- Freeradius-Users - lists.freeradius.org

TLS Question
by Juan Daniel Moreno 05 Oct '05

05 Oct '05

Hi, I'm using freeRadius 1.0.4 and I would like to know something about tls config. When I launch radius en debug mode I get this messages: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/juan/key.key" tls: certificate_file = "/etc/raddb/certs/juan/cert.cert" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" but I would like to know how to change some parameters (like rsa_key_exchange = yes) and, even more important, if the rsa_key_length is given in Bytes or bits. Does it mean that the certificate length changes in function of this rsa_key_length? Thank you, Juan Daniel MORENO

2 1

Call-Check
by Ivo 05 Oct '05

05 Oct '05

Hi, Can someone tell me is it possible to get freeradius respond to Service-Type==Call-Check requests? I have read on cisco's web pages that it is not possible. I am using PM3 RAS with "set call-check on" option set. Namely, I would like to check for valid caller-id before answering the call and going on with username/password check. If it is possible, some pointers would be very appreciated... TIA Ivo.

2 1

Success Story (A tribute to the FreeRADIUS project)
by Lefteris St 05 Oct '05

05 Oct '05

Hello everyone, I am writing this -long overdue- letter to express my gratitude to all FR developers and other people who help through this mailing list. I may not be an active poster, but this list's archive has been a tremendous help during my involvement with FreeRADIUS. Thanks to the intense support (and of course great open source software), my project was a success and I managed to learn a couple of things too :-). To whom it may concern, I have deployed the following setup for my Univercity wifi hotspot: WiFi users connect to APs in the Univercity premises. Authentication follows two scenarios (depending on the particular AP site): Scenario A or NoCat Scenario (low security): -A NoCat captive gateway runs on a PC connected directly to the AP (or the AP itself, for embedded devices). This PC is also responsible for DHCP, firewall rules etc... -The user's web browser is redirected to the login page hosted at the AAA server for this building. There runs the NoCat Auth Server and (of course) a FreeRADIUS server. the NCA server gives the user credentials to FR, who in turns authorizes them against the local Windows AD (where Univercity users reside) and a mysql database (for temporary wifi accounts -can be duration-restricted). -After the NoCat gateway lets the user in, it periodically sends accounting information to the FR server (to be stored in the mysql DB). Scenario B or EAP scenario (high security): -A FreeRADIUS proxy runs on a PC connected directly to the AP (or the AP itself, for embedded devices). This PC is also responsible for DHCP, firewall rules etc... -The AP has WPA-Enterprise enabled and connects to the proxy FR for authentication. -Users IEEE.1X clients for EAP authentication (mainly PEAP). -The FR proxy forwards authentication packets to the central FR server (the same one as scenario A) who authenticates ands authorizes against the Windows AD and mysql DB. -Accounting packets are sent either by the AP (through the proxy) or a NoCat gateway (set in "Open" mode) which runs at the same PC with the proxy. Accounting information is monitored through the dialup_admin front-end, which is also used for temporary wifi accounts (that go in the mysql db). (The above may imply a large scale deployment but there are only two APs for now :-) [both running scenario A].) That's about it in a nutshell. I named the whole system the WAL (Wireless Aueb -my Univercity- Lan). As you can see, I have also made heavy use of the NoCat project (thanks to everyone in that mailing list/developer team too!!) but it saddens me to see that it got stuck in version 0.82 :-(. Anyway, thanks again and keep up the good work. I am not done with FR just yet, so I'll ne seeing you all :-). Stefanis Eleftherios MsC Student in Computer Science AUEB PS: Sorry for the long post, I just thought it would be nice for people to see what FR (combined with other great open source software) can do in a complete WiFi deployment. PS2: The total software cost for the WAL was 0$ and took one person (me) a total of about 2 months to architecture and setup. __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Re: No updates with radiusd log
by john＠jetcityorange.com 05 Oct '05

05 Oct '05

Thanks Alan. I was trying to debug but not in full debugging mode. I'll give that a shot. Thanks again, John > -----Original Message----- > From: Alan DeKok [mailto:aland@ox.org] > Sent: Wednesday, October 5, 2005 01:07 AM > To: 'FreeRadius users mailing list' > Subject: Re: No updates with radiusd log > > john(a)jetcityorange.com wrote: > > When we attempt to access the FreeRadius server via a remote AP, the > > radiusd log shows nothing. > > Run the server in debugging mode to see what it's doing, and why. > > This is mentioned in the FAQ, README, INSTALL, and daily on this list. > > > No attempt, nothing. Yet the XP client shows a 'validating > > identity' message. However, I see nothing in the logs to debug. > > Accounts are set to local authentication via EAP-TLS. > > EAP-TLS doesn't use local authentication. It uses certificates. > Perhaps that's the problem. And debug mode *will* explain this. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

RE: PID variable
by Jonathan De Graeve 05 Oct '05

05 Oct '05

Pidof freeradius will also do -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Josh Howlett Verzonden: woensdag 5 oktober 2005 11:21 Aan: FreeRadius users mailing list Onderwerp: Re: PID variable [root@lichen ~]# cat /var/run/radiusd.pid 10163 josh. Abdul Lateef wrote: > Hi all, > > How i can retrive the current pid value of freeradius > in Shell script. > > I wanted to create one shell script to run in linux > corn commond. because our database is very slow and > always radius is going to crashed when it receives > more than 1000 request. so my script will check if the > radius is crashed it will start automatically using > cron. > > Is anyone have good logic to auto restart radius when > it will be crashed? > > > > -------- > Yours, > Abdul Lateef > Computer Programmer > HATIF COM > Mob: +974 - 5405022 > Tel: +974 - 4883068 > ICQ: 276994704 > YM!: abdul_zu > Fax: +974 - 4883063 > Doha Qatar > http://www.hatif.com > > > > __________________________________ > Yahoo! Mail - PC Magazine Editors' Choice 2005 > http://mail.yahoo.com > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Crashes with 1.0.4/1.0.5, perhaps connected with slow LDAP backend?
by Martin Pauly 05 Oct '05

05 Oct '05

Hi, we seem to have a stability issue with freeradius 1.0.4/1.0.5: 1.0.4 crashed in short sequence on both of my redundant servers during my vacation -- not much of a trace in the logfiles. On Monday, I upgraded to 1.0.5 with everything looking fine for almost 2 days. Yesterday, we started polling the servers regularly from a NAGIOS system, using the check_rad NAGIOS plugin. On server (the one processing the highest number of requests) crashed twice yesterday; this time it complained about "Unresponsive child" processes in close temporal correlation. We do have perfomance problems with our LDAP backend, so this sound reasonable, but could this cause the server to crash? During testing, I also encountered a situation where the freeradius process lived on, but became comletely unresponsive; I had to to kill -9 What should I do to track down these issues? Does running in full debug mode for days make sense? Thanks, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 6

PID variable
by Abdul Lateef 05 Oct '05

05 Oct '05

Hi all, How i can retrive the current pid value of freeradius in Shell script. I wanted to create one shell script to run in linux corn commond. because our database is very slow and always radius is going to crashed when it receives more than 1000 request. so my script will check if the radius is crashed it will start automatically using cron. Is anyone have good logic to auto restart radius when it will be crashed? -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

RE: Tru64 again
by Adharsh P 05 Oct '05

05 Oct '05

Hello Tim Winders, When you run configure in Tru64, configure sets GETHOSTBYADDRRSTYLE and GETHOSTBYNAMERSTYLE to GNUSTYLE in src/include/autoconf.h Modify the two lines in src/include/autoconf.h -#define GETHOSTBYADDRRSTYLE GNUTYPE -#define GETHOSTBYNAMERSTYLE GNUTYPE to +#undef GETHOSTBYADDRRSTYLE +#undef GETHOSTBYNAMERSTYLE Also undef OSFC2 if you haven't already done this. do a make and make install. Run radiusd. It should be work. ---adharsh RE: Tru64 again Tim Winders Thu, 15 Sep 2005 08:17:25 -0700 responding to my own post. I saw a message about looking at the core dump in another thread. So, I followed those instructions. Here is the output from gdb: This GDB was configured as "alphaev67-dec-osf5.1"... BFD: Unhandled OSF/1 core file section type 4464 BFD: Unhandled OSF/1 core file section type 528 BFD: Unhandled OSF/1 core file section type 0 BFD: Unhandled OSF/1 core file section type 7 BFD: Unhandled OSF/1 core file section type 16384 BFD: Unhandled OSF/1 core file section type 8192 BFD: Unhandled OSF/1 core file section type 0 BFD: Unhandled OSF/1 core file section type 32768 BFD: Unhandled OSF/1 core file section type 49152 BFD: Unhandled OSF/1 core file section type 49152 BFD: Unhandled OSF/1 core file section type 7 BFD: Unhandled OSF/1 core file section type 57344 BFD: Unhandled OSF/1 core file section type 49152 warning: big endian file does not match little endian target. Core was generated by ` '. Program terminated with signal 1, Hangup. warning: Couldn't find general-purpose registers in core file. warning: Couldn't find general-purpose registers in core file. #0 0x00000000 in ?? () when I did bt in gdb I got the same "#0 0x00000000 in ?? ()" response and nothing else. But, in reading the above, it seems a big endian v. little endian problem. Does this help in getting freeradius to work on Tru64? --- Tim Winders Associate Dean of Information Technology South Plains College Levelland, TX 79336 Problem replying to my email? Click the "Sign" button in the OE toolbar or, better yet, get your own FREE Personal E-Mail Digital ID: http://www.thawte.com/email/index.html > -----Original Message----- > From: Tim Winders [mailto:[EMAIL PROTECTED] > Sent: Wednesday, September 14, 2005 11:35 AM > To: 'freeradius-users(a)lists.freeradius.org' > Subject: Tru64 again > > I'm back at trying to get freeradius working under Tru64. > This time using 1.0.5. > > I have an older cvs version working, but I can't remember > what I did to make it work. :-( The working version I have > is marked 1.1.0-pre0 built on Feb 17, 2005. > > First, in src/main/radiusd.c I have commented out the OSFC2 > define. I do this because I'm not running C2, but it is > always found and enabled, which kills the make. Then, I run > configure with these options: > > CFLAGS="-I/usr/local/ssl/include -I/usr/local/include" > LDFLAGS="-L/usr/local/ssl/lib -L/usr/local/lib" LIBS="-lssl > -lcrypto -lsecurity" ./configure \ > --disable-shared \ > --enable-ltdl-install=no \ > --with-openssl-includes=/usr/local/ssl/include \ > --with-openssl-libraries=/usr/local/ssl/lib \ > --without-mysql --disable-mysql > > radiusd seems to compile, but with many warnings. However, > when I run it, it immediately seg faults and dumps core. > Unfortunately, I am not a programmer, so I don't know how to > begin troubleshooting this and try to help get freeradius > working under Tru64. > > I remember being told that none of the development team uses > Tru64. So, it's possible this will never work "right". But, > I'm willing to help out in whatever limited capacity I can, > including CPU/shell account. > > Any useful suggestions are welcome.

1 0

Cannot start Cisctron radius server
by Nagaraja Gundurao 05 Oct '05

05 Oct '05

Hi everyone, I have installed cistron 1.6.7. When I tried to run it,t it gives me an error saying [root@naga init.d]# ./radiusd start Starting RADIUS server: radiusd: dict_init: Couldn't open dictionary: /etc/raddb/dictionary.compat [FAILED] can someone tell me what this error message means. Cheers, Nagaraja Gundurao www.inchara.com -----------------------------------------------------------------------------------------------------------------------

2 1

RE: MSCHAPv2, MySQL, Freeradius
by Dan Russell 05 Oct '05

05 Oct '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: Wednesday, 5 October 2005 1:48 AM > To: FreeRadius users mailing list > Subject: Re: MSCHAPv2, MySQL, Freeradius > > "Dan Russell" <dan(a)in-house.com.au> wrote: > > Hey, I'm not having a go at you, I believe it does work, I'm just having > > issue getting it working.. > > Yes, but too many people post messages saying "Stuff went > wrong... how do I fix it?". Without any context, the only possible > answer is "No idea..." > > > Tue Oct 4 15:10:39 2005 : Info: rlm_sql (sql): No matching entry in the > > database for request from user [wolfer] > > Well, that would appear to be useful. > > > Here is a snippet of the radcheck table : > > > > ID UserName Attribute op Value > > 25 wolfer SMB-Account-CTRL == 16 > > 27 wolfer NT-Password == > > 0x47C8F8E50C470E37AAD3B435B51404EE > > See the docs for rlm_sql. '==' is a *comparison* operator. There > is no NT-Password in the packet, so of course it never matches. > > Change both '==' to ':='. > > Alan DeKok. > That's fixed it.. All works well now.. Thanks for your help. Daniel Russell > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0