- Freeradius-Users - lists.freeradius.org

PsionTeklogix 9150
by LUX Wissenmeyer Daniel 29 Mar '06

29 Mar '06

Hello, i would like to use freeradius authentication for psionteklogix 9150, instead of local authentication. Has sombody an experience with such client? thks, daniel

1 0

Shared secret is wrong, except that it isn't?
by seebs＠plethora.net 29 Mar '06

29 Mar '06

Okay, I'm sorta stumped here. I'm getting the exact behavior described for "shared secret is wrong", but I am pretty confident that it isn't. FreeRadius 1.1.1, installed on NetBSD 3.0/amd64. Synopsis: No matter how cleverly I try to make sure I have the right shared secret, I get garbage passwords. My clients file says: 127.0.0.1 foobar I'm using radtest: radtest user pw localhost 10 foobar I get: auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [beta1]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! There are no unprintable characters in the password I'm sending. So. The one thing I can think of is the 64-bit environment, because an old version of cistron-radiusd I was skimming once had a comment about assumptions about the size of long and the size of (void *). However, even then, I would expect that a radtest and a radiusd built and running on the same server would, even if they were doing it wrong, do it wrong in precisely compatible ways! So, uhm. Where exactly is this encryption happening? It looks like lib/radius.c is the place where shared secrets are used, but the code seems to be substantially different from the cistron code I vaguely remember from way back when. In particular, I don't remember this MD5 stuff... -s

3 3

Expiration Date using Freeradius 1.1.1 and mysql
by Atkins, Dwane P 29 Mar '06

29 Mar '06

Good morning all, I would like to be able to begin and expire accounts on certain dates, but I would like to be able to do it by input information into the radius database that I have created using mysql. Also, I appreciate the help you all have given. If I have one bit of information to share with new freeradius people, it is to slow down and do not get ahead of yourself. Once I took it step by step, all the piece feel into place. I get access-accepts using radtest, sql logins and even NTRadPing. So I have come quite far in a week. Thanks again. Dwane

2 1

RE: Different user attributes based on NAS-IP-Address? AlsoSuffixwildcards available?
by John Mylchreest 29 Mar '06

29 Mar '06

Can you give me an example in SQL please of how I might implement it using this fashion? Is it not just a case of if it passes radcheck, then it will respond with radreply? -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 28 March 2006 18:14 To: FreeRadius users mailing list Subject: Re: Different user attributes based on NAS-IP-Address? AlsoSuffixwildcards available? "John Mylchreest" <John.Mylchreest(a)ioko.com> wrote: > When you mean key off the NAS-IP-Address, do you mean like I > suggested in my previous example, or a cleaner solution? The NAS-IP-Address can be used as a check item, just like anything else. DEFAULT NAS-IP-Address == 1.2.3.4 Reply-Message = "Hello you guy from 1.2.3.4" The same config can be applied to SQL. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

2 1

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 29 Mar '06

29 Mar '06

Hi, > From: "Natalia Escalera" <nescalera(a)gmail.com> > > We tried FR 1.1.1 and we are still having problems with > passwords containing > special characters like '$' for the LDAP authentication. In > FR 1.1.0 the '$' > was replaced by a character such as '%24'. For the new > version, the symbol > '$' is deleted as well as the character that is next to it. Here is an > example of the executed command and its output: > > Command: > /usr/local/bin/radtest username "test$2006" x.x.x.x 1 test123 > Output: > Sending Access-Request of id 215 to x.x.x.x port 1812 > User-Name = "username" > User-Password = "test006" #<----- No dollar sign, no number 2 > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1 > rad_recv: Access-Reject packet from host x.x.x.x:1812, > id=215, length=20 That seems to be a problem with the radtest/radclient. Can you test with some "real" RADIUS client? The server may now work correctly but the special characters in User-Password seem to be "destroyed" by the radtest/radclient so they are never sent to the server. I haven't tested 1.1.1 yet, so unfortunately I cannot give more specific help :( -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

opening sockets in modules
by radhika putty 29 Mar '06

29 Mar '06

Hi.. Are we allowed to open sockets inside a module and communicate with other programs. If not then how else can we communicate with other network programs.. --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.

3 2

Re: RADTEST
by Atkins, Dwane P 29 Mar '06

29 Mar '06

Alan and all, Thanks for your help. Here is an issue that I cannot get worked out. However, if I run the > mysql -u radius -p radius command it will take me right to the radius database so it is working (right?) sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Then tell the server to use that password instead of the Unix module Where is this process at? I cannot find it in the Radius book I bought. Thanks Dwane Message: 3 Date: Thu, 23 Mar 2006 14:30:00 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: RADTEST To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20060323193001.1C92716CC1(a)mail.nitros9.org> "Atkins, Dwane P" <ATKINSD(a)uthscsa.edu> wrote: > I have looked at the radius.log file Don't. Run the server in debugging mode. > Thu Mar 23 12:47:48 2006 : Auth: rlm_unix: [atkinsd]: invalid password The Unix module says that the password is wrong, or the user doesn't exist in /etc/passwd. > But I have it in radcheck and can prove it. Then tell the server to use that password instead of the Unix module. Alan DeKok. Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

3 6

(no subject)
by Mark Supersonik 29 Mar '06

29 Mar '06

Hi friends! I speak from the tongue of an engineering student in a research group trying to implement a RADIUS proxy system. My doubt is: can a freeradius server do first an authorization of a request throught a DB (i.e MySQL) and proxy then if so or reject it (if all isn't in rule)? I mean, summarizing: Can a request be authenticated/authorized for two times? We want only to accept access if each one of the two servers process the authentication successfully. Thanks in advance for all the support you can give us, hope to hear from you Marc (Nets Research Group [Pompeu Fabra University]) _________________________________________________________________ ¿Estás pensando en cambiar de coche? Todas los modelos de serie y extras en MSN Motor. http://motor.msn.es/researchcentre/

1 0

Upgrade Freeradius
by Paulo Cabrita 29 Mar '06

29 Mar '06

Hello. I have a network where wireless users use the freeradius to authenticate via OpenLDAP (in an another box) I recently installed the 1.1.0 version using last version of the SLES for OS and everything worked well. I did the following: ./configure --with-openssl-includes=/usr/local/openssl/include --with-openssl-libraries=/usr/local/openssl/lib --prefix=/usr/local/radius --with-rlm-ldap-lib-dir=/usr/local/openldap/lib/ --with-rlm-ldap-include-dir=/usr/local/openldap/include/ make make install Before, I installed openssl (0.9.8a) like this: ./config --prefix=/usr/local/openssl shared make make install From the radiusd.conf I have: ... ldap { server = "192.168.2.4" port = 636 basedn = "ou=users,dc=ual,dc=pt" filter = "(mail=%{User-Name})" start_tls = no access_attr = "radiusClientIPAddress" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 30 timeout = 60 timelimit = 60 net_timeout = 60 } ... It runs perfectly well but when it received a request from a client, I have the following error: Error: rlm_ldap: could not set LDAP_OPT_X_TLS option Success Using "clear" comunication (ldap://), it works well, so I definitively have a problem with TLS/SSL. I have the same configuration in an another box using freeradius 1.0.5 and it works fine. Any idea? TIA -- Atentamente, ------------------------------------ |Paulo Cabrita, Msc | |Director do Centro de Informática | |da Universidade Autónoma de Lisboa| |Tel: +351-213177635 | |Fax: +351-213533702 | |E-mail: pjc(a)ual.pt | ------------------------------------

1 0

v1.1.1 build problems (SSL, EAP)
by Bill Roberts 29 Mar '06

29 Mar '06

Hi, I'm just posting my experiences in building v1.1.1 in case it is of use to anyone else with similar problems. My system is Solaris 10 Sparc, Freeradius v1.1.1, OpenSSL 0.9.8a, Sun compiler version 5.7 (SunStudio 10). I ran configure like this: ./configure --with-raddbdir=/usr/local/etc/raddb --with-openssl-includes=/usr/local/ssl/include --with-openssl-libraries=/usr/local/ssl/lib (OpenSSL 0.9.8a is installed in /usr/local/ssl) In the midst of the configure output I saw this: configure: warning: skipping test for openssl/ssl.h This ultimately caused compilation errors in rlm_eap_peap.c: "../../libeap/eap_tls.h", line 138: syntax error before or at: SSL "../../libeap/eap_tls.h", line 141: syntax error before or at: BIO "../../libeap/eap_tls.h", line 186: syntax error before or at: SSL "../../libeap/eap_tls.h", line 186: warning: undefined or missing type for: SSL "../../libeap/eap_tls.h", line 187: warning: undefined or missing type for: cons When I investigated by looking at the config.log there was a "not found" error for libcrypto. It turns out that the configure script has this line in the "test for libcrypto" section: LIBS="-lcrypto $LIBS" In my case, this expands to: -lcrypto -L/usr/local/ssl/lib .....<other stuff deleted>.... Which means libcrypto is not found because it is listed before the -L directive telling the compiler where it can be found. OK, easy fix, so I edit configure and change the LIBS line to be "$LIBS -lcrypto". This gets me past the libcrypto test but the scsript then fails the next test for libssl and I can't use the same fix (I suspect for reasons related to library order). In the end I decide to fudge the crypto and ssl tests by removing the DH_new(); and SSL_new(); calls from the conftest C programs. Everything then builds OK until rlm_perl.c when I see: "rlm_perl.c", line 165: syntax error before or at: CV I found an article on the FreeRadius users mailing list archive ( http://www.archivesat.com/FreeRadius_users_mailing_list/thread357241.htm ) about rlm_eap compilation problems where it was suggested that removing the rlm_eap directory would allow the build to finish and the server to run. So I removed src/modules/rlm_perl and src/modules/rlm_eap and I now have a running server. Regards, Bill Roberts

2 1