December 2005 - Freeradius-Users - lists.freeradius.org

Hello Radius Server Problem
by Kai Geek 28 Dec '05

28 Dec '05

Hello, what your radius server starting problem? dont log /varlog/radius/radius.conf :( Switch IP : 10.0.0.250 <- Dlink (26 Port) Radius Server: 10.0.0.6 #ssh 10.0.0.6 #pico clients.conf client 10.0.0.250 { secret = testing shortname = des-deneme } #pico users tbaygul Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, # Framed-IP-Address = , # Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP root@****:/etc# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: ipaddr = 10.0.0.6 IP address [10.0.0.6] listen: port = 1812 listen: type = "auth" radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Listening on authentication 10.0.0.6:1812 Ready to process requests. -- what is problem, please help me.. thank you +-+-+- BEGIN PGP SIGNATURE -+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) ___ / __) Kai "Ozgur" Geek \__ \ PGP ID: B1B63B6E (___/lackware Network Engineer +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

Fw: segmentation fault on solaris,unable to call modules
by Qin Zhen 27 Dec '05

27 Dec '05

Hi developers, this is the output from gdb. i was trying to run freeradius-1.0.5 on Solaris 8. pls kindly assist. thanks in advance. Rgds, QZ (gdb) bt #0 0xff324878 in lt_dlsym (handle=0x81cd8, symbol=0xffbee4b8 "rlm_ldap") at ltdl.c:3330 #1 0x1c9a4 in linkto_module (module_name=0xffbee628 "rlm_ldap", cffilename=0x276c8 "radiusd.conf", cflineno=724) at modules.c:230 #2 0x1cc14 in find_module_instance (instname=0x4ef90 "ldap") at modules.c:347 #3 0x1e024 in do_compile_modsingle (component=1, ci=0x4f3b8, filename=0x276c8 "radiusd.conf", grouptype=0, modname=0xffbee87c) at modcall.c:814 #4 0x1e090 in compile_modsingle (component=1, ci=0x4f3b8, filename=0x276c8 "radiusd.conf", modname=0xffbee87c) at modcall.c:830 #5 0x1d0d0 in load_component_section (cs=0x4f2a0, comp=1, filename=0x276c8 "radiusd.conf") at modules.c:568 #6 0x1d57c in setup_modules () at modules.c:858 #7 0x147e0 in main (argc=2, argv=0xffbefa84) at radiusd.c:960 > ----- Original Message ----- > From: "Alan DeKok" <aland(a)ox.org> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Wednesday, December 21, 2005 12:27 AM > Subject: Re: segmentation fault on solaris,unable to call modules > > >> "Qin Zhen" <qin.zhen(a)pacific.net.sg> wrote: >>> havent figured out how to solve the segmentation fault problem yet. any >>> suggestion? or anybody encountered the similar problem as me? >> >> Read doc/bugs >> >> Alan DeKok. >> - > "Qin Zhen" <qin.zhen(a)pacific.net.sg> wrote: >> Hi All, installing freeradius on Solaris is already a big headache, afterwards i encountered Segmentation fault as well. i am using Freeradius-1.0.5 if i commend up those modules called in radiusd.conf (e.g. files, preprocess,ldap, prefix under 'Authorize'), there is no segmentation fault error. so seems that it is not able to call any of the modules inside radiusd.conf. this configuration is able to work for freeradius-0.8 on solaris, as well as freeradius-1.0.5 on debian. pls advise. thanks in advance. >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

1 0

FR caching problem
by Lemaster, Rob 27 Dec '05

27 Dec '05

FreeRADIUS v.1.0.5 I am trying to enable caching on line 623 in radiusd.conf. When I turn on caching and reload, I get the following error: Info: Reloading configuration files. Info: Using deprecated naslist file. Support for this will go away soon. Info: HASH: Reinitializing hash structures and lists for caching... Error: rlm_unix: You MUST specify a shadow password file! Error: HASH: unable to create user hash table. disable caching and run debugs Error: radiusd.conf[605]: unix: Module instantiation failed. When I turn caching back off and reload, FreeRadius starts just fine: Info: Using deprecated naslist file. Support for this will go away soon. Info: Ready to process requests. I am using the /etc/passwd and /etc/group for authentication. I am not using /etc/shadow. Does FR require an /etc/shadow path even if it is not used? Any thoughts or suggestions? thanks

2 1

Adding multiple realms
by JD 27 Dec '05

27 Dec '05

Hello everyone! I am serious newbie and I apologize for my poor netiquette. I am such a newbie that I cannot tell you what version of free radius that I am running for I know not where to look. It is running on red hat 9 box with mysql. Currently we resell dial-up access; we have to provide the provider with a "realm". We currently have only one realm but we need 2. I do not want to keep the users separate; in other words I want the users that are in there now to be able to use both realms with their user name; i.e. someone(a)realm1.com and someone(a)realm2.com only one entry for both realms in the dialup admin. I also already have all the IPs entered for the access provider as they were left over from the initial configuration. So far I have checked in radius.conf: proxy_requests = yes $INCLUDE ${confdir}/proxy.conf Proxy.conf has: ####################################################################### # # Configuration for the proxy realms. # # The information given here is used in conjunction with the 'realms' # file. This format is preferred, as it is more flexible. The realms # listed here take priority over those listed in the 'realms' file. # #this one works realm oldrealm.com { type = radius authhost = LOCAL accthost = LOCAL # nostrip } #this is the second realm that I added #it does not work; nothing comes across the log script that I use #but the error the customer sees is invalid username realm newrealm.com { type = radius authhost = LOCAL accthost = LOCAL # nostrip } At the bottom it has default realm DEFAULT { type = radius authhost = localhost:1812 accthost = localhost:1813 secret = sharedsecret } cd /var/www/dialup_admin/conf admin.conf: general_base_dir: /var/www/dialup_admin general_radiusd_base_dir: /usr/local general_domain: old_domain.com #here it has the old domain; is there a way #to add a second or am I just completely lost. Sorry to be so general; I #would really appreciate any help. Thanks, J.D. See you @ AppState.Net's Wireless Technology Open House - Boone NC Jan. 26 Covering Watauga County with Broadband for Everyone 828-265-3773 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.7/214 - Release Date: 12/23/2005

2 2

Configuration of users file
by Mike Cisar 27 Dec '05

27 Dec '05

Hoping someone can give me some hints/ideas. We have 2 modem pools available to our users, the availability of which is controlled by the user's unix group and the Radius Client IP. We also offer dialup accelleration which is available to members of either modem pool, and is also controlled by a Unix group membership. The accelleration is provided by the providers of the "poola" services, and thus the authentication requests for acceleration come from the "poola" radius servers. This is currently set up in our users file thusly... DEFAULT Group == "slipstream" Slipstream-Auth = "true", Fall-Through = 1 <...> DEFAULT Client-IP-Address == 65.167.179.3, Group != "poola", Auth-Type :=Reject Reply-Message = "Your account is not authorized for this modem pool." DEFAULT Client-IP-Address == 65.167.179.4, Group != "poola", Auth-Type :=Reject Reply-Message = "Your account is not authorized for this modem pool." <... more poola ...> DEFAULT Client-IP-Address == 207.102.99.65, Group != "poolb", Auth-Type :=Reject Reply-Message = "Your account is not authorized for this modem pool." DEFAULT Client-IP-Address == 207.102.99.81, Group != "poolb", Auth-Type :=Reject Reply-Message = "Your account is not authorized for this modem pool." <... more poolb ...> <whole bunch more group checks w/ fallthroughs, usage checks, session timeout & parameter setting, etc> <...> This is working just fine for users of "poola" either with or without accelleration. Dialup requests are working just fine for "poolb" users, but they are being rejected accelleration because the accelleration request is coming from the "poola" radius server, and they do not have "poola" membership. A temporary workaround has been made by simply adding them to the "poola" group as well. At that point they are able to dial in to a "poolb" number and still have accelleration, however they could also dial in to "poola" if they were so inclined, and this would cause them/us other issues. I have spoken to the provider and they have provided me with the NAS-IP's of the accelleration servers so I should be able to use the NAS-IP-Address attribute to identify when the radius requests coming from the "poola" radius server is a dialup request or an authentication request. I can't quite figure out the best way to integrate this into the users file though. So the first part I presume ends up looking like DEFAULT NAS-IP-Address == 64.136.173.17, Group == "slipstream" Slipstream-Auth = "true", Fall-Through = 1 DEFAULT NAS-IP-Address == 64.136.164.67, Group == "slipstream" Slipstream-Auth = "true", Fall-Through = 1 <...> But beyond that, how can I then skip over the 20 or so poola/poolb checks which do not apply for accelleration requests? Maybe there's a cleaner way of doing this? There is the possibility that down the road our provider will be radius-authenticating our clients for permission to use their NNTP server, so this will nessesitate a 3rd branch of processing. So I'd like to kind of be prepared for that when it happens. So essentially what I need to do is an initial determination of whether the request is dialup, accelleration, or NNTP (well basically if it's accelleration or nntp, with dialup being the default path if it's neither of the former). Go down a particular branch of processing depending on which of the three flavors of request it is, and then drop back out of those checks into a common branch where I'm checking for such things as their account being over limits, time of day checks, expired account checks, etc, etc processing through to the end of the file. Any hints, tips, suggestions, and brainstorms are greatly appreciated. Thanks, >>>>> Mike <<<<< P.S. Is there a syntax by which I can specify something like... DEFAULT Client-IP-Address == (207.102.99.65 or 207.102.99.66 or 207.102.99.67), Group != "poolb", Auth-Type :=Reject or somehow pre-define a group of NAS' to use in place such as... clientpoola = 207.102.99.65, 207.102.99.66, 207.102.99.67 DEFAULT Client-IP-Address == clientpoola, Group != "poolb", Auth-Type :=Reject rather than specifiying a separate stanza for each Client-IP-Address as I have in my existing config?

2 1

Re: Failed to link to module 'rlm_eap': ... : No such file or directory
by Roberto S. G. 27 Dec '05

27 Dec '05

thanks Alan for your advice. If any other one has this issue, I found a simple suse 9.2 FR 1.0.5 package for peap+ldap at: ( http://www.whitemiceconsulting.com/node/61 ) from which it's possible to extract the libraries that suse forgot (?) to install: rlm_eap.so and rlm_eap_peap.so (cd dump; rpm2cpio ../freeradius-1.0.5-2.1.suse92.i586.rpm | cpio -id) bye >------------------------------ > >Message: 11 >Date: Mon, 26 Dec 2005 11:42:02 -0500 >From: "Alan DeKok" <aland(a)ox.org> >Subject: Re: Failed to link to module 'rlm_eap': ... : No such file or > directory >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <20051226164202.552BD1712E(a)mail.nitros9.org> > >"Roberto S. G." <roberto.santos(a)unileon.es> wrote: > >>> I can see that previous package had rlm_eap.so, and that the last one >>> doesn't, and apparently has delete the previous one... What can I do? > > > Either install a package that has rlm_eap.so, or re-build the server >completely from source. > > Alan DeKok.

1 0

Experimental bleeding edge patched debian packages available
by Joe Maimon 27 Dec '05

27 Dec '05

I have made my local customized debian apt-get repository available online. http://apt-repo.ttec.com Found there are freeradius packages -- they are generally unstable CVS and contain patches that I run with. These should not in any way be construed as any actual release by the freeRADIUS team or by any offical Debian maintainers. I dont expect anyone to actually install the binaries. I expect most people who actually use it (if any) to merely obtain the source. No guarantees or warranties made in any way shape or form for anything. In particular, the latest package(s) there is suspected to core-dump infrequently after HUP. I want to thank Paul Hampson and all those who have contributed to Freeradius development, and for this instance, in particular the debian packaging. It was done in such a way as to make maintaining a customized package that parallels offical releases and code trivial. (##from memory its something like ..... mkdir cvs-XXXX cd cvs-XXX cvs co radiusd cd .. mkdir debian cd debian apt-get source freeradius cd freeradius-* diff -urN ../../cvs-XXX/radiusd/debian debian | less #<use your head> vi debian/changelog mv debian .. #carefull here rm -rf * cp -R ../../cvs-XXX/radiusd/* . mv ../debian . dpkg-buildpackage -rfakeroot ) Thank You!

1 0

no response from server on other machines
by yao guoxian 27 Dec '05

27 Dec '05

I have installed Freeradius 1.0.5 on the Redhat 9 machine. When I type the command" radtest test test localhost 0 testing123" to check ,the output is as the following: Sending Access-Request of id 252 to 127.0.0.1:1812 User-Name = "test" User-Password = "test" NAS-IP-Address = room129 NAS-Port = 0 Re-sending Access-Request of id 252 to 127.0.0.1:1812 User-Name = "test" User-Password = "S\306\212Go'\3216?!w\025\377\251\320," NAS-IP-Address = room129 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=252, length=20 Is this a proof that the Radius Server runs correctly? Then I run NTRadPing(a handy tool to test Radius Server on clients machines) on other machine which has Windows server 2003 OS, only got the results as follows: sending authentication request to server 202.117.x.x:1812 Transmitting packet ,code =1,id=2,length = 45 no response from server(time out),new attempt #1 no response from server(time out),new attempt #2 no response from server(time out),new attempt #3 could not recieve the response from the server I have configured /raddb/users and /raddb/clients.conf and had no effects. Then i configured /raddb/naslist, add winServer 2003 machines' ip and type as livingston, the problem is still not resolved. I don't know what difference between the types "Unix","Cisco","Livingston" and "Slaveport". Can anyone explain the difference for me?

2 1

rlm_jradius linking problems
by BigMick 27 Dec '05

27 Dec '05

Hi there, Point me in the right direction if I'm talking to the wrong people here :). I'm trying to get JRadius up and running, but not having much success. I've built rlm_jradius, but for some reason it is not creating .so objects for freeradius to load. As a result its crashing out with this error: radiusd.conf[1515] Failed to link to module 'rlm_jradius': /usr/local/radius/lib/rlm_jradius.a: invalid ELF header Has anyone had any success with JRadius, and if so can they possibly help me? Thanks all. -- BigMick

4 6

confused on attrs file entries
by Chuck 27 Dec '05

27 Dec '05

if i just used the default in the attrs file to test our realms replies and pass them on upstream, i am confused on how to limit.. example my realm sends me a reply of Session-Timeout = 8400 tested against my attrs file, it is within range so it would be passed.. my attrs contains Session-Timeout <= 14400 now... if someone sends me a value above 14400 i am under the impression that the Session-Timeout reply would be dropped and none would be sent. I would like to, if the value is over, set the max value and send my reply instead of theirs still giving them the ability to send replies of less value to be passed.. i am confused how to do this. i am aware of the := operator which would substitute my value in place of whatever theirs is and pass it on, but how do I do a conditional in this file so I only do that if it is higher? -- Chuck "Windows?? You mean the thirty-two bit extension and graphical shell to a sixteen-bit patch to an eight-bit operating system originally coded for a four-bit microprocessor which was written by a two-bit company that can't stand one bit of competition? Oh, that..." -- Lee Clarke

2 1