July 2006 - Freeradius-Users - lists.freeradius.org

FreeRadius/jRadius with Ericsson GGSN
by Adrian Heath 12 Jul '06

12 Jul '06

Trying to use FreeRadius (with jradius) to authenticate GPRS connections over a private APN with Vodafone UK based on a common userid/password but validating the MSISDN number (caller-id/mobile phone number) against a PostgreSQL. Installed an evaluation version of SteelBelt Radius (Vodafone's recommended solution) and their test connection worked. Configured FreeRadius to return same attributes and Vodafone's test connection failed although FreeRadius sent back an accepted authentication. The default SBR configuration file replaces something in the Class attribute included in the response with the User-Name attribute value. How do I configure FreedRadius to do the same? SBR returns Class attribute that starts 'SBR2 CL' and then binary characters. The User-Name attribute is included somewhere in the rest of the string as changing the length of the User-Name in the request varies the length of the Class response by the same number of characters. The NAS is an Ericsson GGSN. Any suggestions welcome Adrian Heath TrackTrans

2 1

eap: Module instantiation failed
by Alexey Plutakhin 12 Jul '06

12 Jul '06

Hello! I'm trying to use 802.1x according http://www.tldp.org/HOWTO/8021X-HOWTO/freeradius.html#confradius . But when I start radiusd -X, it write out next message: ..... tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain 68047:error:0200100E:system library:fopen:Bad address:bss_file.c:349:fopen('','r') 68047:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: 68047:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:720: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1893] Unknown module "eap". radiusd.conf[1840] Failed to parse authenticate section. All conf files are same with HOWTO. I tryed to reinstall radius and openssl, but it didn't help. Anybody knows, how to resolve problem?

2 1

Re: Error: WARNING: Unresponsive child
by Farhan Karim 12 Jul '06

12 Jul '06

still waiting for the answer... On 7/11/06, Farhan Karim <farhan.karim(a)gmail.com> wrote: > > > Thanks for the response. > > INFRANET, is a portal based customer management and billing system for IP > and telecommunications service providers. it provides many functionality. > > well coming back to problem, i have a little question with me, that is > there a way in free radius server to acknowledge the request with OK to the > infranet radius server as soon as it receives packet from it, so that the > infranet radius server that is forwarding packets to the freeradius server > does not get stuck (queue overloaded) due to some problem arising in > freeradius server. (again informing that the free radius server is acting as > proxy server in b/w infranet radius server and jradius server). > > infranet radius server ----> (forwarding packets) < ---- > freeradius > server -----> JRadius Server. > > > thanks, > > > > > On 7/10/06, Alan DeKok <aland(a)nitros9.org> wrote: > > > > Phil Mayers <p.mayers(a)imperial.ac.uk> wrote: > > > I believe it's the new and very very stupid name for a Juniper > > > (Funk-based?) > > > > Yes. Juniper bought Funk. > > > > > product that checks your AV definitions are up to date > > > before letting you through the firewall using either 802.1x or > > > eap-over-udp maybe? > > > > Like NAC. Which is a little odd from a security perspective. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > >

2 1

an infamous LDAP-FreeRadius question
by Matt Ashfield 12 Jul '06

12 Jul '06

Hi All, I know this has been discussed at length on this list, but it's kinda confusing reading through the archive and making sense of all the threaded discussions. What I didn't see (and I apologize if it's there) is if anyone has a HowTo or something similar on how to configure Freeradius for authentication against LDAP (not active directory) which has usernames and password stored on it in cleartext. Presumably I'd be using PEAP for this. If anyone has this or can give a hand offline from this mailing list, that would be much appreciated. Thanks Matt mda(a)unb.ca

7 12

attr_rewrite question
by Norbert Wegener 12 Jul '06

12 Jul '06

I am using FreeRADIUS Version 1.1.0 on a Suse10.1 system and want to rewrite the User-name in that way, that all ":" in that name are dropped, before fr looks into the users file. In analogy to sanecallerid in radiusd.conf I setup attr_rewrite saneusername { attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet searchfor = "[:]" replacewith = "" ignore_case = no new_attribute = no max_matches = 10 ## If set to yes then the replace string will be appended to the original string append = no } Running radtest 12:34:567890123 1234567890123 lnxt2 0 maxen Sending Access-Request of id 114 to 149.246.222.70 port 1812 User-Name = "12:34:567890123" User-Password = "1234567890123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 149.246.222.70:1812, id=114, length=20 radiusd -AX shows: ... Ready to process requests. rad_recv: Access-Request packet from host 149.246.133.44:32791, id=46, length=66 User-Name = "12:34:567890123" User-Password = "1234567890123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 What am I doing wrong? Thanks Norbert Wegener

1 1

rlm_perl issue...
by Nikola Pavkovic 12 Jul '06

12 Jul '06

Hi all, I'm expiriencing strange behaviour of rlm_perl module causing freeradius be unable to start. Here is the output of `freeradius -X` (running on Debian Sarge i386, freeradius version 1.1.2): # freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded perl perl: module = "/root/bin/mymodule.pm" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" Can't load '/usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so' for module Data::Dumper: /usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so: undefined symbol: Perl_sv_cmp at /usr/lib/perl/5.8/XSLoader.pm line 68. at /usr/lib/perl/5.8/Data/Dumper.pm line 27 Compilation failed in require at /root/bin/mymodule.pm line 30. BEGIN failed--compilation aborted at /root/bin/mymodule.pm line 30. rlm_perl: perl_parse failed: /root/bin/mymodule.pm not found or has syntax errors. radiusd.conf[540]: perl: Module instantiation failed. radiusd.conf[1747] Unknown module "perl". radiusd.conf[1746] Failed to parse authenticate section. If I comment out the "use Data::Dumper;" line, freeradius starts ok, but then it does not send any attributes back to the Cisco AS5300, but only Access-Accept (or Access-Reject). Are there any ideas where could be the problem with loading the Data::Dumper module (since I assume that not sending the attributes back is caused by commenting out the "use Data::Dumper;" line)? Thanks in advance. Sincerely, Nikola Pavkovic

2 2

1.1.2 compile issues on Solaris
by Rob Shepherd 12 Jul '06

12 Jul '06

Hi freeradius, 1.1.2 won't compile on Solaris/GCC I gather this is a known issue. something to do with closefrom return type. What does to community suggest I do? use CVS? downgrade? wait for 1.1.3? apply a patch? regards and thanks rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 07776 210516

2 1

Framed-IP-Address accounted in Hex
by Graeme Hinchliffe 12 Jul '06

12 Jul '06

Hi, I have just (as of yesterday) upgraded FreeRADIUS from 1.0.3 to 1.1.2 keeping all the same config files. I am running it on a Debian Woody system and using Postgres 7.4.7 as the database. This particular box is solely for RADACCT and only uses RADIUS as a test to test the state of the service/db for health checks. I have postgres configured to dump any SQL lines which throw up an error and I have seen a large number being logged failing to insert the Framed-IP-Address attribute, in the dumped SQL string the IP Address is a hex value instead of a dotted quad which fails the insert. The RADACCT packets causing this are not just coming from one NAS either, and accounting still seems to be happening on the most part. any ideas? or have i found a bug ? thanks ----- Graeme Hinchliffe (BSc) Core Systems Designer Zen Internet (http://www.zen.co.uk/) Direct: 0845 058 9074 Main : 0845 058 9000 Fax : 0845 058 9005

2 11

freeradius and router problem
by Moustapha Ould Maouloud 12 Jul '06

12 Jul '06

Hello, I have in my LAN a AC Access Conroller (IP: 192.168.10.80; gw: 192.168.10.1 /83.B.C.D) which I authenticate on a freeradius via Internet (IP of this server: 63.E.F.G). My server receives : access-request from 63.E.F.G:10980 . and fact: sending access accept to 63.E.F.G: 10980 My problem is that: the response of the radius does not reach AC (IP 192.168.10.80) although the answer was indeed turned over to my router!!! Someone can help me? Please Thanks; MOM --------------------------------- Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire.

1 1

Re: Problem with rlm_perl
by Boian Jordanov 12 Jul '06

12 Jul '06

Hi please use mailing list instead of writing to me directly. Regarding the trouble try reinstalling the Data::Dumper module and check that it is linked with correct perl library. On Wednesday 12 July 2006 03:09, you wrote: > Hello! > > I have a problem with rlm_perl. > > My Linux box is Debian Sarge (perl 5.8.4-8sarge4 from Debian packages), > with FreeRADIUS 1.1.2 compiled from source (using debian/rules). > > Debug output from freeradius is: > > Wed Jul 12 02:07:28 2006 : Debug: Module: Loaded perl > Wed Jul 12 02:07:28 2006 : Debug: perl: module = "/root/bin/alfatelkom.pm" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_authorize = "authorize" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_authenticate = "authenticate" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_accounting = "accounting" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_preacct = "preacct" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_checksimul = "checksimul" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_detach = "detach" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_xlat = "xlat" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_pre_proxy = "pre_proxy" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_post_proxy = "post_proxy" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_post_auth = "post_auth" > Wed Jul 12 02:07:28 2006 : Debug: perl: perl_flags = "(null)" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_start_accounting = "(null)" > Wed Jul 12 02:07:28 2006 : Debug: perl: func_stop_accounting = "(null)" > Can't load '/usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so' for module > Data::Dumper: /usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so: undefined > symbol: Perl_sv_cmp at /usr/lib/perl/5.8/XSLoader.pm line 68. at > /usr/lib/perl/5.8/Data/Dumper.pm line 27 > Compilation failed in require at /root/bin/alfatelkom.pm line 30. > BEGIN failed--compilation aborted at /root/bin/alfatelkom.pm line 30. > Wed Jul 12 02:07:28 2006 : Error: rlm_perl: perl_parse failed: > /root/bin/alfatelkom.pm not found or has syntax errors. Wed Jul 12 02:07:28 > 2006 : Error: radiusd.conf[540]: perl: Module instantiation failed. Wed Jul > 12 02:07:28 2006 : Error: radiusd.conf[1747] Unknown module "perl". Wed Jul > 12 02:07:28 2006 : Error: radiusd.conf[1746] Failed to parse authenticate > section. > > Thanks in advance, > Ivan Rako > University Computing Centre, Zagreb -- Best Regards, Boian Jordanov SNE Orbitel - Next Generation Telecom tel. +359 2 4004 723 tel. +359 2 4004 002

1 0