June 2006 - Freeradius-Users - lists.freeradius.org

RE: freeradius-mysql rpm
by Jin Fan 19 Jun '06

19 Jun '06

It didn't work for me. If you look closely, the rpm is for freeradius 1.0.2-2. I am using freeradius 1.0.2. -----Original Message----- From: freeradius-users-bounces+jfan=cwlab.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jfan=cwlab.com@lists.freeradius.org] On Behalf Of Leandro Pereira de Lima e Silva - ViaLink Sent: Monday, June 19, 2006 10:03 AM To: FreeRadius users mailing list Subject: Re: freeradius-mysql rpm Why don't just rpm -i freeradius-mysql-0.9.3-1.1.i386.rpm ? Best regards, Leandro. Jin Fan escreveu: > I am using an older version of freeradius 1.0.2 and Fedora 4. > > My way to solve the missing rlm_sql_mysql.so problem is the following. > > 1. I download the freeradius-mysql rpm package from this website. > http://rpmfind.net/linux/RPM/fedora/updates/1/i386/freeradius-mysql-0. > 9. > 3-1.1.i386.html > > 2. Then I used 7-Zip to extract rlm_sql_mysql.so from the rpm. There > are two files in the rpm, rlm_sql_mysql-1.0.2.so and rlm_sql_mysql.so. > The second file is the link file to the first file. > > 3. Then load the first file into /use/lib/ folder, which contains all > the link library files. Make a link to the file and name it > rlm_sql_mysql.so. You also need to use chmod command to change the > file permission. > > 4. Restart freeradius server and it might run. > > You might need to find the correct rpm package for your system. > > Jin Fan > > -----Original Message----- > From: freeradius-users-bounces+jfan=cwlab.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+jfan=cwlab.com@lists.freeradius.org] > On Behalf Of Abul Monsur Mannan > Sent: Monday, June 19, 2006 8:45 AM > To: FreeRadius users mailing list > Subject: Re: freeradius-mysql rpm > > > First of all Thank You for your response. > > Actuallu I'm using Redhat Linux Enterprise 4 .I've 4 cds.After > installation, I've got Mysql_devel,mysql_client and mysql_server.But I > don't get any rlm_mysql.so file in any directory. > > In the meantime, I found the freeradius_mysql rpm from web and want to > install it. But my Q. is where should I install the file.I want your > Help... > > Please help me out of this problem. > Thank You again. > > On 6/19/06, Kofi Adusei Koduah-Sarpong <Kofikoduah(a)hotmail.com> wrote: > >> It's on the one of cds I can't remember which one which version are >> you using? Dvd or cds? Just look through the cds. I actually saw it >> this week while looking for it to make a package for a cobalt RaQ550 >> box. It has the mysql rpm too. I'll try see which cd it's on when I >> get home. Hope this helped >> >> -----Original Message----- >> From: Abul Monsur Mannan [mailto:monsurc1@gmail.com] >> Sent: 18 June 2006 14:56 >> To: FreeRadius users mailing list >> Subject: freeradius-mysql rpm >> >> Dear FR users >> >> I've an enquiry.Please response. >> >> I'm using RHEL 4.It has no rlm_mysql.so files and I found that it has >> no freeradius-mysql rpm either. >> >> So, can anyone help me providing the info. that where I find that rpm >> for redhat linux enterprise 4 to use with freeradius-1.1.2? >> >> I'm looking fr ur response soon. >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

freeradius-mysql rpm
by Abul Monsur Mannan 19 Jun '06

19 Jun '06

Dear FR users I've an enquiry.Please response. I'm using RHEL 4.It has no rlm_mysql.so files and I found that it has no freeradius-mysql rpm either. So, can anyone help me providing the info. that where I find that rpm for redhat linux enterprise 4 to use with freeradius-1.1.2? I'm looking fr ur response soon.

3 4

Active Directory Integration with FreeRADIUS - NTLM_Auth
by Doug White 19 Jun '06

19 Jun '06

Hello, I am trying to walk through the following document: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf in order to authenticate Cisco router and switch logins against FreeRadius/Active Directory. Using the HowTo, I have successfully joined a FC2 box to our Windows 2003 AD for testing purposes. I have also successfully used the manual ntlm_auth command to authenticate a user from the Radius server. I have configured the Cisco switch to point to the Radius server for authentication. I am not trying to authenticate an actual PC from a switch port, so I have not followed through with the EAP portion of the HowTo. Here is the output of the Radiusd -X and the attempted telnet login to the switch: # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain= %{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge= %{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.0.3:1645, id=68, length=78 NAS-IP-Address = 172.16.0.3 NAS-Port = 66 NAS-Port-Type = Virtual User-Name = "dwhite" Calling-Station-Id = "172.16.2.122" User-Password = "Password1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "dwhite", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 68 to 172.16.0.3:1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 68 with timestamp 448daaf9 Nothing to do. Sleeping until we see a request. Any help as to my next step would be greatly appreciated. Thanks, Doug White

4 5

Auth Problems 2 !!!
by Emerson 19 Jun '06

19 Jun '06

Hi, The problem was a error in eap.conf, i change default eap to tls (and not md5), and work. Now has a another problem, i try to authnticate, but this messages appear. My radius client is a Access Point wl-5460AP with IP 10.254.0.254, and my pc with Airlink 802.11g authing in AP, my IP is 10.254.0.240. I use freeradius with auth eap/tls in MYSQL. Anyone can help me.... Thank's Emerson **********************************Out of radiusd -X************************************************** Sending Access-Reject of id 54 to 10.254.0.254 port 2053 Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.254.0.254:2053, id=55, length=173 User-Name = "usuario1" NAS-IP-Address = 10.254.0.254 NAS-Port = 0 Called-Station-Id = "004f62087474" Calling-Station-Id = "0014a53c478d" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000d017573756172696f31 Message-Authenticator = 0x7f0c4bd69d33ce3fe0cb757219d2f05e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 18 radius_xlat: 'usuario1' rlm_sql (sql): sql_set_user escaped user --> 'usuario1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'usuario1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'usuario1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'usuario1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'usuario1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 18 modcall: leaving group authorize (returns updated) for request 18 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [usuario1/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) Delaying request 18 for 1 seconds Finished request 18 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 16 ID 53 with timestamp 4496c6c7 Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 55 to 10.254.0.254 port 2053 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 17 ID 54 with timestamp 4496c6c9 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 18 ID 55 with timestamp 4496c6cc Nothing to do. Sleeping until we see a request.

2 1

NAS pool
by Mircea Harapu 19 Jun '06

19 Jun '06

Hello, I have a /24 of NAS IP's . What I want is to have an entry in users file that match every IP from that /24 class . Is this possible ? -- ................................................................ Mircea Harapu Abuse Engineer, RDS NOC in Bucharest t: 021-301.08.50 f: 021-301.08.51 e: mircea.harapu(a)rcs-rds.ro w: www.rdslink.ro ................................................................ Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail.

2 1

RE: freeradius-mysql rpm
by Jin Fan 19 Jun '06

19 Jun '06

I am using an older version of freeradius 1.0.2 and Fedora 4. My way to solve the missing rlm_sql_mysql.so problem is the following. 1. I download the freeradius-mysql rpm package from this website. http://rpmfind.net/linux/RPM/fedora/updates/1/i386/freeradius-mysql-0.9. 3-1.1.i386.html 2. Then I used 7-Zip to extract rlm_sql_mysql.so from the rpm. There are two files in the rpm, rlm_sql_mysql-1.0.2.so and rlm_sql_mysql.so. The second file is the link file to the first file. 3. Then load the first file into /use/lib/ folder, which contains all the link library files. Make a link to the file and name it rlm_sql_mysql.so. You also need to use chmod command to change the file permission. 4. Restart freeradius server and it might run. You might need to find the correct rpm package for your system. Jin Fan -----Original Message----- From: freeradius-users-bounces+jfan=cwlab.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jfan=cwlab.com@lists.freeradius.org] On Behalf Of Abul Monsur Mannan Sent: Monday, June 19, 2006 8:45 AM To: FreeRadius users mailing list Subject: Re: freeradius-mysql rpm First of all Thank You for your response. Actuallu I'm using Redhat Linux Enterprise 4 .I've 4 cds.After installation, I've got Mysql_devel,mysql_client and mysql_server.But I don't get any rlm_mysql.so file in any directory. In the meantime, I found the freeradius_mysql rpm from web and want to install it. But my Q. is where should I install the file.I want your Help... Please help me out of this problem. Thank You again. On 6/19/06, Kofi Adusei Koduah-Sarpong <Kofikoduah(a)hotmail.com> wrote: > It's on the one of cds I can't remember which one which version are > you using? Dvd or cds? Just look through the cds. I actually saw it > this week while looking for it to make a package for a cobalt RaQ550 > box. It has the mysql rpm too. I'll try see which cd it's on when I > get home. Hope this helped > > -----Original Message----- > From: Abul Monsur Mannan [mailto:monsurc1@gmail.com] > Sent: 18 June 2006 14:56 > To: FreeRadius users mailing list > Subject: freeradius-mysql rpm > > Dear FR users > > I've an enquiry.Please response. > > I'm using RHEL 4.It has no rlm_mysql.so files and I found that it has > no freeradius-mysql rpm either. > > So, can anyone help me providing the info. that where I find that rpm > for redhat linux enterprise 4 to use with freeradius-1.1.2? > > I'm looking fr ur response soon. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

error starting radiusd
by Paulo Andre 19 Jun '06

19 Jun '06

Hi, our server went down due to power complications , the server has been up for +300days before this. Now when I try and start radiusd I get and error , could comeone urgently help or point me in the right direction: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 *** glibc detected *** malloc(): memory corruption: 0x08134288 *** Aborted Freeradius: radiusd: FreeRADIUS Version 1.0.5, for host , built on Nov 10 2005 at 14:50:16 Mysql: Server version 4.1.11 Thanks Paulo

2 1

Auth Problem !
by Emerson 19 Jun '06

19 Jun '06

Hi, i have a freeradius 1.1.1 running in slack-10.1 My radius client is a Access Point wl-5460AP, auth with WPA working with Enterprise (Radius), in ports 1812/1813 with correct secret, but when i try to authenticate in this AP, i configure my PC with this configuration and it auth. But in my radius, running in mode debug (radiusd -X), not show any messages. When i use radtest, it's work. Wich the test i do, to resolv or show the messages..... Thank´s a lot..... Emerson

2 1

Re: rlm_perl forking zombies
by david.suarezdelis＠telefonica.es 19 Jun '06

19 Jun '06

Thanks for the reply! > david.suarezdelis(a)telefonica.es wrote: > > By itself, this works and no zombies are left behind, as expected. However, > > when used with FreeRadius, zombies are left behind. > FreeRADIUS has a wrapper around fork() that modules are expected to > use. The reason is that the server is threaded, and some modules want > to wait for the child to return. In a threaded environment, the > SIGCHLD may be delivered to *another* thread, which causes problems. > Hence the wrapper, which catches all of the SIGCHLD's, and ensures > they're delivered to the correct destination. I understand the problem... How can I use/call the wrapper from rlm_perl (if it's possible at all)? > A solution is to modify src/main/threads.c, function > reap_children(). Right now it loops over known PIDs, and waits on > them. Change it to wait for any PID, and then look that PID up in the > list. If it's known, it's updated. Otherwise, the status is tossed. I have glanced at the code, but I'm not sure I can put time to do that at the moment... If there's a way to use the standard wrapper to fork() from rlm_perl, I'll do it... Anyway I'll speak with the bosses about the possibility... thanks! david ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

2 1

non-authentication port
by Leandro Pereira de Lima e Silva - ViaLink 18 Jun '06

18 Jun '06

Hello everybody, my name is Leandro and I'm from an ISP in Brazil. My freeradius is giving me errors saying that my NAS is sending auth packets to the wrong port. I have already seen people with this error around the net, including here at the list. Testing with radclient it works very well. I'm trying to migrate from cistron to freeradius. The packet is coming from the telecom that handles the dial-in for us. I've already set up a sniffer on the machine to check to what port they are sending the packets and it's to 1812. There is something to do with NAS type? Does anyone knows how to solve this? Thanks, Leandro. Running freeradius -X: (...) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 200.184.x.x:49852, id=141, length=124 Authentication-Request sent to a non-authentication port from client nas-intelig-1:49852 - ID 141 : IGNORED --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 200.184.x.x:49852, id=141, length=124 Authentication-Request sent to a non-authentication port from client nas-intelig-1:49852 - ID 141 : IGNORED --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 200.184.x.x:49852, id=220, length=124 Authentication-Request sent to a non-authentication port from client nas-intelig-1:49852 - ID 220 : IGNORED (...) -- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay

2 5