- Freeradius-Users - lists.freeradius.org

Re: reject reply
by hannibal 27 Oct '05

27 Oct '05

well, i've set reply_delay to 0, and it did work. thank you, men. but there is another question. if reply_delay=1, it should send the message in 1 sec, but with tcpdump, i found that it didn't send the message after 1 sec. and i think max_request_time plays a role here. someone knows?

1 0

LDAP Authentication
by James Taylor 27 Oct '05

27 Oct '05

I am currently trying to get LDAP authentication to work properly. As I am still learning the ins-and-outs on how all this comes together I am having an issue validating a user with Radius-LDAP. Attached is an example of the debug. Maybe it is just something stupid that I am doing. Thank you for your help! James Taylor EAP-Message = 0x573bea1ceb16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf666044c26dce30b13ecbacd04693e18 rad_recv: Access-Request packet from host 192.168.43.106:1645, id=126, length=151 User-Name = "jtaylor" Framed-MTU = 1400 Called-Station-Id = "0014.6ae0.3180" Calling-Station-Id = "0040.96a6.d46c" Service-Type = Login-User Message-Authenticator = 0x421ab8418995a7c7b6b94367b0d154d9 EAP-Message = 0x0204001119800000000715030100020230 NAS-Port-Type = Wireless-802.11 NAS-Port = 4082 State = 0xf666044c26dce30b13ecbacd04693e18 NAS-IP-Address = 192.168.43.106 NAS-Identifier = "SAP" rlm_ldap: - authorize rlm_ldap: performing user authorization for jtaylor rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jtaylor authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_eap_tls: Length Included TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 9963:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 9963:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.

3 4

cheking mysql requests
by Alex M 27 Oct '05

27 Oct '05

Hi Im having problem with that freeradius doesn't recognize the clients (NAS) in the NAS table of MySQL.. It keeps throwing me: Unknown client nothing to do. So, I have set up sql.conf to trace mysql qureys in -X debug mode to YES, but I still don't see any qureys shown to the NAS table to see is the client is authorized. So how can I check if freeradius sends the query to the NAS table of the DB to SELECT * NAS where NASNAME = 'xxx.xxx.xxx.xxx' and SECRET='testing123' ??? I MUST make this work!!! Please help!

2 5

thread pool
by alexander＠infomed.sld.cu 27 Oct '05

27 Oct '05

At an ISP where we use freeradius with mysql in older to authenticate remote dial up users. The system worked fine until some weeks ago when there was an increase of the number of users and the radius begun to have troubles. For instance some days ago we have an electric problem and was nessesary shutdown the radius servers and the NASes. When turne on the system the radius daemon die with a "segmentation foult" error or it stay running but do not solve any request because an error of type: "There are no DB handles to use!" take care. Running radiusd -xx, the server die because with the error message: "can not spread more mysql connection" or something like this. Even frequently, at times of more trafic the server also die. I`m supose that it`s a problem of trafic due to the increase of the numbers of users. So i´m need to know if there any form of do that the radiusd accept just a limited number of requests in order to avoid that troubles when increase the load of the server? Regards. ------------------------------------------------- Este mensaje fue enviado usando el servicio de correo en web de Infomed http://webmail.sld.cu

2 1

MS SQL Schema File
by Daniel Corbe 26 Oct '05

26 Oct '05

Hello, I have unixodbc configured as the SQL back end for my RADIUS server and the back end database is an MS SQL Server. Does anyone have a schema available for MS SQL Server? This would need to include a unix_timestamp stored procedure. Please help -Daniel

5 9

RE: FreeRadius with NTLM
by Jaygopal Upadhyay 26 Oct '05

26 Oct '05

Hello, I feel my samba configuration is fine as I am able to use ntlm_auth --username=username --domain=domainname and get it authenticated. But through radius I am not able to get authenticated. Below is the log when a request is received by the radius server. Can anyone guide me correct the problem? Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.159.186:1031, id=8, length=260 Message-Authenticator = 0x13b3b93f61a42974560bd934ea94ed07 Service-Type = Framed-User User-Name = "DOMAINNAME\\username" Framed-MTU = 1488 State = 0xf4e76dd53f28774073c9ffd19f060b3d Called-Station-Id = "00-13-46-70-50-54:SierraAtlantic" Calling-Station-Id = "00-13-CE-24-AB-DC" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001b5521adc1357e0251337f314c5568e0fe5404c4fc59106c977397 80 NAS-IP-Address = 192.168.159.186 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 26 modcall[authorize]: module "preprocess" returns ok for request 26 modcall[authorize]: module "chap" returns noop for request 26 modcall[authorize]: module "mschap" returns noop for request 26 rlm_realm: No '@' in User-Name = "DOMAINNAME\username", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 26 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 26 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 26 modcall: group authorize returns updated for request 26 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 26 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 26 modcall: group authenticate returns invalid for request 26 auth: Failed to validate the user. Delaying request 26 for 1 seconds Finished request 26 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.159.186:1031, id=8, length=260Sending Access-Reject of id 8 to 192.168.159.186:1031 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Regards, Jaygopal. -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, October 25, 2005 10:20 PM To: FreeRadius users mailing list Subject: Re: FreeRadius with NTLM Jaygopal Upadhyay <Jaygopal.Upadhyay(a)sierraatlantic.com> wrote: > Can anyone provide me with steps on how to configure FreeRadius to use samba > and allow access to WI-FI to valid domain users? Read radiusd.conf. Look for "ntlm_ath". Read samba's documentation to see how to configure it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html "The information contained in this message and the attachments (if any) may be privileged and confidential and protected from disclosure. You are hereby notified that any unauthorized use, dissemination, distribution or copying of this communication, review, retransmission, or taking of any action based upon this information, by persons or entities other than the intended recipient, is strictly prohibited. If you are not the intended recipient or an employee or agent responsible for delivering this message, and have received this communication in error, please notify us immediately by replying to the message and kindly delete the original message, attachments, if any, and all its copies from your computer system. Thank you for your cooperation."

2 1

Cisco and No NAS-Port seen (checkrad)
by Miguel 26 Oct '05

26 Oct '05

Hi, im having problems implementing simultaneous-use on a cisco AS5400, is the same problem addresses in this thread http://lists.cistron.nl/pipermail/freeradius-users/2005-March/041894.html Ok, i know what the problem is, but how can i instruct the cisco that it must send the NAS-Port attribute?, is this even posible? thanks

3 3

Problems Installation Debian
by awaradius＠myawa.com 26 Oct '05

26 Oct '05

Hello everydoy, I am installing the last version of freeradius, but I have a bit problem in the installation. I work with debian. First of all, I download the software from freeradius´ web: radiusnoc:/# wget ftp://ftp.freeradius.org/pub/freeradius-1.0.5.tar.gz The next step: radiusnoc:/#tar zxvf freeradius-1.0.5.tar.gz After, I change to the directory: radiusnoc:/#cd freeradius-1.0.5 Now, I must do this steps: ./configure make make install But, it is here where I have some problems: radiusnoc:/freeradius-1.0.5# ./configure creating ./config.status creating Makefile creating config.h config.h is unchanged radiusnoc:/freeradius-1.0.5# make x99_rlm.c:492: error: `user_info' undeclared (first use in this function) make[6]: *** [x99_rlm.o] Error 1 make[6]: Leaving directory `/freeradius-1.0.5/src/modules/rlm_x99_token' make[5]: *** [common] Error 2 make[5]: Leaving directory `/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/freeradius-1.0.5' make: *** [all] Error 2 radiusnoc:/freeradius-1.0.5# make install make[4]: Leaving directory `/freeradius-1.0.5/src/modules' Making install in main... make[4]: Entering directory `/freeradius-1.0.5/src/main' /freeradius-1.0.5/libtool --mode=install /freeradius-1.0.5/install-sh -c -m 755 radiusd /usr/local/sbin /freeradius-1.0.5/install-sh -c -m 755 radiusd /usr/local/sbin/radiusd install: radiusd does not exist make[4]: *** [install] Error 1 make[4]: Leaving directory `/freeradius-1.0.5/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/freeradius-1.0.5/src' make[2]: *** [install] Error 2 make[2]: Leaving directory `/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/freeradius-1.0.5' make: *** [install] Error 2 somebody can help me? somebody knows these errors? Thanks!!!

2 1

reject reply
by hannibal 26 Oct '05

26 Oct '05

hi, everyone, i got these logs: ---------------------------------------------------------------------------------------------- modcall: group authorize returns reject for request 37 Delaying request 37 for 1 seconds Finished request 37 // why finished request, but not send reply to client?? Going to the next request Thread 6 waiting to be assigned a request --- Walking the entire request list --- Sending Access-Reject of id 1 to 127.0.0.1:32874 // Sending this message, i think is because of process time out. Cleaning up request 37 ID 1 with timestamp 435cf28f --------------------------------------------------------------------------------------------- what happened behind? i'm a completely newbie. can someone tell me? thank you!!

3 2

Freeradius and Hardware Tokens
by michel APPLAINCOURT 26 Oct '05

26 Oct '05

Hi all, I am currently looking for a replacement solution for centralized authentication for one customer. They want openness and standards. Freeradius seems a very good solution, but they also want a solution that permits use of hardware tokens. I looked that FreeRadius support X9.9, so I have a simple question : Which are the hardware tokens that can be used surely with FreeRadius (fully supported)? I saw that cryptocards are fully supported, but references are often dated of 2002. Today, are cryptocards still usable? If yes what is possible and what is not. For example how can we manage tokens, is there an open source tool? How can we reset a blocked token (too much pin errors)? do we need initializer? but then do we need also cryptocard server? and if yes how muche licenses do we need and what is the advantage of using freeradius with it? Are there other tokens than cryptocards fully or well supported? I am actually blocked by these questions and can't find any answers, even in the mailing list. Thanks for a quick response, as I have to give answer to my customer in 2 days (sic). =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Michel APPLAINCOURT | E-mail : michel.applaincourt(a)it-optics.com Managing Director | Phone : +32 65 321573 ext 6001 IT-OPTICS s.a | Fax : +32 65 321574 [The boy that you love is the man that you fear] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0