- Freeradius-Users - lists.freeradius.org

RE: EAP module Problem
by King, Michael 03 Mar '06

03 Mar '06

> -----Original Message----- > > > yes ssl, is fun :-) > > now i have another problem, it seems that the the peap module > isnt loading... because when i will compile ./configure > rlm_eap_tls or other ssl modules he says me that iv not > installed openssl but i have installed it. > whats the problem??? > /usr/local/openssl i compiled it by myself... its > openssl-0.9.8a, and later ive installed with apt-get but the > same error... > > >alan I think you just said the magic words. (apt-get) Your using Debian. Are you using th Debian FreeRADIUS package? If so, OpenSSL support is not in the Debian Binary. (It's against the OpenSSL license to distribute it, there is a fun conversation on this in the Debian bug reports) I"ve got a doc on how to create your own local Debian package that includes OpenSSL and all the steps nesscary to install it. Email me directly, and I'll send it to you. I want to go over it a bit, it's still very rough in the later phases. (Joining to an Active Directory Domain) but it's pretty close to done in the building package statge. When I'm finished with it, I'm going to put it up on the Wiki.

1 0

Adding attributes to the reply of a proxied request
by Kristofer Sigurdsson 03 Mar '06

03 Mar '06

Hi list, I have a Linux box running FreeRADIUS 1.0.4. What I'd like to do is receive authentication requests for many groups of users from the same NAS boxes. The identifier for the different types of users would be the @domain part of their username. I'd like to proxy requests to different RADIUS servers based on their domain, which is fairly easy, but what I'd also like to do, is that when the reply from the other RADIUS server comes, add an attribute to the reply. For example: 1. A request comes in, it's user@dadada 2. FreeRADIUS sends a request to RADIUS server 192.168.2.1, because of the @dadada part. 3. RADIUS 192.168.2.1 replies with, "OK, accepted, Framed-IP-Address is this, Framed-Route is that..." 4. FreeRADIUS adds "cisco-avpair: lcp:ip vrf dadada-vrf" and sends the reply back to the NAS. Also, if at all possible, I'd like to be able to strip out attributes sent by the other RADIUS server, eg. if that server includes any cisco-avpair stuff (other than name servers), I'd like to strip that from the reply before it gets to the NAS. Any pointers would be appreciated. I've been looking through the archives, but I can't seem to find a way to modify the replies from the other RADIUS server. Thanks in advance, Kristo

2 2

Ldap-Group and EAP
by Benoît Bianchi 03 Mar '06

03 Mar '06

I have trouble to set up some authorization upon ldap attribute of the user: I have different SSID for my wireless LAN, using WPA or WPA2 with EAP/TTLS and ldap auth which work fine right now with Freeradius How can I prevent user without some ldap special attribute to get authenticated on a special SSID (which is send with the access request as: Called-Station-Id = "00-12-34-56-78-90:SSID" ) ???

1 0

realms in DB
by Santiago Balaguer García 03 Mar '06

03 Mar '06

1 0

EAP module Problem
by Konne 03 Mar '06

03 Mar '06

hi i ve a problem with the eap module, i think its a problem with the certificate... but i used the CA.all script from freeradius... freeradius:~# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/lbs-certs/priv-srv.pem" tls: certificate_file = "/etc/lbs-certs/cert-srv.pem" tls: CA_file = "/usr/src/802/radius/freeradius-snapshot-20060227/scripts/demoCA/cacert.pem" tls: private_key_password = "lbsbz23kliu87nfgqeq3" tls: dh_file = "/etc/lbs-certs/dh" tls: random_file = "/dev/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" 17062:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:454: 17062:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:425: 17062:error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib:ssl_rsa.c:669: rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap: Module instantiation failed.

2 3

SQL Accounting and Null Attribute Values
by trs 02 Mar '06

02 Mar '06

Accounting queries fail if an attribute is null when supplied as a value for certain column types. Partial line from debug output: radius_xlat: 'UPDATE radacct SET AcctStartTime = '2006-03-02 01:18:04', AcctStartDelay = '', It fails with: rlm_sql (sql): Couldn't update SQL accounting START record - ERROR: invalid input syntax for type bigint: "" Can freeradius substitute a zero if an integer attribute is missing from an accounting packet, instead of just a null value?

2 3

radiusd and PEAP
by Riccardo.Veraldi 02 Mar '06

02 Mar '06

PEAP authentication will no work with kerberos is it irght ? I can use EAP-TTLS with kerberos and it works fine but not EAP-PEAP. is this because PEAP users mschapv2 which si a challenge ? thanks Rick

2 1

multiple User-Passwords
by Stefan Winter 02 Mar '06

02 Mar '06

Hi list, again something from the legacy-auth-backend to radius freak cabinet: I need to have more than one password for a small group of users (which had a seperate one for dial-up vs. other services). All of these pw are available in clear text, so I thought I could mis-use the mySQL tables to allow both with the following trick: Attribute: User-Password op: =~ Value: (pass1|pass2) This doesn't work; even though in my understanding it should. I found a different way: using the same syntax in the "users" file works beautifully: name User-Password =~ (pass1|pass2), Auth-Type := Accept That did it. However, I'd like to stick with pure SQL as a backend. Is there some reason why this doesn't work, or is it just a bug/inflexibility of the rlm_sql(_mysql) module? Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Radius Features
by mohammad flaifel 02 Mar '06

02 Mar '06

Hi all, I need to install a radius server and i already testes freeradius and seems is really good. i need to know if freeradius supports: - Change of Authorization while the subscriber's PPP session is still connected. - Disconnect users based on download volume limitation regards, Flaifel Regards, ------------------------------------------------------------------- Mohammad Flaifel Senior System Engineer Jordan Telecom Network Operation Center Tel: (+962) 6 5805-214 Mob: (+962) 777 374-933

2 1

Replace Cisco Secure ACS 3 with FreeRadius
by Michael Castillo 02 Mar '06

02 Mar '06

For our dial in users and some vpn clients we are using Cisco Secure ACS3 which is authenticating with Novell NDS. Would that configuration be possible using FreeRadius? Thanks

3 2