May 2006 - Freeradius-Users - lists.freeradius.org

authing clients !!!
by emerson 26 May '06

26 May '06

Pessoal, i have a server linux running slackware 10.1, with freeradius 1.1.1 with auth eap/tls/ttls + openssl-0.97d + mysql. My freeradius client is a ap wl-5460AP. When i try to authenticate any user on my freeradius, in logs appear this messages: Fri May 26 09:06:07 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri May 26 09:06:07 2006 : Info: Ready to process requests. Fri May 26 09:10:56 2006 : Info: rlm_eap_md5: Issuing Challenge Fri May 26 09:10:56 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Fri May 26 09:10:56 2006 : Error: TLS Alert read:fatal:unknown CA Fri May 26 09:10:56 2006 : Error: TLS_accept:failed in SSLv3 read client certificate A Fri May 26 09:10:56 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Fri May 26 09:10:56 2006 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. Fri May 26 09:10:56 2006 : Auth: Login incorrect: [mobile/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) Fri May 26 09:35:44 2006 : Auth: Login incorrect: [joao/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) what it can be ? thanks... Emerson

2 1

Blank Password and Recommeded RFC standard
by Craig T. Hancock 26 May '06

26 May '06

Question, The RFC seems to have a provision on how to handle a Radius request with a blank password. As an option the Radius Server can send a request back to a client to stating that a password is needed enter password. However what I am trying to figure out is that is this a requirement of a the RFC or a recommendation. Thanks -- ****************************************************** Craig T. Hancock Systems Engineer, Infrastructure Services Office of Information Technology University of Notre Dame ******************************************************

2 3

Inserting Cisco AVPairs from accounting request into database
by vignesh 26 May '06

26 May '06

Hello all I want to insert cisco AV Pairs from accounting request packet into database. Here is the accounting request packet for a single leg. Acct-Session-Id = "00000B93" Calling-Station-Id = "216" Called-Station-Id = "9833515315" Cisco-AVPair = "call-id=19421006761822000202723(a)202.80.61.42" h323-setup-time = "h323-setup-time=*14:42:31.708 PCTime Fri May 26 2006" h323-conf-id = "h323-conf-id=989CA2C5 EBCE11DA 81EF9672 750B1B97" h323-call-type = "h323-call-type=VoIP" Cisco-AVPair = "h323-incoming-conf-id=989CA2C5 EBCE11DA 81EF9672 750B1B97" Cisco-AVPair = "session-protocol=sipv2" h323-connect-time = "h323-connect-time=*14:42:34.904 PCTime Fri May 26 2006" Acct-Session-Time = 4 h323-disconnect-time = "h323-disconnect-time=*14:42:39.020 PCTime Fri May 26 2006" h323-disconnect-cause = "h323-disconnect-cause=10" h323-remote-address = "h323-remote-address=202.80.61.42" h323-voice-quality = "h323-voice-quality=0" Cisco-AVPair = "remote-media-address=202.80.61.42" Cisco-AVPair = "gw-rxd-cgn=ton:0,npi:0,pi:0,si:0,#:216" User-Name = "202.80.61.42" Acct-Status-Type = Stop Service-Type = Login-User NAS-IP-Address = 202.80.61.1 Acct-Delay-Time = 0 I changed the default table structure to include the extra columns. Also made changes in sql.conf to add values in the respective columns. Here is my problem. I insert h323-remote-address by adding '%{h323-remote-address}' in the insert query But I get the value as h323-remote-address=202.80.61.42 whereas I wanted only the ip address not the complete string after the '=' sign. Also I want to insert other fields like callid, remote-media-address both of which are Cisco AVPair. So how do I include them into my database coz I cant refer them direcly by their attribute name like '%{remote-media-address}. I tried that but it doesn't return any value. So how do I insert all these values. Thanks Vignesh

1 0

mysql issue
by andy 26 May '06

26 May '06

Hi list, Fairly new to freeradius, just about to deploy a solution involving RedBack with data storage on the backend using MySQL. I am using NDBD MySQL clustering on the backend and I see the following error from FreeRadius: rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN This seems to relate to a timeout issue but googling doesnt provide any answers for that specific error code. (too like the date 2006 I expect). I have fairly tweaked the mysql backend to be fairly resilant in a heavy load situation, and none of the other applications running against this cluster seem to have issues. I was wondering if anyone could enlighten me as to how to fix this error, or what threshholds would be recomended for running in this environment? It seems that when this error occurs, for the next few auth attempts, certain attributes are not passed back to the redback. This specifically being IP-Interface. any clues on this issue would be greatly appreciated. thanks -- andy andy(a)shady.org ----------------------------------------------- Never argue with an idiot. They drag you down to their level, then beat you with experience. -----------------------------------------------

4 6

Undefined symbol "cbtls_password"
by Mario Alberto Cruz Gartner 25 May '06

25 May '06

Hello! I'm installing Freeradius1.1.1 on a FreeBSD 4.11-RELEASE-p8 (from the ports system). I'm installing EAP/TLS support (with a mysql backend). The basic setup (and mysql) works fine. The EAP/TLS part it's the one witrh the problem that i have. I'd put the certs on their location, change the eap.conf to reflect this locations and try to start the server. I would thank any help that you can give to me so i can see where the problem lives ;) I'd tried making a pasword-less and a password-protected certificate for the server, but anyway the "cbtls_password" came on. I'm reading about and think that maybe the OpenSSL (OpenSSL 0.9.7d 17 Mar 2004) installation was getting the conflicts, but i reinstalled (both, the OpenSSL and Freeradius) and the problem persists. Again, thanks a lot guys! ----- BEGIN SERVER OUTPUT ----- [1451]virtuse03-{~}# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Failed to link EAP-Type/tls: /usr/local/lib/rlm_eap_tls-1.1.1.so: Undefined symbol "cbtls_password" radiusd.conf[9]: eap: Module instantiation failed. radiusd.conf[1893] Unknown module "eap". radiusd.conf[1840] Failed to parse authenticate section. ----- END SERVER OUTPUT ----- ----- BEGIN EAP FILE----- [1454]virtuse03-{~}# cat /usr/local/etc/raddb/eap.conf # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # $Id: eap.conf,v 1.4 2004/04/15 18:34:41 aland Exp $ # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = peap # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # #md5 { #} # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # #leap { #} # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # #gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # #auth_type = PAP #} ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/tls/cert-srv.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = ${raddbdir}/certs/tls/cert-srv.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/tls/CA/cacert.pem dh_file = ${raddbdir}/certs/tls/dh random_file = ${raddbdir}/certs/tls/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd # check_crl = yes # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # check_cert_cn = %{User-Name} } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # #ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. #default_eap_type = md5 #default_eap_type = mschapv2 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} #copy_request_to_tunnel = yes # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} #use_tunneled_reply = yes #} # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # peap { #The tunneled EAP session needs a default #EAP type which is separate from the one for #the non-tunneled EAP module. Inside of the #PEAP tunnel, we recommend using MS-CHAPv2, #as that is the default type supported by #Windows clients. default_eap_type = mschapv2 copy_request_to_tunnel = no } # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } } [1455]virtuse03-{~}# ----- END EAP FILE----- -- Mario Alberto Cruz Gartner mario.cruz(a)gmail.com

1 0

RE: rlm_sqlippool - try sql if not try sql1
by RobertB 25 May '06

25 May '06

>>>RobertB wrote: >>> >>> At present it is not possible to do something like: try sql, if not >>> available try sql1. >> >>Did you try to put the module in a "redundant" or a "group" >>stanza? http://freeradius.org/radiusd/doc/configurable_failover Actually I'm using it with accounting packets, but it doesn't work with rlm_sqlippool, as radiusd.conf is expecting ip pool name. The sql-instance-name is set in sqlippool.sqls. Having two sql-instances would mean two sqlippools.conf files and a different pool in each which wouldn't really work, unless I'm missing something. Cheers, RobertB

1 0

RE: FreeRadius daily build fails on FreeBSD?
by Remy de Ruysscher 25 May '06

25 May '06

Thanks for the quick reply. It works using net-snmp instead of ucd-snmp. > -----Original Message----- > From: > freeradius-users-bounces+remy=unix-asp.com(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+remy=unix-asp.com@lists.freer > adius.org] On Behalf Of Alan DeKok > Sent: donderdag 25 mei 2006 20:27 > To: FreeRadius users mailing list > Subject: Re: FreeRadius daily build fails on FreeBSD? > > "Remy de Ruysscher" <remy(a)unix-asp.com> wrote: > > On FreeBSD I get these errors after ./configure and make: > > > > radius_snmp.c:176: warning: (near initialization for > > `radiusauth_variables[4]') > > radius_snmp.c:177: warning: initialization makes pointer > from integer > > without a cast > > radius_snmp.c:177: warning: excess elements in struct initializer > > The only way that happens is if UCD-SNMP or NET-SNMP have > updated their data structures to be incompatible with earlier > versions. > > So... what SNMP are you using, and what version? What is > the definition of the "variables" structure in the SNMP you're using? > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

FreeRadius daily build fails on FreeBSD?
by Remy de Ruysscher 25 May '06

25 May '06

On FreeBSD I get these errors after ./configure and make: radius_snmp.c:176: warning: (near initialization for `radiusauth_variables[4]') radius_snmp.c:177: warning: initialization makes pointer from integer without a cast radius_snmp.c:177: warning: excess elements in struct initializer radius_snmp.c:177: warning: (near initialization for `radiusauth_variables[5]') radius_snmp.c:177: warning: excess elements in struct initializer radius_snmp.c:177: warning: (near initialization for `radiusauth_variables[5]') radius_snmp.c:177: warning: excess elements in struct initializer radius_snmp.c:177: warning: (near initialization for `radiusauth_variables[5]') radius_snmp.c:177: error: extra brace group at end of initializer radius_snmp.c:177: error: (near initialization for `radiusauth_variables[5]') radius_snmp.c:177: warning: excess elements in struct initializer radius_snmp.c:177: warning: (near initialization for `radiusauth_variables[5]') radius_snmp.c:178: warning: initialization makes pointer from integer without a cast radius_snmp.c:178: warning: excess elements in struct initializer radius_snmp.c:178: warning: (near initialization for `radiusauth_variables[6]') radius_snmp.c:178: warning: excess elements in struct initializer radius_snmp.c:178: warning: (near initialization for `radiusauth_variables[6]') radius_snmp.c:178: warning: excess elements in struct initializer radius_snmp.c:178: warning: (near initialization for `radiusauth_variables[6]') radius_snmp.c:178: error: extra brace group at end of initializer radius_snmp.c:178: error: (near initialization for `radiusauth_variables[6]') radius_snmp.c:178: warning: excess elements in struct initializer radius_snmp.c:178: warning: (near initialization for `radiusauth_variables[6]') radius_snmp.c:179: warning: initialization makes pointer from integer without a cast radius_snmp.c:179: warning: excess elements in struct initializer radius_snmp.c:179: warning: (near initialization for `radiusauth_variables[7]') radius_snmp.c:179: warning: excess elements in struct initializer radius_snmp.c:179: warning: (near initialization for `radiusauth_variables[7]') radius_snmp.c:179: warning: excess elements in struct initializer radius_snmp.c:179: warning: (near initialization for `radiusauth_variables[7]') radius_snmp.c:179: error: extra brace group at end of initializer radius_snmp.c:179: error: (near initialization for `radiusauth_variables[7]') radius_snmp.c:179: warning: excess elements in struct initializer radius_snmp.c:179: warning: (near initialization for `radiusauth_variables[7]') radius_snmp.c:180: warning: initialization makes pointer from integer without a cast radius_snmp.c:180: warning: excess elements in struct initializer radius_snmp.c:180: warning: (near initialization for `radiusauth_variables[8]') radius_snmp.c:180: warning: excess elements in struct initializer radius_snmp.c:180: warning: (near initialization for `radiusauth_variables[8]') radius_snmp.c:180: warning: excess elements in struct initializer radius_snmp.c:180: warning: (near initialization for `radiusauth_variables[8]') radius_snmp.c:180: error: extra brace group at end of initializer radius_snmp.c:180: error: (near initialization for `radiusauth_variables[8]') radius_snmp.c:180: warning: excess elements in struct initializer radius_snmp.c:180: warning: (near initialization for `radiusauth_variables[8]') radius_snmp.c:181: warning: initialization makes pointer from integer without a cast radius_snmp.c:181: warning: excess elements in struct initializer radius_snmp.c:181: warning: (near initialization for `radiusauth_variables[9]') radius_snmp.c:181: warning: excess elements in struct initializer radius_snmp.c:181: warning: (near initialization for `radiusauth_variables[9]') radius_snmp.c:181: warning: excess elements in struct initializer radius_snmp.c:181: warning: (near initialization for `radiusauth_variables[9]') radius_snmp.c:181: error: extra brace group at end of initializer radius_snmp.c:181: error: (near initialization for `radiusauth_variables[9]') radius_snmp.c:181: warning: excess elements in struct initializer radius_snmp.c:181: warning: (near initialization for `radiusauth_variables[9]') radius_snmp.c:182: warning: initialization makes pointer from integer without a cast radius_snmp.c:182: warning: excess elements in struct initializer radius_snmp.c:182: warning: (near initialization for `radiusauth_variables[10]') radius_snmp.c:182: warning: excess elements in struct initializer radius_snmp.c:182: warning: (near initialization for `radiusauth_variables[10]') radius_snmp.c:182: warning: excess elements in struct initializer radius_snmp.c:182: warning: (near initialization for `radiusauth_variables[10]') radius_snmp.c:182: error: extra brace group at end of initializer radius_snmp.c:182: error: (near initialization for `radiusauth_variables[10]') radius_snmp.c:182: warning: excess elements in struct initializer radius_snmp.c:182: warning: (near initialization for `radiusauth_variables[10]') radius_snmp.c:183: warning: initialization makes pointer from integer without a cast radius_snmp.c:183: warning: excess elements in struct initializer radius_snmp.c:183: warning: (near initialization for `radiusauth_variables[11]') radius_snmp.c:183: warning: excess elements in struct initializer radius_snmp.c:183: warning: (near initialization for `radiusauth_variables[11]') radius_snmp.c:183: warning: excess elements in struct initializer radius_snmp.c:183: warning: (near initialization for `radiusauth_variables[11]') radius_snmp.c:183: error: extra brace group at end of initializer radius_snmp.c:183: error: (near initialization for `radiusauth_variables[11]') radius_snmp.c:183: warning: excess elements in struct initializer radius_snmp.c:183: warning: (near initialization for `radiusauth_variables[11]') radius_snmp.c:184: warning: initialization makes pointer from integer without a cast radius_snmp.c:184: warning: excess elements in struct initializer radius_snmp.c:184: warning: (near initialization for `radiusauth_variables[12]') radius_snmp.c:184: warning: excess elements in struct initializer radius_snmp.c:184: warning: (near initialization for `radiusauth_variables[12]') radius_snmp.c:184: warning: excess elements in struct initializer radius_snmp.c:184: warning: (near initialization for `radiusauth_variables[12]') radius_snmp.c:184: error: extra brace group at end of initializer radius_snmp.c:184: error: (near initialization for `radiusauth_variables[12]') radius_snmp.c:184: warning: excess elements in struct initializer radius_snmp.c:184: warning: (near initialization for `radiusauth_variables[12]') radius_snmp.c:185: warning: initialization makes pointer from integer without a cast radius_snmp.c:185: warning: excess elements in struct initializer radius_snmp.c:185: warning: (near initialization for `radiusauth_variables[13]') radius_snmp.c:185: warning: excess elements in struct initializer radius_snmp.c:185: warning: (near initialization for `radiusauth_variables[13]') radius_snmp.c:185: warning: excess elements in struct initializer radius_snmp.c:185: warning: (near initialization for `radiusauth_variables[13]') radius_snmp.c:185: error: extra brace group at end of initializer radius_snmp.c:185: error: (near initialization for `radiusauth_variables[13]') radius_snmp.c:185: warning: excess elements in struct initializer radius_snmp.c:185: warning: (near initialization for `radiusauth_variables[13]') radius_snmp.c:186: warning: initialization makes pointer from integer without a cast radius_snmp.c:186: warning: excess elements in struct initializer radius_snmp.c:186: warning: (near initialization for `radiusauth_variables[14]') radius_snmp.c:186: warning: excess elements in struct initializer radius_snmp.c:186: warning: (near initialization for `radiusauth_variables[14]') radius_snmp.c:186: warning: excess elements in struct initializer radius_snmp.c:186: warning: (near initialization for `radiusauth_variables[14]') radius_snmp.c:186: error: extra brace group at end of initializer radius_snmp.c:186: error: (near initialization for `radiusauth_variables[14]') radius_snmp.c:186: warning: excess elements in struct initializer radius_snmp.c:186: warning: (near initialization for `radiusauth_variables[14]') radius_snmp.c:187: warning: initialization makes pointer from integer without a cast radius_snmp.c:187: warning: excess elements in struct initializer radius_snmp.c:187: warning: (near initialization for `radiusauth_variables[15]') radius_snmp.c:187: warning: excess elements in struct initializer radius_snmp.c:187: warning: (near initialization for `radiusauth_variables[15]') radius_snmp.c:187: warning: excess elements in struct initializer radius_snmp.c:187: warning: (near initialization for `radiusauth_variables[15]') radius_snmp.c:187: error: extra brace group at end of initializer radius_snmp.c:187: error: (near initialization for `radiusauth_variables[15]') radius_snmp.c:187: warning: excess elements in struct initializer radius_snmp.c:187: warning: (near initialization for `radiusauth_variables[15]') radius_snmp.c:188: warning: initialization makes pointer from integer without a cast radius_snmp.c:188: warning: excess elements in struct initializer radius_snmp.c:188: warning: (near initialization for `radiusauth_variables[16]') radius_snmp.c:188: warning: excess elements in struct initializer radius_snmp.c:188: warning: (near initialization for `radiusauth_variables[16]') radius_snmp.c:188: warning: excess elements in struct initializer radius_snmp.c:188: warning: (near initialization for `radiusauth_variables[16]') radius_snmp.c:188: error: extra brace group at end of initializer radius_snmp.c:188: error: (near initialization for `radiusauth_variables[16]') radius_snmp.c:188: warning: excess elements in struct initializer radius_snmp.c:188: warning: (near initialization for `radiusauth_variables[16]') radius_snmp.c:189: warning: initialization makes pointer from integer without a cast radius_snmp.c:189: warning: excess elements in struct initializer radius_snmp.c:189: warning: (near initialization for `radiusauth_variables[17]') radius_snmp.c:189: warning: excess elements in struct initializer radius_snmp.c:189: warning: (near initialization for `radiusauth_variables[17]') radius_snmp.c:189: warning: excess elements in struct initializer radius_snmp.c:189: warning: (near initialization for `radiusauth_variables[17]') radius_snmp.c:189: error: extra brace group at end of initializer radius_snmp.c:189: error: (near initialization for `radiusauth_variables[17]') radius_snmp.c:189: warning: excess elements in struct initializer radius_snmp.c:189: warning: (near initialization for `radiusauth_variables[17]') radius_snmp.c:190: warning: initialization makes pointer from integer without a cast radius_snmp.c:190: warning: excess elements in struct initializer radius_snmp.c:190: warning: (near initialization for `radiusauth_variables[18]') radius_snmp.c:190: warning: excess elements in struct initializer radius_snmp.c:190: warning: (near initialization for `radiusauth_variables[18]') radius_snmp.c:190: warning: excess elements in struct initializer radius_snmp.c:190: warning: (near initialization for `radiusauth_variables[18]') radius_snmp.c:190: error: extra brace group at end of initializer radius_snmp.c:190: error: (near initialization for `radiusauth_variables[18]') radius_snmp.c:190: warning: excess elements in struct initializer radius_snmp.c:190: warning: (near initialization for `radiusauth_variables[18]') radius_snmp.c:191: warning: initialization makes pointer from integer without a cast radius_snmp.c:191: warning: excess elements in struct initializer radius_snmp.c:191: warning: (near initialization for `radiusauth_variables[19]') radius_snmp.c:191: warning: excess elements in struct initializer radius_snmp.c:191: warning: (near initialization for `radiusauth_variables[19]') radius_snmp.c:191: warning: excess elements in struct initializer radius_snmp.c:191: warning: (near initialization for `radiusauth_variables[19]') radius_snmp.c:191: error: extra brace group at end of initializer radius_snmp.c:191: error: (near initialization for `radiusauth_variables[19]') radius_snmp.c:191: warning: excess elements in struct initializer radius_snmp.c:191: warning: (near initialization for `radiusauth_variables[19]') radius_snmp.c:192: warning: initialization makes pointer from integer without a cast radius_snmp.c:192: warning: excess elements in struct initializer radius_snmp.c:192: warning: (near initialization for `radiusauth_variables[20]') radius_snmp.c:192: warning: excess elements in struct initializer radius_snmp.c:192: warning: (near initialization for `radiusauth_variables[20]') radius_snmp.c:192: warning: excess elements in struct initializer radius_snmp.c:192: warning: (near initialization for `radiusauth_variables[20]') radius_snmp.c:192: error: extra brace group at end of initializer radius_snmp.c:192: error: (near initialization for `radiusauth_variables[20]') radius_snmp.c:192: warning: excess elements in struct initializer radius_snmp.c:192: warning: (near initialization for `radiusauth_variables[20]') radius_snmp.c:193: warning: initialization makes pointer from integer without a cast radius_snmp.c:193: warning: excess elements in struct initializer radius_snmp.c:193: warning: (near initialization for `radiusauth_variables[21]') radius_snmp.c:193: warning: excess elements in struct initializer radius_snmp.c:193: warning: (near initialization for `radiusauth_variables[21]') radius_snmp.c:193: warning: excess elements in struct initializer radius_snmp.c:193: warning: (near initialization for `radiusauth_variables[21]') radius_snmp.c:193: error: extra brace group at end of initializer radius_snmp.c:193: error: (near initialization for `radiusauth_variables[21]') radius_snmp.c:193: warning: excess elements in struct initializer radius_snmp.c:193: warning: (near initialization for `radiusauth_variables[21]') radius_snmp.c:194: warning: initialization makes pointer from integer without a cast radius_snmp.c:194: warning: excess elements in struct initializer radius_snmp.c:194: warning: (near initialization for `radiusauth_variables[22]') radius_snmp.c:194: warning: excess elements in struct initializer radius_snmp.c:194: warning: (near initialization for `radiusauth_variables[22]') radius_snmp.c:194: warning: excess elements in struct initializer radius_snmp.c:194: warning: (near initialization for `radiusauth_variables[22]') radius_snmp.c:194: error: extra brace group at end of initializer radius_snmp.c:194: error: (near initialization for `radiusauth_variables[22]') radius_snmp.c:194: warning: excess elements in struct initializer radius_snmp.c:194: warning: (near initialization for `radiusauth_variables[22]') radius_snmp.c:195: warning: initialization makes pointer from integer without a cast radius_snmp.c:195: warning: excess elements in struct initializer radius_snmp.c:195: warning: (near initialization for `radiusauth_variables[23]') radius_snmp.c:195: warning: excess elements in struct initializer radius_snmp.c:195: warning: (near initialization for `radiusauth_variables[23]') radius_snmp.c:195: warning: excess elements in struct initializer radius_snmp.c:195: warning: (near initialization for `radiusauth_variables[23]') radius_snmp.c:195: error: extra brace group at end of initializer radius_snmp.c:195: error: (near initialization for `radiusauth_variables[23]') radius_snmp.c:195: warning: excess elements in struct initializer radius_snmp.c:195: warning: (near initialization for `radiusauth_variables[23]') radius_snmp.c:196: warning: initialization makes pointer from integer without a cast radius_snmp.c:196: warning: excess elements in struct initializer radius_snmp.c:196: warning: (near initialization for `radiusauth_variables[24]') radius_snmp.c:196: warning: excess elements in struct initializer radius_snmp.c:196: warning: (near initialization for `radiusauth_variables[24]') radius_snmp.c:196: warning: excess elements in struct initializer radius_snmp.c:196: warning: (near initialization for `radiusauth_variables[24]') radius_snmp.c:196: error: extra brace group at end of initializer radius_snmp.c:196: error: (near initialization for `radiusauth_variables[24]') radius_snmp.c:196: warning: excess elements in struct initializer radius_snmp.c:196: warning: (near initialization for `radiusauth_variables[24]') radius_snmp.c:200: error: syntax error before "oid" radius_snmp.c:201: warning: function declaration isn't a prototype radius_snmp.c: In function `get_client': radius_snmp.c:205: error: `objid_len' undeclared (first use in this function) radius_snmp.c:205: error: (Each undeclared identifier is reported only once radius_snmp.c:205: error: for each function it appears in.) radius_snmp.c:205: error: `v' undeclared (first use in this function) radius_snmp.c:210: error: `exact' undeclared (first use in this function) radius_snmp.c:214: error: `objid' undeclared (first use in this function) radius_snmp.c:225: warning: return from incompatible pointer type radius_snmp.c: At top level: radius_snmp.c:238: error: syntax error before '*' token radius_snmp.c:243: error: syntax error before "switch" /usr/local/include/ucd-snmp/snmp_impl.h:118: warning: array 'sid' assumed to have one element radius_snmp.c:123: warning: 'radAccServ' declared `static' but never defined radius_snmp.c:129: warning: 'radAccEntry' declared `static' but never defined radius_snmp.c:135: warning: 'radAuthServ' declared `static' but never defined radius_snmp.c:141: warning: 'radAuthEntry' declared `static' but never defined radius_snmp.c:201: warning: 'get_client' defined but not used radius_snmp.c:29:1: unterminated #ifdef gmake[3]: *** [radius_snmp.lo] Error 1 gmake[3]: Leaving directory `/tmp/freeradius-snapshot-20060525/src/main' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/tmp/freeradius-snapshot-20060525/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/tmp/freeradius-snapshot-20060525/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /tmp/freeradius-snapshot-20060525.

2 1

Re: could not determine local IP address
by Italo Morellato 25 May '06

25 May '06

Hi Alan and many thanks for the fast reply.. this is the report of radiusd -x command... _________________________________________________________________ rad_recv: Access-Request packet from host 10.10.0.30:1144, id=37, length=130 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1116 NAS-Port-Type = Ethernet User-Name = "test" Calling-Station-Id = "00:15:D6:02:03:54" Called-Station-Id = "PPPoE" NAS-Port-Id = "wlan2" User-Password = "pqyqalxb" NAS-Identifier = "nas1" NAS-IP-Address = 10.10.0.30 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): Processing sql_postauth rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 Sending Access-Accept of id 37 to 10.10.0.30 port 1144 Framed-Routing = Broadcast-Listen Framed-Pool = "pppoe-pool1" Framed-IP-Netmask = 255.255.255.0 rad_recv: Accounting-Request packet from host 10.10.0.30:1144, id=38, length=146 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1116 NAS-Port-Type = Ethernet User-Name = "test" Calling-Station-Id = "00:15:D6:02:03:54" Called-Station-Id = "PPPoE" NAS-Port-Id = "wlan2" Acct-Session-Id = "81100016" Framed-IP-Address = 10.0.0.220 Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Identifier = "nas1" NAS-IP-Address = 10.10.0.30 Acct-Delay-Time = 0 rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 Sending Accounting-Response of id 38 to 10.10.0.30 port 1144 rad_recv: Accounting-Request packet from host 10.10.0.30:1144, id=39, length=194 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1116 NAS-Port-Type = Ethernet User-Name = "testt" Calling-Station-Id = "00:15:D6:02:03:54" Called-Station-Id = "PPPoE" NAS-Port-Id = "wlan2" Acct-Session-Id = "81100016" Framed-IP-Address = 10.0.0.220 Acct-Authentic = RADIUS Acct-Session-Time = 0 Acct-Input-Octets = 72 Acct-Input-Gigawords = 0 Acct-Input-Packets = 6 Acct-Output-Octets = 54 Acct-Output-Gigawords = 0 Acct-Output-Packets = 6 Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Error NAS-Identifier = "nas1" NAS-IP-Address = 10.10.0.30 Acct-Delay-Time = 0 rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 Sending Accounting-Response of id 39 to 10.10.0.30 port 1144 _______________________________________________________ at this point, in the Mikrotik log I see --> terminating... - could not determine local IP address Thanks in advance... ----- Original Message ----- From: Alan DeKok To: FreeRadius users mailing list Sent: Wednesday, May 24, 2006 6:31 PM Subject: Re: could not determine local IP address "Italo Morellato" <italo(a)witel.it> wrote: > my freeradius work fine with HotSpot but when I check ppp I've one > error. > Freeradius 1.1.1 > Log is paste below... No, it's a PPP log. It looks like your PPP is broken. Ask on a PPP list how to fix it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: PEAP + AD
by Chris Liles 25 May '06

25 May '06

> AD doesn't supply passwords through LDAP. That's why the server >ships with support for ntlm_auth. That is right, I forgot that even if you are on a ssl/tls ldap connection as an administrator, you can't pull the password back from AD. What "hooks" are you talking about? The extensions for unix services? -- Chris Liles -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 25, 2006 11:36 AM To: FreeRadius users mailing list Subject: Re: PEAP + AD "Chris Liles" <Chris.Liles(a)air2web.com> wrote: > But I have also read about some guy successfully using OpenLDAP with > PEAP because he stored the LM and NT password hashes in the ldap > schema along with the clear text password. With AD I suppose you > could extend the schema to store these as well, but you'd have to > manually update them when a password changes. Yes. There are hooks in AD to do just that, but the software implementing the hooks has to be installed on every domain controller. > In my attempts to use ldap with active directory for PEAP it > wouldn't work, so I went samba. It works fine. Radiusd -X and the > mailing list are your best friends. :) AD doesn't supply passwords through LDAP. That's why the server ships with support for ntlm_auth. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1