December 2006 - Freeradius-Users - lists.freeradius.org

RE: DEFAULT access-reject Reply-Message
by Garber, Neal 04 Dec '06

04 Dec '06

> In your code, $RAD_REQUEST{'Module-Failure-Message'} what that variable mean? It means look in the RAD_REQUEST hash for key named 'Module-Failure-Message'. RAD_REQUEST, RAD_CHECK and RAD_REPLY are hashes that rlm_perl creates that contain the request, check and reply attributes respectively. For single-value attributes, you can test the value by referring to the hash name and key name (as above). If the attribute has multiple values, then value for the requested key is an array. > Is there any doc on how to write scripts for radius? FR comes with example.pl which is a sample perl script that can be called by the rlm_perl module. You can also find documentation for rlm_perl at the wiki: http://wiki.freeradius.org/Rlm_perl (the doc. says RAD_CONFIG is a hash that is created, but I believe the code to support that was only recently added..)

2 1

Questions about proxy radius on multihomed host
by Kostas Zorbadelos 04 Dec '06

04 Dec '06

Hello to everyone. I have a question regarding freeradius proxying. My setup is freeradius 1.1.3 on Solaris 9. I have a very simple proxy configuration. The setup is a bit 'weird' in the sense that I have a freeradius server on the machine that acts as a proxy to another radius server running on the same machine (different IP). So the setup is described as Solaris 9 Host ---------------------------------------------- | IP1 IP2 | | Freeradius <---Proxy---> Other Radius | | | ---------------------------------------------- The Solaris host contains 2 IPs, freeradius is configured with the listen directive to accept authentication requests on IP1, while the other server is listening on IP2. In the other radius, I have configured as client the IP1 but I notice several failures. My question is: on a multihomed Solaris host when radius packets are proxied what is their source IP? Is it IP1 or it could also be IP2? I took a look at the sources where I see that in proxy.c a rad_send() is used to actually send the packet. rad_send() uses sendto() unless WITH_UDPFROMTO is defined in which case sendfromto() is used. In my case, WITH_UDPFROMTO is undefined. sendfromto() is defined in freeradius sources with comments that it works on Linux and FreeBSD 5.x. I have not seen any configuration option that sets the source address of outgoing packets, in case of multihomed hosts. There is only the following comment in radiusd.conf: # bind_address: Make the server listen on a particular IP address, and # send replies out from that address. This directive is most useful # for machines with multiple IP addresses on one interface. # # It can either contain "*", or an IP address, or a fully qualified # Internet domain name. The default is "*" # # As of 1.0, you can also use the "listen" directive. See below for # more information. # Can I assume that outgoing packets use as source address the one listed in the listen directive? Thanks in advance, Kostas -- Kostas Zorbadelos m@il contact: kzorba (at) otenet.gr Out there in the darkness, out there in the night out there in the starlight, one soul burns brighter than a thousand suns.

2 3

FreeRadius + Ldap + TLS/SSL
by Rafał Kamiński 04 Dec '06

04 Dec '06

Hello I install freeradius on Debian Sarge machine. I have my user in ldap and I use that directory to auth. them. It's works. But when I want to use TLS in connections between radius and ldap, I have that error in radius log. rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/freeradius/cert/ca.crt rlm_ldap: setting TLS CACert File to /etc/freeradius/cert/ rlm_ldap: setting TLS Require Cert to never rlm_ldap: setting TLS Cert File to /etc/freeradius/cert/radius.crt rlm_ldap: setting TLS Key File to /etc/freeradius/cert/radius.key rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 When i saw that error, i check ldap logs. My ldap is configure with SSL not a TLS. Now i have a problem with configure freeradius to work with SSL ldap not TLS ldap :( I have in radiusd.conf: server = "ldap" port = 636 #port = 389 ... filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" start_tls = no # tls_cacertfile = /path/to/cacert.pem tls_cacertfile = /etc/freeradius/cert/ca.crt # tls_cacertdir = /path/to/ca/dir/ tls_cacertdir = /etc/freeradius/cert/ tls_cacertdir = /etc/freeradius/cert/ # tls_certfile = /path/to/radius.crt tls_certfile = /etc/freeradius/cert/radius.crt # tls_keyfile = /path/to/radius.key tls_keyfile = /etc/freeradius/cert/radius.key #tls_mode = yes I read about SSL in freeradius and i thought that that conf. use SSL to connections with ldap, but i wrong ? Can somebody tell me how i can use SSL auth between ldap and freeradius ? BR. Kamyk

3 3

Error with rlm_perl
by Robert Masse 04 Dec '06

04 Dec '06

Hi, I have the following error when trying to use rlm_perl : Module: Loaded perl /usr/sbin/freeradius: symbol lookup error: /usr/local/lib/rlm_perl-1.1.2.so: undefined symbol: perl_alloc I use freeradius-1.1.2 Thanks for any help. Robert Masse

2 3

Re: unable to compile with openssl libraries
by Stephen Gran 04 Dec '06

04 Dec '06

On Mon, Dec 04, 2006 at 02:21:53PM +1100, Peter Param said: > The following hasn't worked for me either: > > ./configure --with-openssl-includes=/usr/local/ssl/include/ > --with-openssl-libraries=/usr/local/ssl/lib/ On Mon, Dec 04, 2006 at 02:36:52PM +1100, Peter Param said: > no good. when I configure with: > > ./configure --with-openssl-includes=/usr/local/ssl > --with-openssl-libraries=/usr/local/ssl You said you now had the Debian packages installed. Why aren't you just using the path to them? They are /usr/include/openssl and /usr/lib, respectively. -- -------------------------------------------------------------------------- | Stephen Gran | Minicomputer: A computer that can be | | steve(a)lobefin.net | afforded on the budget of a middle- | | http://www.lobefin.net/~steve | level manager. | --------------------------------------------------------------------------

1 0

unsubscribe
by Müller, Holger 04 Dec '06

04 Dec '06

-- CONET Solutions GmbH Holger Müller Theodor-Heuss-Allee 19, 53773 Hennef Tel.: +49 2242-939-482, Fax: +49 2242-939-393 Internet: http://www.conet.de

1 0

FreeRadius and LDAP
by Sundaram Divya-QDIVYA1 04 Dec '06

04 Dec '06

Hi all, I'm trying to configure the server to use LDAP for authentication And am finding the documentation to be less than straightforward. We don't use openldap or eDirectory - which is what the docs are Derived from. The information for FreeRADIUS and LDAP seems to suggest that I need to provide access to the LDAP server's password to the service account that the FreeRADIUS Server uses. What I need to understand is how to integrate FreeRADIUS with an LDAP Server without exposing the (crypted) password hashes. Any pointers on what I need to do for that? I'd be happy to provide updated documentation once I have gotten it working. I'd appreciate any insights. Divya Sundaram ----------------------------- CONDITUR IN PETRA Let us realize that the privilege to work is a gift, that power to work is a blessing, that love of work is success. --David O. McKay ==============================================================

3 2

Re: unable to compile with openssl libraries
by Peter Param 04 Dec '06

04 Dec '06

I've tried that but I get the following errors: debian:~/freeradius-1.1.3# dpkg-buildpackage -b -uc dpkg-buildpackage: source package is freeradius dpkg-buildpackage: source version is 1.1.3-0 dpkg-buildpackage: source changed by Nicolas Baradakis <nicolas.baradakis(a)cegetel.net> dpkg-buildpackage: host architecture i386 dpkg-buildpackage: source version without epoch 1.1.3-0 dpkg-checkbuilddeps: Unmet build dependencies: debhelper (>= 4.2.32) dpatch (>= 2) autotools-dev libtool (>= 1.5) libltdl3-dev libpam0g-dev libmysqlclient15-dev | libmysqlclient14-dev | libmysqlclient-dev libgdbm-dev libldap2-dev libsasl2-dev libiodbc2-dev libkrb5-dev snmp libsnmp9-dev | libsnmp5-dev | libsnmp4.2-dev libpq-dev | postgresql-dev libssl-dev dpkg-buildpackage: Build dependencies/conflicts unsatisfied; aborting. dpkg-buildpackage: (Use -d flag to override.) cheers Peter >>> aland(a)deployingradius.com 12/04/06 1:27 PM >>> Peter Param wrote: > Debian licensing prohibits the installation of openssl as part of its > packaging and hence why i downloaded the individual tarballs to work > around this issue. See the Wiki. There are instructions for building the server on Debian. You do NOT have to play with configure, command-line options, or anything else like that. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Re: unable to compile with openssl libraries
by Peter Param 03 Dec '06

03 Dec '06

no good. when I configure with: ./configure --with-openssl-includes=/usr/local/ssl --with-openssl-libraries=/usr/local/ssl cheers Peter >>> Stephen Gran <steve(a)lobefin.net> 12/04/06 1:42 PM >>> On Mon, Dec 04, 2006 at 01:22:56PM +1100, Peter Param said: > what configure flags should I pass to allow for rlm_eap ...i thought > the defaults should work? You need to pass at least --with-openssl-libraries, I see now. That is probably a bug in the Debian packaging as well. I'll take a look at that shortly. -- -------------------------------------------------------------------------- | Stephen Gran | <aav> coffee on an empty stomach is | | steve(a)lobefin.net | pretty nasy <knghtbrd> aav: time to run | | http://www.lobefin.net/~steve | to the vending machine for cheetos | | | <aav> cheetos? :) | -------------------------------------------------------------------------- ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0

Re: unable to compile with openssl libraries
by Peter Param 03 Dec '06

03 Dec '06

The following hasn't worked for me either: ./configure --with-openssl-includes=/usr/local/ssl/include/ --with-openssl-libraries=/usr/local/ssl/lib/ cheers Peter >>> Stephen Gran <steve(a)lobefin.net> 12/04/06 1:42 PM >>> On Mon, Dec 04, 2006 at 01:22:56PM +1100, Peter Param said: > what configure flags should I pass to allow for rlm_eap ...i thought > the defaults should work? You need to pass at least --with-openssl-libraries, I see now. That is probably a bug in the Debian packaging as well. I'll take a look at that shortly. -- -------------------------------------------------------------------------- | Stephen Gran | <aav> coffee on an empty stomach is | | steve(a)lobefin.net | pretty nasy <knghtbrd> aav: time to run | | http://www.lobefin.net/~steve | to the vending machine for cheetos | | | <aav> cheetos? :) | -------------------------------------------------------------------------- ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

1 0