- Freeradius-Users - lists.freeradius.org

Eap-Tls Problem
by Matteo Lazzarini 25 Aug '06

25 Aug '06

Freeradius I have installed last version available (1.1.2 that it seems to work!) but I know that there is also an August version SNAPSHOT but to me it has given problems in compile and did not install me module EAP-TLS (bug Debian). The lib I have installed to them with the command apt-get install openssl libssl-dev and this is the command dphg - l|grep SSL ii libflac++5c2 1.1.2-1ubuntu2 Free Lossless Audio Codec - C++ runtime libr ii libflac7 1.1.2-1ubuntu2 Free Lossless Audio Codec - runtime C librar ii liboggflac3 1.1.2-1ubuntu2 Free Lossless Audio Codec - runtime C librar ii libssl-dev 0.9.7g-1ubuntu1.1 SSL development libraries, header files and ii libssl0.9.7 0.9.7g-1ubuntu1.1 SSL shared libraries ii libwww-ssl0 5.4.0-9ubuntu0.5.10 The W3C-WWW library (SSL support) ii openssl 0.9.7g-1ubuntu1.1 Secure Socket Layer (SSL) binary and related ii python-pyopenssl 0.6-2ubuntu1 Python wrapper around the OpenSSL library (d ii python2.4-pyopenssl 0.6-2ubuntu1 Python wrapper around the OpenSSL library, e ii ssl-cert 1.0-11 Simple debconf wrapper for openssl On the Openssl site many versions can be downloaded which 0.9.7a-x, 0.9.8a-x, ecc.. Which the correct version? Someone knows gives to me of the information to care of coupled freeradius-version&Openssl-version? anticipated thanks Matteo

2 3

Active Directory/freeradius/enterasys - combination
by Michael Messner 24 Aug '06

24 Aug '06

hello, we are testing the 802.1x authentication in a small test network. (http://www.enterasys.com/products/whitepapers/secure-networks-wp.pdf) The user management works via an active directory on a Windows 2003 server, a Freeradius on a Linux machine, and the switch is an Enterasys Matrix-series. Windows 2003 (AD) <---> Freeradius <---> Enterasys switch <---> Linux/MS-Client The user is able to authenticate with PEAP and MD5 from a Linux and a Windows Client. Active Directory and Freeradius (ntlm_auth) give the OK as well. The Enterasys switch is dynamically configured with the Policy Manager. Therefore it is possible to define rules for various user groups, and in the AD different user groups are defined. Now the switch needs the group to user information from the AD with the filter ID, which normally looks like this: Filter-Id = "Enterasys:version=1:mgmt=su:policy=adminrole" If I define the users on the Radius with the help of the users file it is no problem and it works perfectly, but how can I use the information from the AD? The problem is that the users are correctly authenticated, but the switch doesn't have information what to do with these users and they get an invalid role and furthermore they don't get access to the network (they are assigned to the default role which is a blocking role)! We made the first tests with the IAS from Microsoft where we created different "Remote Access Policies", and there we added the different user groups from the AD. I've not found anything in the Internet concerning this very matter, so I hope someone of you can give me more information how this can be realized. Thanks! mIke

6 12

Re: Cannot compile and run on Mac OS X 10.4.7
by Lasse 24 Aug '06

24 Aug '06

I followed the info in the Mac OS Read Me file, which is included in the Docs folder I believe. I uncommented the references to rlm_eap and rlm_sql, but see the Doc for more info on how to do that and where. /L Den 24/08/2006 kl. 17.04 skrev Michael Check: > On 8/24/06, Lasse <lassejakobsen(a)mac.com> wrote: >> I can't say for sure what the problem is, but 1.0.5 is the last one I >> have been able to get running on Mac OS X. > > Thanks Lasse, can you tell me a bit about your environment in which it > worked? (OSX version, DeveloperTools version, platform, etc.) Did > you change anything at compile or run time? > > Thanks, > > Michael Check > - List info/subscribe/unsubscribe? See http://www.freeradius.org/ > list/users.html

1 0

processes invoked goes <defunct>
by Fabio Pedretti 24 Aug '06

24 Aug '06

I have just upgraded to 1.1.3, but I get again the same error. Fabio > "Fabio" <fabio.ped at libero.it> wrote: > > Install 1.1.2. > > Alan DeKok. My previous message (Thu Jun 1 15:21:59 CEST 2006): Hi, I am using freeradius 1.0.5, configured so that when a user fails the password for X times, a mail is sent to a sysadmin. I have added the following to modules section: exec accept_notify { wait = no program = "/usr/local/etc/raddb/radius_reject_notify %{User-Name} accept %{FreeRADIUS-Proxied-To}" input_pairs = request } exec reject_notify { wait = no program = "/usr/local/etc/raddb/radius_reject_notify %{User-Name} reject %{FreeRADIUS-Proxied-To}" input_pairs = request } and this is my posth-auth section: post-auth { accept_notify Post-Auth-Type REJECT { reject_notify } } radius_reject_notify is the bash script attached. However, when a user log in and the script is executed, I see that the script remains in a <defunct> state. After some time I see hundreds of such processes: Output of ps -e: 13110 ? 00:00:00 radius_reject_n <defunct> 13232 ? 00:00:00 radius_reject_n <defunct> 13233 ? 00:00:00 radius_reject_n <defunct> .... Has someone idea why freeradius does not close correctly my script? Thanks, Fabio radius_reject_notify: #!/bin/bash # #Sintax: # #mail_notify user access type # user: user name # access: accept or reject # type: accepted only if ( == FreeRADIUS-Proxied-To ) == 127.0.0.1 # # TRY: number of retry TRY=10 FAILED_USERS_DIR=/tmp/radius_user_fail/ MAIL_ADMINS="admin at domain.com" USER_RETRY=0 CURRENT_USER=$1 ACCESS=$2 failed() { mkdir -p $FAILED_USERS_DIR if [ -e $FAILED_USERS_DIR/$CURRENT_USER ] then USER_RETRY=`cat $FAILED_USERS_DIR/$CURRENT_USER` fi USER_RETRY=$(( USER_RETRY + 1 )) echo $USER_RETRY > $FAILED_USERS_DIR/$CURRENT_USER if (( USER_RETRY == $TRY )) then #Limit exceded! send_mail fi ; } success() { if [ -e $FAILED_USERS_DIR/$CURRENT_USER ] then rm -f $FAILED_USERS_DIR/$CURRENT_USER fi } send_mail() { HOSTNAME=`hostname` env MAILRC=/dev/null from=radius.admin@$HOSTNAME smtp=smtp.domain.com nail -n -s "RADIUS - Autentication failed $TRY times" $MAIL_ADMINS <<-END $CURRENT_USER failed authentication for $TRY times. END } case $3 in '127.0.0.1') case $ACCESS in 'accept') success ;; 'reject') failed ;; esac ;; esac

2 1

MSCHAP-SUCCESS message in TTLS/MSChapV2
by Andrew 24 Aug '06

24 Aug '06

Hi, I am trying to use wpa_supplicant with freeradius server. I am using FreeRadius server version 1.1.2. I read a wpa_supplicant document saying the FreeRadius server does not send MSChap-Success message at the end of a successful TTLS/MSCHAPV2 authentication. It only sends EAP-Success. Is that true? Is there anyway to fix this? Thanks, Andrew -- http://www.fastmail.fm - Access your email from home and the web

2 1

freeradius vs vlan
by Szabolcs Géczi 24 Aug '06

24 Aug '06

Hello, I have installed freeradius (1.1.2) on freebsd and would like to use for authorizing ieee-802.1x request coming from hp 2524 switch. But fails to start correctly. radiusd -sfxxyz -l stdout result: /usr/local/etc/raddb/users[217]: Parse error (check) for entry Tunnel-Type:0: expecting '=' Errors reading /usr/local/etc/raddb/users radiusd.conf[1059]: files: Module instantiation failed. radiusd.conf[1817] Unknown module "files". radiusd.conf[1753] Failed to parse authorize section. the relevant part of users.conf: "username" Auth-Type := EAP, User-Password == "password" Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = 12 what do I wrong? sz

2 1

No Such Object available on this agent at this OID
by Hasan Ovuc 24 Aug '06

24 Aug '06

- I copied all mib directory into /usr/share/snmp/mibs/ and added the following lines to my original snmpd.conf : dlmod /usr/share/snmp/mibs/RADIUS-ACC-SERVER-MIB.txt dlmod /usr/share/snmp/mibs/RADIUS-AUTH-SERVER-MIB.txt dlmod /usr/share/snmp/mibs/GNOME-PRODUCT-RADIUSD-MIB dlmod /usr/share/snmp/mibs/RADIUS-STAT-MIB.txt dlmod /usr/share/snmp/mibs/RADIUS-ACC-SERVER-MIB.chart dlmod /usr/share/snmp/mibs/RADIUS-AUTH-SERVER-MIB.chart - smuxpeer .1.3.6.1.4.1.3317.1.3.1 pass I added the following line to radiusd's snmp.conf: - smux_password = pass Uncommented the following lines in radiusd.conf : snmp = yes $INCLUDE ${confdir}/snmp.conf Then I walked over the MIBs to see what can I get with : snmptranslate -m /usr/share/snmp/mibs/RADIUS-STAT-MIB.txt -Tl And tried to get radiusStatUpTime, but got the following error: #snmpwalk -m /usr/share/snmp/mibs/RADIUS-STAT-MIB.txt -v 2c -c sol localhost .1.3.6.1.2.1.67.3.1.2 RADIUS-STAT-MIB::radiusStatUpTime = No Such Object available on this agent at this OID So we can read the MIB but can't get the OID correspondent from the SNMPD which means that SNMPD can't communicate with RADIUS. Also, as another example, I've started the radius server with -X flag and got the following lines on the screen, and couldnt get an answer when I tried 1.3.6.1.4.1.3317.1.3.1, 1.3.6.1.2.1.67.1.1.1.1 or 1.3.6.1.2.1.67.2.1.1.1 : Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

2 1

IAS acting as Proxy
by Fitzner Daniel 24 Aug '06

24 Aug '06

Hi folks, we have the following scenario: Radius-Client (Checkpoint-Firewall NGX) -> IAS-Agent (Windows 2K3) acting as Proxy -> Freeradius-Server (1.0.2) All authentication requests are denied by the Freeradius-Server. It seems that Freeradius cannot read/decrypt the password sended by the IAS, because in logfile the password is like "\226\231\....." Is there any special configuration needed for this scenarion? btw: the scenario without proxy (Radius-Client -> Freeradius-Server) works perfectly... best regards and thanks

2 1

Problem with character Ä in username/password
by Velusamy, Vinodh 24 Aug '06

24 Aug '06

Hi, There seems to be a problem if the username/password contain the character Ä, when trying to authenticate via freeradius. rad_recv: Access-Request packet from host 127.0.0.1:33292, id=245, length=98 User-Name = "\303\251\303\242\303\244\303\245\303\247\303\252\303\250\303\257\303\256\303\254\303\204\303\246\303\264\303\262\303\273" User-Password = "\222\023S~\345v\322\250\207\216\261\206\242J\301\301\251\006\233\026N\374\014\213\036c\022'\220\r\370\210" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "éâäåçêëèïîì@?æôòû", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_unix: [éâäåçêëèïîì@?æôòû]: invalid password modcall[authenticate]: module "unix" returns reject for request 1 modcall: leaving group authenticate (returns reject) for request 1 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- I am using version 1.1.0 on Ubuntu Does anyone know of a workaround or solution to this. Thanks in advance. V~ --- Vinodh Velusamy Software Engineer Ubizen - a Cybertrust company Ubicenter, Philipssite 5, 3001 Leuven, Belgium T: +32 16 28 73 14 F: +32 16 28 71 00 E-mail: vinodh.velusamy(a)ubizen.com www.ubizen.com - www.cybertrust.com

2 8

Simultaneous-Use is not working
by Marwan Sultan 24 Aug '06

24 Aug '06

Hello everyone.. Please help in this issue.. Im on freebsd 6.1, freeradius, chillispot, phpmyprepaid, all latest..and mysql4.1. Everything works good for me, I can create hourly accounts monthly accounts, and on time it will stop.. But there is 1 big major problem.. Im able to use the same username to log again and again from the same username and same online time.. I checked the radcheck in mysql i found Simultaneous-Use =1 (which is created by phpmyprepaid) but its not working ?? I checked my radiusd.conf and found the follow: (this is part of my radiusd.conf) Please tell me if you need to see any file.PLEASE. # This file is used mainly for Simultaneous-Use checking, # and also 'radwho', to see who's currently logged in. # radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. filename = /var/log/radutmp # The field in the packet to key on for the # 'user' name, If you have other fields which you want # to use to key on to control Simultaneous-Use, # then you can use them here. # # Note, however, that the size of the field in the # 'utmp' data structure is small, around 32 # characters, so that will limit the possible choices # of keys. # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # Whether or not we want to treat "user" the same # as "USER", or "User". Some systems have problems # with case sensitivity, so this should be set to # 'no' to enable the comparisons of the key attribute # to be case insensitive. # case_sensitive = yes # Accounting information may be lost, so the user MAY # have logged off of the NAS, but we haven't noticed. # If so, we can verify this information with the NAS, # # If we want to believe the 'utmp' file, then this # configuration entry can be set to 'no'. # check_with_nas = yes # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes" } # "Safe" radutmp - does not contain caller ID, so it can be # world-readable, and radwho can work for normal users, without # exposing any information that isn't already exposed by who(1). # # This is another 'instance' of the radutmp module, but it is given # then name "sradutmp" to identify it later in the "accounting" # section. radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } Thank you, Marwan _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1