March 2006 - Freeradius-Users - lists.freeradius.org

RADTEST
by Atkins, Dwane P 23 Mar '06

23 Mar '06

I cannot get the radtest to work and this seems to be an integral part of continuing. I can now do a mysql -u radius -p radius and get into mysql. Resetting the password and FLUS PRIVILEGES helped there. I have created a user, atkinsd, on the radius database in radcheck. If I do a radtest atkinsd cisco123 localhost 1645 SHARED, I still get the same error. Why? [root@cleveland raddb]# radtest atkinsd cisco123 localhost 1812 xxxxx (I have tried both 1645 and 1812 with no luck) Sending Access-Request of id 225 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "cisco123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 225 to 127.0.0.1 port 1812 User-Name = "atkinsd" User-Password = "cisco123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=225, length=20 rad_decode: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) [root@cleveland raddb]#

2 1

RE : Failed Compilation of Freeradius with Mysql since 1.1.0 (Works on 1.0.5)
by Philippe JOYEZ 23 Mar '06

23 Mar '06

Hi all, As suggested by Michael, I've recompiled Mysql with --enable-thread-safe-client and now it works. Thanks to Michael Best regards, -- Disclaimer ------------------------------------ Ce message ainsi que les eventuelles pieces jointes constituent une correspondance privee et confidentielle a l'attention exclusive du destinataire designe ci-dessus. Si vous n'etes pas le destinataire du present message ou une personne susceptible de pouvoir le lui delivrer, il vous est signifie que toute divulgation, distribution ou copie de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expediteur par telephone ou de lui retourner le present message, puis d'effacer immediatement ce message de votre systeme. *** This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender by phone or by replying this message, and then delete this message from your system.

1 0

Multiple responses per user, based on NAS
by John Mylchreest 23 Mar '06

23 Mar '06

Hi guys, I’m currently mulling over two important things for us. Before I state the problems though, any input would certainly be appreciated and also that we have this working at the moment, but it did require a schema change to support. 1: How would radius be able to respond with a different fixed IP address (or a set/subset of other attributes) from radreply, based on the NAS the user connected from? 2: why would you Proxy-To-Realm and point it to a different instance/box, instead of handle it all within the local realm? Ie: Why is handing off the request a good thing, instead of building the functionality into the LOCAL realm. I have my own opinions on this, but I’d like some group input. Currently we have a nasty hack where in the radreply we have an additional field which links to the NAS. In the SQL query (this is all sql backed) we link the NAS field to the real NAS and therefore selectively respond with a different fixed IP, or set of attributes. This as stated, requires a schema hack and I would like to support it without. How would you go about it? For the record, the same goes against radgroupcheck/reply but that should follow suit with any solution. Any suggestions welcome, Cheers. John -- John Mylchreest ioko T: +44 (0)1904 438000 x324 M: +44 (0)7730 529047 E: john.mylchreest(a)ioko.com Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Authentication with LDAP
by fvt3 23 Mar '06

23 Mar '06

Question, How do you hide password that is sent to LDAP so it will not show up in the log and in debug mode ..Thanks in advance __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

RE: Error building version 1.1.1
by Sandworm 23 Mar '06

23 Mar '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Nicolas Baradakis wrote: >But the next line shows that installation is done in the parent >directory /var/tmp/freeradius-root/usr. That is what I am seeing. Files are being created in the parent directory (see below), but the symlink is being attempted from lib directory which does not exist. [rdev@e15 usr]# pwd /var/tmp/freeradius-root/usr [rdev@e15 usr]# ls bin libradius-1.1.1.so libradius.a libradius.la libradius.so sbin share -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkQglL8ACgkQmw4BJyaatJ2O/ACgrSMol1U1pxGJKWfe18MYcHW1MaoA n0w8lr3c+EyDX4R7DLhLYcTaQ8v0 =2Zi1 -----END PGP SIGNATURE-----

6 8

Re: Error building version 1.1.1
by Frank Büttner 23 Mar '06

23 Mar '06

That is not possible, because I use rpmbuild. I it only possible to patch the sources. But what have changed?? 1.1.0 will work without any problems!!! Nicolas Baradakis schrieb: > Frank Büttner wrote: > >> Ok now compiling works, but at make install I get another error: >> ln -s libradius.la /var/tmp/freeradius-1.1.1-Frank-buildroot/usr/lib/libradius-1.1.1.la >> ln: creating symbolic link `/var/tmp/freeradius-1.1.1-Frank-buildroot/usr/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory > > Now it's the same error as posted yesterday by someone else. I don't > know exactly how to fix the bug because I've no problem to build a > Debian package. > > Could you please try if the following patch fixes the problem? > > Index: src/lib/Makefile > =================================================================== > RCS file: /source/radiusd/src/lib/Makefile,v > retrieving revision 1.20.4.3 > diff -u -r1.20.4.3 Makefile > --- src/lib/Makefile 10 Feb 2006 19:47:04 -0000 1.20.4.3 > +++ src/lib/Makefile 21 Mar 2006 17:19:21 -0000 > @@ -48,6 +48,6 @@ > rm -rf .libs > > install: all > - $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir) > + $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir)/$(TARGET).la > rm -f $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la; > ln -s $(TARGET).la $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la > Index: src/modules/rlm_eap/libeap/Makefile > =================================================================== > RCS file: /source/radiusd/src/modules/rlm_eap/libeap/Makefile,v > retrieving revision 1.1.4.2 > diff -u -r1.1.4.2 Makefile > --- src/modules/rlm_eap/libeap/Makefile 10 Feb 2006 19:47:09 -0000 1.1.4.2 > +++ src/modules/rlm_eap/libeap/Makefile 21 Mar 2006 17:19:21 -0000 > @@ -38,6 +38,6 @@ > rm -rf .libs > > install: all > - $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir) > + $(LIBTOOL) --mode=install $(INSTALL) -c $(TARGET).la $(R)$(libdir)/$(TARGET).la > rm -f $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la; > ln -s $(TARGET).la $(R)$(libdir)/$(TARGET)-$(RADIUSD_VERSION).la > >

3 2

Freeradius ip allocation.
by Ashwin Gobind 23 Mar '06

23 Mar '06

Is it possible to use freeradius to dynamically allocate ip adrreses from predefined pools. I want to assign an ip address from a specific set of pools, which pool to use is to be determined by the NAS Identifier & the Called-Station-Id of the AccessRequest. Also to throw another complication in, these ip's should be consistent over 3 radius servers that are load balanced. Thanks �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.co.za/legal/email.jsp "

3 2

Error message when using Simultaneous-use with EAP
by JVUVANT Yahoo 23 Mar '06

23 Mar '06

Hi all I'm trying to use Simultaneous-Use to limit sessions connexions, but I havre following message: ... [/usr/local/etc/raddb/users]:217 WARNING! Check item "Simultaneous-Use" ?found in reply item list for user "jvuvant". ?This attribute MUST go on the first line with the other check items ... Someone can help me ? Here is users configuration file for this account: Jvuvant Auth-Type := EAP, User-Password =="ayati" Simultaneous-Use=1 Other question How to use freeradius with Mysql ? Thanks Jacques ___________________________________________________________________________ Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international. Téléchargez sur http://fr.messenger.yahoo.com

2 1

user not found in freeradius "users" file
by Bertrand Poulet 23 Mar '06

23 Mar '06

hello all , i've got a vpn server which make authentication to a freeradius server. the user "someone" is authenticated (file users of freeradius) when tested locally via radtest, but not when the request comes from nas box in first case , the user is found in file users of freeradius at line 227 , and in the second case the same user isn't found in file. instead, the user is searched in system (/etc/passwd). why the user isn't found in file users of freeradius ? thanks . root@gringo raddb]# radtest someone thepass localhost 0 secret Sending Access-Request of id 161 to 127.0.0.1 port 1812 User-Name = "someone" User-Password = "thepass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Request packet from host 127.0.0.1:35045, id=161, length=59 User-Name = "someone" User-Password = "thepass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 rlm_realm: No '@' in User-Name = "someone", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry someone at line 227 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found *Auth-Type Local* auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [someone/thepass] (from client localhost port 0) Sending Access-Accept of id 161 to 127.0.0.1 port 35045 ====================================================== root@gringo raddb]# rad_recv: Access-Request packet from host 192.168.10.1:1025, id=181, length=156 User-Name = "someone" User-Password = "thepass" NAS-Port = 546 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "191.254.137._" Calling-Station-Id = "66.147.66.24_" Tunnel-Client-Endpoint:0 = "66.147.66.24_" NAS-IP-Address = 192.168.10.1 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=66.147.66.24_" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' Invalid operator for item Suffix: reverting to '==' modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 rlm_realm: No '@' in User-Name = "someone", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found *Auth-Type System* auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: leaving group authenticate (returns notfound) for request 2 auth: *Failed *to validate the user.

3 3

Tagged Vlans
by radhika putty 23 Mar '06

23 Mar '06

Hi All, Does Free Radius support tagging of VLAN's --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.

2 1