June 2005 - Freeradius-Users - lists.freeradius.org

Compilation error
by Oleg M. Golovanov 21 Jun '05

21 Jun '05

I try to make FreeRADIUS 1.0.4 on FreeBSD 4.11 and got the followin ( the previous version has been made successfully). Does anybody know the problem or maybe where to search? In file included from rlm_attr_rewrite.c:31: /usr/include/regex.h:46: syntax error before `regoff_t' /usr/include/regex.h:46: warning: type defaults to `int' in declaration of `regoff_t' /usr/include/regex.h:46: warning: data definition has no type or storage class /usr/include/regex.h:56: syntax error before `regoff_t' rlm_attr_rewrite.c: In function `do_attr_rewrite': rlm_attr_rewrite.c:314: structure has no member named `rm_so' rlm_attr_rewrite.c:316: structure has no member named `rm_so' rlm_attr_rewrite.c:318: structure has no member named `rm_eo' rlm_attr_rewrite.c:318: structure has no member named `rm_so' rlm_attr_rewrite.c:330: structure has no member named `rm_eo' rlm_attr_rewrite.c:348: structure has no member named `rm_so' rlm_attr_rewrite.c:357: structure has no member named `rm_so' rlm_attr_rewrite.c:358: structure has no member named `rm_eo' rlm_attr_rewrite.c:358: structure has no member named `rm_so' rlm_attr_rewrite.c:359: structure has no member named `rm_eo' rlm_attr_rewrite.c:359: structure has no member named `rm_so' gmake[5]: *** [rlm_attr_rewrite.o] Error 1 gmake[5]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules/rlm_attr_rewrite' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /usr/home/olmi/com/freeradius-1.0.4. -- Respectively, Oleg Golovanov Krasnoyarsk city Russia

2 1

Re: corrupt UDP packets sent to proxy (Alan DeKok)
by Taylor, Graham 21 Jun '05

21 Jun '05

Message: 2 Date: Fri, 17 Jun 2005 13:20:06 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: corrupt UDP packets sent to proxy To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>> Message-ID: <20050617172007.F3ED716FAB(a)mail.nitros9.org>> "Taylor, Graham" <GrahamTaylor(a)michaelpage.com>> wrote: >> Hi People, I hope you can shed some light on a problem I am having with >> freeradius acting as a proxy. As you can see the packet below has a >> corrupt UDP header > The kernel creates the UDP header, including checksum. If it's >wrong, there's little FreeRADIUS can do. Alan I agree that the kernel creates the UDP header normally, I am concerned that FreeRADIUS is forwarding the packet to the proxy without re-calculating the UDP header. This would explain why the behaviour is different when proxying than when using radtest. >> If I use radtest then the packet is fine and I get authenticated, the >> problem only occurs when the request is proxied out, all of the packets >> forwarded to the secondary radius server have the UDP checksum error, > I've never seen that, and I'm not sure why it would happen. Alan DeKok.

2 1

mrtg
by Micko 21 Jun '05

21 Jun '05

HI! I use FreeRADIUS as proxy. I would like to know if I can create mrtg using snmp on how many users are currently connected? Thank you!

6 7

EAP Supplicant Authentictaed falied to Ping.
by Sudha 21 Jun '05

21 Jun '05

Hi List.. I tried to enable EAP MD5 authentication and the configration in the wpa_supplicant.conf file is as: network { ssid=valid ssid identity=some identity password=secret pass word key_mgmt=IEEE8021X eap_flags=0 auth_algo=OPEN WEP_key1="some key" WEP_keytxindex=1 priority = 1 } I'm authenticated with AP and got the state "AUTENTICATED" but it then goes to RECEIVE and I'm not able to Ping to the AP. Is there any changes I need to make in suppliccant.conf or /etc/sysconfig/networkscripts? Any help on this regard is appreciable. Thanks.

1 0

Log / Dialup admin Nas lookup
by Cris Boisvert 21 Jun '05

21 Jun '05

Freeradius fedora core 3 Mysql with dialup admin.. Is their a way to have the dialup admin show all the users that have logged in to one Nas Server in a one month period? But not list all the login and accounting info? I just need a list of the users not everytime each logged in. Currently I do this.. From the radius.log Cat radius.log | grep nasserveraddress > NEWFILE Then I import the file and sort them and delete all the login lines but one.. Any recccomenddations? Thanx Cris

1 0

Re: Local (system) account creation
by Haydur 21 Jun '05

21 Jun '05

Ok, so from what I've learnt it's not possible to create accounts via pam_radius_auth if they don't exist on the system. How about this? Is it possible to use pam_radius_auth only authentication with "login", and if the user does not exist in the local password file, a default dummy account is used? How would I do that? I have tried modifying the login PAM configuration file, but although the authentication succeeds, the system gives me errors like "session setup problem, abort" or "user not known to underlying authentication module" and reloads the login application. How can I fix that? On 6/20/05, Alan DeKok <aland(a)ox.org> wrote: > Haydur <haydur(a)gmail.com> wrote: > > Is there a way to have remote FreeRadius only authentication on a > > Linux box, and if successful, creation of a system / local account for > > that user. > > Not really. There's pam_radius_auth, but that's only for usernames > & passwors, as I could never figure out the PAM magic required to do > UID, etc. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ROUTING / This message may be Spam/Junk - Diese Email wird als Spam/Junk EMail eingestuft. Falls Sie diese Email nicht mehr erhalten moechten, erstellen Sie bitte eine Regel in Ihrem Mailclient, die diese Email automatisch loescht oder verschiebt (http:/ > /www.schnell-im-netz.de/spam). > > --

1 0

EAP MD5 authentication
by Sudha 21 Jun '05

21 Jun '05

Hi List.. I'm trying EAP MD5 authentication using free radius but since MD5 doesn't generate any keys, I'm getting an error message "Failed to generate key". Generally MD5 is used in the phase2 of TLS or PEAP and that is working fine. Is it possible to establish EAP MD5 authentication without using, TLS or PEAP. The information in the supplicant.conf file is as: network { ssid=valid session ID identity="user" password="test" key_mgmt=NONE eap=MD5 priority=1 } Do help me in this regard asap, thanks in advance.

2 1

Problem checkrad cisco ap1200
by ph b. 21 Jun '05

21 Jun '05

Hello, The script "checkrad" not run with my ap1200, when i test it i have : SNMP Error: Received SNMP response with error code error status: noSuchName index 1 (OID: 1.3.6.1.4.1.9.2.9.2.1.18.XXX) SNMPv1_Session (remote host: "192.XXX.XXX.XXX" [192.XXX.XXX.XXX].161) community: "public" request ID: -662891836 PDU bufsize: 8000 bytes timeout: 2s retries : 5 backoff: 1) at /usr/sbin/checkrad line 221 checkrad: No SNMP answer from cisco checkrad: not found! I think it is a problem with the ap but i don't see what it is. The conf for the snmp on the ap is : access-list 111 permit tcp any any neq telnet snmp-server view dot11view ieee802dot11 included snmp-server community public view dot11view RO If i erase the view, i have the same problem. Furthermore, when i use the tool snmpge for the oid 1.3.6.1.4.1.9.2.9.2.1.18.XXX, it return me the same result : noSuchName. The ap use the IOS 12.3(2) And when i connect on the ap and do "show aaa user all", i can see the users name et other data. So the logins are stored on the ap but can i get them by SNMP or not ? how can i fnd the good OID ? Could you help me ? thanks ph

3 4

'authorize' module
by Edgars Klavinskis 21 Jun '05

21 Jun '05

still fighting with test configuration.. I have created two rlm_passwd modules. Afterwards, have put them under 'authorize' section one by one. Why the deamon is accepting the request depending only on the rlm_passwd file where User-Password is present and ignoring the one which should check NAS-IP-Address and Realm? My aim is to make it so that if the last mentioned returns "wrong", the whole request is wrong. Please assist me with ideas. Edgars

3 13

freeradius 1.0.2 compilation: problem with libtool
by manou 21 Jun '05

21 Jun '05

Hello all, I try to compile freeradius 1.0.2-4 (debian sarge's source) and I got the error message below: rbtree.c:265: warning: assignment discards qualifiers from pointer target type rbtree.c:278: warning: assignment discards qualifiers from pointer target type /usr/bin/libtool --mode=link ld \ -module -static -Wall -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LIBRADIUS -I../include -DHMAC_SHA1_DATA_PROBLEMS dict.o print.o radius.o valuepair.o token.o misc.o log.o filters.o missing.o md4.o md5.o sha1.o hmac.o hmacsha1.o snprintf.o isaac.o crypt.o udpfromto.o rbtree.o -o libradius.a libtool: link: unable to infer tagged configuration libtool: link: specify a tag with `--tag' make[5]: *** [libradius.a] Error 1 I tried to google but I could not find any issue. I found a related post in freeradius-users archive but it seems not been answered. So someone could tell me how to do? my libtool's version is 1.5.6-6. I can give other informations if necessary. Thanks in advance, Manou.

1 1