- Freeradius-Users - lists.freeradius.org

pam_radius_auth on 64bit Linux doesn't work (fwd)
by JR Mayberry 13 Jun '05

13 Jun '05

Hello, We are starting to deploy 64bit RH Linux systems (AS3). The 32bit module didn't work, and I had trouble getting the 64bit to compile successfully. For the sake of time, I found a 64bit pam_radius_auth RPM and installed it. It attempts to authenticate, but every packet gives an incorrect shared secret error on both sides. I've tried everything imaginable to get it to work with no success. The shared secrets are absolutely correct on both sides. Any success stories? Any ideas?

3 2

PROBLEM WITH THE CERTIFICATES
by Georgina Noemi González Ceballos 13 Jun '05

13 Jun '05

i have a problem with a radius server, i am using freeradius and openssl, when i run the server in debug mode i don't have any errors... but when i use a windows client i get the next error in the server.. lm_eap_tls: <<< TLS 1.0 Handshake [length 02e8], Certificate --> verify error:num=20:unable to get local issuer certificate chain-depth=0, error=20 rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B 4768:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:1989: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. I know that is a problem with the client certificate.. i imported the root and client certificate to windows. my versions are: freeradius 1.0.0 openssl-0.9.6m openssl-SNAP-20050330 openssl-0.9.7d i am using AP 350 series. EAP--- i am using TLS do you have some idea?? it's very important because is my final project.. thanks¡¡ Gina _________________________________________________________________ Dale rienda suelta a tu tiempo libre. Encuentra mil ideas para exprimir tu ocio con MSN Entretenimiento. http://entretenimiento.msn.es/

2 1

Link error (invalid ELF header) in freeradius 1.0.3
by Software Development Group 13 Jun '05

13 Jun '05

Hello, I am getting the following error when running freeradius -X: radiusd.conf[2] Failed to link to module 'rlm_sqlcounter': /usr/lib/freeradius/rlm_sqlcounter.a: invalid ELF header Thanks. Max

1 0

Qry:- How to assgin DNS server IP address to the client through RADIUS server
by romel dutta 13 Jun '05

13 Jun '05

Hai all Here i am using freeradius-1.0.2 using for AAA function...and pppoe-server as the client.... Here i need to assgin the DNS ip address to the pppoe-client through the radius..... server... pls tell me which attribute is there to assign DNS IP address.... Also tell me it is possible to assign ip address through the freeradius-1.0.2 (source code) in pppd we are using the patch version ppp-2.4.1b2-vanilla-radclient-v2.0.patch.gz .... With regards Romel

2 1

bogus session handling in radutmp?
by Stefan Winter 13 Jun '05

13 Jun '05

Hello, we are using a FR 1.0.1 server for accounting purposes. The server is configured to keep track of current sessions in radutmp. Occasionally, this file gets corrupted: it contains a _plain text_ copy of an accounting packet (exactly as you see them in the detail files) as opposed to the binary format this file is usually in. The result is that the parser radwho gets confused by these entries and fails to display the sessions that are located in the vicinity of the plain text part of the file. Strangely enough, there are no other problems. FR keeps working, no SEGVs, and radwho displays the other sessions as usual. Has anyone experienced this? Would upgrading to 1.0.3 help (this server is in heavy production use and I would like to avoid upgrading if possible)? Greetings, Stefan Winter -- Stefan WINTER Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingénieur de recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu tél.: +352 424409-1 http://www.restena.lu fax: +352 422473

2 1

RE: Class attribute questions
by Shawn K. O'Shea 13 Jun '05

13 Jun '05

> > I just wanted to make > > sure that I wasn't missing something, and that there isn't > an easier > > way to get at the ASCII inside the octet stream. > Edit the dictionary, and change "octets" to "string"? I saw discussion in a previous thread (Handling of the 'Class' attribute, this post in particular, http://lists.freeradius.org/mailman/htdig/freeradius-users/2003-July/021 267.html) that implied this was frowned upon, at least when interacting with other RADIUS servers (which is what I'm using FreeRADIUS for), but also because the RFC recommends that it should be treated as undistinguished octets. > > 2) The rfc's allow for more than one Class attribute (at least in > > Accounting-Request packets). How does FreeRADIUS treat > references to > > %{Class} when this happens? i.e. Is there a syntax to refer to each > > instance of the Class attr or get a count of how many are > in the packet? > The CVS snapshots allow this. 1.0.x doesn't. See doc/variables.txt I read through the current doc/variables.txt in CVS. Looks great. Is this a 1.1.x kind of feature or will it find it's way into a later 1.0.x? Thanks for the reply. -Shawn

2 1

Free RADIUS for WLAN - Problems?
by dat nguyen 13 Jun '05

13 Jun '05

I'm using freeRADIUS-1.02 as an Authentication Server for my Wireless LAN. I've read "802.1X Port-Based Authentication HOWTO" and I'm still wondering some thing: - What are differences between "unicast key" and "multicast/global key". If unicast key is used for encrypting per-client data and if I have 20 client, does that mean Access Point must hold all 20 per-client unicast key? And if multicast/global key is used for encrypting multicast/broadcast traffic, does that mean we have to pre-configure the key in Access Point? - Can someone explain me about "4-way handshake" and how a client derives 128-bits key for Encryption and 64-bits key for MIC. - I want to authenticate my clients with ComputerName\\UserName and i configured my radiusd.conf like below: realm ntdomain { format = prefix delimiter = "\\\\" ignore_default = no ignore_null = no } Is it right? Is it neccessary to care lowercase or upercase in ComputerName? - And I have a problem with my XP client: after the first successful authentication, when I disconnect and reconnect, Instead I must enter my username and password, It automatically connect without a login prompt. Thanks in advance! __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

Authenticate/Attributes based on NAS-IP-Address
by N White 13 Jun '05

13 Jun '05

Using MySQL as a backend, is there any way to configure Authentication and Attribute (replies), based on the NAS-IP-Address sent to the FreeRADIUS server? Allow requests from NAS1 to authenticate and have certain attributes for users in that group and then allow requests from NAS2 to authenticate and have different attributes. Would there be anyway to allow a user to be a part of both groups? Thanks, Nick

6 16

Multiple logins Freeradius/Mysql
by Mark Elkins 13 Jun '05

13 Jun '05

We've set up Simultaneous-Use := 1 - and this seems fine. However, I have my first user - who is really off the net and 'radzap' seems to do nothing.... (radwho still gives the user as being there). What is the code... in sql.conf... simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" ...for???? In our previous Radius - we used to simply provide a valid AcctStopTime time - and the user could then login again. What do I need to do to change freeradius to do Simultaneous-Use control using mysql and not using radwho?? I've read doc/Simultaneous-Use - which doesn't use/mention [my]sql. I'm guessing (looking at where radutmp is mentioned)... radiusd.conf has... session { radutmp } Should this be changed to... session { sql } ??? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

2 2

RE: restricting access for users
by alan walters 13 Jun '05

13 Jun '05

Dustin I get matchs in my users files. But the huntgroup seems to just be bypassed. Could you PM me with a users file and huntgroups file incase it is a syntax issue. thenks -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Dustin Doris Sent: 13 June 2005 14:52 To: FreeRadius users mailing list Subject: RE: restricting access for users > > I have a second issue with this in that the users file has a defulat > reject if the group is not matched. This also is not being used > correctly by freeradius. The user defaults into that if there group does > not match but does not get rejected. > I have never noticed any problems like that myself. I suspect you have something else in your users file that it is matching on. Perhaps a DEFAULT Auth-Type = something? Please post your users file in its entirety (you can remove the # lines if you would like for easier reading) Then post your radiusd -X output showing this behavior. That way you can read the debug info and look for a line that says something like "matched users file at 1". Without seeing the users file and the actual debug here its hard to say. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.6.7 - Release Date: 10/06/2005

1 0