- Freeradius-Users - lists.freeradius.org

eaptls certificate question
by Norbert Wegener 14 Feb '06

14 Feb '06

My radius does an eaptls 802.1x authentication with looking into AD to get group information and finally consulting the users file, to assign the correct vlan. This works without problems. When I configure another certificate_file/private_key_file in eap.conf, the authentication process does not succeed. The obvious difference between the working and the not working configuration is, that in the bad case, the certificate is issued by an intermediate ca, not by the root ca. May this chaining have negative influence on the configuration? If this is not the case, maybe another reason may be found in radiusd -AX's lengthy output: http://www.wegener-net.de/fr/typescript Thanks Norbert Wegener

3 4

$INCLUDE dictionary.fortinet is missed in dictionary in freeradius-1.1.0
by Richie Lee 14 Feb '06

14 Feb '06

I requested to add dictionary.fortinet to Freeradius last September. (please search the thread according to author's name richie). The file has been added into freeradius-1.1.0.tar.gz, but the dictionary file under /usr/local/share/freeradius doesn't include the line of "$INCLUDE dictionary.fortinet". So a fortinet user has to add the line manually when using freeradius. Could you please add the line to dictionary file? Thanks Richie _________________________________________________________________ Take charge with a pop-up guard built on patented Microsoft® SmartScreen Technology http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

2 1

RADIUS relocation error
by John Metcalfe 13 Feb '06

13 Feb '06

Hello: We are using FreeRADIUS version 1.1.02 with OpenSSL version 0.9.6g. The client supplicant is WinXP SP2 with WPA TKIP, PEAP and EAP MS-CHAP v2 configured. The NAS is a Symbol WS5100 WLAN switch configured to use RADIUS, TKIP and PEAP. We configured RADIUS and it starts (in debug mode) and we are able login to the server with test client software using raduser and shared secret password. On the XP client we are able to enter credentials (raduser and shared secret) and the Symbol switch receives and forwards the request to the RADIUS server with the following error in the switch log file: "failed 802.1x authentication for BSS " Then RADIUS server stops with the following error: radiusd: relocation error: /usr/lib/freeradius/rlm_eap_tls-1.0.2.so: undefined symbol: SSL_set_msg_callback Last week Alan said: You have two versions of OpenSSL installed on your system. One that you used to build FreeRADIUS, and another that your dynamic linker finds at run-time. The versions are incompatible. Are there anny other causes for the relocation message above? Also, how can we ensure we don't have two versions? Any advice is greatly appreciated. Thank you! Here is the startup. rad_recv: Access-Request packet from host 10.203.10.51:10666, id=222, length=140 User-Name = "raduser" NAS-IP-Address = Called-Station-Id = Calling-Station-Id = NAS-Identifier = NAS-Port = 29 Framed-MTU = 1000 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000c0172616475736572 Message-Authenticator = 0x46b0bbaca854130635f0fca5647e9a45 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "raduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry raduser at line 90 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls radiusd: relocation error: /usr/local/lib/rlm_eap_tls-1.1.0.so: undefined symbol: SSL_set_msg_callback John Metcalfe, Jr. IT Specialist - AIS IBM Business Consulting Services, Public Sector Telephone: 240-396-5305 email: metcalfej(a)us.ibm.com

2 1

Thanks Alan
by Sean 13 Feb '06

13 Feb '06

On Mon, 2006-02-13 at 19:58 +0100, freeradius-users-request(a)lists.freeradius.org wrote: > Phil Mayers <p.mayers(a)imperial.ac.uk> wrote: > > Alan, in case anyone hasn't said it recently - you do an excellent > job > > maintaining this project under difficult conditions. You have my and > I > > suspect many other peoples sincere gratitude, and I can only hope > it's > > as rewarding for you as it is helpful for us. > > Thanks. > > FreeRADIUS is being used as part of the core product in at least 3 > startups I know of, and possibly as many as 5. It's at the point now > where it's getting me more professional attention than my other work > activities. > > Alan DeKok. Alan, I'd like to add my thanks also. FreeRadius is at the core of swarmhotspots.com and I'm amazed at the help and support that is available from you and the open source community. The best way to show your appreciation is to contribute something back. Regards, Sean http://swarmhotspots.com

2 1

Get Username providing IP to radius in accounting mode!
by Mohsen A. Momeni 13 Feb '06

13 Feb '06

Hi, I have a router (NAS) configured to authenticate from a RADIUS server, and then send accounting information to it (i.e. IP frame address). Then the traffic is redirected through a firewall. Is there any way that the firewall can get the accounting information (Specially username) from RADIUS by providing the IP frame address to it? Firewall needs authentication (to know the username to apply policies) but I don't want to authenticate the user for the second time. If this is not possible, Can RADIUS be configured to send the accounting information (Specially username and IP frame address) to a LDAP server so that the firewall can query the LDAP server for the information? Regards,

2 1

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 13 Feb '06

13 Feb '06

Yohoo! >> I hope, I could help some people trying to use AD for radius. >there is another way - use the krb module to authenticate against AD Are there any advantages/ disadvantages ldap <-> krb5?

5 13

Free radius with MySQL
by Radius User 13 Feb '06

13 Feb '06

Hi all. How can I configure freeradius-1.1.0 with MySQL for authenticating and accounting. from http://www.frontios.com/freeradius.html, it says that, authorise { preprocess chap mschap #counter #attr_filter #eap suffix sql #files #etc_smbpasswd } but, there is none as follows in radiusd.conf........... regards...

2 1

(Cannot assign requested address) bind() failed
by tommy garsia 13 Feb '06

13 Feb '06

Hello all, I'm trying to run chilli with external radius server....e.g....the chilli machine's IP is 172.17.1.200 and then the radius is 172.17.1.222....this is the chilli.conf #radiuslisten 127.0.0.1 radiusserver1 172.17.1.222 radiusserver2 172.17.1.222 but, after i start chilli...it shows error like this:: hotspot: chilli --fg --debug ChilliSpot version 1.0 started. chillispot[3181]: ChilliSpot 1.0. Copyright 2002-2005 Mondru AB. Licensed under GPL. See http://www.chillispot.org for credits. chillispot[3181]: redir.c: 532: 99 (Cannot assign requested address) bind() failed chillispot[3181]: chilli.c: 3558: Failed to create redir is this a chilli error or radius error?? what should i do with my configuration?? regards, --------------------------------- Yahoo! Mail Use Photomail to share photos without annoying attachments.

3 3

freeradius src for mysql
by Radius User 13 Feb '06

13 Feb '06

hi members, can anyone inform me that what is the source file in freeradius-1.1.0, in where the mysql quiries for authentication and accounting is executed. thanks and regards...

2 1

Problem with PPTP and LDAP authentication.
by Joey McDonald 13 Feb '06

13 Feb '06

Hey gang, I'm still struggling getting freeradius and LDAP working to authenticate my PPTP users. I'd really appreciate if one of the guru's could have a look. I've wiped my old install and installed a fresh copy of freeradius and all the config files. Reading the list postings it's clearly best to make as few changes as posible to the config files. So, the bit's I've changed in radiusd.conf are as follows: modules { ldap { server = "ldap.mycompany.net" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "ou=people,dc=mycompany,dc=net" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" password_attribute = userPassword I uncommented the ldap section under authenticate: authenticate { ... Auth-Type LDAP { ldap } Then, I added my client in clients.conf. In users I added: DEFAULT Auth-Type := LDAP Fall-Through = 1 Those are all the changes I've made to the default configurations. I'm now storing my password(s) in the ldap directory in plain text. Using radtest from another machine on the network authenticates from the LDAP server just fine. Authentication from my PPTP server always gives me the following: rad_recv: Access-Request packet from host x.x.x.x:32792, id=112, length=149 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "joey" MS-CHAP-Challenge = 0x0a5f7e5035f0d2306105161cdf7060c4 MS-CHAP2-Response = 0xb600a2aa1bab3836758fcf6e48643de987c900000000000000003e30dd6e4b9c0b1d9bebde2c68fbab2aa625a5246217a002 Calling-Station-Id = "165.236.229.162" NAS-Identifier = "pptp" NAS-Port = 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Login incorrect: [joey/<no User-Password attribute>] (from client vpn-external port 0 cli 165.236.229.162) Sending Access-Reject of id 112 to x.x.x.x:32792 What am I doing wrong? Thanks so much! --joey

4 5