- Freeradius-Users - lists.freeradius.org

freeradius wont let realms based auth
by Andres Pazos 10 Nov '05

10 Nov '05

hi, im new to the mailing list. i'd be really thanked if someone could help me with the following issue: im trying to use freeradius with sql and mysql realm based (i.e.: sql when realm=dhcp and mysql when realm=wireless). i've red acct-type and tried to do the same. is that correct?, should i use acct-type?, what should i use instead?. Nevertheless, i'll add the debug of radtest, radiusd and radiusd.conf. radtest: root@andy:/var/log# radtest andy@wireless andy localhost 1812 testing123 Sending Access-Request of id 177 to 127.0.0.1:1812 User-Name = "andy@wireless" User-Password = "andy" NAS-IP-Address = andy NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=177, length=20 radiusd -X: rad_recv: Access-Request packet from host 127.0.0.1:32812, id=177, length=65 User-Name = "andy@wireless" User-Password = "andy" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "wireless" for User-Name = "andy@wireless" rlm_realm: Found realm "wireless" rlm_realm: Proxying request from user andy to realm wireless rlm_realm: Adding Realm = "wireless" rlm_realm: auth_port is not set. Proxy cancelled. modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 212 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 177 to 127.0.0.1:32812 Waking up in 4 seconds... thanks in advance!.

2 1

Running as root to authenticate against system accounts..
by Kevin Hanser 10 Nov '05

10 Nov '05

Hello, I've recently been looking into getting a FreeRADIUS server to authenticate against the system passwd file. When I was originally testing, it always seemed to reject my access, no matter what I tried. So I did some searching on the lists, and found another person that was having a similar issue. They discovered that the system only allows root to read the shadow password file, so when radius was requesting the password, it would get rejected. So I changed my setup to run the radiusd daemon as root, and tested again. Sure enough, if radiusd is run as root, I can authenticate against the system. So now my question is: What security concerns should I have if I run the radiusd as root? Is there another way to do this that doesn't require radiusd to run as root? Basically, I just want to make sure this is the best way to authenticate against system accounts, or if there's some other method that I've missed :) thx! k

2 2

Couldn't open /etc/freeradius/users for reading: Permission denied
by Dominik Benninger 10 Nov '05

10 Nov '05

hi everybody im trying to set up freeradius but i cant advance anymore because of this silly error. all information you need to know are down below. i might not see the wood for the trees, so please be easy on me! :-) # freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "shadow" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Couldn't open /etc/freeradius/users for reading: Permission denied Errors reading /etc/freeradius/users radiusd.conf[1035]: files: Module instantiation failed. # ls -lha /etc/freeradius total 244K drwxr-s--- 3 root freerad 4.0K 2005-11-10 14:47 . drwxr-xr-x 71 root root 4.0K 2005-11-10 16:29 .. -rw-r----- 1 freerad freerad 422 2005-10-16 14:02 acct_users -rw-r----- 1 freerad freerad 4.0K 2005-10-16 14:02 attrs drwxr-s--- 3 freerad freerad 4.0K 2005-11-10 12:41 certs -rw-r----- 1 freerad freerad 189 2005-10-16 14:02 clients -rw-r----- 1 freerad freerad 2.9K 2005-10-16 14:02 clients.conf -rw-r----- 1 freerad freerad 929 2005-10-16 14:02 dictionary -rw-r----- 1 freerad freerad 8.9K 2005-10-16 14:02 eap.conf -rw-r----- 1 freerad freerad 8.1K 2005-10-16 14:02 experimental.conf -rw-r----- 1 freerad freerad 2.4K 2005-10-16 14:02 hints -rw-r----- 1 freerad freerad 1.6K 2005-10-16 14:02 huntgroups -rw-r----- 1 freerad freerad 2.3K 2005-10-16 14:02 ldap.attrmap -rw-r----- 1 freerad freerad 9.2K 2005-10-16 14:02 mssql.conf -rw-r----- 1 freerad freerad 1020 2005-10-16 14:02 naslist -rw-r----- 1 freerad freerad 856 2005-10-16 14:02 naspasswd -rw-r----- 1 freerad freerad 12K 2005-10-16 14:02 oraclesql.conf -rw-r----- 1 freerad freerad 15K 2005-10-16 14:02 postgresql.conf -rw-r----- 1 freerad freerad 1.1K 2005-10-16 14:02 preproxy_users -rw-r----- 1 freerad freerad 8.7K 2005-10-16 14:02 proxy.conf -rw-r----- 1 freerad freerad 57K 2005-11-10 20:17 radiusd.conf -rw-r----- 1 freerad freerad 187 2005-10-16 14:02 realms -rw-r----- 1 freerad freerad 1.4K 2005-10-16 14:02 snmp.conf -rw-r----- 1 freerad freerad 14K 2005-10-16 14:02 sql.conf -rw-r----- 1 freerad freerad 6.8K 2005-11-10 20:03 users -rw-r----- 1 freerad freerad 7.1K 2005-10-16 14:02 x99.conf -rw-r----- 1 freerad freerad 4.1K 2005-10-16 14:02 x99passwd.sample

1 0

RE: loading files to oracle
by Eyas Sarabi 10 Nov '05

10 Nov '05

Hi Alan; I have dialup connection detail file having the information for each connected session,a hard disk was corrupted so when the radius tried to write directly to Oracle database it could because of the HD failure. Now I have file per each day including all information about the session was connected each day and want to load it to DB. Is there any tools that can be Used to write the contents of files to database directly the same way it is Automated through freeradius. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-> > > users-bounces(a)lists.freeradius.org] On Behalf Of freeradius-users-> > > > > request(a)lists.freeradius.org > Sent: Thursday, November 10, 2005 8:40 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 7, Issue 31 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > Today's Topics: > 1. Re: FreeBSD anyone? (Alan DeKok) > 2. Re: Failed attempts log (Alan DeKok) > 3. Re: Failed attempts log (Nicolas Baradakis) > 4. Re: JRadius (Raoul Demour) > 5. Re: Proxy not sending out packets (was Re: Proxying a PEAP > request to an IAS server) (Dan Newcombe) > 6. Re: Problem with loading files from free radius (Alan DeKok) > 7. Re: simultaneous use, checkrad, and MPP attempts (Alan DeKok) > 8. Re: simultaneous use, checkrad, and MPP attempts (Kevin Bonner) > 9. authenticate against bytes in and out with sqlcounter > (Martin Potgieter) > 10. Problem with loading files from free radius (Eyas Sarabi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 09 Nov 2005 13:00:27 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: FreeBSD anyone? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109180027.7F7FC16CC1(a)mail.nitros9.org> christian meutes <christian.meutes(a)de.clara.net> wrote: > Can you point me to the explanation, i cant find it? http://www.freeradius.org/cgi-bin/cvsweb.cgi/radiusd/man/man5/rlm_sql_log.5? rev=1.2&content-type=text/x-cvsweb-markup Alan DeKok. ------------------------------ Message: 2 Date: Wed, 09 Nov 2005 13:01:48 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Failed attempts log To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109180148.A5EE817122(a)mail.nitros9.org> "Thierry Hoferlin" <thierry.hoferlin(a)staff.cybernet.be> wrote: > Is there a way to log failed authentification records to SQL ? Not really, no. Alan DeKok. ------------------------------ Message: 3 Date: Wed, 9 Nov 2005 19:08:55 +0100 From: Nicolas Baradakis <nbk(a)sitadelle.com> Subject: Re: Failed attempts log To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109180855.GA18225(a)asuka.tech.sitadelle.com> Content-Type: text/plain; charset=us-ascii Thierry Hoferlin wrote: > I've configured a freeradius 1.0.5 with MSSQL authentification. > It works fine. > > Is there a way to log failed authentification records to SQL ? Please don't post HTML on the list. Search the archives for detailed instructions, but the general idea is to use the module "sql" in section "post-auth". http://freeradius.org/radiusd/doc/Post-Auth-Type -- Nicolas Baradakis ------------------------------ Message: 4 Date: Wed, 9 Nov 2005 10:12:06 -0800 (PST) From: Raoul Demour <kongo_007(a)yahoo.com> Subject: Re: JRadius To: freeradius-users(a)lists.freeradius.org Message-ID: <20051109181206.34792.qmail(a)web53211.mail.yahoo.com> Content-Type: text/plain; charset=iso-8859-1 Hello thanks for all the answers! > Regarding EAP-SIM, JRadius has no specific support > for it. What is it > you are trying to do? What I have understood: FreeRADIUS is able to authenticate using EAP-SIM. But you need to set the attributes: EAP-SIM-Rand1 EAP-SIM-SRES1 EAP-SIM-KC1 EAP-SIM-Rand2 EAP-SIM-SRES2 EAP-SIM-KC2 EAP-SIM-Rand3 EAP-SIM-SRES3 EAP-SIM-KC3 (do you really need to set all the 9 attributes? or just one rand, one SRES and one Kc is enough?) I dont have access to GSM network and I dont know Ki (share secret). But to check if the system is correctly set up, I would like to give manually the attributes (on the serveur). (In a way I cheat...). Or to reproduce the generation of Rand, SRES and Kc (using my own algorithm) and on the supplicant I simulate SIM card... With JRadius it is possible to create object like Attr_UserPassword (according to the given example of JRadius). After what, it is used to set the attribut UserPassord for FreeRADIUS. So I think it would not be too complicate to create new attribute like: Attr_EAP_SIM_Rand, Attr_EAP-SIM-SRES, Attr_EAP-SIM-KC. In a way, I would like to use JRadius to avoid writing a module which will set the nine above attributes. My explanation may be not realy clear because I still learning how the thing work (for exemple, I suppose that the algorith to generate Rand, SRES and Kc is mobil operator specific, but I'm not complitly sure of the fact) Raoul __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs ------------------------------ Message: 5 Date: Wed, 09 Nov 2005 13:16:12 -0500 From: Dan Newcombe <DanNewcombe(a)mail.clayton.edu> Subject: Re: Proxy not sending out packets (was Re: Proxying a PEAP request to an IAS server) To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <43723CEC.90203(a)mail.clayton.edu> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Alan DeKok wrote: >Dan Newcombe <DanNewcombe(a)mail.clayton.edu> wrote: > > >>One thing I've noticed is on the non-PEAP packets, the src address of >>the packet going to the IAS box is 172.28.240.73, whereas on the PEAP >>packets, it is 127.0.0.1, >> >> > > That's bad. That's the source of the problem, then. > > I have *no* idea why that would be happening. What's so magic about >PEAP packets? > > I'll take a look at the source and see if anything pops out/. >You're using 1.0.5, right? > > Yes...I'm on 1.0.5. Glad to know I'm not crazy - wonder if my wife will believe me though :) Thanks, -Dan ------------------------------ Message: 6 Date: Wed, 09 Nov 2005 16:04:30 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Problem with loading files from free radius To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109210430.D390B16CC1(a)mail.nitros9.org> Eyas Sarabi <eyas.sarabi(a)atheer.net.sa> wrote: > I faced a major problem, My Hard disk was corrupted and the free radius > wasn't being able to write to database, I still have the files generated by > free radius and I want to load them to the database .Is there any tool that > can load the generated files to oracle database ? What files? Alan DeKok. ------------------------------ Message: 7 Date: Wed, 09 Nov 2005 16:06:06 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: simultaneous use, checkrad, and MPP attempts To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20051109210606.A121B16CC1(a)mail.nitros9.org> Christopher Carver <ccarver(a)pennswoods.net> wrote: > The proxy'ing radius servers and NAS's of the other company from whom we > lease equipment are unavailable to checkrad. By default shouldn't it be > allowing these people on? It depends what you want. The current behavior is to disallow logins, as you found out. It should really be configurable. > Any idea why this isn't behaving how I expect? Is there a more > appropriate way I can ensure that users connecting via NAS's and > proxy'ing radius servers we lease will never be rejected because of > multiple logins? No, juest edit the code. Alan DeKok. ------------------------------ Message: 8 Date: Wed, 9 Nov 2005 16:20:38 -0500 From: Kevin Bonner <keb(a)pa.net> Subject: Re: simultaneous use, checkrad, and MPP attempts To: freeradius-users(a)lists.freeradius.org Message-ID: <200511091620.41060.keb(a)pa.net> Content-Type: text/plain; charset="iso-8859-1" On Wednesday 09 November 2005 00:35, Christopher Carver wrote: > The proxy'ing radius servers and NAS's of the other company from whom we > lease equipment are unavailable to checkrad. By default shouldn't it be > allowing these people on? I looked at the code and it seemed as though > it should. I set the nastype to other in clients.conf for these entries > and I still see MPP attempts. Finally, I looked at the source of > checkrad. I modified the line for "other" nastypes to always return 0, > which should be interpreted as no multiple login. The numbers you see > to the left are line numbers Chris, Look at the code again. In session.c, the rad_check_ts function is what calls checkrad. If the nastype is empty or "other", checkrad is _never_ called, and the function returns 1 (meaning the user is logged in). We did this simult use bypass by using a nastype called visp, which returns 0 in checkrad. See freeradius bug#166 for a checkrad patch we've been using here which cleans up the code a bit and makes it easier to add new types. Any comments/problems can be posted to the bug. -Kevin

2 1

FreeRADIUS Proxy
by Chanin Luangingkasut 10 Nov '05

10 Nov '05

Hello All, I've stupid question about radius proxy configuration followed: On master(192.168.5.1 <http://192.168.5.1>) proxy.conf --- proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm suffix { format = suffix delimiter = "@" } realm mydomain.org <http://mydomain.org> { type = radius authhost = LOCAL accthost = LOCAL } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } On proxy(192.168.5.10 <http://192.168.5.10>) proxy.conf --- proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = yes } proxy_requests = yes realm suffix { format = suffix delimiter = "@" } realm mydomain.org <http://mydomain.org> { type = radius authhost = 192.168.5.1:1645 <http://192.168.5.1:1645> accthost = 192.168.5.1:1646 <http://192.168.5.1:1646> secret = vtwidyogouUp nostrip } There are not work, please let me know about how to setup proxy radius. Thank you, Chanin.

2 1

Solaris 10 (SPARC 64bit) - problems installing freeradius 1.0.5
by Reiko U. 10 Nov '05

10 Nov '05

hi all ... i'm trying to installing freeradius-1.0.5 on a sun-ultra-e220 (2x450MHZ ULTRASparcII), OS: Solaris 10 (SPARC 64bit), since three days without success. I've read many hours in different news-groups, mailing-lists and manuals / howtos but no way. Now i hope someone else already have successfully running freeradius on Solaris 10 - Sparc-Architcture and can tell me wat's wrong. I've attached the configure.log to this email (hope this works in mailinglists ???). Here are my environments: uname -a: SunOS r220 5.10 Generic sun4u sparc SUNW,Ultra-60 $CC /usr/local/bin/gcc $LD_LIBRARY_PATH /usr/sfw/lib/sparcv9/:/lib/sparcv9/:/usr/sfw/lib/:/lib:/usr/lib:/usr/local/lib:/usr/local/X11/lib:/usr/dt/lib:/usr/openwin/lib $PATH /usr/sbin:/usr/bin:/opt/sfw/bin/:/usr/sfw/bin:/usr/sfw/sbin/:/opt/sfw/sbin/:/sbin/:/usr/sbin/:/usr/ccs/bin/:/usr/local/bin:/usr/local/sbin:/opt/sfw/bin/:/usr/sfw/bin pkginfo | grep gcc utility GNUgcc GNU gcc 3.4.4 SPARC 64bit Solaris 10 (installed in /usr/local) system SUNWgcc gcc - The GNU C compiler system SUNWgccruntime GCC Runtime libraries /usr/local/bin/gcc -v read specs from /usr/local/lib/gcc/sparc64-sun-solaris2.10/3.4.4/specs configured with: /var/tmp/gcc-3.4.4/configure --prefix=/usr/local --host=sparc64-sun-solaris2.10 --enable-threads=posix --with-gxx-include-dir=/usr/local/include/g++ --with-system-zlib --enable-shared --with-ld=/usr/ccs/bin/ld --without-gnu-ld Thread-Modell: posix gcc-Version 3.4.4 MY PROBLEM: ./configure --localstatedir=/var/ --sysconfdir=/etc/ --with-openssl-includes=/usr/sfw/include/openssl/ --with-openssl-libraries=/usr/lib/sparcv9/ produces these warnings: ###################################################################################################### configure: warning: the comm_err library isn't found! configure: warning: silently not building rlm_krb5. configure: warning: FAILURE: rlm_krb5 requires: krb5. configure: warning: silently not building rlm_ldap. configure: warning: FAILURE: rlm_ldap requires: libldap_r. configure: warning: iodbc headers not found. Use --with-iodbc-include-dir=<path>. configure: warning: sql submodule 'iodbc' disabled configure: warning: silently not building rlm_sql_postgresql. configure: warning: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: warning: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: warning: sql submodule 'oracle' disabled configure: warning: unixODBC headers not found. Use --with-unixodbc-include-dir=<path>. configure: warning: sql submodule 'unixodbc' disabled ####################################################################################################### but finished "successfully". ./make crashs with the following errors: !!!!!I've translated some lines because i use a german console!!!!! #################################################################################################################################################### . . . creating radiusd gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/sfw/include/openssl/ -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../include -DHOSTINFO=\"\" -DRADIUSD_VERSION=\"1.0.5\" -c radwho.c gcc -L../lib -o radwho radwho.o util.o log.o conffile.o -L/usr/lib/sparcv9/ -lssl -L/usr/lib/sparcv9/ -lcrypto -lnsl -lresolv -lsocket -lposix4 -lpthread -lradius -lcrypt undefined referenced for first time Symbol in file MD5Init ../lib/libradius.a(radius.o) (symbol is part of implicit dependency /lib/libmd5.so.1) MD5Final ../lib/libradius.a(radius.o) (Symbol gehört zu impliziter Abhängigkeit /lib/libmd5.so.1) MD5Update ../lib/libradius.a(radius.o) (Symbol gehört zu impliziter Abhängigkeit /lib/libmd5.so.1) ld: Fatal Error: symbol referencing error. No output in radwho written. collect2: ld returned 1 exit status gmake[4]: *** [radwho] Error 1 gmake[4]: Leaving directory `/opt/sfw/freeradius-1.0.5/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/opt/sfw/freeradius-1.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/opt/sfw/freeradius-1.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/opt/sfw/freeradius-1.0.5' make: *** [all] Error 2 ################################################################################################################################################### Now, I'm not sure is it a comiler problem, a processor problem (64 bit / big/little endian) or, i don't think so, a freeradius problem. Great thanks to all for any help and hints for solution Cheers Reiko

1 0

Re: PEAP MS_CHAP V2: problem with tunnel attributes on enterasys V2 switch
by slapeyre＠free.fr 10 Nov '05

10 Nov '05

Hello, I run my FreeRadius in debug mode. I put a sniffer between the freeRadius server and the novell Server (users LDAP base). I don't have users file because the users base is on the novell server. I set the tunnel AVs on each user with the e-directory tool of novell server(v6.5). In debug mode and with the sniffer,i see the filter_id attributs but not the tunnel attributs. Authentication with filter_id attributes work but not with the tunnel attributes. Is it necessary to active or configure something on FreeRADIUS to use "tunnel" parameters ??? Best regards Stephane Selon "Zoltan A. Ori" <z.ori(a)morehead-st.edu>: > On Wednesday 02 November 2005 04:50, you wrote: > > It wasn´t a problem to configure EAP-PEAP with freeradius server (running > > on suse) and Enterasys switches. > > I want to implement VLAN assignment at a > > enterasys switch. > > > > Any tips ?? > > Is it necessary to active or configure something on FreeRADIUS to use > > "tunnel" parameters ??? > > If you have the tunnel AVs set in you users file as replies, FreeRADIUS will > send them. Run in debug mode to see. > > Zoltan Ori > >

1 0

FreeBSD anyone?
by Miguel 10 Nov '05

10 Nov '05

Hi, im running freeradius 1.0.5 + postgres 8.0.3 on a dual xeon, gentoo 2005.1, all is working ok, but i have another server with the same hardware specs that i recently "upgraded" from gentoo to freebsd 5.3, the server was running apache + postgres and, wow , great diference, better performance, so postgres definitely liked freebsd, what about freeradius?, i have read on the website that it is developed on debian but it compiles on freebsd, what is your experience with freebsd , good?, bad? , any gotchas?. Should i migrate to freebsd or stay with gentoo?, my personal preference is bsd, but im worried of any obscure future that only works on linux api's ,etc thanks in advance, Miguel

6 11

having filter-id sent on an eap response
by Dan Newcombe 10 Nov '05

10 Nov '05

It's tired and I'm late or something like that :) Thanks to Alan's help, things are now resolving to the IAS server as mentioned in my previous posts and configs. The switches seem to be receiving the Access-Accept packets as they are marking the ports as authenticated with the correct user id. However, I'm also trying to pass back a filter-id so the switch can change the policy on the port the user has authenticated on. The IAS server returns this just fine, and when using radclient, my proxied request returns: Sending Access-Accept of id 219 to 172.25.7.11:1024 Filter-Id = "Enterasys:version=1:mgmt=su:policy=Administrator" Callback-Number = "" Service-Type = Framed-User Class = 0x570b067a000001370001a81cf03c01c5e5644a584e9e00000000000001b2 However, when my XP machine tries to authenticate with PEAP/MS-CHAPv2, everything goes to the IAS server, and the Filter-ID is passed back from the IAS server to freeradius, however Sending Access-Accept of id 9 to 172.25.7.11:1024 MS-MPPE-Recv-Key = 0x50c3bedb696d476e8ed66808b5a2e452a6554fa470ca566bd77fc6d8c170e277 MS-MPPE-Send-Key = 0x1bd55848cc4c172fece6e24a9fb00f91652e74bbf509eef674948bd2c6e4cea1 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "CCSU\\testuser" is what gets sent to the switch/NAS. I'm sure this is just my lack of understanding of the PEAP process, but what am I missing to have the other attributes go back out with the Access-Accept? Thanks all! -Dan

1 0

Problem with loading files from free radius
by Eyas Sarabi 10 Nov '05

10 Nov '05

Hi All; I faced a major problem, My Hard disk was corrupted and the free radius wasn't being able to write to database, I still have the files generated by free radius and I want to load them to the database .Is there any tool that can load the generated files to oracle database ? Regards, Eyas

1 0