- Freeradius-Users - lists.freeradius.org

RE: 802.1x
by Jeff Reilly 02 Nov '05

02 Nov '05

2 1

SV: rlm_sql module won't compile under Solaris 10
by Torkel Mathisen 02 Nov '05

02 Nov '05

Hi Add /usr/ccs/bin to your PATH. Regards, Torkel -----Opprinnelig melding----- Fra: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] På vegne av M.McNeil Sendt: 28. oktober 2005 22:55 Til: freeradius-users(a)lists.freeradius.org Emne: rlm_sql module won't compile under Solaris 10 Viktighet: Høy Hello, I'm trying to get FreeRadius 1.0.5 to compile with MySQL / RLM_SQL, under Solaris 10. Configure works just fine, however, after running "make", I get the following: gmake[7]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' Making static in drivers... gmake[8]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' /usr/sfw/bin/gmake -w WHAT_TO_MAKE=static common gmake[9]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' Making static in rlm_sql_iodbc... gmake[10]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_iodbc' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making static in rlm_sql_mysql... gmake[10]: Entering directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -xc99=none -c sql_mysql.c -o sql_mysql.o gcc: language c99=none not recognized gcc: sql_mysql.c: linker input file unused because linking not done /export/home/freeradius-1.0.5/libtool --mode=link ld -module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -xc99=none sql_mysql.o -o rlm_sql_mysql.a mkdir .libs (cd . && ln -s sql_mysql.lo sql_mysql.o) ar cru rlm_sql_mysql.a sql_mysql.o ar: cannot open sql_mysql.o No such file or directory ar: sql_mysql.o not found gmake[10]: *** [rlm_sql_mysql.a] Error 1 gmake[10]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' gmake[8]: *** [static] Error 2 gmake[8]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' gmake[6]: *** [static] Error 2 gmake[6]: Leaving directory `/export/home/freeradius-1.0.5/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/export/home/freeradius-1.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/export/home/freeradius-1.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/export/home/freeradius-1.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/freeradius-1.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/export/home/freeradius-1.0.5' *** Error code 2 The following command caused the error: /usr/sfw/bin/gmake WHAT_TO_MAKE=all common make: Fatal error: Command failed for target `all' I dowloaded the binary MySQL package from mysql.com and added /usr/local/mysql to my PATH and LD_LIBRARY_PATH variables. FreeRadius can see the files, however, it will *not* compile the rlm_sql module. I've combed the mailing list archive, but I have yet to find a solution to this problem. Has anyone else experienced this issue ? Best Regards, Mike McNeil Sr. Network Engineer Communications & Network Services University of California Berkeley - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

RE: 802.1x
by Guy Davies 02 Nov '05

02 Nov '05

Which Vendor Specific Attributes are implemented by a Vendor are, as the name suggests, specific to the vendor and totally up to them to choose. I would not be surprised if DLink implement *NO* VSAs. Given the market into which they're pitching their kit, I doubt very much that their kit will do bandwidth control. Authenticating access to the port is the basic function of 802.1x so if DLink claim 802.1x support, then you can configure your NAS so that you don't get any access without authenticating first. Rgds, Guy ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alex M Sent: 02 November 2005 17:04 To: 'FreeRadius users mailing list' Subject: RE: 802.1x Ok I got it... By the way what is AV pair? And how do you get NAS related attributes to control bandwidth from vendors? Like if im using D-Link how could I get attributes from them? Thanks! ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeff Reilly Sent: Wednesday, November 02, 2005 11:53 AM To: FreeRadius users mailing list Subject: RE: 802.1x Alex, Features such as 'bandwidth and port blocking" (if any) are allocated/configured on the _NAS_ (in this case a NAS port) via AV pair/s provided by RADIUS... the '802.1x Supplicant" (Client/Endpoint) in simple terms... provides a secure/standard conduit which facilitates the communication of credentials (from the Supplicant to the Authenticator). The '802.1x Authenticator" (or NAS) _MAY_ provision/enforce Authorization for the specific endpoint in the context of a user or group... The management & granularity of this functionality verifies greatly by switch vendor as a result providing this functionality across a multi-vendor environment... in a large scale deployment... is often too complex to seriously consider.<? jmr -------- Original Message -------- Subject: RE: 802.1x From: "Alex M" <alexm(a)lrcommunications.net> Date: Wed, November 02, 2005 9:10 am To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Now im totally lost... Can u give me an example what 802.1x does? -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, November 02, 2005 11:04 AM To: FreeRadius users mailing list Subject: Re: 802.1x "Alex M" <alexm(a)lrcommunications.net> wrote: > So then such features as bandwidth and port blocking could be controlled via > 802.1x? No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

Patches
by kdr akm 02 Nov '05

02 Nov '05

Hi i need to ask is there any patch for PPPD to send this MAC adress to RADIUS ??? and what about rp-pppoe is there any patch let pppoe server is probrably rp-pppoe to send Mac address to pppd ? --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0

RE: 802.1x
by Jeff Reilly 02 Nov '05

02 Nov '05

2 1

freeradius with static IP
by Daniel Torres 02 Nov '05

02 Nov '05

Hi, First of all excuse my englis it is not very well, i wanted to know if somebody has been able to set a freeradius server to assign static IP or if it is possible to assign static IP with freeradius1.0.5. Thanks for the information. --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

2 1

how to use ntlm_auth
by Juan Mauel Lopez Villalobos 02 Nov '05

02 Nov '05

Hi, I want to know how to use ntlm_auth with ntlm-server-1 and freeradius, with the users login and password information in ldap. I have read documentation of ntlm_auth (only found the man page), docs and howtos about pptp and squid, i don't found about freeradius, and i'm experimenting with the options of ntlm_auth. I have configured freeradius+ldap+802.1X for a wireless lan, but i can't get it to work because of mschap, and i dont have windows domain. The ntlm_auth man page said: "Server-side helper protocol, intended for use by a RADIUS server or the 'winbind' plugin for pppd, for the provision of MSCHAP and MSCHAPv2 authentication." Who i can use it with (free)radius only?? The radius.conf said in the mschap module definition: "#The module can perform authentication itself, OR # use a Windows Domain Controller. How can the module permorm authentication itself??? can someone helpme?? -- LCC Juan Manuel Lopez Villalobos Departamento de Sistemas de Informacion Coordinacion de Informacion Academica Universidad Autonoma de Baja California Tel: (686) 551 8274 Fax: (686) 551 8269 Conmutador: (686) 551 8222 y 8270 ext. 3360

2 1

Re: New to List - First Time Set-up
by tech13＠netaxis.ca 02 Nov '05

02 Nov '05

Hi, Start with: http://www.oreilly.de/catalog/radius/chapter/ch05.html It was very helpful for me. Pierre Forget > -- Original Message ---- > Date: Tue, 1 Nov 2005 15:12:19 -0800 > From: "Mark Sarria" <mes4294(a)lausd.k12.ca.us> > Subject: New to List - First Time Set-up > ------------------ > Hello List, > > I have been reading about freeradius and would like to set it up in my > sandbox environment for testing. Can you point me to the right direction on > how to go about setting this service up. Also can you give me a brief list > down of the items I will need on my server. > > At the moment I have been working with Fedora Core 3 running as my > Samba-LDAP server, on my sandbox environment. > > Thanks for your help > > --mark > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

using ldap, sql and pam for user authentification
by Markus Krause 02 Nov '05

02 Nov '05

hi all! i want to configure the freeradius server (1.0.5) to use ldap, sql and pam as source for user authentification. i only get the first two to work at the same time (ldap and sql) but not together with pam. if i use this in /etc/raddb/users: ##### users wlan Auth-Type = EAP testuser Auth-Type := Local, User-Password == "secret" ------ all user in ldap and sql (and of course the "testusers" in the "users" file) can be authorized, but if users in pam can not, radiusd says: ##### radiusd debug output auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. ----- with the following in /etc/raddb/users: ##### users DEFAULT Auth-Type = Pam Fall-Through = Yes wlan Auth-Type = EAP testuser Auth-Type := Local, User-Password == "secret" ----- users in pam get an access-accept message, but not those in ldap and sql (nor the "testuser" in "users". the debug output for a user in sql says: ##### radiusd debug output (only "important parts" as i assume) modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for nig49594 radius_xlat: '(uid=nig49594)' radius_xlat: 'dc=mogli,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mogli,dc=de, with filter (uid=nig49594) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 6 radius_xlat: 'nig49594' rlm_sql (sql): sql_set_user escaped user --> 'nig49594' [snipp sql queries] rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 6 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user nig49594, check_item=1, counter=0 rlm_sqlcounter: Sent Reply-Item for user nig49594, Type=Session-Timeout, value=1 modcall[authorize]: module "onedayaccounts" returns ok for request 6 modcall: group authorize returns ok for request 6 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <nig49594>. Reason: User not known to the underlying authentication module modcall[authenticate]: module "pam" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. ----- same for an ldap user: ##### radiusd debug output (snipped again) rlm_ldap: - authorize rlm_ldap: performing user authorization for ldapuser radius_xlat: '(uid=ldapuser)' radius_xlat: 'dc=mogli,dc=de' [snipp] rlm_ldap: user ldapuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 radius_xlat: 'ldapuser' rlm_sql (sql): sql_set_user escaped user --> 'ldapuser' [snipp] rlm_sql (sql): User ldapuser not found in radcheck rlm_sql (sql): User ldapuser not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "onedayaccounts" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <ldapuser>. Reason: User not known to the underlying authentication module modcall[authenticate]: module "pam" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Login incorrect: [ldapuser] (from client wlan port 0) ----- it seems that the pam returns "reject" if a user is not found by pam, sql and ldap reutrn "nofound". how can i set up the pam part to return "notfound" and not overwrite the "ok" request by the other modules? thanx in advance for your help! regards markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

1 0

PEAP MS_CHAP V2: problem with tunnel attributes on enterasys V2 switch
by slapeyre＠free.fr 02 Nov '05

02 Nov '05

Hello, I am new to this list and would like to know if someone out there has been successfull in implementing eap-PEAP user authentication and VLAN assignment with freeradius and Enterasys V2 switches ? It wasn´t a problem to configure EAP-PEAP with freeradius server (running on suze) and Enterasys switches. I already use it for client authentication but I had no success with switch/port based authentication and VLAN assignment at a enterasys switch. The users and their RADIUS attributes are on LDAP base on a Novell server (version 6.5) I know from reading our enterasys notice that the switch expects the following parameters within access_accept "tunnel-type= 13 (VLAN)" "tunnel-medium-type=6 (802) "tunnel-private-group-ID=vlan_id" but with no success. I didnt see the attribute on FreeRADIUS LOG. I have put a sniffer machine between the FreeRadius Server and the Novell server, but I didnt see any Tunnel attribute. In fact, I dont know: - if the switch dont receive the tunnel parameters - OR if the switch dont understand the tunnel parameters it is receiving Any tips ?? Is it necessary to active or configure something on FreeRADIUS to use tunnel parameters ??? thank you in advance. Best regards Stephane

2 2