September 2005 - Freeradius-Users - lists.freeradius.org

Small patch for proxy code - listen.c
by Michael Mitchell 15 Sep '05

15 Sep '05

Hi, I have a small patch for the proxy code, in particular for listen.c in CVS HEAD. When the proxy reply comes back, only the cl->ipaddr is checked against the reply source address, however it is possible to configure cl->acct_ipaddr differently to cl->ipaddr (ie different auth and acct home servers for a single realm entry), and thus the active status and last reply time may never be updated for an accounting home server. I'm not sure what functional detriment the current behaviour might have, as I only stumbled across this while trying a small modification to proxy.c so that it would choose one of the home servers, even if they are all marked dead. Unfortunately I can't get CVS HEAD to compile under Solaris 10 x86 using gcc, so I have to admit I haven't compiled this code yet, but I have test the equivalent for 1.0.1 at work today. Sorry. Actually, this brings up another point that just crossed my mind, should cl->last_reply be split between authentication and accounting? Probably not a big deal, but I think it could result in for example the home auth server not being marked dead for the realm if a reply had been received from the home accounting server? (files.c around line 500) regards, Mike -bash-3.00$ diff -u listen.c.orig listen.c --- listen.c.orig Thu Sep 1 23:28:11 2005 +++ listen.c Fri Sep 2 00:00:48 2005 @@ -916,17 +916,24 @@ * as garbage. */ for (cl = mainconfig.realms; cl != NULL; cl = cl->next) { - if (oldreq->proxy_reply->src_ipaddr.af != cl->ipaddr.af) continue; + if ((oldreq->proxy_reply->src_ipaddr.af != cl->ipaddr.af) && + (oldreq->proxy_reply->src_ipaddr.af != cl->acct_ipaddr.af)) + continue; + if (cl->ipaddr.af != AF_INET) continue; /* FIXME */ - if (oldreq->proxy_reply->src_ipaddr.ipaddr.ip4addr.s_addr == cl->ipaddr.ipaddr.ip4addr.s_addr) { - if (oldreq->proxy_reply->src_port == cl->auth_port) { - cl->active = TRUE; - cl->last_reply = oldreq->timestamp; - } else if (oldreq->proxy_reply->src_port == cl->acct_port) { - cl->acct_active = TRUE; - cl->last_reply = oldreq->timestamp; - } + if ((oldreq->proxy_reply->src_ipaddr.ipaddr.ip4addr.s_addr == cl->ipaddr.ipaddr.ip4addr.s_addr) && + (oldreq->proxy_reply->src_port == cl->auth_port)) { + + cl->active = TRUE; + cl->last_reply = oldreq->timestamp; + + } else if ((oldreq->proxy_reply->src_ipaddr.ipaddr.ip4addr.s_addr == cl->acct_ipaddr.ipaddr.ip4addr.s_addr) && + (oldreq->proxy_reply->src_port == cl->acct_port)) { + + cl->acct_active = TRUE; + cl->last_reply = oldreq->timestamp; + } }

3 2

RE: custom variable in config files
by Tariq Rashid 15 Sep '05

15 Sep '05

i'm running into the same problem again in the clients.conf file where variables are not visible in the "host =" entries. i'd like to do something like ... realm abc.def { type = radius authhost = `%{config:network_address}`.126:1812 accthost = `%{config:network_address}`.126:1813 secret = llustreamkey nostrip } where network_address is defined in a file included in radius.cfg (which works for the users file shown below). any ideas? can i force the clients.conf to be xlat'ed? tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Nicolas Baradakis Sent: 13 September 2005 18:08 To: FreeRadius users mailing list Subject: Re: custom variable in config files Tariq Rashid wrote: > but this doesn't ... > > # local test user for monitoring and diagnostics > test1@proxyradius.%{config:easynet_site} User-Password == "test1.proxyradius.%{config:easynet_site}" > Reply-Message = "hello from the proxyradius layer %{config:easynet_site}" > > any ideas? i'm using version 1.0.2 on debian 3.1 It doesn't work because the name of the entry isn't xlat'ed in src/main/files.c. Perhaps this syntax would work: DEFAULT User-Name = "test1@proxyradius.%{config:easynet_site}", User-Password == "test1.proxyradius.%{config:easynet_site}" Reply-Message = "hello from the proxyradius layer %{config:easynet_site}" -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Tru64 again
by Tim Winders 15 Sep '05

15 Sep '05

responding to my own post. I saw a message about looking at the core dump in another thread. So, I followed those instructions. Here is the output from gdb: This GDB was configured as "alphaev67-dec-osf5.1"... BFD: Unhandled OSF/1 core file section type 4464 BFD: Unhandled OSF/1 core file section type 528 BFD: Unhandled OSF/1 core file section type 0 BFD: Unhandled OSF/1 core file section type 7 BFD: Unhandled OSF/1 core file section type 16384 BFD: Unhandled OSF/1 core file section type 8192 BFD: Unhandled OSF/1 core file section type 0 BFD: Unhandled OSF/1 core file section type 32768 BFD: Unhandled OSF/1 core file section type 49152 BFD: Unhandled OSF/1 core file section type 49152 BFD: Unhandled OSF/1 core file section type 7 BFD: Unhandled OSF/1 core file section type 57344 BFD: Unhandled OSF/1 core file section type 49152 warning: big endian file does not match little endian target. Core was generated by ` '. Program terminated with signal 1, Hangup. warning: Couldn't find general-purpose registers in core file. warning: Couldn't find general-purpose registers in core file. #0 0x00000000 in ?? () when I did bt in gdb I got the same "#0 0x00000000 in ?? ()" response and nothing else. But, in reading the above, it seems a big endian v. little endian problem. Does this help in getting freeradius to work on Tru64? --- Tim Winders Associate Dean of Information Technology South Plains College Levelland, TX 79336 Problem replying to my email? Click the "Sign" button in the OE toolbar or, better yet, get your own FREE Personal E-Mail Digital ID: http://www.thawte.com/email/index.html > -----Original Message----- > From: Tim Winders [mailto:twinders@southplainscollege.edu] > Sent: Wednesday, September 14, 2005 11:35 AM > To: 'freeradius-users(a)lists.freeradius.org' > Subject: Tru64 again > > I'm back at trying to get freeradius working under Tru64. > This time using 1.0.5. > > I have an older cvs version working, but I can't remember > what I did to make it work. :-( The working version I have > is marked 1.1.0-pre0 built on Feb 17, 2005. > > First, in src/main/radiusd.c I have commented out the OSFC2 > define. I do this because I'm not running C2, but it is > always found and enabled, which kills the make. Then, I run > configure with these options: > > CFLAGS="-I/usr/local/ssl/include -I/usr/local/include" > LDFLAGS="-L/usr/local/ssl/lib -L/usr/local/lib" LIBS="-lssl > -lcrypto -lsecurity" ./configure \ > --disable-shared \ > --enable-ltdl-install=no \ > --with-openssl-includes=/usr/local/ssl/include \ > --with-openssl-libraries=/usr/local/ssl/lib \ > --without-mysql --disable-mysql > > radiusd seems to compile, but with many warnings. However, > when I run it, it immediately seg faults and dumps core. > Unfortunately, I am not a programmer, so I don't know how to > begin troubleshooting this and try to help get freeradius > working under Tru64. > > I remember being told that none of the development team uses > Tru64. So, it's possible this will never work "right". But, > I'm willing to help out in whatever limited capacity I can, > including CPU/shell account. > > Any useful suggestions are welcome. > > --- > > Tim Winders > Associate Dean of Information Technology > South Plains College > Levelland, TX 79336 > > Problem replying to my email? Click the "Sign" button in the > OE toolbar or, better yet, get your own FREE Personal E-Mail > Digital ID: http://www.thawte.com/email/index.html

1 0

Re: Freeradius and PPPoe Server ?
by Paweł Małkowski 15 Sep '05

15 Sep '05

2005/9/13, Charles Price <charlie.price(a)w3z.co.uk>: > > I have the same problem. I have a radius server with ldap oracle. > > I dont know how to configure freeradius to use pppoe. > > > You have to configure pppd to authenticate using freeradius. In short: > > 1. Make sure you have a recent version of ppp and rp-pppoe (getting ppp from > CVS is a good idea) ok I installed ppp and rp-pppoe > 2. Make sure that the radius plugins for pppd have been installed > in /etc/ppp/plugins and the radiusclient configuration is > in /etc/radiusclient In default, plugin radius.so wasn't there, but I found one in another dict. > 3. Enter your specific radius server details into /etc/radiusclient/servers > and /etc/radiusclient/radiusclient.conf I would like to use Windows XP as a client :) > 4. Make sure you have some user information in your freeradius backend. I am > assuming you have configured freeradius to see your LDAP server... :) yes > 5. Put 'plugin /etc/ppp/plugins/radius.so' (no quotes) > in /etc/ppp/pppoe-server-options I put this line in pppoe-server-options > 6. Start the pppoe-server process. I started the serwer > 7. pppd should now ask freeradius for authentication. And here I have problem :( My ppp server and freeradius are still not connected. Do you have any idea? Maybe this is Windows and its pppoe fault? -- Pawel volfen Malkowski

1 0

Wrong Dialins
by Dominik Sennfelder 15 Sep '05

15 Sep '05

Hello With our old Redback we have been able to see Authentication failures in den the Freeradius Detail file. At the Moment this is not logged any more in the Details file. But I don't know why. We changed the Redback some time ago. The new one uses the same config file like the old one. Is this an Option in the Freeraius config for logging Authentication failures? And is it possible to log the Passwords the users entered?. Thanks Dominik Sennfelder

1 0

chap authentication failure
by dilip simha 15 Sep '05

15 Sep '05

hi, i have problems using chap with my radius server(FreeRADIUS Version 1.0.4). please help me out.. my users file on radius server: simha Auth-Type := CHAP , CHAP-Password == "hello" on the packet from radclient: User-Name = "simha" , CHAP-Password = "40c567281480e959747ddd9ea7589015" , CHAP-Challenge = "challenge" i use a request-id of 200 to generate the chap password as: 200hellochallenge when i run md5sum on this ..i get: 40c567281480e959747ddd9ea7589015 which i use as CHAP-Password attribute in radclient. in radiusd.conf: chap { authtype = CHAP } this is what i have. now when i use radclient as : radclient -f packet_chap 10.91.0.167 auth testing123 -i 200 where packet_chap(a file) has the contents: User-Name = "simha" , CHAP-Password = "40c567281480e959747ddd9ea7589015" , CHAP-Challenge = "challenge" 200 is the request id 10.91.0.167 is the radius server. on the radius server ..i get : rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "simha" with CHAP password rlm_chap: Using clear text password for user simha authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. so what is wrong with the process i have followed? bye simha

2 2

status of rlm_python in 1.1.0 release
by Ilia Chipitsine 15 Sep '05

15 Sep '05

Dear Sirs, I just made diff between 1.0.4 and 1.1.0 rlm_python sources and they appear to be the same. When that module will become non-experimental ? It has not been changing for years, maybe it can become regular module in 1.1.0 ? We develop an application that uses rlm_python and we would like our customers to be able to run it against "out of box" compiled freeradius. It would be bad to tell each customer "You know, our application uses rlm_python, which is still marked experimental and therefore You need to recompile freeradius ..." We confirm that we didn't experience any problem with rlm_python. It behave quite robust and predictable. Cheers, Ilia Chipitsine

3 3

duplicate records
by Callis 14 Sep '05

14 Sep '05

Hi all, I am trying to use freeradius(1.0.1-1 on FC3) to collect AAA records from a CISCOAS5300. I keep getting this error in my radius.log and my cisco also reports most of radius timeout. A ping test give <10ms on my network. Any suggestions would be of great help. Thank you. === Wed Sep 14 15:49:19 2005 : Error: rlm_sql (pgsql-voip): failed after re-connect Wed Sep 14 15:49:19 2005 : Error: rlm_sql (pgsql-voip): Couldn't update SQL accounting STOP record - ERROR: duplicate key violates unique constraint "stoptelephonycombo" Wed Sep 14 15:49:19 2005 : Error: rlm_sql (pgsql-voip): failed after re-connect Wed Sep 14 15:49:19 2005 : Error: rlm_sql (pgsql-voip): Couldn't update SQL accounting STOP record - ERROR: duplicate key violates unique constraint "stoptelephonycombo" ==

2 1

One question
by Sinan Ulker 14 Sep '05

14 Sep '05

Hi all, How can I setup EAP support on freeradius? Regards,

2 1

SQL Documentation
by Sean 14 Sep '05

14 Sep '05

Hi All, Can anyone recommend a good source for documentation for FreeRadius. I'm trying to understand the processes that occur between Chillispot, FreeRadius and MySql. In particular I need to understand how the Counter works and how to use the counter in MySQL. Regards, Sean

2 1