June 2005 - Freeradius-Users - lists.freeradius.org

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

no DB handles
by Lucas Aimaretto 31 Oct '07

31 Oct '07

Hi all, I've seen many of these messages in the radius.log ... Wed Jun 15 15:10:23 2005 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 What does it mean ? How to solve this ? Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

11 23

Installation of FreeRadius on Solaris 10
by Jas 23 Jul '05

23 Jul '05

Hi All, I would really appriciate, if you would kindly help me out. I'm trying to install FreeRadius-1.0.4(downloaded from freeradius.org) on Solaris OS 10 (SPARC) as below: /freeradius-1.0.4# ./configure /freeradius-1.0.4# make /freeradius-1.0.4# make install But I'm getting errors while installing it. /freeradius-1.0.4# ./configure ... ... checking for string.h... (cached) yes checking for strchr... (cached) yes checking for strrchr... (cached) yes checking for memcpy... (cached) yes checking for memmove... (cached) yes checking for strcmp... (cached) yes updating cache .././config.cache creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_attr_rewrite running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for regex.h... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_counter running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for gdbm.h... no checking for gdbm_open in -lgdbm... no checking for gdbm_fdesc... (cached) no configure: warning: silently not building rlm_counter. configure: warning: FAILURE: rlm_counter requires: libgdbm. creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_dbm running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for ndbm.h... yes checking for dbm in default lib... yes creating ./config.status creating Makefile configuring in src/modules/rlm_eap running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes creating ./config.status creating Makefile configuring in ./types/rlm_eap_md5 running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking how to run the C preprocessor... (cached) gcc -E checking for malloc.h... (cached) yes creating ./config.status creating Makefile configuring in ./types/rlm_eap_mschapv2 running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking how to run the C preprocessor... (cached) gcc -E checking for malloc.h... (cached) yes creating ./config.status creating Makefile configuring in ./types/rlm_eap_peap running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for openssl/ssl.h... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking how to run the C preprocessor... (cached) gcc -E checking for openssl/err.h... (cached) yes checking for openssl/engine.h... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in ./types/rlm_eap_sim running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for openssl/ssl.h... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking how to run the C preprocessor... (cached) gcc -E checking for openssl/err.h... (cached) yes checking for openssl/engine.h... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in ./types/rlm_eap_tls running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for openssl/ssl.h... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking how to run the C preprocessor... (cached) gcc -E checking for openssl/err.h... (cached) yes checking for openssl/engine.h... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in ./types/rlm_eap_ttls running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for openssl/ssl.h... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking how to run the C preprocessor... (cached) gcc -E checking for openssl/err.h... (cached) yes checking for openssl/engine.h... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_ippool running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for gdbm.h... no checking for gdbm_open in -lgdbm... no checking for gdbm_fdesc... (cached) no configure: warning: silently not building rlm_ippool. configure: warning: FAILURE: rlm_ippool requires: libgdbm. creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_krb5 running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for krb5.h... no checking for krb5_encrypt_data in -lk5crypto... no checking for DH_new in -lcrypto... yes checking for set_com_err_hook in -lcom_err... no configure: warning: the comm_err library isn't found! checking for krb5_init_context in -lkrb5... no configure: warning: silently not building rlm_krb5. configure: warning: FAILURE: rlm_krb5 requires: krb5. creating ./config.status creating Makefile configuring in src/modules/rlm_ldap running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for inet_aton in -lresolv... (cached) yes checking for lber.h... yes checking for ldap.h... yes checking for sasl_encode in -lsasl... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking for ber_init in -llber... no configure: warning: silently not building rlm_ldap. configure: warning: FAILURE: rlm_ldap requires: liblber. creating ./config.status creating Makefile configuring in src/modules/rlm_pam running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for dlopen in -ldl... (cached) yes checking for pam_start in -lpam... (cached) yes checking for security/pam_appl.h... (cached) yes checking for pam/pam_appl.h... (cached) no creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_radutmp running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking how to run the C preprocessor... (cached) gcc -E checking for sys/mman.h... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_sql running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes creating ./config.status creating ./Makefile creating ./drivers/Makefile configuring in ./drivers/rlm_sql_iodbc running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for isql.h... no configure: warning: iodbc headers not found. Use --with-iodbc-include-dir=<path>. configure: warning: sql submodule 'iodbc' disabled creating ./config.status creating Makefile configuring in ./drivers/rlm_sql_mysql running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for mysql_config... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in ./drivers/rlm_sql_postgresql running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for libpq-fe.h... no checking for PQconnectdb in -lpq... no configure: warning: silently not building rlm_sql_postgresql. configure: warning: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. creating ./config.status creating Makefile configuring in ./drivers/rlm_sql_oracle running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for oci.h... no configure: warning: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: warning: sql submodule 'oracle' disabled creating ./config.status creating Makefile configuring in ./drivers/rlm_sql_unixodbc running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for sql.h... no configure: warning: unixODBC headers not found. Use --with-unixodbc-include-dir=<path>. configure: warning: sql submodule 'unixodbc' disabled creating ./config.status creating Makefile configuring in src/modules/rlm_unix running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for system password file... /etc/passwd checking for system shadow password file... /etc/shadow checking for crypt... (cached) yes checking for crypt.h... (cached) yes checking for shadow.h... (cached) yes checking for getspnam... (cached) yes checking for getusershell... (cached) yes checking for getspnam in -lshadow... (cached) no checking for fgetpwent... (cached) yes checking for fgetspent... (cached) yes checking for fgetgrent... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_x99_token running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking how to run the C preprocessor... (cached) gcc -E checking for inttypes.h... (cached) yes creating ./config.status creating Makefile configuring in src/modules/rlm_checkval running /bin/sh ./configure --enable-ltdl-install --enable-ltdl-install --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... nochecking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for regex.h... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged **************************** # make gmake[1]: Entering directory `/freerad' Making all in libltdl... gmake[2]: Entering directory `/freerad/libltdl' /bin/sh ./libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c mkdir .libs gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c -fPIC -DPIC -o .libs/ltdl.lo ltdl.c: In function `lt_dlopenext': ltdl.c:2926: warning: unused variable `file_found' gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -c ltdl.c -o ltdl.o >/dev/null 2>&1 mv -f .libs/ltdl.lo ltdl.lo /bin/sh ./libtool --mode=link gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -o libltdl.la -rpath /usr/local/lib -no-undefined -version-info 4:0:1 ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypto -lssl rm -fr .libs/libltdl.la .libs/libltdl.* .libs/libltdl.* /usr/ccs/bin/ld -G -z defs -h libltdl.so.3 -o .libs/libltdl.so.3.1.0 ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypto -lssl -lc ld: fatal: library -lcrypto: not found ld: fatal: library -lssl: not found ld: fatal: File processing errors. No output written to .libs/libltdl.so.3.1.0 gmake[2]: *** [libltdl.la] Error 1 gmake[2]: Leaving directory `/freerad/libltdl' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/freerad' *** Error code 2 The following command caused the error: /usr/sfw/bin/gmake WHAT_TO_MAKE=all common make: Fatal error: Command failed for target `all' ************************* # make install /freerad/install-sh -c -d -m 755 /usr/local/sbin /freerad/install-sh -c -d -m 755 /usr/local/bin /freerad/install-sh -c -d -m 755 /usr/local/etc/raddb /freerad/install-sh -c -d -m 755 /usr/local/man /freerad/install-sh -c -d -m 755 /usr/local/var/run/radiusd /freerad/install-sh -c -d -m 700 /usr/local/var/log/radius /freerad/install-sh -c -d -m 700 /usr/local/var/log/radius/radacct /freerad/install-sh -c -d -m 700 /usr/local/share /freerad/install-sh -c -d -m 755 /usr/local/share/freeradius for i in 1 5 8; do \ /freerad/install-sh -c -d -m 755 /usr/local/man/man$i; \ for p in man/man$i/*.$i; do \ /freerad/install-sh -c -m 644 $p /usr/local/man/man$i; \ done \ done gmake[1]: Entering directory `/freerad' Making install in libltdl... gmake[2]: Entering directory `/freerad/libltdl' /bin/sh ./libtool --mode=link gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -o libltdl.la -rpath /usr/local/lib -no-undefined -version-info 4:0:1 ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypto -lssl rm -fr .libs/libltdl.la .libs/libltdl.* .libs/libltdl.* /usr/ccs/bin/ld -G -z defs -h libltdl.so.3 -o .libs/libltdl.so.3.1.0 ltdl.lo -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypto -lssl -lc ld: fatal: library -lcrypto: not found ld: fatal: library -lssl: not found ld: fatal: File processing errors. No output written to .libs/libltdl.so.3.1.0 gmake[2]: *** [libltdl.la] Error 1 gmake[2]: Leaving directory `/freerad/libltdl' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/freerad' *** Error code 2 The following command caused the error: /usr/sfw/bin/gmake WHAT_TO_MAKE=install common make: Fatal error: Command failed for target `install' # Thanks, Jas __________________________________ Yahoo! Mail Mobile Take Yahoo! Mail with you! Check email on your mobile phone. http://mobile.yahoo.com/learn/mail

4 3

accounting and LOCAL realm (freeradius dont send Accounting-Response)
by Victor 10 Jul '05

10 Jul '05

Hi! Im using FreeRadius (1.0.2, 1.0.3) for proxying only. My proxy.conf: realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = 192.168.1.1:1812 accthost = 192.168.1.1:1813 secret = key1 } realm provider.com { type = radius authhost = 10.1.1.1:1645 accthost = 10.1.1.1:1646 secret = key2 nostrip } I need some users, who called "555555" (any names or realms) authenticate and accounting local via start/alive/stop scripts. Authentication work perfectly: Im added to users: DEFAULT Auth-Type = Accept, Called-Station-Id == "555555", Proxy-To-Realm := LOCAL Exec-Program-Wait = "/usr/local/bin/555555-auth.pl" But accounting with similar config dont work. My acct_users: DEFAULT Proxy-To-Realm := LOCAL, Called-Station-Id == "555555" Exec-Program = /usr/local/bin/555555-acct.pl I see in logs WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. But freeradius DONT send Accounting-Response to NAS and NAS continue re-sending accounting packets. In logs its look like: ... rlm_detail: Freeradius-Proxied-To set to 255.255.255.255 modcall[accounting]: module "reply_log" returns ok for request 0 modcall: group accounting returns ok for request 0 WARNING: Cancelling proxy to Realm LOCAL, as the realm is local. Finished request 0 Going to the next request ... -- /kha0s

3 6

Chap password failing with Cisco
by Brent Smith 08 Jul '05

08 Jul '05

All- I am trying to get freeradius to authenticate chap for a ISDN backup call on a cisco. I am running version 1.0.1. I am in control of server and clients, so I know the passwords match, but the logs say they do not. Router setup: username ie_phx2 password 0 password users file: ie_phx2 Password == "password" Service-Type = Framed, Framed-Protocol = ppp, Cisco-Avpair += "multilink:max-links=6", Cisco-Avpair += "multilink:min-links=1", Cisco-Avpair += "multilink:load-threshhold=192", Cisco-Avpair += "lcp:interface-config=ip vrf forwarding VPDN-1444-ISDNBackup", Cisco-Avpair += "lcp:interface-config=ip unnumbered loop144", Cisco-Avpair += "lcp:send-secret=password" log: rad_recv: Access-Request packet from host XX.XX.XX.XX:1645, id=0, length=91 Framed-Protocol = PPP User-Name = "ie_phx2" CHAP-Password = 0x1906c1e965a82a39db372abde8f7455ee6 NAS-Port = 1 NAS-Port-Type = Virtual Called-Station-Id = "04082415687" Service-Type = Framed-User NAS-IP-Address = XX.XX.XX.XX Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "ie_phx2", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 9 users: Matched ie_phx2 at 147 modcall[authorize]: module "files" returns ok for request 9 modcall: group authorize returns ok for request 9 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 9 rlm_chap: login attempt by "ie_phx2" with CHAP password rlm_chap: Using clear text password password for user ie_phx2 authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 9 modcall: group Auth-Type returns reject for request 9 auth: Failed to validate the user. Login incorrect (rlm_chap: Wrong user password): [ie_phx2/<CHAP-Password>] (from client c pe2.pop2 port 1) Delaying request 9 for 1 seconds Finished request 9 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 38 with timestamp 42c333c5 Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to XX.XX.XX.XX:1645 Cisco-AVPair += "multilink:max-links=6" Cisco-AVPair += "multilink:min-links=1" Cisco-AVPair += "multilink:load-threshhold=192" Cisco-AVPair += "lcp:interface-config=ip vrf forwarding VPDN-1444-ISDNBackup\n ip unnumbered loop144" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 9 ID 0 with timestamp 42c333ca Nothing to do. Sleeping until we see a request. Any idea why freeradius thinks the passwords don't match? Thanks -Brent Smith

2 2

'Segmentation fault' loading rlm_sql_postgresql
by Achim Friedland 05 Jul '05

05 Jul '05

Hello, is there a known problem with freeradius 1.0.2 and rlm_sql_postgresql? Load the sql.conf just makes my freeradius segfaulting... thx... achim # radiusd -A -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "ahzftest" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_postgresql" sql: server = "localhost" sql: port = "" sql: login = "radius" sql: password = "pass" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,E sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,u sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct- sql: accounting_update_query = "UPDATE radacct ? SET FramedIPAddress = '%{Framed-IP-Address}', ? AcctSessionTime = '%{Acct-Session-Time}', ? AcctInputOctets = '%{Accd sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessi{ sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, ' sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSe- sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOc sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTimV sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE Us sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NO sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Segmentation fault

3 3

Current CVS logging issue
by Dinko Korunic 01 Jul '05

01 Jul '05

Hi. I believe that it might be a bug in current CVS. I've encountered an issue that FreeRADIUS does not log nor into files, nor into syslog, no matter what the configuration says [always dumps on stdout/stderr]. I've tried to track down the cause, and it might be this: arwen:~/work/cvs/radiusd-cvs/src/main# cvs diff -u mainconfig.c Index: mainconfig.c =================================================================== RCS file: /source/radiusd/src/main/mainconfig.c,v retrieving revision 1.63 diff -u -r1.63 mainconfig.c --- mainconfig.c 26 May 2005 21:26:29 -0000 1.63 +++ mainconfig.c 20 Jun 2005 09:17:45 -0000 @@ -945,8 +945,8 @@ * * This really is a hack, but it works... */ - if ((debug_flag < 2) && - (mainconfig.radlog_dest != RADLOG_STDOUT)) { + if (debug_flag < 2) + { mainconfig.radlog_dest = lrad_str2int(str2dest, radlog_dest, RADLOG_NULL); if (mainconfig.radlog_dest == RADLOG_NULL) { fprintf(stderr, "radiusd: Error: Unknown log_destination %s\n", I believe that mainconfig.radlog_dest doesn't get initialised, since local radlog_dest is used: static char *radlog_dest = NULL; as well as: { "log_destination", PW_TYPE_STRING_PTR, -1, &radlog_dest, "files" }, That would mean that (mainconfig.radlog_dest != RADLOG_STDOUT) is obviously a bogus check, since it should check radlog_dest, rather than mainconfig.radlog_dest. -- NAME:Dinko.kreator.Korunic NOTE:Standard.disclaimer.applies URL:kreator.esa.fer.hr IRC:kre ICQ:16965294 PGP:0xea160d0b

2 2

radiusprofile entry don't work
by Felice Pizzurro 01 Jul '05

01 Jul '05

hi all, excuse me for my bad english, I'm italian. i would to create a structure wich control the user's access on a WLAN by an auth-ldap. I have create a ldap directory witch basedn dc=unime,dc=it. now, like is write on the ldap_tutorial in the doc/ directory, i try to import this ldif file (modified for my interst). the authentication to be with the EAP-TLS protocol (it work fine) therefore I've deleted the sections of the passwords and for authentication. dn: dc=unime,dc=it objectClass: dcObject objectClass: organizationUnit ou: Unime.it Radius dc: unime dn: ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: radius dn: ou=profiles,ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: profiles dn: ou=users,ou=radius,dc=unime,dc=it objectclass: organizationalunit ou: users dn: uid=WLAN,ou=profiles,ou=radius,dc=unime,dc=it objectclass: radiusprofile uid: WLAN radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None dn: uid=Felice,ou=users,ou=radius,dc=mydomain,dc=com objectclass: radiusProfile uid: Felice radiusGroupName: WLAN the entry with uid =WLAN don't work, this is the message returned is invalid syntax #0 approximately... I don't have my pc here. Anyone can help me? -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: Migliaia di manuali e guide scaricabili su: Hacker, Reti, Webmaster, Windows e non solo...clicca qui Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3412&d=30-6

2 9

Re: EAP problem
by Graham, Robert 30 Jun '05

30 Jun '05

> No. Messages in the past few days have said you can't get passwords >from AD. It's impossible. > You have to use ntlm_auth. See radiusd.conf > Alan DeKok. This still doesn't make any since. I have ntlm_auth enable, and it is working fine autheniticating our vpn users using ms-chap.

2 1

Re: EAP problem
by Graham, Robert 30 Jun '05

30 Jun '05

I'm I correct to state that the "password_attribute = userPassword" in the ldap section causes ldap to retrieve the user's password out Active Directory? and if so, what I am doing wrong. The only thing that I can thing of is the mapping in the ldap.attrmap file which I have below: checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password sambaLMPassword checkItem NT-Password sambaNTPassword checkItem SMB-Account-CTRL-TEXT sambaAcctFlags checkItem Expiration radiusExpiration replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode Or I'm I completely off base? -Robert

2 1