June 2005 - Freeradius-Users - lists.freeradius.org

external script stays in <defunct> state after executing
by rashad 27 Jun '05

27 Jun '05

External script stays in <defunct> state after successfull executing. My configuration: OS: Debian Linux 3.0 Freeradius: 1.0.4 acct_users file: DEFAULT Acct-Status-Type == Stop Exec-Program = "/usr/local/sbin/testacct.php" Note that this problem was not in my old freeradius 1.0.1 installation in the machine with the same configuration.

2 1

Re: Radius server with web/gui interface
by Marcin Jessa 27 Jun '05

27 Jun '05

On Thu, 16 Jun 2005 20:01:34 +1200 Andrew Thompson <thompsa(a)freebsd.org> wrote: > On Thu, Jun 16, 2005 at 09:45:03AM +0200, Marcin Jessa wrote: > > On Thu, 16 Jun 2005 07:04:24 +0300 > > Abu Khaled <khaled.abu(a)gmail.com> wrote: > > > > > On 6/16/05, phil grainger <lists(a)netxp.com.au> wrote: > > > > > > > > you can mod the icradius cgi interface to work with freeradius, > > > > works fine. > > > > > > > > > > Very interesting. How much modification is required? > > > When it comes to setting up a icradius/freeradius, mysql and apache > > > then I can do it. I know only the basics of c/perl/php/... (Just how > > > to write a Hello World and sometimes I need help writing one), so any > > > help is appreciated > > > > > > > I thought you didnt want to run freeradius becouse of the security issues. > > And now all the sudden it became secure becouse of a different web interface? > > And dialupadmin would work fine, you dont need to recode interface of icradius. > > Email thompsa(a)FreeBSD.org and ask him if he's working on new port of freeradius 1.0.3. > > If not, I can do that. > > Ive been aware of 1.0.3 for a week now but it has known bugs. > > "06 June, 2005: Minor problems in version 1.0.3 mean that we will be > releasing 1.0.4 in a day or so. Please wait until then to upgrade." > > 1.0.4 was meant to be out by now and I have it confirmed that will be > only a few more hours. It will be updated as soon as its out. > Is there a way you could include a new dictionary.mikrotik as a patch for the port? And add it as $INCLUDE dictionary.mikrotik in the dictionary file? I suppose it will not make it to the 1.0.4 release (Paul, Alan?). The old one is inaccurate. Here is the new dictionary.mikrotik : # http://www.mikrotik.com # # http://www.mikrotik.com/Documentation/manual_2.8/dictionary.mikrotik # VENDOR Mikrotik 14988 ATTRIBUTE Recv-Limit 1 integer Mikrotik ATTRIBUTE Xmit-Limit 2 integer Mikrotik ATTRIBUTE Mikrotik-Group 3 string Mikrotik ATTRIBUTE Wireless-Forward 4 integer Mikrotik ATTRIBUTE Wireless-Skip-Dot1x 5 integer Mikrotik ATTRIBUTE Wireless-Enc-Algo 6 integer Mikrotik ATTRIBUTE Wireless-Enc-Key 7 string Mikrotik ATTRIBUTE Rate-Limit 8 string Mikrotik ATTRIBUTE Mikrotik-Realm 9 string Mikrotik # MikroTik Values VALUE Wireless-Enc-Algo No-encryption 0 VALUE Wireless-Enc-Algo 40-bit-WEP 1 VALUE Wireless-Enc-Algo 104-bit-WEP 2 Cheers, Marcin P.S The dictionary file on mikrotik's website is inaccurate as well. The realm and group values are not changed to match the current ones even tho I asked them to correct that.

2 1

EAP/TTLS Doubts (Another one!)
by Mario Alberto Cruz Gartner 27 Jun '05

27 Jun '05

Hello! I succesfully configured FreeRadius 1.0.4 on a FreeBSD 4.11 with a D-LINK DI-524 to autehticate usgin EAP/TLS and certificates on client machines. Now, i want to try the TTLS mode. But i'm confused by some things. So.. no certificates will be needed on the clients? First must be open a TLS tunnel, so i think that still need the certificates. But the TTLS doesn't bring the solution for don't mess up with PKI? I follow the guide: http://www.alphacore.net/spipen/article.php3?id_article=4 But i was trying the securew2 client works with a username/password instead of AEGIS client. OK, the radius log at start-up: --------------- metro@onebox> ./sbin/radiusd-tls -X + LD_LIBRARY_PATH=/usr/local/openssl/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /programas/freeradius-1.0.4/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /programas/freeradius-1.0.4/etc/raddb/proxy.conf Config: including file: /programas/freeradius-1.0.4/etc/raddb/clients.conf Config: including file: /programas/freeradius-1.0.4/etc/raddb/snmp.conf Config: including file: /programas/freeradius-1.0.4/etc/raddb/eap.conf Config: including file: /programas/freeradius-1.0.4/etc/raddb/sql.conf main: prefix = "/programas/freeradius-1.0.4" main: localstatedir = "/programas/freeradius-1.0.4/var" main: logdir = "/programas/freeradius-1.0.4/var/log/radius" main: libdir = "/programas/freeradius-1.0.4/lib" main: radacctdir = "/programas/freeradius-1.0.4/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/programas/freeradius-1.0.4/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/programas/freeradius-1.0.4/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/programas/freeradius-1.0.4/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /programas/freeradius-1.0.4/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/programas/freeradius-1.0.4/etc/raddb/certs/tls/cert-srv.pem" tls: certificate_file = "/programas/freeradius-1.0.4/etc/raddb/certs/tls/cert-srv.pem" tls: CA_file = "/programas/freeradius-1.0.4/etc/raddb/certs/tls/CA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/programas/freeradius-1.0.4/etc/raddb/certs/tls/dh" tls: random_file = "/programas/freeradius-1.0.4/etc/raddb/certs/tls/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/programas/freeradius-1.0.4/etc/raddb/huntgroups" preprocess: hints = "/programas/freeradius-1.0.4/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/programas/freeradius-1.0.4/etc/raddb/users" files: acctusersfile = "/programas/freeradius-1.0.4/etc/raddb/acct_users" files: preproxy_usersfile = "/programas/freeradius-1.0.4/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/programas/freeradius-1.0.4/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/programas/freeradius-1.0.4/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/programas/freeradius-1.0.4/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. -------------- The radius log on the auth with the securew2/wireless client: rad_recv: Access-Request packet from host 192.168.20.7:1211, id=33, length=133 User-Name = "metrolap" NAS-IP-Address = 192.168.20.7 NAS-Port = 0 Called-Station-Id = "00-0F-3D-36-05-87" Calling-Station-Id = "00-0B-7D-0F-F7-35" NAS-Identifier = "DI-524" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000d016d6574726f6c6170 Message-Authenticator = 0xed375bf750fcd3ea4aadb70cc76ef78b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "metrolap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 33 to 192.168.20.7:1211 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73087f91b1e8f8d957e58cac09478b25 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:1211, id=34, length=144 User-Name = "metrolap" NAS-IP-Address = 192.168.20.7 NAS-Port = 0 Called-Station-Id = "00-0F-3D-36-05-87" Calling-Station-Id = "00-0B-7D-0F-F7-35" NAS-Identifier = "DI-524" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060315 State = 0x73087f91b1e8f8d957e58cac09478b25 Message-Authenticator = 0xf2faf5d17f9913fd3106ec27f0341a3b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "metrolap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 34 to 192.168.20.7:1211 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x14001116f181b54cdac28661f81bb75c Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.20.7:1211, id=35, length=198 User-Name = "metrolap" NAS-IP-Address = 192.168.20.7 NAS-Port = 0 Called-Station-Id = "00-0F-3D-36-05-87" Calling-Station-Id = "00-0B-7D-0F-F7-35" NAS-Identifier = "DI-524" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203003c158000000032160301002d01000029030167011500be9cd9e84ee59487da2abab412e0a45f0781141bc0769e65c37ae49c000002000a0100 State = 0x14001116f181b54cdac28661f81bb75c Message-Authenticator = 0x48f356371704be253b38cf1e4d24d0d3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: No '@' in User-Name = "metrolap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 60 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 002d], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0662], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 35 to 192.168.20.7:1211 EAP-Message = 0x0104040a15c0000006bf160301004a02000046030142c078e2643c13b1fbb273aba0a34d630c307d3df9bed6355d62ccf55d679438200ad8dc7278f815a2e681bc446183c040700e4ee612a23c822ea1927ed14bbfab000a0016030106620b00065e00065b0002c4308202c030820229a003020102020900f12ab1347a5cd9e1300d06092a864886f70d010104050030818c310b300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e61206465 EAP-Message = 0x20496e666f726d617469636120792054656c65636f6d756e69636163696f6e6573301e170d3035303632323138333932335a170d3036303632323138333932335a30819d310b300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e6120646520496e666f726d617469636120792054656c65636f6d756e69636163696f6e6573310f300d060355040313066f6e65626f7830819f300d06092a864886f70d010101050003818d00308189028181 EAP-Message = 0x00d30db19c37a7284f5f673101f2773ac3924fc774d15b7f55bc563b955b73aff9ac4f61d88aadaab244f47e944cdba13890f54008bd9ef1c553229e671ac5f4ffe6bb9bea797ac67188e37b9db3fb60006b68a8b3d01f73e9600612ae2d6bd4f0ce313e761bbdd177d9344579bd17565cc7b12a944820f52ab29365d22e4a24d30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181000795bf4630d57fde5f57eb8b0d4f0ceab17fd13b31437e09d666c1a5f7e3c6bc095b29442d889460764b7108194e06cc690a8b4e5ce1bc45744d57ffff07a9326ff1ac7e0d066e2cc86f83 EAP-Message = 0x8db90cbfa1ecd56e767573304003569d1693f6cf224e9a651d9d2e78a208ce2aed4ac4f0da6187ca561c946c98d24aa0161d9bf2080003913082038d308202f6a003020102020900f12ab1347a5cd9df300d06092a864886f70d010104050030818c310b300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e6120646520496e666f726d617469636120792054656c65636f6d756e69636163696f6e6573301e170d3035303632323138333631 EAP-Message = 0x395a170d3037303632323138333631395a30818c310b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xddedfde893839de0b50389bdc049c9db Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... rad_recv: Access-Request packet from host 192.168.20.7:1211, id=36, length=144 User-Name = "metrolap" NAS-IP-Address = 192.168.20.7 NAS-Port = 0 Called-Station-Id = "00-0F-3D-36-05-87" Calling-Station-Id = "00-0B-7D-0F-F7-35" NAS-Identifier = "DI-524" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061500 State = 0xddedfde893839de0b50389bdc049c9db Message-Authenticator = 0x8fcef06e38748df8ff8ecb3da88c003b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_realm: No '@' in User-Name = "metrolap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 36 to 192.168.20.7:1211 EAP-Message = 0x010502c91580000006bf300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e6120646520496e666f726d617469636120792054656c65636f6d756e69636163696f6e657330819f300d06092a864886f70d010101050003818d0030818902818100a4d3a6bb7f0b08a448a8b84fe5236a0ef724951374d6320389f264f2c5007aee8cfc1cfd319e16e1cb910c5cfd07821ac809e1ac9baade2e618b7addf29844732d923ca1103395642bd3f9c2 EAP-Message = 0x30d4aaceb77b9b2e3f96436860556ece59ee48b29a57b7824847e851a6829cc9dbefe96b24e9fb66d03e368cdcd4e40c7a7b66230203010001a381f43081f1301d0603551d0e0416041433bfd1100827d8643dcde9ca1ce76b25f46446913081c10603551d230481b93081b6801433bfd1100827d8643dcde9ca1ce76b25f4644691a18192a4818f30818c310b300906035504061302434f311830160603550408130f56616c6c652064656c204361756361310d300b0603550407130443616c69311e301c060355040a1315556e6976657273696461642064656c2056616c6c6531343032060355040b132b4f666963696e6120646520496e666f726d EAP-Message = 0x617469636120792054656c65636f6d756e69636163696f6e6573820900f12ab1347a5cd9df300c0603551d13040530030101ff300d06092a864886f70d0101040500038181003e06154dfd6945605d183a420498b80e43472ddc37ba210af99451122c28c0f9c0fe3a8c35e5fbf834e8c9359cab9c8a5178c6e93656d1aa4a90a40114d600bdc2698199b4adb031c83633ac990f05f42244a771769d888393d4c183f71cfdbaad74a467189ae89427f68d1e55ac68320bc63370dac576cfeaa005fc9855ef5e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec0b973431f71a50b826c7614cef7bdc Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 33 with timestamp 42c078e0 Cleaning up request 1 ID 34 with timestamp 42c078e0 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 35 with timestamp 42c078e2 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 36 with timestamp 42c078e3 Nothing to do. Sleeping until we see a request. ---------------------- -What is "rlm_eap: EAP NAK"? -It says: "TLS_accept:error in SSLv3 read client certificate A" But the client had the certs installed already (TLS works fine!). -Is there another guide (maybe a little updated?) for a EAP/TTLS with FreeRadius? I know that maybe i'm missing something obvious... So, for any help/clue/tip/link that you could give me, THKS A LOT!

2 1

Re: traffic based accounting info
by Antonio Mancuso 27 Jun '05

27 Jun '05

I am using pppd as "NAS" with the radius.so plugin. what do you think about this idea: I'll modify the kernel in order to add more statistics on the ppp interface (like #bytes per protocol or similar) and when the radius.so plugin ask the kernel for ppp statistics it will have all the needed information. At this time I think it can pass all the info to radius for accounting. does this idea sound correct to you? it can be of interest of other people on this list? Thnks, Antonio On Monday 27 June 2005 18:24, Alan DeKok wrote: > Antonio Mancuso <antonio.mancuso(a)digitaltelevision.it> wrote: > > The Acc-Output-Octets and Acc-Input-Octets report the number > > of bytes passed through the ppp interface. > > > > I need to strip from this #bytes all the traffic to POP3 and SMTP > > servers. > > > > any idea? > > If the NAS doesn't send that information, then it doesn't exist, and > you can't discover it. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html ROUTING / This message may be > Spam/Junk - Diese Email wird als Spam/Junk EMail eingestuft. Falls Sie > diese Email nicht mehr erhalten moechten, erstellen Sie bitte eine Regel > in Ihrem Mailclient, die diese Email automatisch loescht oder verschiebt > (http:/ /www.schnell-im-netz.de/spam). -- -- Esse-Gi s.r.l. c/o DigitalTelevision Tel: (+39) 02/45468220

3 6

Re: Re: lt_preloaded_symbols
by Pablo Rodriguez Dominguez 27 Jun '05

27 Jun '05

Hi Alan. take a look the next lines: libtool: link: not configured to extract global symbols from dlpreopened files gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../include "-DHOSTINFO=\"\"" "-DRADIUSD_VERSION=\"1.0.4\"" -o .libs/radiusd radiusd.o files.o util.o acct.o nas.o log.o valuepair.o version.o proxy.o exec.o auth.o timestr.o conffile.o modules.o modcall.o session.o xlat.o threads.o smux.o radius_snmp.o client.o request_list.o mainconfig.o -L/usr/local/src/freeradius/freeradius-1.0.4/src/lib -lcrypt -lnsl -lresolv -lsocket -lposix4 -lpthread /usr/local/src/freeradius/freeradius-1.0.4/src/lib/.libs/libradius.so /usr/local/lib/libltdl.so -L/usr/local/lib -L/usr/lib -L/usr/openwin/lib -L/usr/local/ssl/lib -ldl -lcrypt -R/usr/local/lib -R/usr/lib -R/usr/openwin/lib -R/usr/local/ssl/lib Undefined first referenced symbol in file lt_preloaded_symbols modules.o Can be the problen in the first line? Is the /usr/local/lib/libltdl.so the libltdl that comes with the server? Thanks thanks thanks ------------------ Pablo Rodriguez Dominguez <prodriguezd(a)sia.es> wrote: > /usr/local/lib/libltdl.so -L/usr/local/lib -L/usr/lib -L/usr/openwin/lib > -L/usr/local/ssl/lib -ldl -lcrypt -R/usr/local/lib -R/usr/lib > -R/usr/openwin/lib -R/usr/local/ssl/lib > Undefined first referenced > symbol in file > lt_preloaded_symbols modules.o > ld: fatal: Symbol referencing errors. No output written to .libs/radiusd > collect2: ld returned 1 exit status You're not using the libltdl that comes with the server. I don't have access to a Solaris box, so I'm not sure what else I can say. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Re: lt_preloaded_symbols
by Pablo Rodriguez Dominguez 27 Jun '05

27 Jun '05

Hello Alan. Firts, thanks for your time. Yes, im hate libtool, too. jejejejeje. i try to use the libtool tha is included in solaris and in FreeRadius too bash-2.05# vi Make.inc ... EXEEXT = LIBTOOL = /usr/local/src/freeradius/freeradius-1.0.4/libtool ACLOCAL = /usr/local/src/freeradius/freeradius-1.0.4/missing aclocal ..... but, when i use the libtool tha is included in solaris (LIBTOOL = /usr/local/bin/libtool) bash-2.05# /usr/local/bin/libtool -version libtool: unrecognized option `-version' Try `libtool --help' for more information. bash-2.05# /usr/local/bin/libtool --version ltmain.sh (GNU libtool) 1.5 (1.1220 2003/04/05 19:32:58) Copyright (C) 2003 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. i see the next lines... make[4]: Nothing to be done for `all'. make[4]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4/src/main' make[3]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4/src' make[2]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4/src' Making all in raddb... make[2]: Entering directory `/usr/local/src/freeradius/freeradius-1.0.4/raddb' make[2]: Nothing to be done for `all'. make[2]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4/raddb' Making all in scripts... make[2]: Entering directory `/usr/local/src/freeradius/freeradius-1.0.4/scripts' make[2]: Nothing to be done for `all'. make[2]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4/scripts' Making all in doc... make[2]: Entering directory `/usr/local/src/freeradius/freeradius-1.0.4/doc' make[3]: Entering directory `/usr/local/src/freeradius/freeradius-1.0.4/doc' Making all in rfc... make[4]: Entering directory `/usr/local/src/freeradius/freeradius-1.0.4/doc/rfc' make[4]: Nothing to be done for `all'. make[4]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4/doc/rfc' make[3]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4/doc' make[2]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4/doc' make[1]: Leaving directory `/usr/local/src/freeradius/freeradius-1.0.4' then i cant do make install. any idea Alan??? ------------------------- Use the libtool that is included with FreeRADIUS. Or, link the server statically. Did I ever mention I hate libtool? Alan DeKok.

1 0

traffic based accounting info
by Antonio Mancuso 27 Jun '05

27 Jun '05

Hello, I am using freeradius on Linux with pppd and rp-pppoe pluging to authenticate and bill DSL user. The Acc-Output-Octets and Acc-Input-Octets report the number of bytes passed through the ppp interface. I need to strip from this #bytes all the traffic to POP3 and SMTP servers. any idea? Thank you very much Antonio -- -- Esse-Gi s.r.l. c/o DigitalTelevision Tel: (+39) 02/45468220

2 1

Freeradius and eDirectory
by Mearl Danner 27 Jun '05

27 Jun '05

I'm having trouble getting a TLS connection from freeradius to my Novell LDAP Server. I've used Novell's document "Integrating Novell eDirectory with FreeRadius" to set it up. The radius -X log shows "rlm_ldap: could not start TLS Connect error" I've configured ldap.conf to use the same certificate and am able to do a successful search using: ldapsearch -vvv -h gwtemp.samford.edu -x -Z -b o=dxmltemp "cn=jmuser" dn FreeRadius 1.0.4 compiled --with-edir Redhat AS3 update 5 on an IBM p615 openldap-2.0.27-17 openssl-0.9.7a-33.15 Netware 6.5 SP3 on Dell hardware. Mearl Here's the log from radiusd -X: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded LDAP ldap: server = "gwtemp.samford.edu" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=admin,ou=cts,o=dxmltemp" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "/usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "demand" ldap: password = "xxxxxx" ldap: basedn = "o=dxmltemp" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "dialupAccess" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x1016f6c8 Module: Instantiated ldap (ldap) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 199.20.16.13:33390, id=156, length=58 User-Name = "jmuser" User-Password = "xxxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 199 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jmuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jmuser radius_xlat: '(uid=jmuser)' radius_xlat: 'o=dxmltemp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to gwtemp.samford.edu:389, authentication 0 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: setting TLS Cert File to /usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64 rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Connect error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 199.20.16.13:33390, id=156, length=58 Discarding duplicate request from client server-network:33390 - ID: 156 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 156 with timestamp 42c01acf Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 199.20.16.13:33390, id=156, length=58 User-Name = "jmuser" User-Password = "xxxxxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 199 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "jmuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for jmuser radius_xlat: '(uid=jmuser)' radius_xlat: 'o=dxmltemp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to gwtemp.samford.edu:389, authentication 0 rlm_ldap: setting TLS Require Cert to demand rlm_ldap: setting TLS Cert File to /usr/local/etc/raddb/certs/GWTEMP-SSL-DNS.b64 rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Connect error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 1 modcall: group authorize returns fail for request 1 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 199.20.16.13:33390, id=156, length=58 Discarding duplicate request from client server-network:33390 - ID: 156 --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 199.20.16.13:33390, id=156, length=58 Discarding duplicate request from client server-network:33390 - ID: 156 --- Walking the entire request list --- Cleaning up request 1 ID 156 with timestamp 42c01ad5 Nothing to do. Sleeping until we see a request.

1 0

proxy eap request and local authentication
by B. Tolka 27 Jun '05

27 Jun '05

I am doing local auth such as the example below in my users file 00097c78dd2d Auth-Type := Local, User-Password == 00097c78dd2d Tunnel-Type:1=13, Tunnel-Medium-Type:1=6, Tunnel-Private-Group-Id:1=23 I also need to proxy eap request to another radius server. I have tried using DEFAULT Auth-Type:= EAP, Proxy-To-Realm := realm name , Fall-Through=yes However the Default profile seems to apply to every user. Is there anyway to separate these auth types. Bryan

1 0

external script goes in <defunct> state in 1.0.4
by rashad 27 Jun '05

27 Jun '05

This problem persists in ver 1.0.4 too.

1 0