- Freeradius-Users - lists.freeradius.org

Error -1635
by Hubert Kupper 07 Feb '06

07 Feb '06

Hello, we have freeradius 1.0.4-4 installed on a suse 10.0 64bit box. We want to authenticate with LDAP against Novell edirectory. On suse 10.0 32bit everything worked fine. With the 64bit version we get the following error: "Error reading Universal Password. Errorcode = -1635". Universal Password is already set for our users. What can be wrong? Best regards Hubert

2 2

Freeradius and IKEV.2
by Priscilla B 06 Feb '06

06 Feb '06

Can someone help me with this? Is Freeradius support the implementation of IKEv.2? If so, where can I find documentation of it? Many thanks Priscilla __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

client certificate in PEAP or TTLS
by Norbert Grochal 06 Feb '06

06 Feb '06

Is it possible to force peap to require client's certificates? I can use PEAP, I can use TLS, but I want to join them together. I know that in PEAP certificates are optional not obligatory, how to make it obligatory? Norbert

3 2

FR - Writing Own Queries in sql.conf - Help
by Saeed Ahmed 06 Feb '06

06 Feb '06

Hi Everyone, I am sending this message at very first time, and I hope that I'll get response. My Question is that: In sql.conf's Authorization section, can I write my own queries and can I use the result of my own query. For detailed elaboration I will give you following example: I want something like that: authorize_check_query = "SELECT id, UserName, Attribute, Value, op, uid \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" in query above I created another field `uid` in my radcheck table and suppose here I am getting some kind of user-id. Then I want to use this value in next authorize_reply_query something like that: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' AND uid= '%{authorize_check_query[5]}' \ ORDER BY id" Instead of authorize_check_query I can also use my own query if possible example my_own_query = "SELECT uid from mytable where Username='%{SQL-User-Name}' and then I should be able to use the result of my_own_query. Like my_own_query[0]; etc etc I am using: freeradius-1.0.5 with MySql 5.0 Hope I will get help soon. Thanks in advance for your time. Regards Saeed Ahmed

1 0

FR - Writing own queries in sql.conf - help
by Saeed Ahmed 06 Feb '06

06 Feb '06

Hi Everyone, I am sending this message at very first time, and I hope that I'll get response. My Question is that: In sql.conf's Authorization section, can I write my own queries and can I use the result of my own query. For detailed elaboration I will give you following example: I want something like that: authorize_check_query = "SELECT id, UserName, Attribute, Value, op, uid \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" in query above I created another field `uid` in my radcheck table and suppose here I am getting some kind of user-id. Then I want to use this value in next authorize_reply_query something like that: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = '%{SQL-User-Name}' AND uid= '%{authorize_check_query[5]}' \ ORDER BY id" Instead of authorize_check_query I can also use my own query if possible example my_own_query = "SELECT uid from mytable where Username='%{SQL-User-Name}' and then I should be able to use the result of my_own_query. Like my_own_query[0]; etc etc I am using: freeradius-1.0.5 with MySql 5.0 Hope I will get help soon. Thanks in advance for your time. Regards Saeed Ahmed FR - User; currently Helpless;

1 0

Re: How to kick a logged user
by John C. Koen 06 Feb '06

06 Feb '06

On Mon, Feb 06, 2006 at 11:47:38AM -0500, Eduardo Bejar wrote: > > Hi, > > I?ve been searching a while about how to kick a logged user or force > terminate it?s session. It seems that this has been asked before on the > list, but I didn?t find an answer different from "radius can?t do that". The > only answer that I?ve found is that it?s required an external script for > this. > > Section 4.3 of the Freeradius FAQ mentions a radkill program, but the link > included is dead. And also says "try using SNMP". I haven?t also been able > to find information on how to use SNMP for this, so I ask the list: > > Can anyone post a link to download radkill? Here is a link I found on google. This site posts a copy of radkill dated from 2000/04/26: http://slava.parma.ru:8100/Linux-Soft/Billing/radkill/ --johnk > > Or > > Can anyone explain me how to do this with SNMP? > > Or perhaps, > > Can anyone post a procedure to kick a logged user? > > Thanks for your replies, > > Edo > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Multiple ippools with a singe group problem
by Georgi Alexandrov 06 Feb '06

06 Feb '06

Hello list, I'm using freeradius 1.1.0 with dialup_admin and mysql 5.0.x I need different ip pools to be accessible only by one name, e.g. : ippool 1 { ... } ippool 2 { ... } ippool 3 { ... } post-auth { 1 2 3 } accounting { 1 2 3 ... } That way it's working if i add a user to one of 1, 2 or 3 pools. But i need him added to all of the pools. Putting "DEFAULT" won't even asign ip address. post-auth { group all { 1 2 3 } } and putting user in pool "all" doesn't work, freeradius says invalid module "group". So i generally need all the pools to be accessible like one pool name ;-) Thanks in advance -- regards, Georgi Alexandrov Key Server = http://pgp.mit.edu/ :: KeyID = 37B4B3EE Key Fingerprint = E429 BF93 FA67 44E9 B7D4 F89E F990 01C1 37B4 B3EE

1 0

freeradius-1.1.0 - compile error
by Jon 06 Feb '06

06 Feb '06

Using freeradius-1.1.0 version. compile with nothing special other than defining log dir when 'make' receive error like following: gcc -shared rlm_unix.lo cache.lo compat.lo -Wl,--whole-archive /usr/lib/libshadow.a -Wl,--no-whole-archive -lcrypt /usr/lib/libshadow.a -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,-soname -Wl,rlm_unix-1.1.0.so -o .libs/rlm_unix-1.1.0.so /usr/lib/libshadow.a: member /usr/lib/libshadow.a(libmisc.a) in archive is not an object collect2: ld returned 1 exit status gmake[6]: *** [rlm_unix.la] Error 1 Any ideas that can help me to solve this, sorry if my English is bad... i found nothing on the website, Wiki, or Google (only Russian forum post about it). Thanks in advance guys, Jon

1 0

Segmentation fault v1.1.0 after requiring client certificate. Server crash.
by Pascal Huisman 06 Feb '06

06 Feb '06

Server crashes, have no clue why. Installed from a debian binary package. I couldn't find rlm_eap_tls.so anywhere in my system. I did various searches. So I got tar.bz v1.1.0, compiled the source, made it and copied the various rlm_eap_tls files to the freeradius directory. Server started up fine. After connection to wlan from the XP machine I get warning messages about fragmentated packages. Check the freeradius server, which crashed with a segmantation fault. What went wrong? Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.3:1812, id=7, length=135 User-Name = "client" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Port = 0 NAS-Identifier = "USR5450\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" Calling-Station-Id = "00-60-b3-9d-ef-dd" EAP-Message = 0x0201000b01636c69656e74 NAS-IP-Address = 192.168.0.3 Message-Authenticator = 0x70375d88fd54fcf3adb87b7293bd15fe Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "client", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate Segmentatie fout Thx.

2 1

Stripping part of the login before authentication?
by Garry Glendown 05 Feb '06

05 Feb '06

Hi, we have multiple ways of getting connections, all in the format user#somestring@morechars Is it possible to define something in FreeRadius to just compare the part before the "#" and authenticate based on that? Tnx,-gg

2 1