November 2006 - Freeradius-Users - lists.freeradius.org

Re: Problems building freeradius 1.1.3 under cygwin...
by 3ric Johanson 13 Nov '06

13 Nov '06

Update: $ cat startup.log Ignoring deprecated command-line option -pStarting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd.conf[1585] Failed to link to module 'rlm_exec': No such file or director y $ ls -lart /usr/local/lib/rlm_exec* -rwxr-xr-x 1 3ricj None 799 Nov 13 16:59 /usr/local/lib/rlm_exec.la -rw-r--r-- 1 3ricj None 34710 Nov 13 16:59 /usr/local/lib/rlm_exec.a lrwxrwxrwx 1 3ricj None 11 Nov 13 16:59 /usr/local/lib/rlm_exec-1.1.3.la -> r lm_exec.la $ Not sure why it can't link to the rlm_exec module. Any ideas? However, I've just found freeradius.net, where they have packaged up builds! woohoo! So I'm going to abort my own building process. FYI, there seems to be outstanding issues with cygwin/win32 on the newer versions of freeradius. Cheers, 3ric On Mon, 13 Nov 2006, 3ric Johanson wrote: > Hi there, > > I've been trying to get cygwin to build freeradius for a while now... just > kinda watching the version numbers grow, but still having problems. :) > > Here is the first error that it bombs out at: > > Making all in rlm_perl... > make[6]: Entering directory > `/home/3ricj/freeradius-1.1.3/src/modules/rlm_perl' > /home/3ricj/freeradius-1.1.3/libtool --mode=compile gcc -g -O2 -D_REENTRANT > -D_ > POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG > -I/home/3ricj/freeradius-1 > .1.3/src/include -DPERL_USE_SAFE_PUTENV -fno-strict-aliasing -pipe > -I/usr/local/ > include -I/usr/lib/perl5/5.8/cygwin/CORE -DPERL_USE_SAFE_PUTENV > -fno-strict-ali > asing -pipe -I/usr/local/include -c rlm_perl.c > mkdir .libs > gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE > -DNDEBUG > -I/home/3ricj/freeradius-1.1.3/src/include -DPERL_USE_SAFE_PUTENV > -fno-strict-a > liasing -pipe -I/usr/local/include -I/usr/lib/perl5/5.8/cygwin/CORE > -DPERL_USE_S > AFE_PUTENV -fno-strict-aliasing -pipe -I/usr/local/include -c rlm_perl.c > -DPIC > -o .libs/rlm_perl.o > rlm_perl.c: In function `rlm_perl_get_handles': > rlm_perl.c:226: warning: cast to pointer from integer of different size > rlm_perl.c: At top level: > rlm_perl.c:614: error: external linkage required for symbol > 'XS_radiusd_radlog' > because of 'dllexport' attribute. > make[6]: *** [rlm_perl.lo] Error 1 > make[6]: Leaving directory > `/home/3ricj/freeradius-1.1.3/src/modules/rlm_perl' > make[5]: *** [common] Error 2 > make[5]: Leaving directory `/home/3ricj/freeradius-1.1.3/src/modules' > > Disabling rlm_perl via: > > ./configure --without-rlm_perl > > Results in a functional build. > > Cheers, > -3ric > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > >

1 0

Problems building freeradius 1.1.3 under cygwin...
by 3ric Johanson 13 Nov '06

13 Nov '06

Hi there, I've been trying to get cygwin to build freeradius for a while now... just kinda watching the version numbers grow, but still having problems. :) Here is the first error that it bombs out at: Making all in rlm_perl... make[6]: Entering directory `/home/3ricj/freeradius-1.1.3/src/modules/rlm_perl' /home/3ricj/freeradius-1.1.3/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_ POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/3ricj/freeradius-1 .1.3/src/include -DPERL_USE_SAFE_PUTENV -fno-strict-aliasing -pipe -I/usr/local/ include -I/usr/lib/perl5/5.8/cygwin/CORE -DPERL_USE_SAFE_PUTENV -fno-strict-ali asing -pipe -I/usr/local/include -c rlm_perl.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/3ricj/freeradius-1.1.3/src/include -DPERL_USE_SAFE_PUTENV -fno-strict-a liasing -pipe -I/usr/local/include -I/usr/lib/perl5/5.8/cygwin/CORE -DPERL_USE_S AFE_PUTENV -fno-strict-aliasing -pipe -I/usr/local/include -c rlm_perl.c -DPIC -o .libs/rlm_perl.o rlm_perl.c: In function `rlm_perl_get_handles': rlm_perl.c:226: warning: cast to pointer from integer of different size rlm_perl.c: At top level: rlm_perl.c:614: error: external linkage required for symbol 'XS_radiusd_radlog' because of 'dllexport' attribute. make[6]: *** [rlm_perl.lo] Error 1 make[6]: Leaving directory `/home/3ricj/freeradius-1.1.3/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/3ricj/freeradius-1.1.3/src/modules' Disabling rlm_perl via: ./configure --without-rlm_perl Results in a functional build. Cheers, -3ric

1 0

freeradius child processes
by dan1＠gmx.net 13 Nov '06

13 Nov '06

Hello, I am using freeradius (1.0.2) with the mysql backed on debian sarge. I noticed that after starting freeradius I can not see the different processes of the radius daemon which are started. The thread pool is configured as follows: thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } When starting the radius server with the option -x I see the message Initializing the thread pool... Is this because freeradius is using multiple threads within one process, and only one process is visible in the process list? However on a different server with a very similar configuration ps aux will list me several freeradius processes which are running. Is there a way how to see how many threads are currently running? Thanks in advance for your help Dan -- Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

4 3

Radius account health checks
by Heivilin, Jim 13 Nov '06

13 Nov '06

I've got a two pairs of radius servers (running red hat 4 update 4, freeradius 1.0.1 with oracle 9.2.0) running under a pair of 2424 load balancers. Every two second the load balancers send an accounting health check to each of the radius machines which then writes a row to our oracle tables. Within these health checks the username is 'DEFAULT' and I have a weekly cron job to remove these records so my table space doesn't fill up. I tried to create an oracle trigger to prevent these rows from being written; SQL> create or replace trigger health_check 2 after insert on radacct 3 for each row 4 when (NEW.username = 'DEFAULT') 5 begin 6 delete from radacct where username = 'DEFAULT'; 7 end; 8 . And it seems to work on our test table but it doesn't work on the production data. Does anyone have any suggestions for this trigger or some other method to prevent or remove these rows from our tables? Jim Jim Heivilin, System Administrator, Combined Server Group, IAT Services, University of Missouri at Columbia mailto:banzai@missouri.edu, (573) 884-3898

2 1

freeradius mac athentication with Tsunami MP.11 5054-R v2.3.0(169)
by Cameron Cowie 13 Nov '06

13 Nov '06

Hi: I have configured my freeradius server to run on ubuntu and is stable (or so I think). I have ran tests from my workstation to ask for authentication and it serves out brilliantly. But as soon as I ask my tsunami 5054 to authenticate it locks and refuses to talk to the radius server. user files is just mac address. I am not sure where the problem lies, on the radius server or on the tsunami? again any and all help is greatly appreciated entry for clients.conf is simple } client xx.xx.xx.x { secret = xxxpasswordxxx shortname = xxshortbusxx } (mac address) Auth-Type :Local, User-Password := "xxxxxxxxx" as I said simple, but event the most simplest things come with complications. is there something I am missing on?

3 2

RE: Reject reason
by Garber, Neal 13 Nov '06

13 Nov '06

>I am authenticating users based on Calling-Station-Id in addition to password. >All accepts and rejects are logged to the postauth table in my database. Using what type of authentication? Are you really checking Calling-Station-Id during authenticate or are you checking it during authorize? What module are you using to validate it?

2 1

Re: freeradius child processes
by dan1＠gmx.net 13 Nov '06

13 Nov '06

Alan & Alan, Thank you for your help. I did not think of the different kernel versions. the ps aux -L does the job. Thanks Dan aland(a)deployingradius.com wrote: > > Is this because freeradius is using multiple threads within one > > process, and only one process is visible in the process list? > > Yes. This is a feature of Linux 2.6. > > > However on a different server with a very similar configuration ps > > aux will list me several freeradius processes which are running. > > Yes. This is a feature of Linux 2.4. > A.L.M.Buxey(a)lboro.ac.uk wrote: > > > Is there a way how to see how many threads are currently running? > > > > "man ps" > > adding the 'L' argument often shows what you need -- "Ein Herz für Kinder" - Ihre Spende hilft! Aktion: www.deutschlandsegelt.de Unser Dankeschön: Ihr Name auf dem Segel der 1. deutschen America's Cup-Yacht!

1 0

machine authentication (was: Windows-Domain login without local users)
by Michael Messner 13 Nov '06

13 Nov '06

hey freeRADIUS users, the testlab looks like Windows 2003 (AD) <---> Freeradius <---> Enterasys switch/Cisco WLAN <---> Linux/MS-Client 802.1x via PEAP works, so the next step is machine authentication to get also a 802.1x Domain login. like in this post (http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-November/05…) we have upgradet our releases: Samba: Version 3.0.23c FreeRADIUS Version 1.1.2 the supplicant is the original Windows supplicant and machine authentication is activated. Because we are working with the policy system from enterasys the normal user authentication starts with a ldap request to the active directory for group to policy mapping. Therefore we have such user-entries: DEFAULT LDAP-Group == "CN=adminrole,CN=users,DC=isalab,DC=local", Huntgroup-Name == "enterasys", Realm == ISALAB.local Filter-ID == "Enterasys:version=1:mgmt=su:policy=adminrole", Reply-Message = "Welcome %{Stripped-User-Name:-%{User-Name:-None}} in the %{Realm} - Domain, there are no restrictions for you in this network", Fall-Through = No So there will be the LDAP request for the group adminrole and then it will be sent to the switch with the above filter-ID. This works good for user-auth, but with machine auth now there are problems because I see the machine LDAP-request now for host/it88.isalab.local and that fails: ============================================= .... Nov 9 15:30:02 Xradius radius: rlm_ldap: object not found or got ambiguous search result Nov 9 15:30:02 Xradius radius: rlm_ldap::ldap_groupcmp: search failed Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_release_conn: Release Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: Entering ldap_groupcmp() Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_get_conn: Checking Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_get_conn: Got Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: object not found or got ambiguous search result Nov 9 15:30:02 Xradius radius: rlm_ldap::ldap_groupcmp: search failed Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_release_conn: Release Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: - authorize Nov 9 15:30:02 Xradius radius: rlm_ldap: performing user authorization for host/it88.isalab.local Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_get_conn: Checking Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_get_conn: Got Id: 0 Nov 9 15:30:02 Xradius radius: rlm_ldap: object not found or got ambiguous search result Nov 9 15:30:02 Xradius radius: rlm_ldap: search failed Nov 9 15:30:02 Xradius radius: rlm_ldap: ldap_release_conn: Release Id: 0 Nov 9 15:30:02 Xradius radius: Login incorrect (rlm_ldap: User not found): [host/it88.isalab.local/<no User-Password attribute>] (from client enterasys port 31005 cli 00-04-75-18-1B-82) Nov 9 15:30:20 Xradius radius: rad_recv: Access-Request packet from host 141.201.43.115:41722, id=8, length=167 Nov 9 15:30:20 Xradius radius: Sending Access-Reject of id 10 to 141.201.43.115 port 41721 Nov 9 15:30:20 Xradius radius: Reply-Message = "Authentication failed ... no access" Nov 9 15:30:20 Xradius radius: Sending Access-Reject of id 35 to 141.201.43.115 port 41720 Nov 9 15:30:20 Xradius radius: Reply-Message = "Authentication failed ... no access" Nov 9 15:30:20 Xradius radius: Message-Authenticator = 0x59025dcce5cd0abfa5433e98b7716282 Nov 9 15:30:20 Xradius radius: User-Name = "host/it88.isalab.local" Nov 9 15:30:20 Xradius radius: NAS-IP-Address = 141.201.43.115 Nov 9 15:30:20 Xradius radius: Called-Station-Id = "00-E0-63-93-75-B3" Nov 9 15:30:20 Xradius radius: NAS-Port = 31005 Nov 9 15:30:20 Xradius radius: NAS-Port-Id = "fe.3.5" Nov 9 15:30:20 Xradius radius: NAS-Port-Type = Ethernet Nov 9 15:30:20 Xradius radius: Service-Type = Framed-User Nov 9 15:30:20 Xradius radius: Calling-Station-Id = "00-04-75-18-1B-82" Nov 9 15:30:20 Xradius radius: EAP-Message = 0x0201001b01686f73742f697438382e6973616c61622e6c6f63616c Nov 9 15:30:20 Xradius radius: Framed-MTU = 1300 ============================================= Then I've tested a bit with ntlm_auth: 16:11:57 Xradius /etc/raddb [root]ntlm_auth --request-key --domain=ISALAB.LOCAL --username=host/it88.isalab.local password: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) ... so I think this is the wrong request! with: 16:12:38 Xradius /etc/raddb [root]ntlm_auth --request-key --domain=ISALAB.LOCAL --username=it88$ password: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) I get the wrong password, so I think this user/machine is available! any ideas how to go on?!? thanks mIke

1 0

Re: Multiple search contexts in LDAP
by Peter Param 12 Nov '06

12 Nov '06

multiple 'ldap { }' in radiusd.conf? cheers Peter >>> jamesw(a)deakin.edu.au 11/13/06 11:49 AM >>> Peter Param wrote: > hey all, > > I would like to have multiple search contexts to get around ambiguous > search results due to duplicate object names found in branches under the > same basedn = "ou=darlinghurst,ou=nsw,o=myorg,c=au" > > Peter > Hi Peter, You could try using multiple instances of the ldap module, one to search one ou and the other to search the other ou, then invoke them one after the other wherever you currently invoke the single ldap instance. Cheers, -- James Wakefield, Unix Administrator, Information Technology Services Division Deakin University, Geelong, Victoria 3217 Australia. Phone: 03 5227 8690 International: +61 3 5227 8690 Fax: 03 5227 8866 International: +61 3 5227 8866 E-mail: james.wakefield(a)deakin.edu.au Website: http://www.deakin.edu.au - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0

Multiple search contexts in LDAP
by Peter Param 12 Nov '06

12 Nov '06

hey all, I would like to have multiple search contexts to get around ambiguous search results due to duplicate object names found in branches under the same basedn = "ou=darlinghurst,ou=nsw,o=myorg,c=au" For instance, I would like to search ou=people,ou=darlinghurst,ou=nsw,o=myorg,c=au & ou=roles,ou=darlinghurst,ou=nsw,o=myorg,c=au only and not all other branches under the ou=darlinghurst branch. Is this possible? currently I've got set in radiusd.conf for LDAP searches: ldap { server = myldap identity = "cn=superuser,o=myorg,c=au" password = <mypassword> filter = "(cn=%u)" basedn = "ou=darlinghurst,ou=nsw,o=myorg,c=au" #basedn = "ou=people,ou=darlinghurst,ou=nsw,o=schs,c=au" - - } cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1