- Freeradius-Users - lists.freeradius.org

freeradius SIGSEGV, Segmentation fault.
by Norbert Wegener 22 Nov '05

22 Nov '05

I want to do machine authentication against an AD and grabbed the latest version from cvs this morning. I configured and ran it, but during establishing the connection, freeradius segfaults. The last lines are: rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 7 modcall: leaving group authenticate (returns ok) for request 7 Sending Access-Accept of id 107 to 111.222.36.124 port 1645 MS-MPPE-Recv-Key = 0x6b1b534ccd84a4f094b930849e651c507bf054567863aa80992384accc184dfc Segmentation fault The complete run under gdb can be found at http://www.wegener-net.de/fr/, where bt.txt contains the ouput of gdb (not too much). Additionaly I have put the config files there. Norbert Wegener

2 1

Access-challenge & attributes
by MINODIER David RD-RESA-LAN 22 Nov '05

22 Nov '05

Hi all, I'm using EAP-MD5 to authenticate a user. Freeradius eventually returns an access-accept packet, the user is authenticated, no pb. However, i have this question: Is it "normal" that the attributes contained in the access-accept packet are also contained in the Access-Challenge packets sent by Freeradius ? Is there a way to force Freeradius to return the attributes associated to the user in the access-accept packet only ? Many thanks. David

2 1

tool for testing machine authentication
by Norbert Wegener 22 Nov '05

22 Nov '05

Does a tool exist, that lets me test machine account authentication against an AD? Something like an equivalent to radtest? Thanks Norbert Wegener

7 9

email the daily logfile ?
by Frank Bonnet 22 Nov '05

22 Nov '05

Hello before writing a script myself I would like to know if there is an option in freeradius to send by email the logfile generated in /var/log/freeradius/radacct/127.0.0.1/detail-YYYYMMDD ? Thank you -- Frank Bonnet

2 1

wireless+freeradius+AD
by Laker Netman 22 Nov '05

22 Nov '05

Hi all. I have been running freeradius for quite a while now to authenticate dial-up users through our Cisco 3660. Additionally, I configured several of our internal devices for AAA. This has all worked quite well and I have been using a MySQL backend. Now I am getting ready to deploy a wireless network in our facility and need to lock it down. My idea is to have our users authenticate and authorize against our active directory. Then, to provide access to guests, just create a bogus wireless user that doesn't exist in the AD, so radius falls back to a different auth method (sql) to let the user at least get on and get an address from our dhcp. I basically have this model working through regular telnet and PPP right now, less the wireless piece. I have successfully set up authentication to AD, but I have some questions and concerns. I have done quite a bit of research on this and read the pertinent files in the /doc folder included with the FR software. So, I hope my questions make sense. First: We do not allow anonymous binding to our AD LDAP. So, for testing to date, I have used "Administrator" and the associated password in the config file. Obviously this is less than ideal :) What is the best or better alternative? Allowing anonymous bind? Creating a bind-only "user" for auth purposes? Am I correct that the NAS passes the username and password to FR in cleartext? Is there any method to send/receive the password between FR and AD encrypted? If I want to use WPA with TKIP (or preferably AES) do I *have* to have a supplicant? Most hosts will be XP, though there is a slim chance I may have to deal with others. Lastly, as I mentioned earlier, I have googles, read, googled, read, a *lot* of info. Is there a CONCISE site anywhere on the web the defines everything needed without leaving out the *one* critical piece that actually makes it work? ;-) Thanks in advance, Laker __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

5 7

help needed for debugging segfault
by Luca Corti 22 Nov '05

22 Nov '05

Hello, I've been banging my head against this for a few days. I've installed freeradius 1.1.0 from cvs and I'm doing EAP-PEAP using ntlm_auth for authentication. freeradius segfaults while sending the access-accept packet. In my first post someone instructed me to enable coredumps in freeradius and post the result. I've compiled freeradius using --enable-developer, set allow_core_dumps = yes in radiusd.conf and used ulimit to remove coredump filesize limit from my shell, but it seems freeradius still doesn't dump core. The radius server is a Debian testing box. The Wi-Fi accesspoint is a D-Link DWL-2100AP. Is there anything else I can do? Is this a freeradius issue or an OS issue? thanks -- Luca Corti PGP Key ID 1F38C091 BOFH excuse of the moment: Sand fleas eating the Internet cables -- Luca Corti PGP Key ID 1F38C091 BOFH excuse of the moment: LBNC (luser brain not connected)

5 5

multiple timespan entries ( Login-Time )
by Seferovic Edvin 22 Nov '05

22 Nov '05

Hi, I would like to allow my users to access the internet only between 0700 and 1430 and between 1530 and 2200 hours. So my Login-Time attribute looks like Wk0700-1430, Wk1530-2200. It is also stored in my LDAP directory... so.. my user wants to connect at 1600 and I get message "Auth: Outside allowed timespan (time allowed Wk0700-1430): username ..." why is freeradius ignoring the second entry? Or should multiple entries look else then that? Regards, Edvin Seferovic

1 0

[Fwd: Re: help needed for debugging segfault]
by Norbert Wegener 22 Nov '05

22 Nov '05

Hello Michael, as you have found the solution of how to make machine authentication work against AD using freeradius and samba: As long as there seems to be a problem with the actual cvs version of freeradius in that area, would it be possible for you, to supply a diff against 1.0.5, so that machine authentication will work? Thanks Norbert Wegener

1 0

authentication by ip address
by Mathias Dörr 22 Nov '05

22 Nov '05

Hello, I have version 1.0.4 installed and trying know to make authorization/ authentication by the remote ip address, instead of username and password. In the main distribution authorization/ authentication is based on username /password. Where is the starting point to get this implemented ? Many thanks Mathias

2 1

RE: wireless+freeradius+AD
by David Antognini 22 Nov '05

22 Nov '05

Yes I too would like some help with this. This what I am trying to do: 1. authenticate via chap (from chillispot) to freeradius, using unix shadow passwords or pam.. I followed the pam directions and it works fine for pap, but not chap.. 2. also, would like to get it to work via AD (kerberos etc.) A doc on this would be very helpful... Dave > On Mon, 21 Nov 2005, King, Michael wrote: > > > > Oh, excellent. I just joined this list hoping to query the > > > members on finding more information on doing > > > wireless+activedirectory+freeradius, > > > unfortunately I could not find any good postings, or web > > > toots/examples. > > > > Hi Robin, Welcome to the club. > > > > > > > I would need to use Microsoft IAS. Is this false ? > > Yes, That particular example used Microsoft IAS, but it is not > > required. > > > > > > > Are people > > > using Active Directory successfully ? > > Yes. Besides myself, there are many people on this list that are. > > > > > I have a linux box that > > > is currently acting as a tacacs server while authenticating > > > using winbind etc, and was hoping to make it a radius server as well. > > > > You are already 3/4 of the way there, since the trickest part of my > > freeradius setup was getting winbind to talk to activedirectory > > > > Depending on your Linux distribution, you will just have to install > > freeradius. (Some distributions like Debian require a -disable-shared) > > > > Go thru the radiusd.conf and the eap.conf files, it's clearly commented > > on what you need to configure. > > > > You'll see a section marked: > > ntlm_auth = "/path/to/ntlm_auth ........(Trimmed) > > > > You might need to modify this to: > > ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > > > Don't hesitate to ask questions. There is a good Howto (unfortuantly, I > > don't have my bookmarks with me) but some others on the list hopefully > > will post it. > > > > Yes winbind kerberos stuff works well, and I got it previously working to > enable TAC_PLUS to do active directory authentication. > > If anyone knows the site with a good howto I would greatly apprecieate it. > > Otherwise I am chugging along. > > I have gotten the windows program NTRadPing to authenticate non CHAP with > a local UNIX account. I am not sure what fields I must enter to get > MS-CHAP to test, or if there is even a difference between CHAP and > MS-CHAP? > > Anyways I fuddled around with a bunch of different combinations and always > get this in the logfile > > Auth: Login incorrect (rlm_chap: Clear text password not available): > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0