December 2006 - Freeradius-Users - lists.freeradius.org

Backing up Mysql
by Sarkis Gabriel 10 Dec '06

10 Dec '06

Hi all i started backing up the db using a crontab job early in the morning which backs up everything, but i have had complains from users who try to logon after the backup process. What is the best way to backup an active database with radiusd waiting for connection? Thank you Sarky

6 9

confusion in nas topic!!!!!
by rina maharjan 10 Dec '06

10 Dec '06

hello, i configure freeradiusd server and it is working fine. but i really confuse about nas table and its entry. In my radiusd server ,people can login multiple with same username and password.i couldn't made simultaneouse login =1 at a same time for that similar username. i try so much to made this simutaneouse login =1 but i couldn't so i feel that it that a problem of naslist because i get this kind of messege in radiusd log file when i start the rasdiusd server. i attached this radiusd log file with this posting. regards rina freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: PEAP+MSCHAP+AD (please help) (Phil Mayers) 2. How to pass information between modules? (Martin Gadbois) 3. Re: How to pass information between modules? (Alan DeKok) 4. Re: LDAP->RADIUS Attribute Mapping (Alan DeKok) 5. Re: How to pass information between modules? (Martin Gadbois) 6. Re: Choosing The best replication system. (Sarkis Gabriel) 7. Re: TTLS : where to indicate User/Password ? (Bruno Costacurta) ---------------------------------------------------------------------- Message: 1 Date: Fri, 08 Dec 2006 18:31:37 +0000 From: Phil Mayers Subject: Re: PEAP+MSCHAP+AD (please help) To: FreeRadius users mailing list Message-ID: <4579AF89.3010307(a)imperial.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hector.Ortiz(a)swisscom.com wrote: > Hi there, this is an old issue, but AFAIAC hasn't been solved yet, that's why I'm asking for help with this problem which is driving me crazy. > > > In the first attempt the user has checked the option "Automatically use my Windows logon name and password (and domain if any)", user account is valid in the domain and is not locked out, however user authentication fails. > > In the next attempt the user has unchecked this option, so everytime he connects to the network he has to type his credentials in. After clicking "Connect" he gets access. > > Why if Windows sends the same user information only in the latter case user is able to get in? > > Exec-Program: /opt/samba/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=testuser --challenge=c61ad7019723b68d --nt-response=70fb1b0438208667d0bac6eb895ea8644b413566785d5785 > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > modcall[authenticate]: module "mschap" returns reject for request 7 It failed because the client returned the wrong challenge > Exec-Program: /opt/samba/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=testuser --challenge=aea3ef9fe78f8ac2 --nt-response=8c6a735e29ed7cddb8c02ae601424aca79d115544324731d > Exec-Program output: NT_KEY: 12047FA4AC9D0AA0F53475F2FA2D03AF > Exec-Program-Wait: plaintext: NT_KEY: 12047FA4AC9D0AA0F53475F2FA2D03AF > Exec-Program: returned: 0 > modcall[authenticate]: module "mschap" returns ok for request 16 > modcall: leaving group MS-CHAP (returns ok) for request 16 > MSCHAP Success Whereas that worked. It looks to me as if you've edited the debug output so I can't be sure, but I'd suggest looking at the client - the radius server is configured correctly. Perhaps the client is not in fact logging on to the laptop with the correct username and password. ------------------------------ Message: 2 Date: Fri, 08 Dec 2006 14:02:36 -0500 From: Martin Gadbois Subject: How to pass information between modules? To: FreeRadius users mailing list Message-ID: <4579B6CC.5010406(a)colubris.com> Content-Type: text/plain; charset=UTF-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Let's say I have the following authorize {} section: authorize { ldap sql } What would be the best way to pass information between ldap and sql? For example, if I were to extract a group name from "ldap" and pass it to "sql" to get all the RADIUS attributes associated to this group, what would be the strategy to acheive that? In other words, how to configure those modules if the "ldap" contains the group info, but "sql" the actual RADIUS attribute per group? Thanks! - -- ============== +----------------------------------------------+ Martin Gadbois | "Windows might take you from 0 to 60 faster, | S/W Developer | but to go to 100 you need Unix." | Colubris Networks Inc. +----------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFebbM9Y3/iTTCEDkRAlbtAJ9xef4aCw0IGd5SIJXXn7UxLtUwEACZAf/e hPg7eJ53Xt+PgxSYPpFecPM= =K9c0 -----END PGP SIGNATURE----- ------------------------------ Message: 3 Date: Fri, 08 Dec 2006 11:11:27 -0800 From: Alan DeKok Subject: Re: How to pass information between modules? To: FreeRadius users mailing list Message-ID: <4579B8DF.6030008(a)deployingradius.com> Content-Type: text/plain; charset=UTF-8 Martin Gadbois wrote: > What would be the best way to pass information between ldap and sql? In the same way that all of the other modules do it: Put the information into attributes. That's what the "config item" list is for. > For example, if I were to extract a group name from "ldap" and pass it > to "sql" to get all the RADIUS attributes associated to this group, what > would be the strategy to acheive that? Put it into an attribute in the config items. > In other words, how to configure those modules if the "ldap" contains > the group info, but "sql" the actual RADIUS attribute per group? You can use the "LDAP-Group" attribute, see the rlm_ldap documentation. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog ------------------------------ Message: 4 Date: Fri, 08 Dec 2006 11:21:59 -0800 From: Alan DeKok Subject: Re: LDAP->RADIUS Attribute Mapping To: FreeRadius users mailing list Message-ID: <4579BB57.5040504(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Owen DeLong wrote: > We have historically used the AuthorizedService attribute in LDAP to > control the level > of access available to the user. We would like to continue to do so. > However, in order > for that to work, I need to map AuthorizedService to different RADIUS > attributes in > the response depending on the authentication client. Do it in two steps. Map the AuthorisedService LDAP attribute to a RADIUS attribute (invent a local one, see the dictionary docs), and then depending on the NAS, map that to another attribute. The reason for doing it this way is that the LDAP -> RADIUS attribute mapping is simple, and should be kept simple. > Ideally, I'd like to be able to map RADIUS clients into "groups" and > have a mapping > of AuthorizedService values for each group. The client groups would, > ideally, > be defined by matching the client IP address. An example of what I'd > like that > mapping to look like is below: Use rlm_passwd to map clients to groups (see it's documentation), and then the "users" file to map AuthorizedService to another RADIUS attribute, as described above. > Alan, your flames and RTFM comments are welcome, but, please understand, > I've done my best to RTFM before posting this. As I tell my co-workers, "Remember, there are no stupid questions. There are only stupid people.". And they still speak to me after that. :) Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog ------------------------------ Message: 5 Date: Fri, 08 Dec 2006 15:41:28 -0500 From: Martin Gadbois Subject: Re: How to pass information between modules? To: FreeRadius users mailing list Message-ID: <4579CDF8.5090207(a)colubris.com> Content-Type: text/plain; charset=UTF-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alan DeKok wrote: >> What would be the best way to pass information between ldap and sql? > > In the same way that all of the other modules do it: Put the > information into attributes. That's what the "config item" list is for. My subconscious FreeRADIUS mind was saying that as well; but how to use config items and what makes them different from RADIUS Reply attributes? An theoritical example: modules { file users { ... } file groups { ... } } authorized { users groups } file users: martin User-Password == "gadbois" Group = "staff" file groups: DEFAULT Group == "staff" Reply-Message = "Hello Staff!" I expect this to set "martin" into the "staff" group, and a RADIUS request returns Reply-Message "Hello Staff!!" This does not work: [/etc/raddb/users]:223 WARNING! Check item "Group" ?found in reply item list for user "martin". ?This attribute MUST go on the first line with the other check items Some explaination, a C function or a URL would greatly help! > >> In other words, how to configure those modules if the "ldap" contains >> the group info, but "sql" the actual RADIUS attribute per group? > > You can use the "LDAP-Group" attribute, see the rlm_ldap documentation. I got it now; LDAP-Group is like a callback into the "ldap" module, where the LDAP group is going to be checked to the value. I'll go update the FR LDAP Wiki.. ;-) Thanks Alan for the quick reply. - -- ============== +----------------------------------------------+ Martin Gadbois | "Windows might take you from 0 to 60 faster, | S/W Developer | but to go to 100 you need Unix." | Colubris Networks Inc. +----------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFec349Y3/iTTCEDkRAsgfAJ45vsoHrRKwsPkITrUBuPsFgbGBXACgm1yU gjlFYOPYrcMsN80odSYfAWA= =6TFA -----END PGP SIGNATURE----- ------------------------------ Message: 6 Date: Fri, 8 Dec 2006 22:53:07 +0100 From: "Sarkis Gabriel" Subject: Re: Choosing The best replication system. To: FreeRadius users mailing list Message-ID: <20061208215219.M71831(a)raycon.net> Content-Type: text/plain; charset=iso-8859-1 Anyone out there with some guide or atleast some pitfalls i should try and avoid on Replicating the radius server ? Sarky ---------- Original Message ----------- From: "Sarkis Gabriel" To: FreeRadius users mailing list Sent: Thu, 7 Dec 2006 17:29:22 +0100 Subject: Choosing The best replication system. > Hello all, > > With the way work is and the pops are growing looks like i need to start > centralising the database. > > At the moment i have 4 pops around the country and all are feeding from a > satellite links, as the company is growing it is becoming very hard to > maintain and we are looking to have a central MySQL DB in the UK which feeds > the slave machines with the updated info. > > Each pop will have a live radius / mysql db feeding info back to a master > machine in the UK and that would replicate the info down to the slaves on the > other pops, this is the wishfull thinking i have :). > > I have read about Replication with MySQL (One-Way) and radrelay, then i > noticed there is rlm_slq_log and radsqlrelay. > > One thing I must mention there is a lot of LAG on satellite connection looking > at approx 650ms and because of BW cost we do rely on proxies which makes BW > usage during the day very expensive, so i would like to be able to replicate > maybe once a night lets say at midnight being less busy and cheaper. > > Any one out there with some ideas they can send my way.. > > Thanks > > Sarky > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------- End of Original Message ------- ------------------------------ Message: 7 Date: Sat, 9 Dec 2006 00:12:01 +0100 From: Bruno Costacurta Subject: Re: TTLS : where to indicate User/Password ? To: FreeRadius users mailing list Message-ID: <200612090012.01376.pubmb01(a)skynet.be> Content-Type: text/plain; charset="iso-8859-1" On Monday 04 December 2006 22:21, Alan DeKok wrote: > Bruno Costacurta wrote: > > I'm trying to configure FreeRadius using TTLS (certificate on server side > > only) and MySQL. Client is a Linux laptop using wpa_supplicant. > > I'm in a learning curve regarding 802.1x and FreeRadius and especially > > TTLS. > > That should work without too much effort. > > > Questions: > > - TTLS available authentications are: CHAP,PAP,MS-CHAP,EAP (correct ?) > > Yes. > > > - 'Auth-Type=local' means CHAP,PAP and MS-CHAP (correct ?) > > No, just CHAP and PAP. You shouldn't be using it at all. > > > - for the learning curve : > > --- which is the easiest authentications to start with ? > > PAP. > > > --- MySQL will be removed at the first stage to ease debugging / setup of > > the config (good idea ?) > > Yes. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html Dear Alan, thanks for your answers. Indeed starting from a fresh FreeRadius install, following instructions http://deployingradius.com/documents/configuration/ I'm now able to authenticate via TTLS. Thanks again for attention. Bye, Bruno ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 20, Issue 29 ************************************************ --------------------------------- Access over 1 million songs - Yahoo! Music Unlimited.

2 1

HELP
by Tomas Eduardo Lotina Ramos 09 Dec '06

09 Dec '06

1 0

route_by_callerid
by Pezhman Lali 09 Dec '06

09 Dec '06

Dear I have a cisco2600,voice enabled, with freeradius, for accounting. some of my customers,always dial a same International number . let me know how cisco accepts CALLED-STATION-ID that was sended by radius server. thanks a lot Best Pezhman ____________________________________________________________________________________ Have a burning question? Go to www.Answers.yahoo.com and get answers from real people who know.

1 0

automated response
by nicog 09 Dec '06

09 Dec '06

I will be out of the office from December 11th thru the 13th. If you need immediate assistance please contact support(a)mischoice.com. Thank you,

1 0

TTLS : where to indicate User/Password ?
by Bruno Costacurta 08 Dec '06

08 Dec '06

Hello, I'm trying to configure FreeRadius using TTLS but got confused about the User/Password definiton and/or location as it seems that (please see log hereafter) user is found but not the password. Currently I indicate it in table radcheck in MySQL. radius.log returns me: ... Debug: modcall[authorize]: module "sql" returns ok for request 0 Debug: modcall: leaving group authorize (returns updated) for request 0 Debug: rad_check_password: Found Auth-Type Local Debug: auth: type Local Debug: auth: No User-Password or CHAP-Password attribute in the request Debug: auth: Failed to validate the user. Auth: Login incorrect: [acer9100/<no User-Password attribute>] (from client Olitec402SG port 1 cli 00-12-F0-21-1A-B6 ... file 'radiusd.conf' contains: ... authorize { auth_log chap suffix eap files sql } authenticate { Auth-Type CHAP { chap } unix eap } ... in file 'users' acer9100 Auth-Type := EAP Thanks for any help. Bye, Bruno -- Register Linux User 353844 http://counter.li.org/ --

2 5

How to pass information between modules?
by Martin Gadbois 08 Dec '06

08 Dec '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! Let's say I have the following authorize {} section: authorize { ldap sql } What would be the best way to pass information between ldap and sql? For example, if I were to extract a group name from "ldap" and pass it to "sql" to get all the RADIUS attributes associated to this group, what would be the strategy to acheive that? In other words, how to configure those modules if the "ldap" contains the group info, but "sql" the actual RADIUS attribute per group? Thanks! - -- ============== +----------------------------------------------+ Martin Gadbois | "Windows might take you from 0 to 60 faster, | S/W Developer | but to go to 100 you need Unix." | Colubris Networks Inc. +----------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFebbM9Y3/iTTCEDkRAlbtAJ9xef4aCw0IGd5SIJXXn7UxLtUwEACZAf/e hPg7eJ53Xt+PgxSYPpFecPM= =K9c0 -----END PGP SIGNATURE-----

2 2

LDAP->RADIUS Attribute Mapping
by Owen DeLong 08 Dec '06

08 Dec '06

I have an environment where I am already using LDAP for AAA for a number of things. We have historically used the AuthorizedService attribute in LDAP to control the level of access available to the user. We would like to continue to do so. However, in order for that to work, I need to map AuthorizedService to different RADIUS attributes in the response depending on the authentication client. Ideally, I'd like to be able to map RADIUS clients into "groups" and have a mapping of AuthorizedService values for each group. The client groups would, ideally, be defined by matching the client IP address. An example of what I'd like that mapping to look like is below: Client Group AuthorizedService RADIUS Attribute in Reply ============== ====================== ======================= PIX Group 1 Pix1Auth1 cisco-avpair="shell:priv-lvl=1" PIX Group 1 Pix1Auth7 cisco-avpair="shell:priv-lvl=7" PIX Group 1 Pix1Auth15 cisco-avpair="shell:priv-lvl=15" PIX Group 2 Pix2auth1 cisco-avpair="shell:priv-lvl=1" ... Router Grp 1 Rtr1Auth1 cisco-avpair="shell:priv-lvl=1" ... LB Group 1 LBAdmin Service-Type="Authenticate-Only" ... etc. Is there any way to do this kind of dynamic mapping in FreeRadius? As near as I can tell, all I can do is statically map the contents of a particular LDAP attribute to a single RADIUS attribute. I'd also like to avoid mapping values of AuthorizedService which don't apply to the particular RADIUS client. I'm assuming I probably need to use something like rlm_perl to do this, and, I have no problem doing that, but, I have been unable to decipher the documentation to rlm_perl enough to have any confidence in creating a working solution. If anyone could provide a configuration example or a pointer to documentation that actually describes the various pieces of solving this problem, I'd be very grateful. Alan, your flames and RTFM comments are welcome, but, please understand, I've done my best to RTFM before posting this. Owen

2 1

FreeRadius + Ldap + EAP-TTLS + WPA - Need your help
by Tho Nguyen 08 Dec '06

08 Dec '06

Hello Everyone, I am trying to configure our system to authenticate through LDAP. I have hard time to figure out what cause my system not working. Please view the log and let me know what I can fix. Thanks very much for your help in advance. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 2560 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "before" main: nospace_pass = "before" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "clear" Module: Instantiated pap (pap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "134.29.247.4" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=ldapbs,o=mctc" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "blue" ldap: basedn = "o=mctc" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "memberUid" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x8143ff8 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 120 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/cacert.pem" tls: private_key_password = "(null)" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = yes peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 134.29.241.113:1645, id=21, length=138 User-Name = "nguyenth" Framed-MTU = 1400 Called-Station-Id = "0013.7f9c.4540" Calling-Station-Id = "0090.96a8.4ba8" Service-Type = Login-User Message-Authenticator = 0x52337bcf72211a5860ac267041436532 EAP-Message = 0x0202000d016e677579656e7468 NAS-Port-Type = Wireless-802.11 NAS-Port = 263 NAS-IP-Address = 134.29.241.113 NAS-Identifier = "TestAP-1230" rad_rmspace_pair: User-Name now 'nguyenth' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "nguyenth", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for nguyenth radius_xlat: '(uid=nguyenth)' radius_xlat: 'o=mctc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 134.29.247.4:389, authentication 0 rlm_ldap: bind as cn=ldapbs,o=mctc/blue to 134.29.247.4:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=mctc, with filter (uid=nguyenth) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user nguyenth authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 21 to 134.29.241.113 port 1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7dfc4b2266e4a6b1bb83e9deb151890a Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 134.29.241.113:1645, id=22, length=149 User-Name = "nguyenth" Framed-MTU = 1400 Called-Station-Id = "0013.7f9c.4540" Calling-Station-Id = "0090.96a8.4ba8" Service-Type = Login-User Message-Authenticator = 0x9186ac40b5451c140582accf952af964 EAP-Message = 0x020300060319 NAS-Port-Type = Wireless-802.11 NAS-Port = 263 State = 0x7dfc4b2266e4a6b1bb83e9deb151890a NAS-IP-Address = 134.29.241.113 NAS-Identifier = "TestAP-1230" rad_rmspace_pair: User-Name now 'nguyenth' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "nguyenth", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for nguyenth radius_xlat: '(uid=nguyenth)' radius_xlat: 'o=mctc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=mctc, with filter (uid=nguyenth) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user nguyenth authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 22 to 134.29.241.113 port 1645 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x24998debc7b4e81250bc4802815043b9 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 134.29.241.113:1645, id=23, length=223 User-Name = "nguyenth" Framed-MTU = 1400 Called-Station-Id = "0013.7f9c.4540" Calling-Station-Id = "0090.96a8.4ba8" Service-Type = Login-User Message-Authenticator = 0xe1b509abc0e1c7c6e03b28c2b085372c EAP-Message = 0x0204005019800000004616030100410100003d03014578dbab47aec1acc6aa12b3578cf154ec4d8bdc63f30d0509eda11dbe5d6dd700001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 263 State = 0x24998debc7b4e81250bc4802815043b9 NAS-IP-Address = 134.29.241.113 NAS-Identifier = "TestAP-1230" rad_rmspace_pair: User-Name now 'nguyenth' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "nguyenth", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for nguyenth radius_xlat: '(uid=nguyenth)' radius_xlat: 'o=mctc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=mctc, with filter (uid=nguyenth) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user nguyenth authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A TLS_accept: SSLv3 write certificate A TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 23 to 134.29.241.113 port 1645 EAP-Message = 0x010503201900160301004a020000460301457983f6da9f7ae228ff4e8f219624a0ecc610d7009bd606d54567e8f105c35a20625e0b932be8e4a5e60b4ed079b865e96da2db8feeaefb0db7764fe29daa47fe00040016030102bd0b0002b90002b60002b3308202af30820218a003020102020101300d06092a864886f70d0101050500308190310b3009060355040613025553310b3009060355040813024d4e311430120603550407130b4d696e6e6561706f6c6973310d300b060355040a13044d435443310c300a060355040b1303495453311630140603550403130d467265657261646975732043413129302706092a864886f70d010901161a74 EAP-Message = 0x686f2e6e677579656e406d696e6e6561706f6c69732e656475301e170d3036313131353230313835375a170d3136313131323230313835375a308190310b3009060355040613025553310b3009060355040813024d4e311430120603550407130b4d696e6e6561706f6c6973310d300b060355040a13044d435443310c300a060355040b1303495453311630140603550403130d467265657261646975732043413129302706092a864886f70d010901161a74686f2e6e677579656e406d696e6e6561706f6c69732e65647530819f300d06092a864886f70d010101050003818d0030818902818100d95e830f5ee64dd1200530e83fef1e1453ea41fa EAP-Message = 0x89cf579e33536c4e393d259d6067f1a29416bf58a40780264b5bb4e8b4cafc4424bc5385ddf6922953ceca1e089cab0e836eb2473c7b1b5cb895020f028bff4b484b55a73ea467f70cb81e34114ca9338ad9652a09710927e1d91beaa88675886bd28f128cb50555408ccb250203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181003f7e3553d683d1deafc1f78df534b19723c4e17e371b0062c2c7cbe70a3e9447cae190ade2bbe2739f052bffd86355764ee0dc9dcbd4c621d44496e777250410f52dd576335acef5757f3d7777d4d211b9194aa72d567dbd76842a81b466f690 EAP-Message = 0x10f132fbe9669c8116b4c045b9f18abe42a83a623ed026dd5443b01f5a1b473d16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe49fded8f29186fb0b0b9ef766db17f4 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 134.29.241.113:1645, id=24, length=149 User-Name = "nguyenth" Framed-MTU = 1400 Called-Station-Id = "0013.7f9c.4540" Calling-Station-Id = "0090.96a8.4ba8" Service-Type = Login-User Message-Authenticator = 0x725ba5a11789db0be97bcbc7658b656c EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 263 State = 0xe49fded8f29186fb0b0b9ef766db17f4 NAS-IP-Address = 134.29.241.113 NAS-Identifier = "TestAP-1230" rad_rmspace_pair: User-Name now 'nguyenth' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "nguyenth", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for nguyenth radius_xlat: '(uid=nguyenth)' radius_xlat: 'o=mctc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=mctc, with filter (uid=nguyenth) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user nguyenth authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: No SSL info available. Waiting for more SSL data. eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 24 to 134.29.241.113 port 1645 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd5e9afceeb8c7e9157b88cd7da19719 Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 21 with timestamp 457983f6 Cleaning up request 1 ID 22 with timestamp 457983f6 Cleaning up request 2 ID 23 with timestamp 457983f6 Cleaning up request 3 ID 24 with timestamp 457983f6 Nothing to do. Sleeping until we see a request.

2 1

compile problem on tru64
by Matthias Henze 08 Dec '06

08 Dec '06

hi, i try to build freeradius 1.1.3 on tru64. at first every thing worked as expected. near the end of the buildprocess i get the following message i'm unable to interpret: creating .libs/radiusdS.c (cd .libs && gcc -pthread -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/exec.o .libs/files.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/nas.o .libs/proxy.o .libs/radiusd.o .libs/radius_snmp.o .libs/request_list.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/timestr.o .libs/xlat.o -lresolv ../lib/.libs/libradius.so /usr/local/lib/libltdl.so __pthread_cancel sem_post pthread_sigmask sem_wait sem_init collect2: ld returned 1 exit status make[4]: *** [radiusd] Error 1 i'm using gcc 3.4.6. please help. TIA -- Matthias Henze matthias(a)mhcsoftware.de Use PGP!! http://www.mhcsoftware.de/MatthiasHenze.asc - - - - - - - - - - - - - - - - - - - - - - - - - - - MHC SoftWare GmbH voice: +49-(0)9533-92006-0 Fichtera 17 fax: +49-(0)9533-92006-6 96274 Itzgrund/Germany e-Mail: info(a)mhcsoftware.de - - - - - - - - - - - - - - - - - - - - - - - - - - -

1 1