- Freeradius-Users - lists.freeradius.org

before freeradius, openssl don't work
by pelusa vali 05 Jan '06

05 Jan '06

hi everybody, well still trying to use freeradius for a wlan. i use debian sarge kernel 2.6.13, openssl 0.9.8.a to generate certificates and last freeradius version. well i followed many tutorials about securing wlans with freeradius and all of them have this step: openssl rsa <newreq.pem > servidor-key.pem but when i type this my system returns: unable to load Private Key 5237:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: ANY PRIVATE KEY so i think it's a problem with rsa generation and tried to generate rsa key but always get same error. i know it's not a list of openssl but i posted this question in openssl list and nobody ask; searched in internet and nothing; so, any body could help?? what is happening and how could i solve this?? excuse if this so trivial but i'm new with both, openssl and freeradius and don't understand what is happening and why. thanks in advance for your time and help. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

1 0

RE: Fw: authorize and authenticate methods ina custom module
by Susana Macias 05 Jan '06

05 Jan '06

Thanks a lot Alan, I would like to explain what I am trying to develop. If someone has any advise, please tell me. This is my scenario: Until now, we have a RADIUS server (RADIUS PSI) which only receives Access-Request packets. Also we have a CGI application located in the URL http://X.Y.Z.W:8080/nucleo This application receives a set of parameters as an URL encoded string (all characters that are not a-z, A-Z or 0-9 are converted to their "URL escaped" version) with this form: Attribute1=Value1&Attribute2=Value2... (where Attribute1, Attribute2... and Value1,Value2... are the differents Attribute/Value pairs obtained from the Access-Request packet) The CGI application consults a remote database (and normally authenticate the user using the telephone number; although there are other variants). According to the response obtained from the remote resource, the RADIUS server adds differents Attribute/Value pairs to the reply list, and always reply with an Access-Accept packet (whether or not the CGI application authenticate the user successfully) Now, we want to change to a FreeRadius server. I only want to call the remote resource (using the libcurl library) passing it the appropiates parameters and collect the information returned by it in order to create the reply list. As the CGI application performs the authorize and authenticate activities I am a little embarrassed to say that I am not sure which function should I implement (authorize or authenticate). Thank you very much in advance Best wishes, Susana ----- Original Message ----- From: "Alan DeKok" To: "FreeRadius users mailing list" Sent: Tuesday, January 03, 2006 4:31 PM Subject: Re: authorize and authenticate methods ina custom module > Susana Macias wrote: > > I have started working with the RADIUS protocol (and with FreeRadius > > in particular) three weeks ago. Congratulations for the product, it is > > really powerful! > > Thanks. > > > But, when are the authorize() and authenticate() methods called? > > When a packet comes in. See doc/aaa.txt > > > Is it necessary to include in the radiusd.conf the name of the > > instance (of the new module created) in the authorize section in order > > to call its authorize() method? > > Yes. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

2 1

LDAP scope
by Stefan Adams 05 Jan '06

05 Jan '06

Hi! Is it possible to specify a basedn of "dc=example,dc=com" with a scope of "sub" so that my search filters can apply to both "ou=People" and "ou=Computers" for example? It seems from my testing that the scope is "one" by default. The reason I would like to do this is to have the check box in Windows XP that says "Authenticate as computer..." checked. Doing this, FreeRADIUS is first presented with the credentials of the computer (host/name). Since I already have a computer account in ou=Computers, I figure I'd just add a cn=host/name attribute and modify the filter to be (|(uid=%{User-Name})(cn=%{User-Name})). But this can only work with a basedn of "dc=example,dc=com" and a scope of sub. Thanks! Stefan

2 1

Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header
by Mathieu Clément 05 Jan '06

05 Jan '06

Good morning, Look at this: --------------------------------------------------------------- # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd.conf[1383] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header -------------------------------------------- Running mandrake with mysql. Second question: How to add users in the mysql table ? I see "UserName, value, etc." but where to put the password, and which format (md5 ? sha1 ? cleared-text ?) Thank you in advance, Have a good day. Mathieu --- avast! Antivirus: message Sortant propre. Base de donnÚes des virus (VPS): 0601-1, 03/01/2006 Test du: 05/01/2006 02:47:50 avast! - copyright (c) 1988-2004 ALWIL Software. http://www.avast.com

1 1

acct_unique
by Velikanov 05 Jan '06

05 Jan '06

Good day. I need to use such a construction in radiusd.conf acct_unique acct_std{ key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } acct_unique acct_PIX{ key = "Acct-Session-Id, NAS-IP-Address, Login-IP-Host, Login-TCP-Port" } preacct { preprocess Acct-Type PIX{ acct_PIX } acct_std } BUT got an error when i do "radiusd -X": .......... .......... Module: Instantiated sql (sql) radiusd.conf[1683] Unknown module rcode 'acct_PIX'. In radiusd.conf there are the strings: string 1682: Acct-Type PIX{ string 1683: acct_PIX string 1684: } WHERE IS MY MISTAKE ? And a questions - Why we need to use attribute "Acct-Unique-Session-Id" ? I use sql database for accounting, there we have unique index "radacctid" and i need to understand the purpose and advantages of using the attribute "Acct-Unique-Session-Id" THANKS

2 1

NAS-identifier instead of IP-identifier
by Rob Cleminson 05 Jan '06

05 Jan '06

Hello, I am new to freeradius and need a little help.... We are going to be deploying a bunch of Wireless Routers all over the place and they may have DHCP addresses on them instead of static WAN addresses..When a client associates to our Wireless Router they are redirected to the Radius Server which then creates a secure session onto the internet(WPA etc) Is there a way of identifying the router to our FreeRadius server without having a static IP address on each Router? Cheers Rob

3 2

In which point does the FR sever send the Access-Accept or Access-Reject packet?
by Marta Lajas 05 Jan '06

05 Jan '06

Hy all, I have a doubt about when FreeRadius server decides to send an Access-Accept or an Access-Reject packet. When the authenticate module returns with a RLM_MODULE_REJECT, does the FR server send an Access-Reject packet? or does it occur later? When the authenticate module returns with a RLM_MODULE_OK, does the FR server send the Access-Accept packet? or does it occur later? Thanks in advance, Marta --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

3 2

EAP-TLS and user configuration
by dark0s dark0s 05 Jan '06

05 Jan '06

Hi, I must ti configure an authentication server with freeradius 1.0.5. The authentication method must be EAP-TLS. I have configured the files: eap.conf, radiusd.conf, clients.conf I would to known: 1) If I must configure /etc/raddb/users 2) How to configure /etc/raddb/users 3) Authentication operation will be showed in the any files in the system Thanks ___________________________________ Yahoo! Mail: gratis 1GB per i messaggi e allegati da 10MB http://mail.yahoo.it

1 0

authorization depending on authentication (ldap)
by tschaos＠gmx.net 05 Jan '06

05 Jan '06

Hi guys, First sorry for my bad english i am from austria ;-) i am running freeradius-1.0.2-5.5 i have a big problem here and cant solve it alone: there are 3 ldap instances: ldap1,ldap2,ldap3. and authenticate them all after another in the authentication section like this: authenticate { ldap1 ldap2 ldap3 } same in authorize-section: authorize { ldap1 ldap2 ldap3 } now my problem is, that if the user x is authenticated at ldap2 for instance the authorization fails cause the user isnt found at ldap1 (freeradius doesnt seem to try authorizing on ldap2 or ldap3) what i need would be a solution how to realize the following needs: if authentication runs over ldap1 authorize on ldap1 if authentication runs over ldap1 authorize on ldap2 if authentication runs over ldap1 authorize on ldap3 how can i do that? hope you guys can help me, i am searching for a solution for 3 days now and i havent got any ideo how to solve that :-( thanks and greetings from snowy austria! -- DSL-Aktion wegen gro�er Nachfrage bis 28.2.2006 verl�ngert: GMX DSL-Flatrate 1 Jahr kostenlos* http://www.gmx.net/de/go/dsl

3 6

RE: Fw: In which point does the FR sever send the Access-Accept orAccess-Reject packet?
by Marta Lajas 05 Jan '06

05 Jan '06

Thank you very much Bjørn. So it is after the post-auth section when the FreeRadius server decides to send an Access-Accept or an Access-Reject packet (in response of a previous Access-Request packet) depending on the result (success or not, OK or REJECT) of the authenticate method. Am I right? Best regards, Marta ----- Original Message ----- From: "Bjørn Mork" To: "FreeRadius users mailing list" Sent: Thursday, January 05, 2006 12:42 PM Subject: Re: In which point does the FR sever send the Access-Accept orAccess-Reject packet? > Marta Lajas writes: > > > I have a doubt about when FreeRadius server decides to send an > > Access-Accept or an Access-Reject packet. > > > When the authenticate module returns with a RLM_MODULE_REJECT, > > does the FR server send an Access-Reject packet? or does it occur > > later? > > > When the authenticate module returns with a RLM_MODULE_OK, does > > the FR server send the Access-Accept packet? or does it occur > > later? > > You can find the answers in src/main/modcall.c. The default > authenticate actions are: > > { > MOD_ACTION_RETURN, /* reject */ > 1, /* fail */ > MOD_ACTION_RETURN, /* ok */ > MOD_ACTION_RETURN, /* handled */ > 1, /* invalid */ > MOD_ACTION_RETURN, /* userlock */ > MOD_ACTION_RETURN, /* notfound */ > 1, /* noop */ > 1 /* updated */ > }, > > > Which means that both RLM_MODULE_REJECT and RLM_MODULE_OK will cause > an immediate return action without calling any further modules in the > authenticate section. > > Note that these actions may be modified by "redundant" or "append" > module grouping, or even configured on code by code basis. See > doc/configurable_failover > > The modules in postauth will of course still be called before sending > Access-Reject or Access-Accept. > > > Bjørn > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

1 0