July 2005 - Freeradius-Users - lists.freeradius.org

TTLS and PAP
by martin.p.bradley＠bt.com 20 Jul '05

20 Jul '05

Folks, I'm repeating this message incase people thought it was not the original. I had the Fw: on the front of the subject. I'm trying to get TTLS/PAP working using freeradius 1.0.4. I must have it configured incorrectly because its giving a Segmentation fault just before giving the Access-Accept & EAP-Success back to the switch. I have searched the archives for a solution but not found help to sort my problem out. I have played around with the configuration but don't fully understand what I'm doing. Could someone point me to a place where I can read and understand how the authenticate and autorize sections work. The explanation in the radiusd.conf file don't seem to click with me. I don't understand is why the modcall[authorise] appear often in request processing before modcall[authenticate]. I thought the order was to authenticate a user and then once we are sure they are who they say they are then we authorise them to use the network. Thanks for any help, Martin. radiusd.conf ................ authenticate { Auth-Type PAP { pap } eap } authorize { preprocess eap files } Users file...................... "Client certificate" Auth-Type := Local, User-Password == "bradley" Service-Type = Framed-User, Framed-Compression = Van-Jacobsen-TCP-IP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 users: Matched entry DEFAULT at line 162 modcall[authorize]: module "files" returns ok for request 3 rlm_eap: EAP packet type response id 34 length 200 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type System rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'anonymous' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 TLS_accept: SSLv3 read client key exchange A TLS_accept: SSLv3 read finished A TLS_accept: SSLv3 write change cipher spec A TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 34 to 10.230.199.248:1126 EAP-Message = 0x0123003d15800000003314030100010116030100288b7a33f454f760f4cddff2f95941 b215a6f3d73b5e422d1744b2201bee31448f10dc78f33f354476 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x49b28c5e2307f384db00487f11336474 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.230.199.248:1126, id=35, length=248 User-Name = "anonymous" NAS-IP-Address = 10.230.199.248 NAS-Port = 2 State = 0x49b28c5e2307f384db00487f11336474 Calling-Station-Id = "00:06:5b:d6:ff:24" NAS-Identifier = "radius-netgear" NAS-Port-Type = Ethernet EAP-Message = 0x02230078150017030100189e2c7d7fea093fe36d2ad301f92cc2ef4cba50563b00a0a8 1703010050b5955c43a5cd51375cebde00ed386a2f4273385aa3f6b0b2c6f7e15b73a75e e8f64e15abdca0a875fd3408d3ce811a76580cee45fc540215f84bcc2f99a95cc5199a36 da952c0a76243f7f7645f4327b Message-Authenticator = 0x3ddd5d8d65f10f4a26c7db7ab52a96db X-Ascend-Token-Idle = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 users: Matched entry DEFAULT at line 162 modcall[authorize]: module "files" returns ok for request 4 rlm_eap: EAP packet type response id 35 length 120 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type System rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'anonymous' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 users: Matched entry Client certificate at line 90 modcall[authorize]: module "files" returns ok for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 modcall: group authorize returns ok for request 4 auth: type Local auth: user supplied User-Password matches local User-Password TTLS: Got tunneled Access-Accept Segmentation fault [root@mars raddb]# - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

rlm_sql_mysql make error for 1.0.4 and snapshot-20050718
by Thor Spruyt 20 Jul '05

20 Jul '05

Hi, I tried to compile 1.0.4 with support for mysql and postgresql, but compilation failed for rlm_sql I then tried with snapshot-20050718 but with the same result. Platform is i386, OS is CentOS 3.4 Below the make output of both attempts. Anybody any ideas? freeradius-1.0.4: Making static dynamic in rlm_sql... gmake[6]: Entering directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wal l -D_GNU_SOURCE -DNDEBUG -I../../include -I/home/thor/freeradius-1.0.4/libl tdl -c rlm_sql.c -o rlm_sql.o rlm_sql.c: In function `rlm_sql_detach': rlm_sql.c:587: warning: passing arg 2 of `xlat_unregister' from incompatible pointer type rlm_sql.c: In function `rlm_sql_instantiate': rlm_sql.c:659: warning: passing arg 2 of `xlat_register' from incompatible pointer type gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wal l -D_GNU_SOURCE -DNDEBUG -I../../include -I/home/thor/freeradius-1.0.4/libl tdl -c sql.c -o sql.o /home/thor/freeradius-1.0.4/libtool --mode=link ld \ -module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO _KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../../include -I/home/thor/freeradiu s-1.0.4/libltdl rlm_sql.o sql.o -o rlm_sql.a mkdir .libs ar cru rlm_sql.a rlm_sql.o sql.o ranlib rlm_sql.a gmake[7]: Entering directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql' Making static in drivers... gmake[8]: Entering directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers' /usr/bin/gmake -w WHAT_TO_MAKE=static common gmake[9]: Entering directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers' Making static in rlm_sql_db2... gmake[10]: Entering directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers/rlm_sql_db2' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers/rlm_sql_db2' Making static in rlm_sql_freetds... gmake[10]: Entering directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers/rlm_sql_freetds' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers/rlm_sql_freetds' Making static in rlm_sql_iodbc... gmake[10]: Entering directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers/rlm_sql_iodbc' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making static in rlm_sql_mysql... gmake[10]: Entering directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers/rlm_sql_mysql' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wal l -D_GNU_SOURCE -DNDEBUG -I../.. -I../../../../include -I'/usr/include/mysq l' -I/home/thor/freeradius-1.0.4/libltdl -c sql_mysql.c -o sql_mysql.o sql_mysql.c:39:20: errmsg.h: No such file or directory sql_mysql.c:40:19: mysql.h: No such file or directory sql_mysql.c:47: syntax error before "MYSQL" sql_mysql.c:47: warning: no semicolon at end of struct or union sql_mysql.c:48: warning: type defaults to `int' in declaration of `sock' sql_mysql.c:48: warning: data definition has no type or storage class sql_mysql.c:49: syntax error before '*' token sql_mysql.c:49: warning: type defaults to `int' in declaration of `result' sql_mysql.c:49: warning: data definition has no type or storage class sql_mysql.c:51: syntax error before '}' token sql_mysql.c:51: warning: type defaults to `int' in declaration of `rlm_sql_mysql_sock' sql_mysql.c:51: warning: data definition has no type or storage class sql_mysql.c: In function `sql_init_socket': sql_mysql.c:62: `mysql_sock' undeclared (first use in this function) sql_mysql.c:62: (Each undeclared identifier is reported only once sql_mysql.c:62: for each function it appears in.) sql_mysql.c:65: syntax error before ')' token sql_mysql.c:76: warning: implicit declaration of function `mysql_init' sql_mysql.c:77: warning: implicit declaration of function `mysql_real_connect' sql_mysql.c:84: `CLIENT_FOUND_ROWS' undeclared (first use in this function) sql_mysql.c:86: warning: implicit declaration of function `mysql_error' sql_mysql.c:86: warning: format argument is not a pointer (arg 3) sql_mysql.c: In function `sql_check_error': sql_mysql.c:122: `CR_SERVER_GONE_ERROR' undeclared (first use in this function) sql_mysql.c:123: `CR_SERVER_LOST' undeclared (first use in this function) sql_mysql.c:131: `CR_OUT_OF_MEMORY' undeclared (first use in this function) sql_mysql.c:132: `CR_COMMANDS_OUT_OF_SYNC' undeclared (first use in this function) sql_mysql.c:133: `CR_UNKNOWN_ERROR' undeclared (first use in this function) sql_mysql.c: In function `sql_query': sql_mysql.c:151: `mysql_sock' undeclared (first use in this function) sql_mysql.c:160: warning: implicit declaration of function `mysql_query' sql_mysql.c:161: warning: implicit declaration of function `mysql_errno' sql_mysql.c: In function `sql_store_result': sql_mysql.c:175: `mysql_sock' undeclared (first use in this function) sql_mysql.c:181: warning: implicit declaration of function `mysql_store_result' sql_mysql.c:184: warning: format argument is not a pointer (arg 3) sql_mysql.c: In function `sql_num_fields': sql_mysql.c:202: `mysql_sock' undeclared (first use in this function) sql_mysql.c:207: warning: implicit declaration of function `mysql_num_fields' sql_mysql.c:211: warning: format argument is not a pointer (arg 3) sql_mysql.c: In function `sql_num_rows': sql_mysql.c:257: `mysql_sock' undeclared (first use in this function) sql_mysql.c:260: warning: implicit declaration of function `mysql_num_rows' sql_mysql.c: In function `sql_fetch_row': sql_mysql.c:277: `mysql_sock' undeclared (first use in this function) sql_mysql.c:286: warning: implicit declaration of function `mysql_fetch_row' sql_mysql.c:286: warning: assignment makes pointer from integer without a cast sql_mysql.c: In function `sql_free_result': sql_mysql.c:305: `mysql_sock' undeclared (first use in this function) sql_mysql.c:308: warning: implicit declaration of function `mysql_free_result' sql_mysql.c: In function `sql_error': sql_mysql.c:327: `mysql_sock' undeclared (first use in this function) sql_mysql.c:332: warning: return makes pointer from integer without a cast sql_mysql.c: In function `sql_close': sql_mysql.c:346: `mysql_sock' undeclared (first use in this function) sql_mysql.c:349: warning: implicit declaration of function `mysql_close' sql_mysql.c: In function `sql_affected_rows': sql_mysql.c:395: `mysql_sock' undeclared (first use in this function) sql_mysql.c:397: warning: implicit declaration of function `mysql_affected_rows' gmake[10]: *** [sql_mysql.o] Error 1 gmake[10]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers' gmake[8]: *** [static] Error 2 gmake[8]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql' gmake[6]: *** [static] Error 2 gmake[6]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/home/thor/freeradius-1.0.4/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/thor/freeradius-1.0.4/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/thor/freeradius-1.0.4/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/thor/freeradius-1.0.4' make: *** [all] Error 2 freeradius-snapshot-20050718: Making all in rlm_sql... gmake[6]: Entering directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql' /home/thor/freeradius-snapshot-20050718/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wal l -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite -strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wn ested-externs -W -Wredundant-decls -Wundef -I../../include -I/home/thor/free radius-snapshot-20050718/libltdl -c rlm_sql.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall - D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-st rings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnest ed-externs -W -Wredundant-decls -Wundef -I../../include -I/home/thor/freerad ius-snapshot-20050718/libltdl -c rlm_sql.c -fPIC -DPIC -o .libs/rlm_sql.o rlm_sql.c: In function `sql_xlat': rlm_sql.c:183: warning: unused parameter `func' rlm_sql.c: In function `rlm_sql_instantiate': rlm_sql.c:828: warning: assignment discards qualifiers from pointer target type rlm_sql.c:830: warning: assignment discards qualifiers from pointer target type gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall - D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-st rings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnest ed-externs -W -Wredundant-decls -Wundef -I../../include -I/home/thor/freerad ius-snapshot-20050718/libltdl -c rlm_sql.c -o rlm_sql.o >/dev/null 2>&1 /home/thor/freeradius-snapshot-20050718/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wal l -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite -strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wn ested-externs -W -Wredundant-decls -Wundef -I../../include -I/home/thor/free radius-snapshot-20050718/libltdl -c sql.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall - D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-st rings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnest ed-externs -W -Wredundant-decls -Wundef -I../../include -I/home/thor/freerad ius-snapshot-20050718/libltdl -c sql.c -fPIC -DPIC -o .libs/sql.o gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall - D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-st rings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnest ed-externs -W -Wredundant-decls -Wundef -I../../include -I/home/thor/freerad ius-snapshot-20050718/libltdl -c sql.c -o sql.o >/dev/null 2>&1 /home/thor/freeradius-snapshot-20050718/libtool --mode=link gcc -release 1.1.0-pre0 \ -module -export-dynamic -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOP ENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmiss ing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../../inclu de -I/home/thor/freeradius-snapshot-20050718/libltdl \ -o rlm_sql.la -rpath /opt/freeradius/lib rlm_sql.lo sql.lo ../../lib/libradius.la \ /home/thor/freeradius-snapshot-20050718/libltdl/libltdl.la -lnsl -lresolv - lpthread -lcrypto gcc -shared .libs/rlm_sql.o .libs/sql.o -Wl,--rpath -Wl,/home/thor/freeradius-snapshot-20050718/src/lib /.libs -Wl,--rpath -Wl,/home/thor/freeradius-snapshot-20050718/libltdl/.libs -Wl,--rpath -Wl,/opt/freeradius/lib ../../lib/.libs/libradius.so /home/thor/freeradius-snapshot-20050718/libltdl/.libs/libltdl.so -lnsl -lres olv -lpthread -lcrypto -Wl,-soname -Wl,rlm_sql-1.1.0-pre0.so -o .libs/rlm_sql-1.1.0-pre0.so (cd .libs && rm -f rlm_sql.so && ln -s rlm_sql-1.1.0-pre0.so rlm_sql.so) ar cru .libs/rlm_sql.a rlm_sql.o sql.o ranlib .libs/rlm_sql.a creating rlm_sql.la (cd .libs && rm -f rlm_sql.la && ln -s ../rlm_sql.la rlm_sql.la) gmake[7]: Entering directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql' Making dynamic in drivers... gmake[8]: Entering directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers' /usr/bin/gmake -w WHAT_TO_MAKE=dynamic common gmake[9]: Entering directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers' Making dynamic in rlm_sql_db2... gmake[10]: Entering directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers/rlm_sql _db2' gmake[10]: Nothing to be done for `dynamic'. gmake[10]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers/rlm_sql _db2' Making dynamic in rlm_sql_freetds... gmake[10]: Entering directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers/rlm_sql _freetds' gmake[10]: Nothing to be done for `dynamic'. gmake[10]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers/rlm_sql _freetds' Making dynamic in rlm_sql_iodbc... gmake[10]: Entering directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers/rlm_sql _iodbc' gmake[10]: Nothing to be done for `dynamic'. gmake[10]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers/rlm_sql _iodbc' Making dynamic in rlm_sql_mysql... gmake[10]: Entering directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers/rlm_sql _mysql' /home/thor/freeradius-snapshot-20050718/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wal l -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite -strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wn ested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I' /usr/include/mysql' -I/home/thor/freeradius-snapshot-20050718/libltdl -c sql_mysql.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall - D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-st rings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnest ed-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include -I/usr /include/mysql -I/home/thor/freeradius-snapshot-20050718/libltdl -c sql_mysql.c -fPIC -DPIC -o .libs/sql_mysql.o sql_mysql.c:41:20: errmsg.h: No such file or directory sql_mysql.c:42:19: mysql.h: No such file or directory sql_mysql.c:49: syntax error before "MYSQL" sql_mysql.c:49: warning: no semicolon at end of struct or union sql_mysql.c:50: warning: type defaults to `int' in declaration of `sock' sql_mysql.c:50: warning: data definition has no type or storage class sql_mysql.c:51: syntax error before '*' token sql_mysql.c:51: warning: type defaults to `int' in declaration of `result' sql_mysql.c:51: warning: data definition has no type or storage class sql_mysql.c:53: syntax error before '}' token sql_mysql.c:53: warning: type defaults to `int' in declaration of `rlm_sql_mysql_sock' sql_mysql.c:53: warning: data definition has no type or storage class sql_mysql.c: In function `sql_init_socket': sql_mysql.c:64: `mysql_sock' undeclared (first use in this function) sql_mysql.c:64: (Each undeclared identifier is reported only once sql_mysql.c:64: for each function it appears in.) sql_mysql.c:67: syntax error before ')' token sql_mysql.c:78: warning: implicit declaration of function `mysql_init' sql_mysql.c:79: warning: implicit declaration of function `mysql_real_connect' sql_mysql.c:86: `CLIENT_FOUND_ROWS' undeclared (first use in this function) sql_mysql.c:88: warning: implicit declaration of function `mysql_error' sql_mysql.c:88: warning: format argument is not a pointer (arg 3) sql_mysql.c: In function `sql_destroy_socket': sql_mysql.c:105: warning: unused parameter `config' sql_mysql.c: In function `sql_check_error': sql_mysql.c:124: `CR_SERVER_GONE_ERROR' undeclared (first use in this function) sql_mysql.c:125: `CR_SERVER_LOST' undeclared (first use in this function) sql_mysql.c:133: `CR_OUT_OF_MEMORY' undeclared (first use in this function) sql_mysql.c:134: `CR_COMMANDS_OUT_OF_SYNC' undeclared (first use in this function) sql_mysql.c:135: `CR_UNKNOWN_ERROR' undeclared (first use in this function) sql_mysql.c: In function `sql_query': sql_mysql.c:153: `mysql_sock' undeclared (first use in this function) sql_mysql.c:162: warning: implicit declaration of function `mysql_query' sql_mysql.c:163: warning: implicit declaration of function `mysql_errno' sql_mysql.c: In function `sql_store_result': sql_mysql.c:177: `mysql_sock' undeclared (first use in this function) sql_mysql.c:183: warning: implicit declaration of function `mysql_store_result' sql_mysql.c:186: warning: format argument is not a pointer (arg 3) sql_mysql.c:175: warning: unused parameter `config' sql_mysql.c: In function `sql_num_fields': sql_mysql.c:204: `mysql_sock' undeclared (first use in this function) sql_mysql.c:206:5: warning: "MYSQL_VERSION_ID" is not defined sql_mysql.c:209: warning: implicit declaration of function `mysql_num_fields' sql_mysql.c:213: warning: format argument is not a pointer (arg 3) sql_mysql.c:201: warning: unused parameter `config' sql_mysql.c: In function `sql_num_rows': sql_mysql.c:259: `mysql_sock' undeclared (first use in this function) sql_mysql.c:262: warning: implicit declaration of function `mysql_num_rows' sql_mysql.c:257: warning: unused parameter `config' sql_mysql.c: In function `sql_fetch_row': sql_mysql.c:279: `mysql_sock' undeclared (first use in this function) sql_mysql.c:288: warning: implicit declaration of function `mysql_fetch_row' sql_mysql.c:288: warning: assignment makes pointer from integer without a cast sql_mysql.c:277: warning: unused parameter `config' sql_mysql.c: In function `sql_free_result': sql_mysql.c:307: `mysql_sock' undeclared (first use in this function) sql_mysql.c:310: warning: implicit declaration of function `mysql_free_result' sql_mysql.c:305: warning: unused parameter `config' sql_mysql.c: In function `sql_error': sql_mysql.c:329: `mysql_sock' undeclared (first use in this function) sql_mysql.c:332: warning: return discards qualifiers from pointer target type sql_mysql.c:334: warning: return makes pointer from integer without a cast sql_mysql.c:327: warning: unused parameter `config' sql_mysql.c: In function `sql_close': sql_mysql.c:348: `mysql_sock' undeclared (first use in this function) sql_mysql.c:351: warning: implicit declaration of function `mysql_close' sql_mysql.c:346: warning: unused parameter `config' sql_mysql.c: In function `sql_finish_query': sql_mysql.c:366: warning: unused parameter `sqlsocket' sql_mysql.c:366: warning: unused parameter `config' sql_mysql.c: In function `sql_affected_rows': sql_mysql.c:397: `mysql_sock' undeclared (first use in this function) sql_mysql.c:399: warning: implicit declaration of function `mysql_affected_rows' sql_mysql.c:395: warning: unused parameter `config' gmake[10]: *** [sql_mysql.lo] Error 1 gmake[10]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers/rlm_sql _mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers' gmake[8]: *** [dynamic] Error 2 gmake[8]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql' gmake[6]: *** [dynamic] Error 2 gmake[6]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/thor/freeradius-snapshot-20050718/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/thor/freeradius-snapshot-20050718' make: *** [all] Error 2 -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

2 2

re: Searching Subcontexts in eDir
by Sayantan Bhowmick 19 Jul '05

19 Jul '05

Hi, If you are getting a reply with ldapsearch then you should be able to authenticate as that user. One of the possible causes of the -669 error is an invalid password. So check the password and make sure you are able to log in as that user. -Sayantan >>> jp(a)joshmp.com 07/20/05 3:00 AM >>> I have not setup Universal Passwords as this is not an option because of the complexities of the tree. As of right now, the LDAP Group in eDirectory does not require TLS, so I am therefore not requiring it in radiusd.conf either. I want to get it to work over cleartext for now, and then setup TLS later.

1 0

Caching results of Exec-Program-Wait
by Norman Elton 19 Jul '05

19 Jul '05

I'm using Exec-Program-Wait for authentication requests. The called program returns some attributes. Is there a way to cache the results of the called program, so that if I get 5 requests in X number of seconds, the program is only called once? Thanks for any advice, Norman Elton

2 1

re: Searching Subcontexts in eDir
by Mearl Danner 19 Jul '05

19 Jul '05

We're using Universal Passwords so the setup is a bit different. The documentation on rlm_ldap says that if password_attribute is set to NULL no password is sent. # default: NULL - don't add password Have you tried it with password_attribute = "userPassword" ? I'm assuming that you've tried to login to that account? Can you get a reply using: ldapsearch -h 10.254.8.25 -D cn=gwaccessPO1,ou=GW,o=Services -w <password> "cn=gwaccessPO1" That's all my best guesses for today. Mearl >>> <jp(a)joshmp.com> 7/19/2005 4:30:12 PM >>> I have not setup Universal Passwords as this is not an option because of the complexities of the tree. As of right now, the LDAP Group in eDirectory does not require TLS, so I am therefore not requiring it in radiusd.conf either. I want to get it to work over cleartext for now, and then setup TLS later. Here is the entire debug of an unsuccessful attempt to authenticate a user in ou=GW,o=Services: -----snip----- episd44# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "10.254.8.25" ldap: port = 389 ldap: net_timeout = 20 ldap: timeout = 20 ldap: timelimit = 20 ldap: identity = "cn=raduser,o=services" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "<password>" ldap: basedn = "o=services" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x808b400 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:4378, id=45, length=63 User-Name = "gwaccesspo1" User-Password = "<password>" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "gwaccesspo1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for gwaccesspo1 radius_xlat: '(cn=gwaccesspo1)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (cn=gwaccesspo1) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gwaccesspo1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "gwaccesspo1" with password "<password>" rlm_ldap: user DN: cn=gwaccessPO1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=gwaccessPO1,ou=GW,o=Services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials rlm_ldap: NDS error: failed authentication (-669) modcall[authenticate]: module "ldap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:4378, id=45, length=63 Sending Access-Reject of id 45 to 127.0.0.1:4378 Reply-Message = "NDS error: failed authentication (-669)" --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 45 with timestamp 42dd058b Nothing to do. Sleeping until we see a request. -----snip----- Thanks, Josh On Tuesday, July 19th, Mearl said: > Are you trying to use Universal Password to authenticate? I don't see the TLS > negotiation required for the admin to read the Universal Password. > > Why don't you post the entire debug log? Then we can see all the setup info as > the radius server reads it. > > Mearl

1 0

re: Searching Subcontexts in eDir
by jp＠joshmp.com 19 Jul '05

19 Jul '05

I have not setup Universal Passwords as this is not an option because of the complexities of the tree. As of right now, the LDAP Group in eDirectory does not require TLS, so I am therefore not requiring it in radiusd.conf either. I want to get it to work over cleartext for now, and then setup TLS later. Here is the entire debug of an unsuccessful attempt to authenticate a user in ou=GW,o=Services: -----snip----- episd44# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "10.254.8.25" ldap: port = 389 ldap: net_timeout = 20 ldap: timeout = 20 ldap: timelimit = 20 ldap: identity = "cn=raduser,o=services" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "<password>" ldap: basedn = "o=services" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x808b400 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:4378, id=45, length=63 User-Name = "gwaccesspo1" User-Password = "<password>" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "gwaccesspo1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for gwaccesspo1 radius_xlat: '(cn=gwaccesspo1)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: bind as cn=raduser,o=services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=services, with filter (cn=gwaccesspo1) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gwaccesspo1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "gwaccesspo1" with password "<password>" rlm_ldap: user DN: cn=gwaccessPO1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=gwaccessPO1,ou=GW,o=Services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials rlm_ldap: NDS error: failed authentication (-669) modcall[authenticate]: module "ldap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:4378, id=45, length=63 Sending Access-Reject of id 45 to 127.0.0.1:4378 Reply-Message = "NDS error: failed authentication (-669)" --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 45 with timestamp 42dd058b Nothing to do. Sleeping until we see a request. -----snip----- Thanks, Josh On Tuesday, July 19th, Mearl said: > Are you trying to use Universal Password to authenticate? I don't see the TLS > negotiation required for the admin to read the Universal Password. > > Why don't you post the entire debug log? Then we can see all the setup info as > the radius server reads it. > > Mearl

1 0

linux requirements
by Lucas Aimaretto 19 Jul '05

19 Jul '05

Hi all, I'm willing to install Freeradius. I'm using red hat 7.3 in a lab enviroment. I now it is outdated so, which linux distribution do you recomend for installing it ? I've heard that gcc is something critical ... Any opinion ? Thanks Regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.9.1/51 - Release Date: 18/07/2005

2 1

Re: Searching Subcontexts in eDir
by Mearl Danner 19 Jul '05

19 Jul '05

Are you trying to use Universal Password to authenticate? I don't see the TLS negotiation required for the admin to read the Universal Password. Why don't you post the entire debug log? Then we can see all the setup info as the radius server reads it. Mearl >>> jp(a)joshmp.com 7/19/2005 3:11:05 PM >>> Ok, I'm now one step closer. Mearl's solution worked somewhat. Here is the output from the debug: -----snip----- rlm_ldap: - authorize rlm_ldap: performing user authorization for gwaccesspo1 radius_xlat: '(cn=gwaccesspo1)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=services, with filter (cn=gwaccesspo1) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gwaccesspo1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns ok for request 3 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 3 rlm_ldap: - authenticate rlm_ldap: login attempt by "gwaccesspo1" with password "<password>" rlm_ldap: user DN: cn=gwaccessPO1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=gwaccessPO1,ou=GW,o=Services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials rlm_ldap: NDS error: failed authentication (-669) -----snip----- To contrast, here is the output from debug when I attempt to authenticate a user in the root context: -----snip----- rlm_ldap: - authorize rlm_ldap: performing user authorization for zentest radius_xlat: '(cn=zentest)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=services, with filter (cn=zentest) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user zentest authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "zentest" with password "<password>" rlm_ldap: user DN: cn=zentest,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=zentest,o=Services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user zentest authenticated succesfully -----snip----- Thanks in advance, Josh On Tuesday, July 19th, Mearl said: > Check the filter statement in the ldap portion of radiusd.conf. It's searching > on "uid" which in eDirectory is an integer field and isn't populated by default. > > Change the filter to filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" and try > it. That will get you past the "object not found" message. It will then be able > to return the fully qualified DN of the user. > > You can search on "cn" or any other ldap field that contains a unique ID. We're > probably going to use uniqueID - the newer user creation API's populate it by > default - in our environment because iPrint requires it. > > Mearl - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius on Fedora Core 1
by Luis Matos 19 Jul '05

19 Jul '05

Hi, I'm a newbie on freeradius, currently I'm trying to configure i ton a box running Fedora Core 1. Since it comes when the box was set I chose to installed everything. So it is already installed on the box. Q1. Where is the dialupadmin? Q2. How to configure it? Q3. Is there any howto configuring it using MySQL? Thanks. Luis Matos Systems & Network Manager Acelera Networks, Puerto Rico TEL. 787.622.2666 Email: <mailto:lmatos@acelerapr.com> lmatos(a)acelerapr.com Web: <http://www.acelerapr.com/> www.acelerapr.com "I never think of the future. It comes soon enough." Albert Einstein

3 2

Re: Searching Subcontexts in eDir
by jp＠joshmp.com 19 Jul '05

19 Jul '05

Ok, I'm now one step closer. Mearl's solution worked somewhat. Here is the output from the debug: -----snip----- rlm_ldap: - authorize rlm_ldap: performing user authorization for gwaccesspo1 radius_xlat: '(cn=gwaccesspo1)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=services, with filter (cn=gwaccesspo1) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gwaccesspo1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns ok for request 3 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 3 rlm_ldap: - authenticate rlm_ldap: login attempt by "gwaccesspo1" with password "<password>" rlm_ldap: user DN: cn=gwaccessPO1,ou=GW,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=gwaccessPO1,ou=GW,o=Services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials rlm_ldap: NDS error: failed authentication (-669) -----snip----- To contrast, here is the output from debug when I attempt to authenticate a user in the root context: -----snip----- rlm_ldap: - authorize rlm_ldap: performing user authorization for zentest radius_xlat: '(cn=zentest)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=services, with filter (cn=zentest) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user zentest authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "zentest" with password "<password>" rlm_ldap: user DN: cn=zentest,o=Services rlm_ldap: (re)connect to 10.254.8.25:389, authentication 1 rlm_ldap: bind as cn=zentest,o=Services/<password> to 10.254.8.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user zentest authenticated succesfully -----snip----- Thanks in advance, Josh On Tuesday, July 19th, Mearl said: > Check the filter statement in the ldap portion of radiusd.conf. It's searching > on "uid" which in eDirectory is an integer field and isn't populated by default. > > Change the filter to filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" and try > it. That will get you past the "object not found" message. It will then be able > to return the fully qualified DN of the user. > > You can search on "cn" or any other ldap field that contains a unique ID. We're > probably going to use uniqueID - the newer user creation API's populate it by > default - in our environment because iPrint requires it. > > Mearl

1 0