- Freeradius-Users - lists.freeradius.org

radclient??
by Sylvain Clerc 02 Jun '05

02 Jun '05

I have to use radclient with another soft but I can't arrive to run it . When I do : radclient 192.168.1.1 auth secret nothing happens, it stays always empty. radtest works successful and depends of radclient, that's why I don't understand why radclient doesn't work. Is my syntax is wrong for radclient?? Thank you, Sylvain Clerc.

2 3

Re: Authenticate to eDirectory
by Sayantan Bhowmick 02 Jun '05

02 Jun '05

Hi, FreeRADIUS 1.0.2 has been integrated with eDirectory to support wireless authentication. See (http://www.novell.com/documentation/edir_radius/index.html) You can also use FreeRADIUS 0.9.3. That supports LDAP authentication to eDirectory. In this case you could try EAP-TTLS + PAP. http://lists.cistron.nl/pipermail/freeradius-users/2005-March/042093.html Hope this helps. Regards, -Sayantan >>>carnold5(a)nc.rr.com 06/01/05 12:35 pm >>> Hello all! I would like to know if anyone has gotten freeradius to work with eDirectory (LDAP)? We are using freeradius 0.93 (ships with sles9) and want our wireless users to authenticate to the eDirectory box. I changed the radiusd.config file at the ldap entry. Clients file has not been touched. It seems that i may need to "extend the schema" on the eDirectory box. Then include the supplied radiusxx.schema file in the slapd.conf file. Any help will be appreciated. Chris - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Problem executing radiusd in freeBSD
by Dan Braun 01 Jun '05

01 Jun '05

I just finished doing a basic install of freeradius on freebsd. However, I am receiving a command not found message when trying to execute radiusd from the command line. I'm sure I am just overlooking something minuscule, but if someone could point me in the right direction I would greatly appreciate it. Thanks, Dan

2 1

Authenticate to eDirectory
by carnold5＠nc.rr.com 01 Jun '05

01 Jun '05

Hello all! I would like to know if anyone has gotten freeradius to work with eDirectory (LDAP)? We are using freeradius 0.93 (ships with sles9) and want our wireless users to authenticate to the eDirectory box. I changed the radiusd.config file at the ldap entry. Clients file has not been touched. It seems that i may need to "extend the schema" on the eDirectory box. Then include the supplied radiusxx.schema file in the slapd.conf file. Any help will be appreciated. Chris

3 2

[MSCHAP/PEAP/EAP-TLS] Default example certificate error
by Pete Flynt 01 Jun '05

01 Jun '05

Hi again, On my quest to get working FreeRadius with Active Directory, I am now stuck in the TLS section. Following some posts on the list ntlm_auth requires mschapv2 and mschapv2 requires peap which needs tls to work! So I tried this but without success. I'm using the default example certificates. It looks like the errors are in the source files. That's what I get when executing radiusd: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "(null)" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" 4121:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:632:Expecting: CERTIFICATE 4121:error:0200100E:system library:fopen:Bad address:bss_file.c:259:fopen('','r') 4121:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:261: 4121:error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib:ssl_rsa.c:513: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap: Module instantiation failed. What could be wrong? I just followed the description of the conf files and some hints on the list here. Regards, Pete _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

2 1

Cannot find a configuration entry for module "exec"
by vicky 01 Jun '05

01 Jun '05

Hey people, I'm trying to upgrade my freeRADIUS server and to do so, I downloaded and installed the latest version available on freeradius.org. I installed and configured it in a separate folder than the "old" server is configured in. Today I stopped the "old" server and brought up the new one with radiusd -X and it gave me an error as shown below. . . . main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradiusupgrade/lib ERROR: Cannot find a configuration entry for module "exec". zsh: exit 1 /opt/freeradiusupgrade/sbin/radiusd -X With no line number or file name I don't even know where to begin to look. Does anyone has any suggestions? Every so thankful! -- Vicky

2 1

Multiple accounting hosts
by Ramm-Ericsson, Johannes 01 Jun '05

01 Jun '05

Hello! I have been searching for a way to send radius accounting information to multiple accounting hosts. I have been unable to get this working using proxy realms. I have also searched the mail archives and not come up with any solution. Has anyone been able to configure freeradius in this way, and if so, is it possible for you to share this information? Best Regards, Johannes R-E

2 1

Re: Forwarding
by Maxim Hitrov 01 Jun '05

01 Jun '05

Hello Alan Thanks for you replay. I have configured freeradius to make preproxing. But i have another problem: The "Reply-Message" didn't reach the application wich have been made auth request. Ready to process requests. rad_recv: Access-Request packet from host 11.0.0.2:3187, id=30, length=44 User-Name = "igor" User-Password = "\330\014\257}" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/11.0.0.2/auth-detail-20050601' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/11.0.0.2/auth-detail-20050601 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "igor", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "igor" rlm_realm: Proxying request from user igor to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 Processing the pre-proxy section of radiusd.conf modcall: entering group pre-proxy for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/11.0.0.2/pre-proxy-detail-20050601' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/11.0.0.2/pre-proxy-detail-20050601 modcall[pre-proxy]: module "pre_proxy_log" returns ok for request 0 preproxy_users: Matched entry DEFAULT at line 17 radius_xlat: '' modcall[pre-proxy]: module "files" returns ok for request 0 modcall: group pre-proxy returns ok for request 0 Sending Access-Request of id 0 to 11.0.0.5:1812 User-Name = "igor" User-Password = "\330\014\257}" NAS-IP-Address = 11.0.0.2 Proxy-State = 0x3330 Calling-Station-Id := "" --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Reject packet from host 11.0.0.5:1812, id=0, length=43 Reply-Message = "Authorization failed." Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/11.0.0.2/post-proxy-detail-20050601' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/11.0.0.2/post-proxy-detail-20050601 modcall[post-proxy]: module "post_proxy_log" returns ok for request 0 modcall[post-proxy]: module "eap" returns noop for request 0 modcall: group post-proxy returns ok for request 0 Login incorrect (Home Server says so): [igor/\330\014\257}] (from client test port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 11.0.0.2:3187, id=30, length=44 Sending Access-Reject of id 30 to 11.0.0.2:3187 Reply-Message = "Authorization failed." --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 30 with timestamp 429db3c5 Nothing to do. Sleeping until we see a request. So, it receives replay only on sencond request. Application failed on the first request timeout. What to do? Thank you Alan DeKok <aland(a)ox.org> wrote: Maxim Hitrov wrote: > Can i use FreeRadius as intermadiate Radius that will change and forward Access-Requests params? Yes. You should be able to do this using the "preproxy_users" file: DEFAULT Calling-Station-Id = "%{Framed-IP-Address}" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Proxying without a realm
by Jeff Fern 01 Jun '05

01 Jun '05

Hello all, I have got an Airespace wireless lan system that allows multiple WLANs to be created and appear as completely seperate networks. The system allows radius authentication via multiple servers, but it does not allow specifying certain WLANs to certain servers. To determin which WLAN has been connected to, airespace passes an attribute along with the username (MAC Address), it does not pass any realm information. Does anyone know if it is possible to configure freeradius to proxy out all incoming radius requests but convert the attribute to an actual realm? To provide a bit more background detail, we have a Tatara AAA system which is connected to a HLR (the HLR actually does the authentication, Tatara just acts as a proxy to it). I need to create two seperate WLANs which, when presented to Tatara for authentication, one will appear as a home connection and the other as a roaming connection - hence the need for specific realms. Freeradius would be proxying all requests to the same Tatara system (but needs to add realm information). Any help or advise would be gratefully recieved. Regards, -Jeff Fern

2 1

How to authenticate users against a Windoze AD server with krb5?
by Arne Götje (高盛華) 01 Jun '05

01 Jun '05

Hi list, I'm trying to authenticate users against a Windows AD server using the krb5 module... but due to missing documentation on how to do this, I'm stuck. When I try to get a Kerberos ticket using kinit on the radius machine, it works. But when I try to use the krb5 module, it always gives me a Reject... Is there anywhere a detailed howto available? Google didn't help me much... :( Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

3 4