- Freeradius-Users - lists.freeradius.org

RE: 'Segmentation fault' loading rlm_sql_postgresql
by Christiaan Ehlers 03 Jun '05

03 Jun '05

Hi, Managed to find the code and plug it into the right place... (I am NO C programmer!) All compiled well and the CALLING_STATION_ID is getting passed on to the server... Here is the diff if anybody is interested in doing the same ============================================== 1258d1257 < CONST char *rhost; 1306,1312d1304 < retval = pam_get_item(pamh, PAM_RHOST, (CONST void **) &rhost); < PAM_FAIL_CHECK; < if (rhost) { < add_attribute(request, PW_CALLING_STATION_ID, (unsigned char *) rhost, < strlen(rhost)); < } < 1613d1604 < =============================================== Thanks Christiaan Ehlers -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: 03 June 2005 17:30 To: FreeRadius users mailing list Subject: Re: 'Segmentation fault' loading rlm_sql_postgresql Achim Friedland <mailinglists(a)ahzf.de> wrote: > is there a known problem with freeradius 1.0.2 and rlm_sql_postgresql? > Load the sql.conf just makes my freeradius segfaulting... It's a libltdl problem. It can't find the postgres libraries on your system, as they're probably installed in a non-standard place. Set LD_LIBRARY_PATH, or in radiusd.conf, "libdir". Or, build the server statically. Or, install the postgres libraries in a standard place. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

FreeRADIUS + MPPE for PPTP VPN clients
by Alexei Monastyrnyi 03 Jun '05

03 Jun '05

Hi List. I have a Q about MS-CHAP and MPPE configuration for FreeRADIUS. OS and software versions Servers OS Solaris 9 SPARC FreeRADIUS 1.0.2 OpenLDAP 2.2.24 SAMBA 3.0.11 Network gateways Cisco PIX 506, IOS 6.3(4) PPTP VPN Clients Windows 2K/XP, MAC OSX. The RADIUS server we're talking about is a secondary LDAP server and SAMBA BDC as well. I'd like to use this FreeRADIUS as a username/password backend for PPTP VPN clients. VPN hub in my case is Cisco PIX device, which supports AAA RADIUS for PPTP VPDN groups. PPTP VPN against Cisco PIX works perfectly well with local authentication, i.e when usernames/passwords are configured locally on PIX. The RADIUS is already configured with OpenLDAP as a backend, authenticating against userPassword attribute. This part works OK. The OpenLDAP server is also a backend for my SAMBA domain controller, the same domain I'm trying to use for user logins via PPTP VPN. All users have both POSIX and SAMBA attiributes in LDAP. The following chain works. Cisco VPN clients --- NAS --- RADIUS --- LDAP This one doesn't PPTP VPN clients --- NAS --- RADIUS --- SAMBA --- LDAP I have configured RADIUS server as following (omitted some lines here). Modules section mschap { authtype = MS-CHAP use_mppe = yes #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no #ntlm_auth = "/usr/local/samba/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = localhost basedn = "ou=People,dc=orcsoftware,dc=com" filter = "(&(objectClass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no password_attribute = userPassword } authorize { preprocess auth_log reply_log mschap suffix ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } For PPTP logins it doesn't work for user MYDOMAIN\username and the server says (omiting the beginning of debug) Fri Jun 3 12:50:37 2005 : Debug: modsingle[authenticate]: calling mschap (rlm_mschap) for request 0 Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create LM-Password. Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: No User-Password configured. Cannot create NT-Password. Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: Told to do MS-CHAPv1 with NT-Password Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. Fri Jun 3 12:50:37 2005 : Debug: rlm_mschap: MS-CHAP-Response is incorrect. My Q is: should I use ntlm_auth program for getting NTLM passwords? If yes, should my RADIUS server be join a SAMBA domain which it is trying to use? Actually I'm a bit confused here and highlighting how RADIUS obtains or generates MPPE keys might be heplful. Any hints or useful URLs would be highly appreciated. Cheers, A.

2 1

radclient: received response to request we did not send.
by Juan Nin 03 Jun '05

03 Jun '05

Alan, Sorry I don't reply to your original mail, but I received it at home, and now I'm at work. My problem was I was receiving this error: # /bin/echo 'Framed-IP-Address=192.168.1.197' | /home/radius/bin/radclient -d /home/radius/etc/raddb/ -x aaa.aaa.aaa.aaa disconnect secret Sending Disconnect-Request of id 196 to aaa.aaa.aaa.aaa:1700 Framed-IP-Address = 192.168.1.197 rad_recv: Disconnect-NAK packet from host aaa.aaa.aaa.aaa:1645, id=196, length=20 radclient: received response to request we did not send. You told me the problem is I'm sending packet to port 1700 and receiving the reply from port 1645... but how can I fix this?? I tried using: # /bin/echo 'Framed-IP-Address=192.168.1.197' | /home/radius/bin/radclient -d /home/radius/etc/raddb/ -x aaa.aaa.aaa.aaa:1700 disconnect secret but I receive the same error, and with: # /bin/echo 'Framed-IP-Address=192.168.1.197' | /home/radius/bin/radclient -d /home/radius/etc/raddb/ -x aaa.aaa.aaa.aaa:1645 disconnect secret I get no response from NAS.. Thanks again! Juan

2 1

How long is the nas-table cached by freeradius?
by Evert Meulie 03 Jun '05

03 Jun '05

Hi all! Just wondering about the following: If a change is made in the nas-table of the radius-db, how long does it take for the freeradius daemon to start using this updated info? Or is the nas-table only read at freeradius (re)start? Regards, Evert

2 1

Configuring maximum number of password attempts
by Martin.Ward＠uk.neceur.com 03 Jun '05

03 Jun '05

Hi all, I am using freeradius to talk to an OpenLDAP server to validate passwords. This all works fine and dandy. If the user enters the right password they get in, if they enter the wrong password the don't. However, I can't find a way of locking out the user if they enter an invalid password three times in a row. I've trolled through the LDAP stuff but can't find anything in there. Is there a way I can create a password policy to do this? |\/|artin -- Senior Network Administrator, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356

4 3

RE: shared secret problem
by Kris 03 Jun '05

03 Jun '05

Novell/SuSE development has an updated package in testing that fixed my problem. I would assume it will be available shortly. While I do not have a continuing support package with them yet, they took care of this problem promptly. Consider me one satisfied user. --Kris -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Tuesday, May 24, 2005 11:46 AM To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem Hi, you welcome ;) If you contact Novell/SuSE and get an answer about this topic ( or maybe a solution ) I would be thankful if you could mail it to this mailing list. I intend to move on SLES shortly, and now when I know the fact that freeRadius is not working ( on x86_64 ) whis move could be delayed. Regards, Edvin Seferovic -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Kris Sent: Dienstag, 24. Mai 2005 18:24 To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem Thanks so much for the information and quick response. I'll attempt to contact Novell/SuSE. I tried the procedure below without much success over the last week or two. -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Tuesday, May 24, 2005 11:17 AM To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem BINGO... there u go ;) I was using SuSE PRO 9.1 on x86_64 WHICH WAS BROKEN !! SuSE changed this in the next version 9.2. Aparently SLES 9 has the same problem. You could try contacting Novell/SuSe about this ;) Here is a part of a friendly person from this list which encountered the same problem, and solved it : --- cut --- Since, I also got the SuSE 9.2 RPM working on SuSE 9.1 I will include the more detailed instructions below: Well I just got mine working on SuSE 9.1 64 bit. It was one heck of a hack, and probably not done in the correct way, but this is what I did: 1. I grabbed the 9.2 source rpm: freeradius-1.0.0-5.4.src.rpm 2. I ran rpm build --rebuild freeradius-1.0.0-5.4.src.rpm to learn dependencies. I installed the dependencies I could off of the 9.1 distribution. From the 9.2 distribution I installed: libnscd-1.0-2.x86_64.rpm and libzio-0.1-4-0.1-4.x86_64.rpm. 3. I thought I had other issues so I also installed libtool-1.5.8-3.x86_64.rpm and libtool-32bit-9.2-200410061204.x86_64.rpm but they are probably not required from 9.2. 4. I installed the source rpm. 5. I went into /usr/src/packages/SOURCES and bunzipped freeradius-1.0.0.0.tar.bz2 6. I cd'ed into the freeradius-1.0.0.0 directory and in Make.inc I modified the variable LIBLTDL to: LIBLTDL = /usr/lib64/libltdl.so 7. I re-bzipped the directory so the change was stored in the bzipped file. 8. I cd'ed into the /usr/src/packages/SPEC/ directory and ran: rpmbuild -bb freeradius.spec 9. I cd'ed into /usr/src/packages/RPMS/x86_64 and installed the 2 created packages: freeradius-1.0.0-5.4.x86_64.rpm freeradius-devel-1.0.0-5.4.x86_64.rpm 10. eap was still broken so I cd'ed into /usr/src/packages/BUILD/ freeradius-1.0.0/src/modules/rlm_eap/.libs/ 11. I copied rlm_eap-1.0.0.soU to /usr/lib/freeradius 12. I cd'ed into /usr/lib/freeradius and did a ln -s rlm_eap-1.0.0.soU rlm_eap.so --- cut --- Maybe you could just take the RPM package from another SuSE distro and try it. I hope this could help. BTW - I spent over 2 weeks looking for this crapy error. Regards, Edvin Seferovic -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Kris Sent: Dienstag, 24. Mai 2005 17:59 To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem So sorry, I'm using SLES 9 for x86_64 --Kris -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Tuesday, May 24, 2005 10:50 AM To: freeradius-users(a)lists.freeradius.org Subject: RE: shared secret problem Hi, can you tell us what operating system are you using? I had recently problems with SuSE 9.1 where some packages were broken and therefore the shared secret auth wasn't functioning. Regards, Edvin Seferovic -----Original Message----- From: freeradius-users-admin(a)lists.freeradius.org [mailto:freeradius-users-admin@lists.freeradius.org] On Behalf Of Kris Sent: Dienstag, 24. Mai 2005 17:38 To: freeradius-users(a)lists.freeradius.org Subject: shared secret problem If I'm getting a incorrect checksum error on the UDP packet sent from the client to the server, would that be the cause of my "Shared secret is incorrect" error? I've removed/readded the secret on both sides many times... If that is the case, I'm assuming the problem is with the md5 hash on the server and not anything with Freeradius. Is that correct? Thanks, Kris - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Authenticate to eDirectory
by carnold5＠nc.rr.com 03 Jun '05

03 Jun '05

>>One possible reason could be that the user you are building the >>radius >>server as does not have the appropriate file system permissions to >>create >>files within the /usr/local directory. I should have stated that i am logged in and running this as root. >>You can also get the FreeRADIUS RPMs for SLES 8 or SLES 9 from: http://forge.novell.com/modules/xfcontent/downloads.php/edirfreeradius So, i downloaded the rpm (and consoleone plug-in (thanks for the link)) and tried to install it using yast. Of course, when yast checks the dependencies, it says that libk5xx.so, libmysql.so and lib5kcrypto are missing. So, i searched (in yast>software>install and remove software) for the said lib's/files, none found. Huh?? So, i thought maybe i could install the freeradius 0.9.3 version and then "upgrade" to the new version 1.0.5 (i think). So as it stands now, i can not install the 1.0.5 version on SLES9/OES-Linux using edirectory. What am i missing. Thanks for all the help!

1 0

PEAP with Freeradius 1.02 on Linux
by Stephen Donovan 03 Jun '05

03 Jun '05

Hello All I have spent the morning looking for a solution to this problem, but I have been unable to find a solution. I am trying to use both PEAP and TTLS to authenticate a mobile device through an Access Point to my radius server. Using TTLS everything works fine, however I can not get it to work using PEAP. I am using Windows 2000 with Funk's Odyssey Client as my supplicant. I am not using certificates on the mobile and I have placed the user information in the users file. I am seeing similar behaviour with PEAP using Windows XP and the built in supplicant. Thanks Stephen Donovan I have attached the debug logs from starting Freeradius with radiusd -X -A. If any one could suggest anything it would be greatly appreciated.

3 3

Re: Authenticate to eDirectory
by Sayantan Bhowmick 03 Jun '05

03 Jun '05

Hi, This will work with eDirectory 8.7.1 onwards with eDirectory running on any eDirectory supported platform. -Sayantan >>> dhesse(a)mmrcsl.org 06/02/05 7:16 PM >>> Does this only work with versions of eDirectory running on Linux or will it work with eDirectory on Netware 6.5 Daniel D. Hesse Technology Administrator Methodist Manor Retirement Community 712-732-1120 Ext.116 dhesse(a)mmrcsl.org >>> sbhowmick(a)novell.com 6/2/2005 12:05 AM >>> Hi, FreeRADIUS 1.0.2 has been integrated with eDirectory to support wireless authentication. See (http://www.novell.com/documentation/edir_radius/index.html) You can also use FreeRADIUS 0.9.3. That supports LDAP authentication to eDirectory. In this case you could try EAP-TTLS + PAP. http://lists.cistron.nl/pipermail/freeradius-users/2005-March/042093.html Hope this helps. Regards, -Sayantan >>>carnold5(a)nc.rr.com 06/01/05 12:35 pm >>> Hello all! I would like to know if anyone has gotten freeradius to work with eDirectory (LDAP)? We are using freeradius 0.93 (ships with sles9) and want our wireless users to authenticate to the eDirectory box. I changed the radiusd.config file at the ldap entry. Clients file has not been touched. It seems that i may need to "extend the schema" on the eDirectory box. Then include the supplied radiusxx.schema file in the slapd.conf file. Any help will be appreciated. Chris - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Authenticate to eDirectory
by Sayantan Bhowmick 03 Jun '05

03 Jun '05

Hi, One possible reason could be that the user you are building the radius server as does not have the appropriate file system permissions to create files within the /usr/local directory. Try running make install as root user. You can also get the FreeRADIUS RPMs for SLES 8 or SLES 9 from: http://forge.novell.com/modules/xfcontent/downloads.php/edirfreeradius Get back to me in case you have any further queries. -Sayantan >>> carnold5(a)nc.rr.com 06/03/05 7:32 AM >>> Thanks for the replies. >>This is also noted on the main web page: http://www.freeradius.org Sorry about that, it seems i overlooked that :) >>See 1.0.2, which includes eDirectory integration. OK, so i uninstalled the 0.9.3 version and i downloaded the tarball and followed the instructions to compile and install v1.0.2. When i ran ./configure, i ran it with the --with-edir option. This process ran for awhile; i did see some warnings during this step but the process did not stop. Then i ran make, no options; i did see some warnings during this step but the process did not stop. Now, during the make install step i did see some warning and errors but again, the process did not stop. When it did complete, i see "error:radiusd not found". Indeed, when i do a search for raddb, i see a folder in usr/local/raddb. The weird thing is, there are 0 files in this folder. When i search for radiusd.conf, no file found. When i go to the shell prompt and type radiusd, command not found. Anybody got any ideas? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0