- Freeradius-Users - lists.freeradius.org

RE: RADTEST
by Atkins, Dwane P 23 Mar '06

23 Mar '06

I have looked at the radius.log file and continue to get this: Thu Mar 23 12:47:48 2006 : Auth: rlm_unix: [atkinsd]: invalid password But I have it in radcheck and can prove it. Does anyone know what is going on? Thanks for all your help. Getting frustrated and even time off of this didn't help. Dwane ________________________________ From: Atkins, Dwane P Sent: Thursday, March 23, 2006 11:24 AM To: 'freeradius-users(a)lists.freeradius.org' Subject: RADTEST I cannot get the radtest to work and this seems to be an integral part of continuing. I can now do a mysql -u radius -p radius and get into mysql. Resetting the password and FLUS PRIVILEGES helped there. I have created a user, atkinsd, on the radius database in radcheck. If I do a radtest atkinsd cisco123 localhost 1645 SHARED, I still get the same error. Why? [root@cleveland raddb]# radtest atkinsd cisco123 localhost 1812 xxxxx (I have tried both 1645 and 1812 with no luck) Sending Access-Request of id 225 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "cisco123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 225 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "cisco123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=225, length=20 rad_decode: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) [root@cleveland raddb]#

2 1

mod_auth_radius: multiple auth attempts
by Christina McAghon 23 Mar '06

23 Mar '06

I am using mod_auth_radius2 with Apache version 2.0.54. When I attempt to authenticate, I see a successful attempt followed by 2 failed attempts, leaving me with a "401 Authorization Required" message in the browser. Any ideas? I have tried increasing the timeout. Here is the relevant portion of my httpd.conf: <IfModule mod_auth_radius-2.0.c> AddRadiusAuth <radius server 1>:1645 shared-secret 5:3 AddRadiusAuth <radius server 2>:1645 shared-secret 5:3 AuthRadiusBindAddress <server IP address> </IfModule> <Directory "/usr/local/apache2/htdocs/secure"> DirectoryIndex index.html AuthType Basic AuthName "secure" AuthAuthoritative off AuthRadiusAuthoritative on AuthRadiusCookieValid 15 AuthRadiusActive On require valid-user </Directory>

1 0

RADTEST
by Atkins, Dwane P 23 Mar '06

23 Mar '06

I cannot get the radtest to work and this seems to be an integral part of continuing. I can now do a mysql -u radius -p radius and get into mysql. Resetting the password and FLUS PRIVILEGES helped there. I have created a user, atkinsd, on the radius database in radcheck. If I do a radtest atkinsd cisco123 localhost 1645 SHARED, I still get the same error. Why? [root@cleveland raddb]# radtest atkinsd cisco123 localhost 1812 xxxxx (I have tried both 1645 and 1812 with no luck) Sending Access-Request of id 225 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "cisco123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 225 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "cisco123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=225, length=20 rad_decode: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) [root@cleveland raddb]#

2 1

RE : Failed Compilation of Freeradius with Mysql since 1.1.0 (Works on 1.0.5)
by Philippe JOYEZ 23 Mar '06

23 Mar '06

Hi all, As suggested by Michael, I've recompiled Mysql with --enable-thread-safe-client and now it works. Thanks to Michael Best regards, -- Disclaimer ------------------------------------ Ce message ainsi que les eventuelles pieces jointes constituent une correspondance privee et confidentielle a l'attention exclusive du destinataire designe ci-dessus. Si vous n'etes pas le destinataire du present message ou une personne susceptible de pouvoir le lui delivrer, il vous est signifie que toute divulgation, distribution ou copie de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expediteur par telephone ou de lui retourner le present message, puis d'effacer immediatement ce message de votre systeme. *** This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender by phone or by replying this message, and then delete this message from your system.

1 0

Multiple responses per user, based on NAS
by John Mylchreest 23 Mar '06

23 Mar '06

Hi guys, I’m currently mulling over two important things for us. Before I state the problems though, any input would certainly be appreciated and also that we have this working at the moment, but it did require a schema change to support. 1: How would radius be able to respond with a different fixed IP address (or a set/subset of other attributes) from radreply, based on the NAS the user connected from? 2: why would you Proxy-To-Realm and point it to a different instance/box, instead of handle it all within the local realm? Ie: Why is handing off the request a good thing, instead of building the functionality into the LOCAL realm. I have my own opinions on this, but I’d like some group input. Currently we have a nasty hack where in the radreply we have an additional field which links to the NAS. In the SQL query (this is all sql backed) we link the NAS field to the real NAS and therefore selectively respond with a different fixed IP, or set of attributes. This as stated, requires a schema hack and I would like to support it without. How would you go about it? For the record, the same goes against radgroupcheck/reply but that should follow suit with any solution. Any suggestions welcome, Cheers. John -- John Mylchreest ioko T: +44 (0)1904 438000 x324 M: +44 (0)7730 529047 E: john.mylchreest(a)ioko.com Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Authentication with LDAP
by fvt3 23 Mar '06

23 Mar '06

Question, How do you hide password that is sent to LDAP so it will not show up in the log and in debug mode ..Thanks in advance __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

RE: Error building version 1.1.1
by Sandworm 23 Mar '06

23 Mar '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Nicolas Baradakis wrote: >But the next line shows that installation is done in the parent >directory /var/tmp/freeradius-root/usr. That is what I am seeing. Files are being created in the parent directory (see below), but the symlink is being attempted from lib directory which does not exist. [rdev@e15 usr]# pwd /var/tmp/freeradius-root/usr [rdev@e15 usr]# ls bin libradius-1.1.1.so libradius.a libradius.la libradius.so sbin share -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkQglL8ACgkQmw4BJyaatJ2O/ACgrSMol1U1pxGJKWfe18MYcHW1MaoA n0w8lr3c+EyDX4R7DLhLYcTaQ8v0 =2Zi1 -----END PGP SIGNATURE-----

6 8

Re: Error building version 1.1.1
by Frank Büttner 23 Mar '06

23 Mar '06

That is not possible, because I use rpmbuild. I it only possible to patch the sources. But what have changed?? 1.1.0 will work without any problems!!! Nicolas Baradakis schrieb: > Frank Büttner wrote: > >> Ok now compiling works, but at make install I get another error: >> ln -s libradius.la /var/tmp/freeradius-1.1.1-Frank-buildroot/usr/lib/libradius-1.1.1.la >> ln: creating symbolic link `/var/tmp/freeradius-1.1.1-Frank-buildroot/usr/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory > > Now it's the same error as posted yesterday by someone else. I don't > know exactly how to fix the bug because I've no problem to build a > Debian package. > > Could you please try if the following patch fixes the problem? > > Index: src/lib/Makefile > =================================================================== > RCS file: /source/radiusd/src/lib/Makefile,v > retrieving revision 1.20.4.3 > diff -u -r1.20.4.3 Makefile > --- src/lib/Makefile 10 Feb 2006 19:47:04 -0000 1.20.4.3 > +++ src/lib/Makefile 21 Mar 2006 17:19:21 -0000 > @@ -48,6 +48,6 @@ > rm -rf .libs > > install: all > - $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir) > + $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir)/$(TARGET).la > rm -f $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la; > ln -s $(TARGET).la $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la > Index: src/modules/rlm_eap/libeap/Makefile > =================================================================== > RCS file: /source/radiusd/src/modules/rlm_eap/libeap/Makefile,v > retrieving revision 1.1.4.2 > diff -u -r1.1.4.2 Makefile > --- src/modules/rlm_eap/libeap/Makefile 10 Feb 2006 19:47:09 -0000 1.1.4.2 > +++ src/modules/rlm_eap/libeap/Makefile 21 Mar 2006 17:19:21 -0000 > @@ -38,6 +38,6 @@ > rm -rf .libs > > install: all > - $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir) > + $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir)/$(TARGET).la > rm -f $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la; > ln -s $(TARGET).la $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la > >

3 2

Freeradius ip allocation.
by Ashwin Gobind 23 Mar '06

23 Mar '06

Is it possible to use freeradius to dynamically allocate ip adrreses from predefined pools. I want to assign an ip address from a specific set of pools, which pool to use is to be determined by the NAS Identifier & the Called-Station-Id of the AccessRequest. Also to throw another complication in, these ip's should be consistent over 3 radius servers that are load balanced. Thanks �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.co.za/legal/email.jsp "

3 2

Error message when using Simultaneous-use with EAP
by JVUVANT Yahoo 23 Mar '06

23 Mar '06

Hi all I'm trying to use Simultaneous-Use to limit sessions connexions, but I havre following message: ... [/usr/local/etc/raddb/users]:217 WARNING! Check item "Simultaneous-Use" ?found in reply item list for user "jvuvant". ?This attribute MUST go on the first line with the other check items ... Someone can help me ? Here is users configuration file for this account: Jvuvant Auth-Type := EAP, User-Password =="ayati" Simultaneous-Use=1 Other question How to use freeradius with Mysql ? Thanks Jacques ___________________________________________________________________________ Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international. Téléchargez sur http://fr.messenger.yahoo.com

2 1