- Freeradius-Users - lists.freeradius.org

EAP module Problem
by Konne 03 Mar '06

03 Mar '06

hi i ve a problem with the eap module, i think its a problem with the certificate... but i used the CA.all script from freeradius... freeradius:~# freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/lbs-certs/priv-srv.pem" tls: certificate_file = "/etc/lbs-certs/cert-srv.pem" tls: CA_file = "/usr/src/802/radius/freeradius-snapshot-20060227/scripts/demoCA/cacert.pem" tls: private_key_password = "lbsbz23kliu87nfgqeq3" tls: dh_file = "/etc/lbs-certs/dh" tls: random_file = "/dev/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" 17062:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:454: 17062:error:0906A065:PEM routines:PEM_do_header:bad decrypt:pem_lib.c:425: 17062:error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib:ssl_rsa.c:669: rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap: Module instantiation failed.

2 3

SQL Accounting and Null Attribute Values
by trs 02 Mar '06

02 Mar '06

Accounting queries fail if an attribute is null when supplied as a value for certain column types. Partial line from debug output: radius_xlat: 'UPDATE radacct SET AcctStartTime = '2006-03-02 01:18:04', AcctStartDelay = '', It fails with: rlm_sql (sql): Couldn't update SQL accounting START record - ERROR: invalid input syntax for type bigint: "" Can freeradius substitute a zero if an integer attribute is missing from an accounting packet, instead of just a null value?

2 3

radiusd and PEAP
by Riccardo.Veraldi 02 Mar '06

02 Mar '06

PEAP authentication will no work with kerberos is it irght ? I can use EAP-TTLS with kerberos and it works fine but not EAP-PEAP. is this because PEAP users mschapv2 which si a challenge ? thanks Rick

2 1

multiple User-Passwords
by Stefan Winter 02 Mar '06

02 Mar '06

Hi list, again something from the legacy-auth-backend to radius freak cabinet: I need to have more than one password for a small group of users (which had a seperate one for dial-up vs. other services). All of these pw are available in clear text, so I thought I could mis-use the mySQL tables to allow both with the following trick: Attribute: User-Password op: =~ Value: (pass1|pass2) This doesn't work; even though in my understanding it should. I found a different way: using the same syntax in the "users" file works beautifully: name User-Password =~ (pass1|pass2), Auth-Type := Accept That did it. However, I'd like to stick with pure SQL as a backend. Is there some reason why this doesn't work, or is it just a bug/inflexibility of the rlm_sql(_mysql) module? Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Radius Features
by mohammad flaifel 02 Mar '06

02 Mar '06

Hi all, I need to install a radius server and i already testes freeradius and seems is really good. i need to know if freeradius supports: - Change of Authorization while the subscriber's PPP session is still connected. - Disconnect users based on download volume limitation regards, Flaifel Regards, ------------------------------------------------------------------- Mohammad Flaifel Senior System Engineer Jordan Telecom Network Operation Center Tel: (+962) 6 5805-214 Mob: (+962) 777 374-933

2 1

Replace Cisco Secure ACS 3 with FreeRadius
by Michael Castillo 02 Mar '06

02 Mar '06

For our dial in users and some vpn clients we are using Cisco Secure ACS3 which is authenticating with Novell NDS. Would that configuration be possible using FreeRadius? Thanks

3 2

RE: Problem with ntlm_auth
by King, Michael 02 Mar '06

02 Mar '06

> -----Original Message----- > On Behalf Of Phil Mayers > > It is supposed to be like that. It's been like that forever > as far as I know. I don't know why it was working for you - > is your samba from an OS package and it's possible they > changed the perms? > > (It's even worse on RHEL4 systems - there's a buggy SELinux > policy that labels that directory so ntlm_auth can't access it!) Ack, it's even worse than I thought. I was running my previous FreeRADIUS server as root! So, that's why it didn't bite me before, it had root access. When I setup my new server, I had it running as it's own user account. Thanks for the answer. It always seems to be the simple things.

1 0

freeradius, user log in, simul use, and radius shut down
by Przemysław Backiel 02 Mar '06

02 Mar '06

Hello What I have to do, when: user connect (simultaneous use 1) and while he is conncected to the network I shut down the radius. After that, when he reconnect he is not able to login to the network, so my question how I can clean sth in sql or what i have to run, to clear that dead sesions after what, the user will be able to connect to the network -- Z powazaniem Przemyslaw Backiel

1 0

Long mysql queries in sqlcounter get truncated.
by Luis Zarrabeitia 02 Mar '06

02 Mar '06

Hi. I'm trying to configure a freeradius 1.1.0 [Debian testing] server with mysql backend, and I'm having trouble with the "sql counter" module. When trying to customize the query to obtain the remaining time (the default query does not reflect my enviroment), I find mysql syntax errors. Apparently, it is not processing the full query. Output of "freeradius -X". Note that I changed the actual query for brevity, as anything [valid] that I put in there seem to get me the same result. ------- rlm_sql_mysql: query: SELECT <pretty big and boring query> AND UNIX_TIMESTAMP(AcctStartT rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): database query error, SELECT <pretty big and boring query> AND UNIX_TIMESTAMP(AcctStartT: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 rlm_sql (sql): Released sql socket id: 2 radius_xlat: 'ime)+AcctSessionTime>'1138766400'' --------- (the original query on my radiusd.conf file is: SELECT <pretty big and boring query> AND UNIX_TIMESTAMP(AcctStartTime)+AcctSessionTime>'%b') Notice how the first line in the log is truncated to the "T" of "AcctStartT", that is, the first 251 characters of the query after applying the parameter expansion (%b, %k). (the length is always 251, regardless of the query - if I strip spaces from it I can fit more, but it is still not enough). Also notice how the end of the query is continued on the next "radius_xlat:" line. The query works perfectly with the command line mysql client (after %b and %k expansions). Glancing at the source I see a line "#define MAX_QUERY_LEN 1024" in rlm_sqlcounter.c, far greater than 251, wich makes me doubt that the problem lies in that size, and seems to confirm my suspicion that it might be a configuration parameter that I'm missing somewhere. Can you suggest either a solution or a workaround? (other than storing the query in a mysql5.0 'stored procedure', because I do not wish to add Debian Unstable to my production servers) Regards, Zarrabeitia

2 2

freradius and krb5 interaction
by Riccardo.Veraldi 02 Mar '06

02 Mar '06

Hello, I am using freeradius with EAP-TTLS + kereros authentication + ldap authorization. Everyhtign works but I have this error: rlm_krb5: verify_krb_v5_tgt: host key not found : key table erntry not found I checked and the permissions on /etc/krb5.keytab are correct... anyone has a hint for me ? thanks Rick

2 1