July 2006 - Freeradius-Users - lists.freeradius.org

freeradius configure line
by Roger Thomas 30 Jul '06

30 Jul '06

Despite several attempts, configure failed to locate my LDAP installation. I installed openLDAP in a non standard location: /etc/ldap.2.2.13 . I have tried freeradius configure like these: a) (includes and libraries) ./configure --with-ldap-includes=/etc/ldap.2.2.13/include --with-ldap-libraries=/etc/ldap.2.2.13/lib b) (include and lib) ./configure --with-ldap-include=/etc/ldap.2.2.13/include --with-ldap-lib=/etc/ldap.2.2.13/lib c) (DASH between rlm and ldap) ./configure --with-modules="rlm-ldap" --with-rlm-ldap-include-dir=/etc/ldap.2.2.13/include --with-rlm-ldap-lib-dir=/etc/ldap.2.2.13/lib d) (UNDERSCORE between rlm and ldap) ./configure --with-modules="rlm_ldap" --with-rlm_ldap-include-dir=/etc/ldap.2.2.13/include --with-rlm_ldap-lib-dir=/etc/ldap.2.2.13/lib and at aech attempt, I will get these warning messages: configure: warning: silently not building rlm_ldap. configure: warning: FAILURE: rlm_ldap requires: libldap_r. I don't think it is a question whether I have installed LDAP correctly BECAUSE if I were to install LDAP libs and headers in /usr/local/lib and /usr/local/include, then freeradius would not complain and everthing compiled smoothly. That said, there could be something that I have missed and I am sure someone has done this before. Please advise. -- Roger --------------------------------------------------- Sign Up for free Email at http://ureg.home.net.my/ ---------------------------------------------------

2 1

MySQL: Checking Attributes for multiple values
by Andreas Liebe 30 Jul '06

30 Jul '06

I try to set up a FreeRadius where any user can be a member of one or more groups. The groups should check which service the user is using. Access should be granted if one of the groups has a match. I used the docs at http://wiki.freeradius.org/index.php/Rlm_sql. The 2 groups in this example should check if the request is coming from concentrator A resp. B. If a user is member of both groups access should be granted if he's either using A or B, but only access through A is permitted. If a user is only member of group A or B then everything is fine. As it turns out the check for IP A is a match for the radius server and thus access is denied because the IP in the request is B. But according to the docs "==" should only match if both attribute and value matches. I would expect the first the not to be a match and to try the 2nd test next. When I change the Attribute in the 1st test from NAS-IP-Address to an attribute not in the request the access from IP B is granted. Probably I misunderstood the checking algorithm. Can you give me a hint how to configure this correctly? I tested with FreeRadius 1.1.2 and a pre 1.0. Thanks, -Andreas radcheck: | id | UserName | Attribute | op | Value | +------+-------------------------+-----------------+----+---------+ | 1 | joe | Password | == | blah | radreply: | id | UserName | Attribute | op | Value | +----+-----------------+--------------+----+-------+ | 1 | joe | Fall-Through | = | Yes | usergroup: | id | UserName | GroupName | +----+---------------------------+-----------+ | 1 | joe | My01group | | 2 | joe | My02group | radgroupcheck: | id | GroupName | Attribute | op | Value | +----+------------+----------------+----+-----------------+ | 1 | My01group | NAS-IP-Address | == | 10.11.12.13 | | 2 | My02group | NAS-IP-Address | == | 10.11.12.14 |

1 0

Distro with FreeRadius 1.1
by Graham Beneke 29 Jul '06

29 Jul '06

Hi All I'm trying to setup a FreeRadius 1.1.x - MySQL - phpMyPrepaid system. I'm looking for a distro that can get me there with the least path of resistance... I've currently got a dedicated box running FC4 and FreeRadius 0.9.x and I've been fumbling around for 2 weeks now and not getting anywhere. I found an RPM for ver 1.1.x and tried to install it but the system was unable to resolve a whole stack of dependencies. Tried to install from source and I got attacked by pages and pages of warnings and errors that i don't have a clue how to resolve... Thanks -- Graham Beneke Apolix Internet Services E-Mail: graham(a)apolix.co.za <mailto:graham@apolix.co.za> WEB: www.apolix.co.za <http://www.apolix.co.za/> Cell: 082-432-1873 <skype:+27824321873?call> Skype: grbeneke <skype:grbeneke?call>

4 4

mikrotik MSCHAPv2 MPPE pppoe
by Igor Smitran 29 Jul '06

29 Jul '06

I am trying to make mikrotik and freeradius work together. However, i can't make it work with pppoe MSCHAPv2 and MPPE. I only succeeded to make it work with PAP. I also tried to set freeradius in every combination that crossed my mind (use mppe, mppe strong, mschapv2, eap-peap....). Mikrotik sends access requests to freeradius but freeradius returns "<No User-Password Attribute> from client...". Maybe this isn't realy a question for freeradius list but can anybody help me? Thank you P.S. If admins feel that this doesn't belong to freeradius list they can delete this message.

2 2

authorize with files + ldap problem
by Wipat Srutiprom 29 Jul '06

29 Jul '06

On freeradius-1.0.4-1.FC4.1 come with fedora core 4. I want to authorize either UNIX user (/etc/passwd/) or LDAP user. /etc/raddb/users file is: DEFAULT Auth-Type = System Fall-Through = 1 I success with both LDAP user and UNIX user with /etc/raddb/radiusd.conf is: authorize { ldap files } Then I change the order in /etc/raddb/radiusd.conf to: authorize { files ldap } only UNIX user is be accept, but LDAP user is be reject. My sample radtest: radtest myuser mypassword localhost 0 testing123 My sample radius-x output: rad_recv: Access-Request packet from host 127.0.0.1:32775, id=165, length=56 User-Name = "myuser" User-Password = "mypassword" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for demo rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user demo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rad_recv: Access-Request packet from host 127.0.0.1:32775, id=165, length=56 Sending Access-Reject of id 165 to 127.0.0.1:32775 I wondor that after files modules failed, why not try LDAP modules? Do I need more config? Thanks for all help. --Wipat ----------------------------------------- This email was sent using SquirrelMail. https://front.psu.ac.th/ -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Problems on FC4
by Vida Luz Arista 28 Jul '06

28 Jul '06

Hi All I have installed rpm freeradius-1.0.4-1.FC4.1 on Fedora core 4, however I have the following problems, whe I use radtest for test my server radtest kiko "kako99" localhost 1812 testing123 Sending Access-Request of id 215 to 127.0.0.1:1812 User-Name = "vlal" User-Password = "vita99" NAS-IP-Address = smtp.cablenet.com.ni NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=215, length=20 All my user are of my system (/etc/passwd and /etc/shadow), I need to enable radius for dialuo users. I am testing the radius server with [root@mailproxy3 raddb]# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "(null)" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. I need you suggestions. Regards.

1 0

Re: LDAP and mySQL
by Roger Thomas 28 Jul '06

28 Jul '06

Quoting Nicolas Baradakis <nbk(a)sitadelle.com>: > > This is common to use OpenLDAP for auth and MySQL for acct. > > http://freeradius.org/radiusd/doc/ldap_howto.txt In that howto on the 2nd para of OVERVIEW: "The radius servers will be accepting Radius auth packets and Radius acct packets. The accounting packets will be stored locally on each radius server and then forwarded to the Accounting radius server, using radrelay. The Accounting radius server will store all the radius information in some sort of database such as MySQL, Postgres, or Oracle." Question: My setup is rather simple. Just one server at the moment that houses the LDAP, RADIUS and mySQL server. Would it be possible to make mySQL accept the acct packets by default and thus making no use of radrelay altogether? -- Roger --------------------------------------------------- Sign Up for free Email at http://ureg.home.net.my/ ---------------------------------------------------

5 5

(no subject)
by Elie Hani 28 Jul '06

28 Jul '06

Hi; I have this error in the log file: rlm_sql: packet has no account status type. [user '', nas x.x.x.x] Error: rlm_unix: no Accounting-Status-Type attribute in request. Error: rlm_radutmp: No Accounting-Status-Type record. I am using postgreSql Database. Any idea? Thanks Elie Hani

3 3

rlm_dbm with empty check and reply items
by Gabriel L. Somlo 28 Jul '06

28 Jul '06

Alan & all, I want to use rlm_dbm for authorization with no check or reply items. A user is authorized if he is listed in the dbm database, and not authorized if not present: modules { ... dbm { usersfile = ${confdir}/users.dbm } ... } ... authorize { ... dbm { notfound = reject } } So, what I need is a dbm file which has "empty" content associated with each username key. "Empty" actually means a "\n\n" string (first '\n' for no check items, second one for no reply items). I can create such a database by calling dbm routines from my own C code, and it works fine with the radiusd.conf excerpt above. HOWEVER, I would like to use the rlm_dbm_parser binary included with the freeradius package. The trouble is, this code checks for the length of each content record before inserting into the dbm file, and refuses to do so unless the record is more than 3 characters long (rlm_dbm_parser.c, line 158, inside function 'static int storecontent' as per freeradius-snapshot-20060728): static int storecontent (const char * username) { datum d,k; int res; if ( pdb == NULL || concntr < 3 ) return 1; /* ^^^^^^^^^^^^^^ */ DOUT2("store:\n%s\ncontent:\n%s",username,content); d.dptr = content; ... Is there a known good reason why this code wants length >=3, or why it prevents check items and reply items from being empty at the same time ? If yes, inquiring minds want to know :) If not, please apply the attached patch, which modifies the check from < 3 to < 2, allowing "empty" keys to be stored in the dbm. Thanks much, Gabriel

1 0

sql_set_user escaped user " HELP"
by ravi reddy 28 Jul '06

28 Jul '06

Hi Users I have been using FreeRadius-1.1.2 with Mysql database For accounting purpose only with combination of Sip-Express-Router So, here what's my problem is some accounting details are very fair but some are getting very rough data :- that means when call starts it logs like 4 to 5 records with starting time and when call stops it again logs in 5 to 6 records with acct stop time . For this reason "just for one call it is almost writing up to 10 Records and my database Engine is becoming very slow" So , how can I set the FreeRadius server so that it logs for one call only one record?. Below are some points i noticed "jack" calls "Billy" here radius server is setting records as sql_set_user escaped user---> jack when account starts and writing to database when acct stops sql_set_user escaped user-----> jack " here in this style i am getting only one record for one call" sql_set_user escaped user------>Billy " if its like this when act stops iam almost gettings 10 records for one call" SO, HOW I CAN SET THE SQL.CONF SO THAT , THE FREERADIUS SERVER BY DEFAULT IT HAS TO TAKE ONLY CALLED PERSON AS "sql_set_user escaped user " Please Help me Guys. Thank You. Regards, Ravi.

2 1