- Freeradius-Users - lists.freeradius.org

PEAP + Active directory
by Kartthik Raghunathan 01 Jun '06

01 Jun '06

Am having a strange problem after my supplicant get authenticated to my active directory. My supplicant trying to get authenticated to active directory or validating identity every 60 mins, which disturbs wireless connection that bother me a lot. Is this normal or can i set the timer to authenticate every 120 mins or whatever timing i like. Am using dynamic WEP and it has been set to change the key every 6 hours. Any help will be really appreciated. Thanks in advance. Kartthik -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

PPPoE server + MySQLbackend tutotrial
by Rani Ahmed 01 Jun '06

01 Jun '06

plz do you have totorial links to PPPoE server + MySQL backend?? strait forward and easy to understand. thanks this tool really needs Howtos

1 0

1.1.2 eap problem
by VannMann32 . 01 Jun '06

01 Jun '06

Hi ! Upgrading from 1.1.1 to 1.1.2 and now I get this error message : Thu Jun 1 12:26:22 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Thu Jun 1 12:26:22 2006 : Error: rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory Thu Jun 1 12:26:22 2006 : Error: rlm_eap_tls: Error reading Trusted root CA list Thu Jun 1 12:26:22 2006 : Error: rlm_eap: Failed to initialize type tls Thu Jun 1 12:26:22 2006 : Error: radiusd.conf[10]: eap: Module instantiation failed. Thu Jun 1 12:26:22 2006 : Error: radiusd.conf[1735] Unknown module "eap". Thu Jun 1 12:26:22 2006 : Error: radiusd.conf[1722] Failed to parse authenticate section. My system is a FreeBSD 6.1-Stable

1 0

proxy_fail_type attribute
by Geoffroy Arnoud 01 Jun '06

01 Jun '06

Hi, I just get the last CVS update, and I discovered a "hidden" attribute in mainconfig.c, name "proxy_fail_type". By reading the source code, my understanding is that setting this attribute to "fail" (for example) in proxy.conf, and setting the value "fail" for Post-Proxy-Type in dictionary.freeradius.internal, will allow FreeRADIUS to execute a module when the proxy of a request failed (no response from server or other cases). My 1st question: - Am I right (or near to the truth)? I saw that this was not shipped into 1.1.2. But this feature appeared by the end of 2004. So my 2nd and 3rd questions are: - Has anyone used or is anyone using this feature on prodcution deployement? - Is this feature planned to be shipped in 1.2.x? Thank you in advance. Geof.

1 0

listening interface configuration
by Geoffroy Arnoud 01 Jun '06

01 Jun '06

Hi, I am going to configure a FreeRADIUS as a RADIUS proxy. My proxy will have to listen on a couple of ports on 2 interfaces, so I set the following configuration in radiusd.conf: listen { ipaddr = IP1 port = 1812 type = auth } listen { ipaddr = IP1 port = 1813 type = acct } listen { ipaddr = IP2 port = 1812 type = auth } listen { ipaddr = IP2 port = 1813 type = acct } When I start FreeRADIUS, I get the following ... Listening on authentication IP1:1812 Listening on accounting IP1:1813 Listening on authentication IP2:1812 Listening on accounting IP2:1813 Listening on proxy IP1:1814 ... If I understand packets coming inside IP2, will be forwarded through IP1, right? Is there a configuration solution to make packets coming inside IP2 to be forwarded through IP1, or is FreeRADIUS limited to only one proxy ip/port? Thank you in advance, Geof.

1 0

Filter attributes when proxying
by Martin Zuziak 01 Jun '06

01 Jun '06

Hello all Is it possible to (easily) remove single attributes sent or received when proxying? I know it can be done with attr_filter but if you only want to remove a single attribute while leaving the rest untouched, you need pass rules for every other attribute. It doesn't look like attr_rewrite can remove attributes. Am I wrong? Otherwise I think this would be a nice feature to implement. The attr_filter module can easily (I think) be changed to include a variable to control whether or not passing rules are needed to allow an attribute. Currently attributes are only allowed if they don't fail any rules in attrs and pass at least one rule: if (fail == 0 && pass > 0) This could be changed to something like if (fail == 0 && (pass > 0 || allow_no_match)) where a variable in the attrs file could control if passing rules are required. Sincerely, Martin Zuziak <zuziak(a)math.ku.dk>

1 0

mysql 5.0.22 with fr 1.1.2
by Alexander Serkin 01 Jun '06

01 Jun '06

while trying to compile the fr 1.1.2 with mysql 5.0.22 i got the following with rlm_sq_mysql configure: checking for mysql_config... yes checking for mysql_init in -lmysqlclient (using mysql_config)... no checking for mysql_init in -lmysqlclient... no configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql.h (using mysql_config)... no checking for mysql/mysql.h... yes configure: warning: sql submodule 'mysql' disabled mysql libraries are in /opt/mysql/lib/mysql. The machine is under Solaris 8 x86. crle output says: root@apollo:/usr/local/src/freeradius-1.1.2~# crle Configuration file [3]: /var/ld/ld.config Default Library Path (ELF): /usr/lib:/usr/local/lib:/opt/mysql/lib/mysql:/usr/local/ssl/lib Trusted Directories (ELF): /usr/lib/secure (system default) And /usr/local/mysql is a symbolic link to /opt/mysql. Everything seems to be in place, but configure does not see mysql. What could be the reason? -- Sincerely Yours, Alexander

2 2

configuring Freeradius server + accounting + IP address
by Basavaraja.pv 01 Jun '06

01 Jun '06

Hi All, I am newly joined to this group. I have started working on radius. I am facing some problems in configuring the free radius for accounting purpose and to get the IP address of MS. Please give me some information regarding the same. Thanks in advance. Regards, Basavaraja -----Original Message----- From: freeradius-users-bounces+basavaraja.pv=masconit.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+basavaraja.pv=masconit.com@lists.freera dius.org]On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, May 31, 2006 8:23 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 13, Issue 145 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Session-Octets-Limits (Seferovic Edvin) 2. Re: Session-Octets-Limits (Mordor Networks) 3. 1.1.2 Build Problems - "rlm_eap-1.1.2.soT" - "ld: skipping incompatible" (Alan) 4. Re: 1.1.2 Build Problems - "rlm_eap-1.1.2.soT" - "ld: skippingincompatible" (Stefan Winter) 5. RE: 1.1.2 Build Problems - "rlm_eap-1.1.2.soT" - "ld:skippingincompatible" (Alan) ---------------------------------------------------------------------- Message: 1 Date: Wed, 31 May 2006 12:16:43 +0200 From: "Seferovic Edvin" <edvin.seferovic(a)kolp.at> Subject: RE: Session-Octets-Limits To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <200605311016.k4VAGqgH004541(a)mxdrop18.xs4all.nl> Content-Type: text/plain; charset="us-ascii" >Its working and the user disconnect when reachs the limit but now if the >user disconnect and reconnect it will all start over is there a way to lock >the account? > >so that the user wont be able to connect again? YES, by using sqlcounter module ! This module should count the traffic usage before user is authorized to connect. Regards, Edvin ------------------------------ Message: 2 Date: Wed, 31 May 2006 14:01:28 +0300 From: "Mordor Networks" <mordor.networks(a)gmail.com> Subject: Re: Session-Octets-Limits To: edvin.seferovic(a)kolp.at, "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <f21372cd0605310401g3a2594bcr5efc0297495430ce(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Do i have to patch the sqlcounter module so that it can be used for counting traffic? I have the default sqlcounter in my radius.conf sqlcounter Dailycounter and sqlcounter monthlycounter/ On 5/31/06, Seferovic Edvin <edvin.seferovic(a)kolp.at> wrote: > > >Its working and the user disconnect when reachs the limit but now if the > >user disconnect and reconnect it will all start over is there a way to > lock > >the account? > > > >so that the user wont be able to connect again? > > YES, by using sqlcounter module ! This module should count the traffic > usage > before user is authorized to connect. > > Regards, > Edvin > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

OSX rlm_sql_mysql problem
by Benedikt Baer 31 May '06

31 May '06

Hi, I am trying to compile FreeRadius 1.1.1 on Mac OSX. The ./configure script works well and without errors (as far as I can see) First, when I do make, it finishes good but shows an error: *** Warning: This library needs some functionality provided by -lmysqlclient_r. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: libtool could not satisfy all declared inter-library *** dependencies of module rlm_sql_mysql. Therefore, libtool will create *** a static module, that should work as long as the dlopening *** application is linked with the -dlopen flag. Then, starting freeradius: Fri May 26 13:16:13 2006 : Info: Starting - reading configuration files ... Fri May 26 13:16:14 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Fri May 26 13:16:15 2006 : Error: rlm_sql (sql): Could not link driver rlm_sql_mysql: dlcompat: invalid handle Fri May 26 13:16:15 2006 : Error: rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. Fri May 26 13:16:15 2006 : Error: radiusd.conf[14]: sql: Module instantiation failed. Fri May 26 13:16:15 2006 : Error: radiusd.conf[1585] Unknown module "sql". The mysql libs and headers are in: /usr/local/mysql-max-5.0.21-osx10.3-powerpc/lib/ /usr/local/mysql-max-5.0.21-osx10.3-powerpc/include/ mysql_config: --cflags [-I/usr/local/mysql-max-5.0.21-osx10.3-powerpc/include -O -fno-common] --include [-I/usr/local/mysql-max-5.0.21-osx10.3-powerpc/include] --libs [-L/usr/local/mysql-max-5.0.21-osx10.3-powerpc/lib -lmysqlclient -lz -lm] --libs_r [-L/usr/local/mysql-max-5.0.21-osx10.3-powerpc/lib -lmysqlclient_r -lz -lm] --socket [/tmp/mysql.sock] --port [3306] --version [5.20.21] --libmysqld-libs [-L/usr/local/mysql-max-5.0.21-osx10.3-powerpc/lib -lmysqld -lz -lm] I also tired to copy, link, move various files but it didn't help. Any ideas?? Thanks for your help.

4 11

freeradius 1.1.1 and mysql issues
by simon＠434canada.com 31 May '06

31 May '06

Hi, I am having some issues getting users authenticated using a mysql database. Right now I simply have one user entered into the database, for testing purposes. If I use either NTRadPing from a remote machine or radtest on the actual server using the credentials in the database I get an Access-Accept packet. However, when I try to actually connect using a WinXP laptop, I continually get Access-Reject messages back. It looks like the password isn't making it across, even though I am entering this information on the laptop as it is trying to connect. When I use another user account (that is defined in the users file) to actually connect, everything works fine. Below is the output from the server running in debug mode when I tried to connect: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.10.1.1:2991, id=0, length=123 User-Name = "simon" NAS-IP-Address = 10.10.1.1 Called-Station-Id = "0014bff3dac8" Calling-Station-Id = "0013ce29c6d7" NAS-Identifier = "0014bff3dac8" NAS-Port = 56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a0173696d6f6e Message-Authenticator = 0x45e7cf8668c2564bc36bea9616eced0e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 51 modcall[authorize]: module "preprocess" returns ok for request 51 modcall[authorize]: module "chap" returns noop for request 51 modcall[authorize]: module "mschap" returns noop for request 51 rlm_realm: No '@' in User-Name = "simon", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 51 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 51 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 51 radius_xlat: 'simon' rlm_sql (sql): sql_set_user escaped user --> 'simon' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'simon' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'simon' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'simon' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'simon' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'simon' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 51 modcall: leaving group authorize (returns updated) for request 51 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [simon/<no User-Password attribute>] (from client linksys-434 port 56 cli 0013ce29c6d7) Delaying request 51 for 1 seconds Finished request 51 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 10.10.1.1 port 2991 Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 51 ID 0 with timestamp 447deb46 Nothing to do. Sleeping until we see a request. It seems as though the password isn't getting across, but only when I try to use credentials stored in the database. Any help here would be greatly appreciated. Thanks, Simon

2 1