March 2006 - Freeradius-Users - lists.freeradius.org

Re: RADTEST
by Atkins, Dwane P 29 Mar '06

29 Mar '06

Alan and all, Thanks for your help. Here is an issue that I cannot get worked out. However, if I run the > mysql -u radius -p radius command it will take me right to the radius database so it is working (right?) sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Then tell the server to use that password instead of the Unix module Where is this process at? I cannot find it in the Radius book I bought. Thanks Dwane Message: 3 Date: Thu, 23 Mar 2006 14:30:00 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: RADTEST To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20060323193001.1C92716CC1(a)mail.nitros9.org> "Atkins, Dwane P" <ATKINSD(a)uthscsa.edu> wrote: > I have looked at the radius.log file Don't. Run the server in debugging mode. > Thu Mar 23 12:47:48 2006 : Auth: rlm_unix: [atkinsd]: invalid password The Unix module says that the password is wrong, or the user doesn't exist in /etc/passwd. > But I have it in radcheck and can prove it. Then tell the server to use that password instead of the Unix module. Alan DeKok. Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

3 6

(no subject)
by Mark Supersonik 29 Mar '06

29 Mar '06

Hi friends! I speak from the tongue of an engineering student in a research group trying to implement a RADIUS proxy system. My doubt is: can a freeradius server do first an authorization of a request throught a DB (i.e MySQL) and proxy then if so or reject it (if all isn't in rule)? I mean, summarizing: Can a request be authenticated/authorized for two times? We want only to accept access if each one of the two servers process the authentication successfully. Thanks in advance for all the support you can give us, hope to hear from you Marc (Nets Research Group [Pompeu Fabra University]) _________________________________________________________________ ¿Estás pensando en cambiar de coche? Todas los modelos de serie y extras en MSN Motor. http://motor.msn.es/researchcentre/

1 0

Upgrade Freeradius
by Paulo Cabrita 29 Mar '06

29 Mar '06

Hello. I have a network where wireless users use the freeradius to authenticate via OpenLDAP (in an another box) I recently installed the 1.1.0 version using last version of the SLES for OS and everything worked well. I did the following: ./configure --with-openssl-includes=/usr/local/openssl/include --with-openssl-libraries=/usr/local/openssl/lib --prefix=/usr/local/radius --with-rlm-ldap-lib-dir=/usr/local/openldap/lib/ --with-rlm-ldap-include-dir=/usr/local/openldap/include/ make make install Before, I installed openssl (0.9.8a) like this: ./config --prefix=/usr/local/openssl shared make make install From the radiusd.conf I have: ... ldap { server = "192.168.2.4" port = 636 basedn = "ou=users,dc=ual,dc=pt" filter = "(mail=%{User-Name})" start_tls = no access_attr = "radiusClientIPAddress" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 30 timeout = 60 timelimit = 60 net_timeout = 60 } ... It runs perfectly well but when it received a request from a client, I have the following error: Error: rlm_ldap: could not set LDAP_OPT_X_TLS option Success Using "clear" comunication (ldap://), it works well, so I definitively have a problem with TLS/SSL. I have the same configuration in an another box using freeradius 1.0.5 and it works fine. Any idea? TIA -- Atentamente, ------------------------------------ |Paulo Cabrita, Msc | |Director do Centro de Informática | |da Universidade Autónoma de Lisboa| |Tel: +351-213177635 | |Fax: +351-213533702 | |E-mail: pjc(a)ual.pt | ------------------------------------

1 0

v1.1.1 build problems (SSL, EAP)
by Bill Roberts 29 Mar '06

29 Mar '06

Hi, I'm just posting my experiences in building v1.1.1 in case it is of use to anyone else with similar problems. My system is Solaris 10 Sparc, Freeradius v1.1.1, OpenSSL 0.9.8a, Sun compiler version 5.7 (SunStudio 10). I ran configure like this: ./configure --with-raddbdir=/usr/local/etc/raddb --with-openssl-includes=/usr/local/ssl/include --with-openssl-libraries=/usr/local/ssl/lib (OpenSSL 0.9.8a is installed in /usr/local/ssl) In the midst of the configure output I saw this: configure: warning: skipping test for openssl/ssl.h This ultimately caused compilation errors in rlm_eap_peap.c: "../../libeap/eap_tls.h", line 138: syntax error before or at: SSL "../../libeap/eap_tls.h", line 141: syntax error before or at: BIO "../../libeap/eap_tls.h", line 186: syntax error before or at: SSL "../../libeap/eap_tls.h", line 186: warning: undefined or missing type for: SSL "../../libeap/eap_tls.h", line 187: warning: undefined or missing type for: cons When I investigated by looking at the config.log there was a "not found" error for libcrypto. It turns out that the configure script has this line in the "test for libcrypto" section: LIBS="-lcrypto $LIBS" In my case, this expands to: -lcrypto -L/usr/local/ssl/lib .....<other stuff deleted>.... Which means libcrypto is not found because it is listed before the -L directive telling the compiler where it can be found. OK, easy fix, so I edit configure and change the LIBS line to be "$LIBS -lcrypto". This gets me past the libcrypto test but the scsript then fails the next test for libssl and I can't use the same fix (I suspect for reasons related to library order). In the end I decide to fudge the crypto and ssl tests by removing the DH_new(); and SSL_new(); calls from the conftest C programs. Everything then builds OK until rlm_perl.c when I see: "rlm_perl.c", line 165: syntax error before or at: CV I found an article on the FreeRadius users mailing list archive ( http://www.archivesat.com/FreeRadius_users_mailing_list/thread357241.htm ) about rlm_eap compilation problems where it was suggested that removing the rlm_eap directory would allow the build to finish and the server to run. So I removed src/modules/rlm_perl and src/modules/rlm_eap and I now have a running server. Regards, Bill Roberts

2 1

Installed freeradius v1.1.1 ok but running got "Floating point exception"?
by Albert Lin 29 Mar '06

29 Mar '06

Hi! My Linux: uname -a Linux ANVL-Workstation 2.4.20-8smp #1 SMP Thu Mar 13 17:45:54 EST 2003 i686 i686 i386 GNU/Linux [root@ANVL-Workstation etc]# radiusd -X Floating point exception Any help? Thanks! __Albert SPECIAL NOTICE All information transmitted hereby is intended only for the use of the addressee(s) named above and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution of confidential and privileged information is prohibited. If the reader of this message is not the intended recipient(s) or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that you must not read this transmission and that disclosure, copying, printing, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. Anyone who receives confidential and privileged information in error should notify us immediately by telephone and mail the original message to us at the above address and destroy all copies. To the extent any portion of this communication contains public information, no such restrictions apply to that information. (gate01)

4 3

Compile errors in Freeradius-1.1.1
by Alan 29 Mar '06

29 Mar '06

I am currently trying to compile the new version of FreeRadius 1.1.1. I've used the same configure statement just like in 1.1.0 and for some reason I am receiving a few build errors. Please help. ~Alan ---- OS: Red Hat Enterprise v.3 (2.4.21-4.EL 32bit) Configure Statement: ./configure --prefix=/custom/freeradius-1.1.1 \ --without-rlm_x99_token \ --without-rlm_krb5 \ --without-rlm_sql_postgresql \ -without-rlm_sql_oracle After running "make install" the ls command shows a few weird symlinks in the install directory: [johnny5@sip][09:37:34 Tue Mar 28]-[/custom/freeradius-1.1.1] $ ls total 436 drwxr-xr-x 2 root root 4096 Mar 28 09:34 bin drwxr-xr-x 3 root root 4096 Mar 28 09:34 etc -rwxr-xr-x 1 root root 170033 Mar 28 09:36 libradius-1.1.1.so -rw-r--r-- 1 root root 233620 Mar 28 09:36 libradius.a -rwxr-xr-x 1 root root 749 Mar 28 09:36 libradius.la lrwxrwxrwx 1 root root 18 Mar 28 09:36 libradius.so -> libradius-1.1.1.so drwxr-xr-x 5 root root 4096 Mar 28 09:34 man drwxr-xr-x 2 root root 4096 Mar 28 09:34 sbin drwx------ 3 root root 4096 Mar 28 09:34 share drwxr-xr-x 4 root root 4096 Mar 28 09:34 var Output error after running "make install": [johnny5@sip][09:36:43 Tue Mar 28]-[~/freeradius-1.1.1] $ sudo make install /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/sbin /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/bin /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/etc/raddb /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/man /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/var/run/radiusd /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 700 /custom/freeradius-1.1.1/var/log/radius /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 700 /custom/freeradius-1.1.1/var/log/radius/radacct /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 700 /custom/freeradius-1.1.1/share /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/share/freeradius for i in 1 5 8; do \ /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/man/man$i; \ for p in man/man$i/*.$i; do \ /home/johnny5/freeradius-1.1.1/install-sh -c -m 644 $p /custom/freeradius-1.1.1/man/man$i; \ done \ done gmake[1]: Entering directory `/home/johnny5/freeradius-1.1.1' Making install in src... gmake[2]: Entering directory `/home/johnny5/freeradius-1.1.1/src' gmake[3]: Entering directory `/home/johnny5/freeradius-1.1.1/src' Making install in include... gmake[4]: Entering directory `/home/johnny5/freeradius-1.1.1/src/include' gmake[4]: Nothing to be done for `install'. gmake[4]: Leaving directory `/home/johnny5/freeradius-1.1.1/src/include' Making install in lib... gmake[4]: Entering directory `/home/johnny5/freeradius-1.1.1/src/lib' /home/johnny5/freeradius-1.1.1/libtool --mode=install /home/johnny5/freeradius-1.1.1/install-sh -c -c libradius.la /custom/freeradius-1.1.1/lib /home/johnny5/freeradius-1.1.1/install-sh -c -c .libs/libradius-1.1.1.so /custom/freeradius-1.1.1/libradius-1.1.1.so (cd /custom/freeradius-1.1.1 && rm -f libradius.so && ln -s libradius-1.1.1.so libradius.so) /home/johnny5/freeradius-1.1.1/install-sh -c -c .libs/libradius.lai /custom/freeradius-1.1.1/libradius.la /home/johnny5/freeradius-1.1.1/install-sh -c -c .libs/libradius.a /custom/freeradius-1.1.1/libradius.a ranlib /custom/freeradius-1.1.1/libradius.a chmod 644 /custom/freeradius-1.1.1/libradius.a libtool: install: warning: remember to run `libtool --finish /custom/freeradius-1.1.1/lib' rm -f /custom/freeradius-1.1.1/lib/libradius-1.1.1.la; ln -s libradius.la /custom/freeradius-1.1.1/lib/libradius-1.1.1.la ln: creating symbolic link `/custom/freeradius-1.1.1/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/home/johnny5/freeradius-1.1.1/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/johnny5/freeradius-1.1.1/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/home/johnny5/freeradius-1.1.1/src' gmake[1]: *** [common] Error 2 make: *** [install] Error 2

4 3

Having multiple authentication query in sql.conf
by vignesh 29 Mar '06

29 Mar '06

Hello all Can I have multiple authentication queries in sql.conf file. There are different ways by which we want to autheticate the users. I will let you know what I exactly want. I want to authenticate users based on the CLID and the remote ip address. The problem is that the remote address has to be searched from a set of ips. I will give you a example Suppose that we have a user 9204 and if the call for this particular user comes from a set of ips like 222.223.33.24 or 33.44.334.44( which will be present in some database tables) etc only then user will be authenticated. Vignesh

3 2

freeradius 1.1.1 does not make on 64 bit intel platfrom
by Ashwin Gobind 29 Mar '06

29 Mar '06

Hi all. I am trying to install freeradius 1.1.1 on a 64 bit intel platform. I get the ffg error : rm -fr .libs/rlm_counter.la .libs/rlm_counter.* .libs/rlm_counter-1.1.1.* gcc -shared rlm_counter.lo -Wl,--rpath -Wl,/usr/software/freeradius-1.1.1/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /usr/software/freeradius-1.1.1/src/lib/.libs/libradius.so /usr/lib/libgdbm.so -lnsl -lresolv -lpthread -Wl,-soname -Wl,rlm_counter-1.1.1.so -o .libs/rlm_counter-1.1.1.so /usr/lib/libgdbm.so: could not read symbols: Invalid operation collect2: ld returned 1 exit status gmake[6]: *** [rlm_counter.la] Error 1 Please indicate how to install freeradius 1.1.1 on a 64 bit platform ? \ �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.co.za/legal/email.jsp "

1 0

Tipical LDAP Schema
by Luca 29 Mar '06

29 Mar '06

Hello, I'm using freeradius with an LDAP Backend to authenticate some users (I'm working in my University' labs). As today, i'm using a clear unencrypted wifi connection authenticating MAC through freeradius, my target is to use WPA (or WPA2) with Radius. What i need is a tipical ldap account ldif layout, 'cause this is the first time i work with ldap and i hope to do my best. The best scenario is a single signon service, so... if you have an ldif with the radiusProfile object plus some samba and other usefull information... please add them too. Thanks in advance. Luca

3 2

MYSQL check_error: 2013, returning SQL_DOWN
by yao guoxian 28 Mar '06

28 Mar '06

I updated NAS table,set type to 'livingston', it seemed the Freeradius server has recogenized the nas client. However, another mistake:' MYSQL check_error: 2013, returning SQL_DOWN 'appears,the following are the complete error message: rad_recv: Access-Request packet from host 202.117.15.164:3735, id=17, length=45 User-Name = "barny" User-Password = "betty" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "barny", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 radius_xlat: 'barny' rlm_sql (sql): sql_set_user escaped user --> 'barny' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'barny' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'barny' ORDER BY id rlm_sql_mysql: MYSQL check_error: 2013, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'barny' ORDER BY id rlm_sql_mysql: MYSQL check_error: 2013, returning SQL_DOWN rlm_sql (sql): failed after re-connect rlm_sql_getvpdata: database query error rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns fail for request 3 modcall: group authorize returns fail for request 3 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 17 with timestamp 4429e5be Nothing to do. Sleeping until we see a request. Dose someone meet the same problem? Appreciate any suggestions.

1 0