November 2006 - Freeradius-Users - lists.freeradius.org

trivial problem?
by Yans van Horn 24 Nov '06

24 Nov '06

Hello, I'm fairly new to freeradius so to some my problem may seem trivial, but ... I'm trying to get EAP-TLS to work, and when using "file" setup everything works as it's suppose to - only selected users can authorize after meeteing check criteria. When i switch to SQL (postgresql) it seems that no matter what i insert to radcheck and radreply tables *any user (if he has valid cert) can authorize without any problems* :-( Can anybody shed some light on this issue ? My configuration: ### USERS ### "ajax" Auth-Type := EAP, Calling-Station-Id == "some-valid-mac" # "ajax" Auth-Type := EAP, Calling-Station-Id == "some-invalid-mac" DEFAULT Auth-Type := Reject Reply-Message = "ACCESS DENIED" ### SQL ### radius=> select * from radcheck; id | username | attribute | op | value -----+----------+--------------------+----+--------------- 410 | ajax | Auth-Type | := | EAP 411 | ajax | Calling-Station-ID | == | some-INVALID-mac 412 | DEFAULT | Auth-Type | := | Reject (3 rows) radius=> select * from radreply; id | username | attribute | op | value ----+----------+---------------+----+--------------- 3 | DEFAULT | Reply-Message | = | ACCESS DENIED (1 row) All other tables are _empty_ ### postgresql.conf ### Is a default postgresql.conf from freeradius (with database connection settings set) ### radiusd.conf ### authorize { preprocess suffix eap sql # files } authenticate { eap } -- best regards, Marcin 'Yans' Bazarnik

2 9

Compiling 1.1.3
by Matthew Green 23 Nov '06

23 Nov '06

Hello, I am trying to compile 1.1.3 on Mac OS X so FreeRADIUS will work with PostgreSQL 8.3 as it does not have libpq.3.dylib but libpq.4.1.dylib but I get the following error: Making all in rlm_perl... /Users/mat/Desktop/freeradius-1.1.3/libtool --mode=link gcc -release 1.1.3 \ -module -export-dynamic -o rlm_perl.la \ -rpath /usr/local/freeRADIUS/lib rlm_perl.lo rlm_perl.c /Users/mat/Desktop/freeradius-1.1.3/src/lib/libradius.la \ `perl -MExtUtils::Embed -e ldopts` -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a is not portable! rm -fr .libs/rlm_perl-1.1.3.so .libs/rlm_perl.a .libs/rlm_perl.so gcc ${wl}-flat_namespace ${wl}-undefined ${wl}suppress -o .libs/rlm_perl-1.1.3.so -bundle .libs/rlm_perl.o /Users/mat/Desktop/freeradius-1.1.3/src/lib/.libs/libradius.dylib -L/usr/local/lib /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a -L/System/Library/Perl/5.8.6/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lc -lresolv -lpthread (cd .libs && rm -f rlm_perl.so && ln -s rlm_perl-1.1.3.so rlm_perl.so) ar cru .libs/rlm_perl.a /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a rlm_perl.o /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (7) cpusubtype (3) is not an object file (bad magic number) ar: internal ranlib command failed make[6]: *** [rlm_perl.la] Error 1 make[5]: *** [common] Error 2 make[4]: *** [all] Error 2 make[3]: *** [common] Error 2 make[2]: *** [all] Error 2 make[1]: *** [common] Error 2 make: *** [all] Error 2 Any ideas why? Thanks in advance Mat

2 6

Using different authentication methods according to realm
by Romain Guilleret 23 Nov '06

23 Nov '06

Hi, We are are currently moving our RADIUS server from Radiator to Freeradius. With Radiator, you can select the authentication method used, according to realm. In our case, each realm is authenticated using MySQL, but with a different database according to the realm. HOw can I do the same thing with Freeradius ?

2 1

FreeRadius working as proxy Radius for RSA ACE Server
by Luis 23 Nov '06

23 Nov '06

Hi there, Is there anyone with experience with FreeRadius working as proxy for the RSA ACE Server? Regards. -- Luis infotech(a)tryoutlinux.com

2 1

Getting the domain/realm
by Pshem Kowalczyk 23 Nov '06

23 Nov '06

Hi, I would like to proxy on a realm/domain basis. Users log in with standard username(a)domain.com logins, so this should be relatively straightforward, the problem is that most of the providers that we serve uses a lot of domains (and we have a few providers as well). Which makes the proxy.conf file really long and ugly (as in most cases there are 2-3 servers we proxy to for every domain) and many information simply overlaps. Is there a way to extract the realm and put it into a different attribute and then proxy on it's basis? so for example user(a)domain.com is logging in, i set My-Domain := domain.com and then in users file DEFAULT My-Domain == 'domain.com', Proxy-To-Realm := domains-realm is there a way of doing this? regards pshemko

2 1

Script to auth. users and control the remote phone number used
by Luis 23 Nov '06

23 Nov '06

Hi again, Can anyone tell me if it is possible to control the authentication process using the remote telephone number used by the user? Thanks again :D -- Luis infotech(a)tryoutlinux.com

2 2

RE: Script to auth. users and control the remote phone number used
by Cihan DEMİR 23 Nov '06

23 Nov '06

Hi, Yes it is possible. Try to add "Calling-Station-Id" parameter. Cihan. -----Original Message----- From: freeradius-users-bounces+cihan.demir=omsan.com.tr(a)lists.freeradius.org [mailto:freeradius-users-bounces+cihan.demir=omsan.com.tr@lists.freeradius.org] On Behalf Of Luis Sent: Thursday, November 23, 2006 1:32 PM To: freeradius-users(a)lists.freeradius.org Subject: Script to auth. users and control the remote phone number used Hi again, Can anyone tell me if it is possible to control the authentication process using the remote telephone number used by the user? Thanks again :D -- Luis infotech(a)tryoutlinux.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------------------------------------------------------------- Omsan'in sundugu hizmetleri nasil degerlendiriyorsunuz? Görüsleriniz bizim için degerli. Aldiginiz hizmetin beklentilerinizi ve ihtiyaçlarinizi ne ölçüde karsiladigi konusunda benimle irtibata geçebilir veya pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr veya innovate(a)omsan.com.tr adreslerine e-mail gönderebilirsiniz. How do you evaluate the services of Omsan? Your opinions are valuable for us. You can contact me or send an e-mail to , pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr or innovate(a)omsan.com.tr to inform us about the extent to which the services provided fulfill your expectations and needs. -------------------------------------------------------------------------------- Bu e-posta mesaji kisiye özel olup, gizli bilgiler içeriyor olabilir. Eger bu e-posta mesaji size yanlislikla ulasmissa, içerigini hiç bir sekilde kullanmayiniz ve ekli dosyalari açmayiniz. Bu durumda lütfen e-posta mesajini kullaniciya hemen geri gönderiniz ve tüm kopyalarini mesaj kutunuzdan siliniz. Bu e-posta mesaji, hiç bir sekilde, herhangi bir amaç için çogaltilamaz, yayinlanamaz ve para karsiligi satilamaz. Bu e-posta mesaji virüslere karsi anti-virüs sistemleri tarafindan taranmistir. Ancak yollayici, bu e-posta mesajinin - virüs koruma sistemleri ile kontrol ediliyor olsa bile - virüs içermedigini garanti etmez ve meydana gelebilecek zararlardan dogacak hiçbir sorumlulugu kabul etmez. This message is intended solely for the use of the individual or entity to whom it is addressed, and may contain confidential information. If you are not the intended recipient of this message or you receive this mail in error, you should refrain from making any use of the contents and from opening any attachment. In that case, please notify the sender immediately and return the message to the sender, then, delete and destroy all copies. This e-mail message, can not be copied, published or sold for any reason. This e-mail message has been swept by anti-virus systems for the presence of computer viruses. In doing so, however, sender cannot warrant that virus or other forms of data corruption may not be present and do not take any responsibility in any occurrence.

1 0

problem with starting radiusd
by Herman Swensson 22 Nov '06

22 Nov '06

I am using freeradius version 1.1.0 When I start radiusd –X then it works , I can log in ps aux | grep radiusd radius 24504 0.4 0.5 6712 2968 pts/1 S 21:50 0:00 radiusd -X root 24508 0.0 0.1 3872 728 pts/0 S 21:50 0:00 grep radiusd When I start it as radiusd Wed Nov 22 21:49:34 2006 : Info: Starting - reading configuration files ... But I can not log in ps aux | grep radiusd root 24512 0.0 0.1 3736 708 pts/0 R 21:51 0:00 grep radiusd what do I wrong regards, Herman -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.430 / Virus Database: 268.14.12/544 - Release Date: 21-11-2006 16:59

2 1

mysql driver compile problem
by Christopher Carver 22 Nov '06

22 Nov '06

Platform is Ubuntu Linux 6.06 server i386 with kernel version 2.6.15-23. Software is Freeradius 1.1.3 and MySQL 4.1.21. The problem is that the Freeradius configure script will not detect the existance of the mysqlclient_r library and subsequently fails to build the rlm_sql_mysql driver despite my use of the --with-mysql-lib-dir directive. The configure line: ./configure --prefix=/usr/local/pw/freeradius-1.1.3 --with-mysql-lib-dir=/usr/local/lib/mysql >From the configure output: checking for mysql_init in -lmysqlclient_r (using mysql_config)... no checking for mysql_init in -lmysqlclient_r... no configure: WARNING: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql.h (using mysql_config)... yes configure: WARNING: sql submodule 'mysql' disabled configure: creating ./config.status A listing of the lib dir: # ls -l /usr/local/lib/mysql/libmysqlclient_r* -rw-r--r-- 1 root root 1462324 2006-11-14 02:23 /usr/local/lib/mysql/libmysqlclient_r.a -rw-r--r-- 1 root root 1395548 2006-11-13 22:44 /usr/local/lib/mysql/libmysqlclient_r.so.15 -rw-r--r-- 1 root root 1395548 2006-11-13 22:44 /usr/local/lib/mysql/libmysqlclient_r.so.15.0.0 Some evidence of the existance of the referenced function in that library: # file /usr/local/lib/mysql/libmysqlclient_r.so.15 /usr/local/lib/mysql/libmysqlclient_r.so.15: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), stripped # strings /usr/local/lib/mysql/libmysqlclient_r.so.15 | grep mysql_init mysql_init Any ideas? Thanks, Chris Carver Network Engineer

2 1

problem after upgrading
by basile 22 Nov '06

22 Nov '06

i upgrade freeradius , and now when i try to authenticate with user in an ldap directory , ldap section good passed and after i have auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. what it means thanks for help because nothing work basile

1 0