreeRADIUS install time errors on Solaris
by Ronak Sutaria 12 Sep '06

12 Sep '06

Hello, I am trying to compile and install the latest FreeRADIUS version 'freeradius-1.1.3' on Solaris 5.8 I am able to run the './configure' and 'make' commands, but when I run 'make install' I'm getting the following error: /nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/install-sh -c -c .libs/libradius.lai /usr/local/lib/libradius.la /nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/install-sh -c -c .libs/libradius.a /usr/local/lib/libradius.a chmod 644 /usr/local/lib/libradius.a ranlib /usr/local/lib/libradius.a /nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/libtool: ranlib: command not found make[4]: *** [install] Error 127 make[4]: Leaving directory `/nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/src/lib' make[3]: *** [common] Error 2 I can gather that my solaris instance is missing the 'ranlib' command- but I was wondering if someone could tell me which is the package I need to install on solaris for the 'make install' to work fine? Is there anything else that I could be doing wrong here? Help is much appreciated, in advance! Thanks, Ronak

2 2