June 2005 - Freeradius-Users - lists.freeradius.org

Re: make error /usr/bin/ld: cannot find -lz
by rashad 25 Jun '05

25 Jun '05

Install zlib library for your system. >make faild with this error... > >gcc -shared sql_mysql.lo -L/usr/lib -L/usr/lib/mysql /usr/lib/libmysqlclient.so -lz -lm -lssl -lcrypto -Wl,-soname -Wl,rlm_sql_my sql-1.0.1.so -?>o .libs/rlm_sql_mysql-1.0.1.so >/usr/bin/ld: cannot find -lz >collect2: ld returned 1 exit status >gmake[10]: *** [rlm_sql_mysql.la] Error 1 > >What is -lz ?

2 1

log good/bad user logins
by MHumphries＠delcomp.net 24 Jun '05

24 Jun '05

i am running FreeRadius Version 1.0.2 with MySQL 3.23.54 and a Lucent Portmaster 3 ComOS 3.9 Here are some Snippits from radiusd.conf prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } authorize { preprocess auth_log auth_log # attr_filter chap mschap # IPASS suffix # ntdomain # eap sql # etc_smbpasswd # ldap } and to make a short ? long i get nothing in the log file for any users what so ever this is what i see: [root@linuxtest raddb]# tail -20 /usr/local/var/log/radius/radius.log Fri Jun 17 03:03:45 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Fri Jun 17 03:03:45 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Fri Jun 17 03:03:45 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Fri Jun 17 03:03:45 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri Jun 17 03:03:45 2005 : Info: Ready to process requests. Mon Jun 20 07:58:30 2005 : Error: Ignoring request from unknown client 90.0.0.163:2253 Mon Jun 20 07:58:34 2005 : Error: Ignoring request from unknown client 90.0.0.163:2253 Mon Jun 20 07:58:37 2005 : Error: Ignoring request from unknown client 90.0.0.163:2253 Mon Jun 20 07:58:41 2005 : Error: Ignoring request from unknown client 90.0.0.163:2253 Mon Jun 20 07:58:45 2005 : Error: Ignoring request from unknown client 90.0.0.163:2253 Mon Jun 20 07:58:48 2005 : Error: Ignoring request from unknown client 90.0.0.163:2253 Thu Jun 23 10:38:53 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jun 23 10:38:54 2005 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Jun 23 10:38:54 2005 : Info: rlm_sql (sql): Attempting to connect to root@90.0.0.190:/radius Thu Jun 23 10:38:54 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Thu Jun 23 10:38:54 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Thu Jun 23 10:38:54 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Thu Jun 23 10:38:54 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Thu Jun 23 10:38:54 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Thu Jun 23 10:38:54 2005 : Info: Ready to process requests. [root@linuxtest raddb]# i would like to be able to see good nd bad login attempts. I am very new to FreeRadius as i just switched to this from ICRadius. Thank you in advance for any help. Michael J. Humphries Network Engineer Delcomp/SOFTEK 1431 N. 26th Street Escanaba, MI 49829 Phone: 906-786-3583, ext 39 Fax: 906-786-4300

2 3

CHECKVAL
by Craig Hancock 24 Jun '05

24 Jun '05

Hello All General Question I am a freeradius system setup where I am authenticating 2 kinds of users 1) Authorized users: Authorized users are users who have are directly afflited with an organization and well be using the system indefintely. 2) Guest Users: Authorized users who are indirectly afflited with an organization and will be using the system for a very short period. With that said all my accounts our stored in a LDAP directory and users are placed into authorized users groups. The question that I have is that in the users file I want to be able to have another level of authorization for users based on NAS-IP-Address attribute. From reading the archive I understand that I can do this with checkval. Unfortantely the only reference I have been able to fine is an example based on the default radius.conf file. What is the syntax for checkval in the sense of having multiple checkval statements. I presume this would work but unfortantely it doesn't. checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string nofound-reject = no } checkval { item-name = NAS-IP-Address check-name = NAS-IP-Address data-type = ipaddr notfound-reject = yes } Unfortantely the first checkval is processed but not the 2nd one. I think I need to give it in additional name like I would if I had multiple LDAP directives i.e checkval NAS-CHECK. Am I correct on this and if so do I have to change the authorize section and put something like Autz-Type CHECKVAL { checkval NAS-CHECK } Lastly is it possible to construct Autz-Types based on Proxies (Proxies being done locally) Thanks for your assitance. -- ****************************************************** Craig T. Hancock Systems Engineer, Infrastructure Services Office of Information Technology University of Notre Dame ******************************************************

2 1

two start record
by james 24 Jun '05

24 Jun '05

For every call I got two start record, the difference is one record the sip-method=1 and the other record the sip-method =4 . Why? Thanks

2 1

lt_preloaded_symbols
by Pablo Rodriguez Dominguez 24 Jun '05

24 Jun '05

Hello all. Im new in the mail list. Im installing a freeradius-1.0.4 on a sol9-sparc box. when i do make, the next error apear. ---------------------------------------------- libtool: link: not configured to extract global symbols from dlpreopened files gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../include "-DHOSTINFO=\"\"" "-DRADIUSD_VERSION=\"1.0.4\"" -o .libs/radiusd radiusd.o files.o util.o acct.o nas.o log.o valuepair.o version.o proxy.o exec.o auth.o timestr.o conffile.o modules.o modcall.o session.o xlat.o threads.o smux.o radius_snmp.o client.o request_list.o mainconfig.o -L/usr/local/src/freeradius/freeradius-1.0.4/src/lib -lcrypt -lnsl -lresolv -lsocket -lposix4 -lpthread /usr/local/src/freeradius/freeradius-1.0.4/src/lib/.libs/libradius.so /usr/local/lib/libltdl.so -L/usr/local/lib -L/usr/lib -L/usr/openwin/lib -L/usr/local/ssl/lib -ldl -lcrypt -R/usr/local/lib -R/usr/lib -R/usr/openwin/lib -R/usr/local/ssl/lib Undefined first referenced symbol in file lt_preloaded_symbols modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd collect2: ld returned 1 exit status ---------------------- I have deleted freeradius-1.0.4/src/modules/rlm_x99_token to eliminate a previous error. any idea?????? Thanks

2 1

How to use different ldap-modules?
by Florian Prester 24 Jun '05

24 Jun '05

Hi I configured 2 ldap modules, one using a clear-text password for PEAP-TLS with MS-CHAPv2 or only CHAP authentication, and one retrieving a Crypt-Password for using PAP-Authentication. radiusd.conf: ldap ldap-PEAP { server = "ip" port = 400 identity = "cn=florian,ou=allro,ou=AAAdsadm,o=Universitaet Erlangen-Nuernberg,c=DE" password = xxxxxx basedn = "ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE" filter = "(Userid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "uid" #The mapping-file for PEAP: -> retrieves the cleartext-Password dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = "User-Password" timeout = 24 timelimit = 23 net_timeout = 1 ldap_debug = 5 } ldap ldap-PAP { server = "ip" port = 400 identity = "cn=florian,ou=allro,ou=AAAdsadm,o=Universitaet Erlangen-Nuernberg,c=DE" password = xxxx basedn = "ou=AAAuser,o=Universitaet Erlangen-Nuernberg,c=DE" filter = "(Userid=%{Stripped-User-Name:-%{User-Name}})" access_attr = "uid" #The mapping-file for PAP: -> retrieves the User-Password dictionary_mapping = ${raddbdir}/ldap.attrmap.pap ldap_connections_number = 5 password_attribute = "User-Password" timeout = 24 timelimit = 23 net_timeout = 1 ldap_debug = 5 } In the authorize-section I have added "group", as told in configurable_failover: authorize { preprocess suffix chap mschap group { ldap-PAP { #first try ldap-PAP, only return if it succeeds notfound = 1 noop = 2 updated = 3 fail = 4 reject = 5 userlock = 6 invalid = 7 handled = 8 ok = return } ldap-PEAP{#then ldap-PEAP notfound = 1 noop = 2 updated = 3 fail = 4 reject = 5 userlock = 6 invalid = 7 handled = 8 ok = return } eap{ #then EAP notfound = 1 noop = 2 updated = 3 fail = 4 reject = 5 userlock = 6 invalid = 7 handled = 8 ok = return } files{#then files notfound = 1 noop = 2 updated = 3 fail = 4 reject = 5 userlock = 6 invalid = 7 handled = 8 ok = return } } But it only takes the first entry, and if I switch the order of ldap-PAP and ldap-PEAP, so it should take ldap-PAP, therefore retrieve an Crypt-Password from the ldap-PAP-section it wants to use ldap for authentication!?!?!? What do I wrong? Thanks in advance Flo -- -------------------------------------------------------------- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Germany Tel.: +499131 8527813

2 9

RE: regexp in attr-rewrite confuses me!
by Tariq Rashid 24 Jun '05

24 Jun '05

in addition, the following suggests an unsual regex process... attr_rewrite attr_rewrite_post-proxy { attribute = Framed-Route searchin = proxy_reply searchfor = "([0-9.]+) ([0-9.]+) ([0-9]+)(.*)" replacewith = "[%{1}] [%{2}] [%{3}]" new_attribute = no ignore_case = no max_matches = 1 append = no } gives me the following unusual output: modcall[post-proxy]: module "attr_filter_post-proxy" returns updated for request 0 radius_xlat: '([0-9.]+) ([0-9.]+) ([0-9]+)(.*)' radius_xlat: '[29 83.67.214.16] [83.67.214.161 1] [1]' rlm_attr_rewrite: Changed value for attribute Framed-Route from '83.67.67.192/29 83.67.214.161 1' to '83.67.67.192/[29 83.67.214.16] [83.67.214.161 1] [1]' that is: Framed-Route = "83.67.67.192/[29 83.67.214.16] [83.67.214.161 1] [1]" so spaces appear in the matched items []. as before there is too much in %2 and £3 is puzzling. i'm surprised by the 83.67.67.192/ in the output when its not in the output template. i'm obviouslty confused so any light shed on this matter would be great! tariq

1 0

proxying users
by Maqbool Hashim 24 Jun '05

24 Jun '05

Hi, Is there a way that I can get my proxying radius server to append the realm for certain users. Basically I'm wondering if theres a way of having a realm based server where users don't have to type in the realm as part of their username. I'm wondering if I can get the radius server to do it as part of its processing before it proxies the access request. Thanks

1 0

regexp in attr-rewrite confuses me!
by Tariq Rashid 24 Jun '05

24 Jun '05

i'm finding counterintuitive behaviour for the regexp in the "searchfor" attr_rewrite. i have the following attr_rewrite attr_rewrite_post-proxy { attribute = Framed-Route searchin = proxy_reply searchfor = "([0-9./]+) ([0-9.]+) ([0-9]+)(.*)" replacewith = "[%{2}]" new_attribute = no ignore_case = no max_matches = 1 append = no } so for a Framed-Route of "83.67.67.192/29 83.67.214.161 1" it should give me: %{1} = 83.67.67.192/29 83.67.214.161 1 %{2} = 83.67.214.161 %{3} = 1 but instead %{2} contains "83.67.214.161 1". see the radiusd -X logs: modcall[post-proxy]: module "attr_filter_post-proxy" returns updated for request 0 radius_xlat: '([0-9./]+) ([0-9.]+) ([0-9]+)(.*)' radius_xlat: '[83.67.214.161 1]' rlm_attr_rewrite: Changed value for attribute Framed-Route from '83.67.67.192/29 83.67.214.161 1' to '[83.67.214.161 1]' anywone know why this is? also the \d for [0-9] don't work! tariq

1 0

Configure IP Pools
by DK 24 Jun '05

24 Jun '05

Hi, I´ve got freeradius instaled on redhat enterprise 3, configured and working :-) But now I need to create a diferents IP pools, I tryed to do it but I can't :-( I´ve created two ippool on radiusd.conf. # ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } ippool General { range-start = 192.168.75.1 range-stop = 192.168.75.126 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } If I configure the user to take an static IP it works fine, but when I try to take from IP pool it doesn´t works. javi Auth-Type := Local, User-Password == "123456" Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Address = 192.168.77.35, Framed-IP-Netmask = 255.255.255.255, Ascend-Maximum-Time = 28800, Ascend-Idle-Limit = 1800 ion Auth-Type := Local, User-Password == "123456" Pool-Name := "General" Service-Type = Framed-User, Framed-Protocol = PPP, Ascend-Assign-IP-Pool = 7, Ascend-Maximum-Time = 28800, Ascend-Idle-Limit = 1800 Any idea?

2 1