October 2005 - Freeradius-Users - lists.freeradius.org

Ippool mysql
by Mark Novitzkas 13 Oct '05

13 Oct '05

Hi There I am trying to setup freeradius 1.0.0.5 using mysql and ippools. Basically i want to use mysql to auth the incoming request and and use ippool to assign an adress to that request. Firstly is that possible? I have setup the mysql DB correctly with the radcheck table specifiying the Pool-Name ( in my case im testing with the main_pool as configured in the radiusd.conf. My second probelm is that if i start up radiusd in debug mode it shows the following error? Module: Loaded IPPOOL ippool: session-db = "/home/radius/db.ippool" ippool: ip-index = "/home/radius/db.ipindex" ippool: range-start = 192.168.1.1 IP address [192.168.1.1] ippool: range-stop = 192.168.3.254 IP address [192.168.3.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = yes ippool: maximum-timeout = 0 rlm_ippool: Failed to open file /home/radius/db.ippool: Permission denied radiusd.conf[1467]: main_pool: Module instantiation failed. Do i need to create the db files first? If so how is this done? I know this may be arb questions but this is my first time using freeradius :) Thanks Mark Notice This email is intended for the addressee only and may contain legally privileged and/or confidential information. If you have received this email in error and are not the intended recipient, you are hereby informed that you are not entitled to read, broadcast, distribute or in any manner whatsoever use the contents of this email or any attachments thereto. You are requested to please notify Psitek that you have received the email and then delete it. Unless clearly stated otherwise, the content and sentiments expressed in this email or any attachments thereto are those of the sender and not of Psitek (Proprietary) Limited. Psitek does not accept liability for any damages, loss or expense of any nature whatsoever arising (a) out of or in connection with the email or any attachments thereto and/or (b) from any act or omission by the recipient relying upon the content of the email or attachments. Psitek further disclaims liability for any damages caused by computer and/or software viruses. Should this email contain the terms of a contract, no binding agreement will result until such time as a written (hardcopy) document is signed on behalf of Psitek.

2 1

EAP Fast
by Juan Daniel Moreno 13 Oct '05

13 Oct '05

Hi, I would like to know if EAP FAST is accepted by freeRadius or if it's under development. If it is under development, when will it be available? Thank you, Juan Daniel MORENO

2 1

Problem with OpenSSL functions
by Juan Daniel Moreno 13 Oct '05

13 Oct '05

Hi, I would like to ask you (experienced people) something. I'm using freeradius 1.0.4 and I have a message of 48 bytes long (a premaster secret) generated with the random function of openssl. This message has to be "public_encrypted" and sent to a radius server. Nevertheless, when I use the RSA_public_encrypt() function this encrypts the message of 48 bytes and generates a 64 bytes encrypted message. Normally this functions like this; but as I sent this "encrypted message" to the server, the server responds me: "tls rsa encrypted value length is wrong". This means that the message is well generated but not well encrypted. Can any of you tell me please how can I fix this problem? Knowing that the RSA public key is 64 bytes long, is it normal that the encrypted message is 64 bytes long too? Do you know another openSSL function that "public_encrypts" a message? Thank you, Juan Daniel MORENO

2 1

build snapshot on freebsd 5.4-release
by Roy 13 Oct '05

13 Oct '05

Hi, Anyone ever tried building current snapshot from cvs on freebsd 5.4- release? Tried searching from the archive and seems like this wasn't resolved yet. Anyone? BR, roy

2 1

RE: Counter reset
by Jonathan De Graeve 13 Oct '05

13 Oct '05

In your SQL query J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 16:51 Aan: 'FreeRadius users mailing list' Onderwerp: AW: Counter reset Ok, now i understand. Thanks. One more question. Where to set the octets value for recalculation? Thanks -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Jonathan De Graeve Gesendet: Donnerstag, 13. Oktober 2005 15:22 An: FreeRadius users mailing list Betreff: RE: Counter reset Octet values are in bytes So just calculated what it would be in MB or in GB. I recalculate the value to be in MB so I force the max octets to like 1024MB for 1GB Divide your end result with 1024*1024 or something J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 15:13 Aan: 'FreeRadius users mailing list' Onderwerp: AW: Counter reset Sorry.... Which value. What query???? Thanks for helping me, but i don´t really understand andi -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Jonathan De Graeve Gesendet: Donnerstag, 13. Oktober 2005 11:59 An: FreeRadius users mailing list Betreff: RE: Counter reset Yes there's a 4GB limit in the counter You have to use smaller values (change your sql query to divided all values by a given value) J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 9:37 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Counter reset Hi, i´m running freeradius 1.0.4 with mysql & chilli. Most of them works good :-) But i have some users, which won´t log out. And now comes the problem: if a user has something like 4GB traffic up or download in one session his traffic would get lost and the counter resets. i´m not sure, but is there a buffer wich will overflowed? Or something like this?? Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: FreeRADIUS - FreeBSD - Segmentation fault
by Dusty Doris 13 Oct '05

13 Oct '05

> > a few thing would be nice to know to maybe localize the problem further: > Are you running FreeBSD 5.4-Release or 5.4-Stable? > Which MySQL version are you running and do you have compiled it with native > threads or with linuxthreads? I installed freebsd 5.4-release and then updated the source about one week ago with the following: cvsup standard-supfile (tag=RELENG_5_4) cd /usr/src make buildworld make buildkernel KERNCONF=mykernel (didn't change much in the kernel) -added options SMP -added device CARP -removed all cpu accept I686_CPU -changed ident make installkernel KERNCONF=mykernel reboot mergemaster -p make installworld mergemaster reboot I installed everything except freeradius from ports with all the defaults (eg: make install clean) # pkg_info -Ea bash-3.0.16_1 cvsup-without-gui-16.1h_2 gdbm-1.8.3_1 gettext-0.14.5 gmake-3.80_2 libiconv-1.9.2_1 libltdl-1.5.20 libtool-1.3.5_2 libtool-1.5.20 mysql-client-4.1.14 mysql-server-4.1.14 openssh-portable-4.2.0.0,1 perl-5.8.6_2 # uname -a FreeBSD radsql1.soc.int 5.4-RELEASE-p7 FreeBSD 5.4-RELEASE-p7 #0: Tue Sep 27 14:14:11 EDT 2005 root@radacctm.lab.soc.int:/usr/obj/usr/src/sys/carp i386 Installed freeradius last from source simply doing ./configure --prefix=/usr/local/freeradius105. My radiusd.conf is very stripped down. Basically this machines only purpose is to do radius accounting to mysql, so almost everything is commented out or blank (such as users). However, I did test authentication with it briefly with an out of the box configuration only modifying sql.conf username/password and uncommenting all instances of sql in radiusd.conf. Hope that is helpful. If you have any more questions, fire away. -Dusty

3 3

RE: Counter reset
by Jonathan De Graeve 13 Oct '05

13 Oct '05

Octet values are in bytes So just calculated what it would be in MB or in GB. I recalculate the value to be in MB so I force the max octets to like 1024MB for 1GB Divide your end result with 1024*1024 or something J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 15:13 Aan: 'FreeRadius users mailing list' Onderwerp: AW: Counter reset Sorry.... Which value. What query???? Thanks for helping me, but i don´t really understand andi -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Jonathan De Graeve Gesendet: Donnerstag, 13. Oktober 2005 11:59 An: FreeRadius users mailing list Betreff: RE: Counter reset Yes there's a 4GB limit in the counter You have to use smaller values (change your sql query to divided all values by a given value) J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 9:37 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Counter reset Hi, i´m running freeradius 1.0.4 with mysql & chilli. Most of them works good :-) But i have some users, which won´t log out. And now comes the problem: if a user has something like 4GB traffic up or download in one session his traffic would get lost and the counter resets. i´m not sure, but is there a buffer wich will overflowed? Or something like this?? Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

WG: Problem conversion of User-Name
by marcus.koestler＠polizei.bayern.de 13 Oct '05

13 Oct '05

> Hello, > > I have a Problem after converting a User-Name of the Form 27180769 to > 27180769(a)apfelbaum.de. > > After radius-server authorized the request i want to convert my user to an > @-Form to pass it to the rlm_krb5-module for authentication, because we > have different Kerberos-Realms and the Name 27180769 is probably not > enough to pick the right Kerberos-Server from krb5.conf. > > For this shake my external Programm gives back a value Pair in the Form > "User-Name := 27180769(a)apfelbaum.de", after I feed it with the LDAP-DN > from the LDAP-request, to pick the right realm. > > It seems that the memory allocated for User-Name is not reallocated, so > vals of other vars were overwritten after the program returns. > > here is my debug-output from radiusd -s -xx: > > Exec-Program: /usr/local/bin/convert.php > CN=27180769,CN=Users,DC=apfelbaum,DC=de > Exec-Program output: User-Name := 27180769(a)APFELBAUM.DE > Exec-Program-Wait: value-pairs: User-Name := 27180769(a)APFELBAUM.DE > Exec-Program: returned: 0 > modcall[authorize]: module "convert_name" returns ok for request 0 > rlm_ldap: Entering ldap_groupcmp() > radius_xlat: 'dc=apfelbaum,dc=de' > radius_xlat: > '(|(&(objectClass=Group)(member=CN=27180769,CN=Users,DC=apfelbaum,DC=de))( > &(objectClass=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apf > elbaum,DC=de)))' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in cn=modemuser,cn=Users,dc=apfelbaum,dc=de, > with filter > (|(&(objectClass=Group)(member=CN=27180769,CN=Users,DC=apfelbaum,DC=de))(& > (objectClass=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apfe > lbaum,DC=de))) > rlm_ldap::ldap_groupcmp: User found in group > cn=modemuser,cn=Users,dc=apfelbaum,dc=de > rlm_ldap: ldap_release_conn: Release Id: 0 > users: Matched entry DEFAULT at line 219 > radius_xlat: 'number=08912124447 direction=outgoing' > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type Kerberos > auth: type "Kerberos" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_krb5: > [ss=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apfelbaum,DC= > de)`] krb5_g_i_t_w_p failed: Cannot resolve network address for KDC in > requested realm > modcall[authenticate]: module "krb5" returns reject for request 0 > modcall: group authenticate returns reject for request 0 > auth: Failed to validate the user. > Login incorrect: > [ss=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users/ROrt9670] (from > client localhost port 0) > > > a snap from radiusd.conf: > > > exec convert_name { > wait=yes > program ="/usr/local/bin/convert.php %{Ldap-UserDn}" > input_pairs = request > output_pairs = request > } > > authorize { > ldap { > notfound = return > } > convert_name > files > } > > my users-file: > > DEFAULT Ldap-Group == "cn=modemuser,cn=Users,dc=apfelbaum,dc=de", > Auth-Type:=Kerberos > DIALT := "number=%{reply:DIALT} direction=outgoing", > PPPT := "callback=ppp_offered blocktime=3 Layer1Protocol=modem", > Idle-Timeout = 900, > Framed-Protocol = PPP, > User-Service := 2, > Fall-Through = 0, > Framed-Netmask := 255.255.255.255 > > DEFAULT Ldap-Group == "cn=isdnuser,cn=Users,dc=apfelbaum,dc=de", > Auth-Type:=Kerberos > DIALT := "number=%{reply:DIALT} direction=outgoing", > PPPT := "callback=ppp_offered blocktime=3", > Idle-Timeout = 900, > Framed-Protocol = PPP, > User-Service := 2, > Fall-Through = 0, > Framed-Netmask := 255.255.255.255 > > > DEFAULT Auth-Type := Reject > Reply-Message = "Your account has been disabled." > > > greetings > Marcus Koestler > Bayerisches Landeskriminalamt > SG 343, Netztechnik

2 1

AW: WG: Problem conversion of User-Name
by marcus.koestler＠polizei.bayern.de 13 Oct '05

13 Oct '05

yes. -----Ursprüngliche Nachricht----- Von: Kenneth Grady [mailto:klg@lanl.gov] Gesendet: Donnerstag, 13. Oktober 2005 16:20 An: FreeRadius users mailing list Betreff: Re: WG: Problem conversion of User-Name in your /etc/krb5.conf do you have ... [realms] apfelbaum.de ={ kdc = kerberos... On Thu, 2005-10-13 at 07:58, marcus.koestler(a)polizei.bayern.de wrote: > > Hello, > > > > I have a Problem after converting a User-Name of the Form 27180769 to > > 27180769(a)apfelbaum.de. > > > > After radius-server authorized the request i want to convert my user to an > > @-Form to pass it to the rlm_krb5-module for authentication, because we > > have different Kerberos-Realms and the Name 27180769 is probably not > > enough to pick the right Kerberos-Server from krb5.conf. > > > > For this shake my external Programm gives back a value Pair in the Form > > "User-Name := 27180769(a)apfelbaum.de", after I feed it with the LDAP-DN > > from the LDAP-request, to pick the right realm. > > > > It seems that the memory allocated for User-Name is not reallocated, so > > vals of other vars were overwritten after the program returns. > > > > here is my debug-output from radiusd -s -xx: > > > > Exec-Program: /usr/local/bin/convert.php > > CN=27180769,CN=Users,DC=apfelbaum,DC=de > > Exec-Program output: User-Name := 27180769(a)APFELBAUM.DE > > Exec-Program-Wait: value-pairs: User-Name := 27180769(a)APFELBAUM.DE > > Exec-Program: returned: 0 > > modcall[authorize]: module "convert_name" returns ok for request 0 > > rlm_ldap: Entering ldap_groupcmp() > > radius_xlat: 'dc=apfelbaum,dc=de' > > radius_xlat: > > '(|(&(objectClass=Group)(member=CN=27180769,CN=Users,DC=apfelbaum,DC=de))( > > &(objectClass=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apf > > elbaum,DC=de)))' > > rlm_ldap: ldap_get_conn: Checking Id: 0 > > rlm_ldap: ldap_get_conn: Got Id: 0 > > rlm_ldap: performing search in cn=modemuser,cn=Users,dc=apfelbaum,dc=de, > > with filter > > (|(&(objectClass=Group)(member=CN=27180769,CN=Users,DC=apfelbaum,DC=de))(& > > (objectClass=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apfe > > lbaum,DC=de))) > > rlm_ldap::ldap_groupcmp: User found in group > > cn=modemuser,cn=Users,dc=apfelbaum,dc=de > > rlm_ldap: ldap_release_conn: Release Id: 0 > > users: Matched entry DEFAULT at line 219 > > radius_xlat: 'number=08912124447 direction=outgoing' > > modcall[authorize]: module "files" returns ok for request 0 > > modcall: group authorize returns ok for request 0 > > rad_check_password: Found Auth-Type Kerberos > > auth: type "Kerberos" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 0 > > rlm_krb5: > > [ss=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users,DC=apfelbaum,DC= > > de)`] krb5_g_i_t_w_p failed: Cannot resolve network address for KDC in > > requested realm > > modcall[authenticate]: module "krb5" returns reject for request 0 > > modcall: group authenticate returns reject for request 0 > > auth: Failed to validate the user. > > Login incorrect: > > [ss=GroupOfUniqueNames)(uniquemember=CN=27180769,CN=Users/ROrt9670] (from > > client localhost port 0) > > > > > > a snap from radiusd.conf: > > > > > > exec convert_name { > > wait=yes > > program ="/usr/local/bin/convert.php %{Ldap-UserDn}" > > input_pairs = request > > output_pairs = request > > } > > > > authorize { > > ldap { > > notfound = return > > } > > convert_name > > files > > } > > > > my users-file: > > > > DEFAULT Ldap-Group == "cn=modemuser,cn=Users,dc=apfelbaum,dc=de", > > Auth-Type:=Kerberos > > DIALT := "number=%{reply:DIALT} direction=outgoing", > > PPPT := "callback=ppp_offered blocktime=3 Layer1Protocol=modem", > > Idle-Timeout = 900, > > Framed-Protocol = PPP, > > User-Service := 2, > > Fall-Through = 0, > > Framed-Netmask := 255.255.255.255 > > > > DEFAULT Ldap-Group == "cn=isdnuser,cn=Users,dc=apfelbaum,dc=de", > > Auth-Type:=Kerberos > > DIALT := "number=%{reply:DIALT} direction=outgoing", > > PPPT := "callback=ppp_offered blocktime=3", > > Idle-Timeout = 900, > > Framed-Protocol = PPP, > > User-Service := 2, > > Fall-Through = 0, > > Framed-Netmask := 255.255.255.255 > > > > > > DEFAULT Auth-Type := Reject > > Reply-Message = "Your account has been disabled." > > > > > > greetings > > Marcus Koestler > > Bayerisches Landeskriminalamt > > SG 343, Netztechnik > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Counter reset
by Jonathan De Graeve 13 Oct '05

13 Oct '05

Yes there's a 4GB limit in the counter You have to use smaller values (change your sql query to divided all values by a given value) J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas Korber Verzonden: donderdag 13 oktober 2005 9:37 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Counter reset Hi, i´m running freeradius 1.0.4 with mysql & chilli. Most of them works good :-) But i have some users, which won´t log out. And now comes the problem: if a user has something like 4GB traffic up or download in one session his traffic would get lost and the counter resets. i´m not sure, but is there a buffer wich will overflowed? Or something like this?? Thanks - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1