August 2006 - Freeradius-Users - lists.freeradius.org

Reply VSA-s in Access-Reject
by Yervand Petrosyan 30 Aug '06

30 Aug '06

Thank you for answers, Really, it would be reasonably to have this option configurable. Yervand On Wed 30 Aug 2006 12:13, Nicolas Baradakis wrote: > Yervand Petrosyan wrote: > > In 1.1.3 version Access-Reject doesn't return in reply > > VSA attributes but it is works well in 1.0.1. > > Something was changed? > > Yes, because it was considered as a bug. > See http://bugs.freeradius.org/show_bug.cgi?id=207 > > I also note Vendor-Specific attributes aren't allow in Access-Reject > packets per RFC 2865. (section 5.44) > See http://www.ietf.org/rfc/rfc2865.txt This is not the first time we have been asked this, and as it appears that some NASes used this behaviour, maybe we should make this rfc compliance a configurable option.. I have added a section to the FAQ: http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#VSA_in_Access-Reje… -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

no more anonymous@my.realm
by A.L.M.Buxey＠lboro.ac.uk 30 Aug '06

30 Aug '06

hi, got a small question for those used to xlate etc. I have a development/test setup here which is happily authenticating via EAP/TTLS and PEAP. however, what I am seeing is that Windows users using PEAP are having their real name logged and recorded, whereas the Mac TTLS and Windows TTLS folk are being recorded as anonymous(a)my.realm - ie the outer layer is being recorded as their username (the inner layer username is happily being used for the authorization stage so all is okay....but the NAS and authentication/accounting SQL are filled with the anonymous(a)my.realm now, the Windows PEAP users also have anonymous(a)my.realm as their outer ID but I believe its the 'Windows is a bit leaky with inner credentials' issue that is allowing their real ID to be caught and logged. whats the recommended way of fixing this? what have other people done to fix this? enabling features such as use_tunneled_reply and log_stripped_name havent helped... I am thinking that xlate is the way to go oh, and currently the RADPOSTAUTH table is showing the real ID and the anonymous ID which isnt helping the NAS which receives the anonymous part last. do I simply drop or discard the anonymous part when it gets to this proxy box? alan

1 0

Cannot compile and run on Mac OS X 10.4.7
by Michael Check 30 Aug '06

30 Aug '06

Hi all, We've tried to compile fr v1.1.2 on os x.4.7 with no luck. We've followed the instructions at doc/MACOSX (using --disable_shared - the mod for the makefile for rlm_sql is already done in this version) but get the following errors during make (this is the tail of the make): /usr/bin/ld: multiple definitions of symbol _CRYPTO_lock /usr/lib/libcrypto.dylib(cryptlib.o) definition of _CRYPTO_lock /usr/local/mysql/lib/libmysqlclient_r.a(libtaocrypt_la-misc.o) definition of _CRYPTO_lock in section (__TEXT,__text) collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Error 1 make[3]: *** [common] Error 2 make[2]: *** [all] Error 2 make[1]: *** [common] Error 2 make: *** [all] Error 2 And cannot proceed further. --- If you try and compile _without_ --disable_shared, the we get through make with this at the end: /usr/local/src/freeradius-1.1.2/libtool --mode=link gcc -o radwho radwho.lo util.lo log.lo conffile.lo -lresolv -lpthread ../lib/libradius.la gcc -o .libs/radwho radwho.o util.o log.o conffile.o -lresolv -lpthread -L../lib/.libs -lradius creating radwho Making all in raddb... make[2]: Nothing to be done for `all'. Making all in scripts... make[2]: Nothing to be done for `all'. Making all in doc... Making all in examples... /usr/bin/make -C examples all make[4]: Nothing to be done for `all'. Making all in rfc... /usr/bin/make -C rfc all make[4]: Nothing to be done for `all'. The make install has these ominous warning while linking all the libraries for each rlm: ---------------------------------------------------------------------- Making install in rlm_realm... if [ "xrlm_realm" != "x" ]; then \ /usr/local/src/freeradius-1.1.2/libtool --mode=install /usr/local/src/freeradius-1.1.2/install-sh -c -c \ rlm_realm.la /usr/local/lib/rlm_realm.la || exit $?; \ rm -f /usr/local/lib/rlm_realm-1.1.2.la; \ ln -s rlm_realm.la /usr/local/lib/rlm_realm-1.1.2.la || exit $?; \ fi libtool: install: warning: relinking `rlm_realm.la' (cd /usr/local/src/freeradius-1.1.2/src/modules/rlm_realm; /bin/sh /usr/local/src/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -module -export-dynamic -o rlm_realm.la -rpath /usr/local/lib rlm_realm.lo rlm_realm.c /usr/local/src/freeradius-1.1.2/src/lib/libradius.la -lresolv -lpthread) gcc -dynamiclib -flat_namespace -undefined suppress -o .libs/rlm_realm-1.1.2.so rlm_realm.lo /usr/local/lib/libradius.dylib -lresolv -lpthread -lc -install_name /usr/local/lib/rlm_realm-1.1.2.so /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm-1.1.2.soT /usr/local/lib/rlm_realm-1.1.2.so (cd /usr/local/lib && rm -f rlm_realm.so && ln -s rlm_realm-1.1.2.so rlm_realm.so) /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm.lai /usr/local/lib/rlm_realm.la /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm.a /usr/local/lib/rlm_realm.a ranlib /usr/local/lib/rlm_realm.a chmod 644 /usr/local/lib/rlm_realm.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable during execution See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- AND FOR PERL: Making install in rlm_perl... /usr/local/src/freeradius-1.1.2/install-sh -c -m 755 example.pl /usr/local/etc/raddb if [ "xrlm_perl" != "x" ]; then \ /usr/local/src/freeradius-1.1.2/libtool --mode=install /usr/local/src/freeradius-1.1.2/install-sh -c -c \ rlm_perl.la /usr/local/lib/rlm_perl.la || exit $?; \ rm -f /usr/local/lib/rlm_perl-1.1.2.la; \ ln -s rlm_perl.la /usr/local/lib/rlm_perl-1.1.2.la || exit $?; \ fi libtool: install: warning: relinking `rlm_perl.la' (cd /usr/local/src/freeradius-1.1.2/src/modules/rlm_perl; /bin/sh /usr/local/src/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -module -export-dynamic -o rlm_perl.la -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /usr/local/src/freeradius-1.1.2/src/lib/libradius.la -L/usr/local/lib /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a -L/System/Library/Perl/5.8.6/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lc -lresolv -lpthread) *** Warning: This library needs some functionality provided by /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. gcc -dynamiclib -flat_namespace -undefined suppress -o .libs/rlm_perl-1.1.2.so rlm_perl.lo /usr/local/lib/libradius.dylib -L/usr/local/lib -L/System/Library/Perl/5.8.6/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lc -lresolv -lpthread -lc -install_name /usr/local/lib/rlm_perl-1.1.2.so /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl-1.1.2.soT /usr/local/lib/rlm_perl-1.1.2.so (cd /usr/local/lib && rm -f rlm_perl.so && ln -s rlm_perl-1.1.2.so rlm_perl.so) /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl.lai /usr/local/lib/rlm_perl.la /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl.a /usr/local/lib/rlm_perl.a ranlib /usr/local/lib/rlm_perl.a chmod 644 /usr/local/lib/rlm_perl.a AND RUNNING sudo radiusd -X, the following error results: read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd.conf[1565] Failed to link to module 'rlm_exec': dlopen(/usr/local/lib/rlm_exec-1.1.2.so, 9): Symbol not found: _debug_flag Referenced from: /usr/local/lib/rlm_exec-1.1.2.so Expected in: flat namespace AND QUITS IMMEDIATELY --- We tried googling around and we're happy to hear that freeradius will be a part of 10.5, but we'd like to get it running now... There really is no other docs we've found on getting it compiled (after difficulty like the above) and installed. Certainly nothing recent anyway. Is it true that it _should_ just work? :) Thanks in advance for any assistance, Michael Check

7 16

Checking Service-Type with checkval and mysql
by Guilhem MORE-CAUSSE 30 Aug '06

30 Aug '06

Hello I am currently trying to have my FreeRadius server check the "Service-Type" values, and reject Login attempts from a user that should be used for service-type Outbound only. My client equipment always send the "Service-Type" attribute in its requests. This attribute is defined into the check databases, but debug mode says: >>Debug: rlm_checkval: Could not find attribute named Service-Type in check pairs I really do not see what is wrong and why value checking is not done properly. It should find the attribute in the database, and reject the request. Can you help me out ? Below is my radcheck table, relevant parts of my radiusd.config and the debug output. mysql> select * from radcheck; +----+----------+--------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+--------------+----+----------+ | 3 | admin | Password | == | cisco | | 5 | admin | Service-Type | == | Outbound | +----+----------+--------------+----+----------+ checkval { item-name = Service-Type check-name = Service-Type data-type = string notfound-reject = yes } //... authorize { preprocess chap suffix eap #files sql checkval } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } eap } rad_recv: Access-Request packet from host 10.10.107.68:1645, id=6, length=86 NAS-IP-Address = 10.10.107.68 NAS-Port = 500 NAS-Port-Type = Virtual User-Name = "admin" Calling-Station-Id = "XXX.XXX.XXX.XXX" User-Password = "cisco" Service-Type = Login-User Wed Aug 30 11:30:13 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 11:30:13 2006 : Debug: modcall: entering group authorize for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_realm: No '@' in User-Name = "admin", looking up realm NULL Wed Aug 30 11:30:13 2006 : Debug: rlm_realm: No such realm "NULL" Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 1 Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'admin' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'admin' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'admin' ORDER BY id' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'admin' ORDER BY id' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): Released sql socket id: 3 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "sql" returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling checkval (rlm_checkval) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_checkval: Item Name: Service-Type, Value: Login-User Wed Aug 30 11:30:13 2006 : Debug: rlm_checkval: Could not find attribute named Service-Type in check pairs Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from checkval (rlm_checkval) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "checkval" returns notfound for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall: group authorize returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: auth: type Local Wed Aug 30 11:30:13 2006 : Debug: auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 6 to 10.10.107.68:1645 Cisco-AVPair += "ipsec:tunnel-password=admin123" Cisco-AVPair == "ipsec:addr-pool=admin" Cisco-AVPair == "ipsec:inacl=admin" Service-Type == Outbound-User Cisco-AVPair += "shell:priv-lvl=0" Cisco-AVPair += "ipsec:key-exchange=ike" Cisco-AVPair += "ipsec:key-exchange=preshared-key" Tunnel-Type:0 == ESP Wed Aug 30 11:30:13 2006 : Debug: Finished request 1 Wed Aug 30 11:30:13 2006 : Debug: Going to the next request Thanks for your help ! G.

1 0

Reply VSA-s in Access-Reject
by Yervand Petrosyan 30 Aug '06

30 Aug '06

Hello, In 1.1.3 version Access-Reject doesn't return in reply VSA attributes but it is works well in 1.0.1. Something was changed? Thanks in advance, Yervand __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

public key for source signature
by Jonathan Casiot 30 Aug '06

30 Aug '06

Hi I've downloaded the most recent source, freeradius-1.1.3.tar.gz, and I'd like to verify the file against the PGP signature but I can't find the public key anywhere. Can someone point me to it's location? Thanks -- Jonathan

2 1

LDAP authentication
by Lin Richardson 30 Aug '06

30 Aug '06

A general question that I have not seen in the forum. I want to authenticate against LDAP... BUT I don't want to use the LDAP password as the password in every case. In a remote connectivity solution I want to check the remotepassword attribute for authentication. Problem is (as I see it), that the real LDAP password is not passed in with the remote connectivity request, so the request seems to be failing. If I make the request with the LDAP password, it succeeds. So my question, and I know that there is a caveat about a cleartext password being required for LDAP authentication, is: Can I make a request to freeradius that gets passed to LDAP but only requires the password to be checked against an attribute of the username, NOT the real LDAP password. Any insight/experience or pointers to helpful doc sources would be appreciated. Regards, Lin Richardson

2 4

Error 403 Dialupadmin
by toink_lagi_enak 29 Aug '06

29 Aug '06

Dear users, i've already configured my pc with freeradius 1.1.2, and after i configured, there still error to load the web page of dialupadmin. I tried some advices : changed the permission of the directory of dialupadmin into 701, added the directory on httpd.conf change the value allowoverride allow, but still got Error 403 about permission denied. My Distro : Linux Trustix 2.2 Kernel : 2.4.32-1tr Sorry for my bad english -- Thanks, Thohir http://toinkers.blogspot.com/

1 0

RE: Building Freeradius RPM on Redhat ES 4.0
by Sandworm 29 Aug '06

29 Aug '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday, 30 August 2006 10:19 AM, Michael King wrote: > > > -----Original Message----- > > I saw this last week building 1.1.3 on RHEL 4.0 ES (Update 3) too. > > Was fixed > > by just applying the latest patches from Redhat. Appears to > > be due to a mismatch between various software levels. With > > the latest fixes, it is all OK. > > > > > Which patches? Just run Up2date and all should be well? > Should be. We have an internal yum repository that collects all the latest updates from Redhat. I just did a "yum -y update" and all was well. SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkT07JAACgkQmw4BJyaatJ1rmwCcD2A6uODCMCxsgc4E7HuQQrEQ6nkA oL3bMPfyWYoZiAAVwMKX7o1fDdNq =SQrq -----END PGP SIGNATURE-----

1 0

4 servers implementation
by Guilherme Franco 29 Aug '06

29 Aug '06

Please, anybody can help me? Thanks.

2 2