February 2007 - Freeradius-Users - lists.freeradius.org

Redundant Ldap Configuration + More groups
by nikitha 28 Feb '07

28 Feb '07

Hi All, Authentication take more time when 2 ldap servers are configured and one is not reachable. I have configured the redundant ldap module as specified in the doc. authorize { ;; ;; redundant { ldap-server-1 ldap-server-2 } } authenticate { ;; ;; Auth-Type LDAP { redundant { ldap-server-1 ldap-server-2 } } The corresponding ldap-server module confiugration is, ldap ldap-server-1 { .. .. } ldap ldap-server-2 { .. .. } 1. In the users file, added some 20 DEFAULT entry for ldap-server-1-Ldap-Group for ex., DEFAULT ldap-server-1-Ldap-Group == "g1" 2. After that added 30 DEFAULT entry for ldap-server-2-Ldap-Group, each DEFAULT entry is like, DEFAULT ldap-server-2-Ldap-Group == "g21" .. .. DEFAULT ldap-server-2-Ldap-Group == "g50" The ldap-server-1 is down now. only ldap-server-2 is reachable. When the request comes to the radius server, it goes one entry by entry in "users" file, ie., It connects to ldap-server-1 with the Ldap-Group tries from g1 till g20, and then connects to ldap-server-2 with Ldap-Group from "g21' till g50. If the user is part of Ldap-group "g50" it takes more time to return success, before itself the request times out, and received eap start again from wireless client. If the "number of DEFAULT entry for ldap-server-1" is less than 10, then it works fine. If the default entry increases, the server takes more time to process. I think redundant ldap server configuration is not correct or in some otherway we can fix it. Is it possible to configure the radius server in such a way that, try ldap-server-1 for the first policy, if its reachable then check it against the next policy. If its not reachable mark this server as dead or whatever and ignore processing the next coming DEFAULT entries which matches with ldap-server-1 and try to process ldap-server-2 entries. Please help me in solving this issue. Thanks for any help. Regards, Nikitha

2 3

[SOLVED] FreeRADIUS + LVS problem
by Sam Schultz 27 Feb '07

27 Feb '07

Brief Review: I had a working FreeRADIUS configuration doing EAP-TTLS wireless authentication that broke when put behind a 1:1 NAT/LVS. No faults were found in the FreeRADIUS configuration, so the NAT configuration was suspect. It likewise was found to have no faults (it's just a single SNAT & a single DNAT rule). After tcpdumping from the server, I discovered that FR was receiving requests via the correct interface/IP, but trying to send them out of a different (virtual) interface/IP. Obviously, this won't work, NAT or otherwise. The original test box was multi-homed, but the interfaces were bonded, so it didn't suffer from the same problem. The NAT just added an extra layer of complexity. The solution was to specifically bind to the correct interface/IP, just as you would with most daemons on a multi-homed box. This would seem to further prove that often the solution is simpler than you'd think :) -- Click to learn how to become a world famous writer or poet http://tagline.hushmail.com/fc/CAaCXv1P6EzvmffHZgm792Hv8Cn74zWV/

1 0

Compile error -- HELP
by ken 27 Feb '07

27 Feb '07

I am trying to install freeradius 1.1.4 on solaris 10 using the following commands. ../configure --without-rlm-x99-token configure creates the Makefile I then run make and get the following error:gcc -shared -Wl,-h -Wl,libradius-1.1.4.so -o .libs/libradius-1.1.4.so .libs/crypt.o ..libs/dict.o .libs/filters.o .libs/hash.o .libs/hmac.o .libs/hmacsha1.o ..libs/isaac.o .libs/log.o .libs/misc.o .libs/missing.o .libs/md4.o ..libs/md5.o .libs/print.o .libs/radius.o .libs/rbtree.o .libs/sha1.o ..libs/snprintf.o .libs/token.o .libs/udpfromto.o .libs/valuepair.o -lcrypt -lc (cd .libs && rm -f libradius.so && ln -s libradius-1.1.4.so libradius.so) false cru .libs/libradius.a crypt.o dict.o filters.o hash.o hmac.o hmacsha1.o isaac.o log.o misc.o missing.o md4.o md5.o print.o radius.o rbtree.o sha1.o snprintf.o token.o udpfromto.o valuepair.o make[4]: *** [libradius.la] Error 1 make[4]: Leaving directory `/export/home/freeradius-1.1.4/src/lib' make[3]: *** [common] Error 2 make[3]: Leaving directory `/export/home/freeradius-1.1.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/export/home/freeradius-1.1.4/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/export/home/freeradius-1.1.4' make: *** [all] Error 2 Thanks _________________________________________________________________ Win a Zunemake MSN® your homepage for your chance to win! http://homepage.msn.com/zune?icid=hmetagline

3 2

Set Pool-Name based on Framed-Pool
by Pasi Kärkkäinen 27 Feb '07

27 Feb '07

Hi list! I'm having problems setting Freeradius internal "Pool-Name" attribute based on "Framed-Pool" attribute (in proxy auth reply). users file: DEFAULT Framed-Pool == "tech", Pool-Name := tech_ippool Fall-Through = 1 I can see the "Framed-Pool" attribute in proxy auth reply (with correct value), but when freeradius is processing "users" file, the above line does not match.. What's wrong with that line? Thanks! -- Pasi

2 3

test Radius with XSupplicant
by Amin BEN ABDALLAH 27 Feb '07

27 Feb '07

in order to test my FreeRadius, I wanted to install XSupplicant-1.2.8, however the installation process failed because of a iwlib.h problem checking for iwlib.h... no configure: error: header file <iwlib.h> is required for Xsupplicant despite that I have already wireless-tools-devel installed. It means that the header iwlib.h exists in /usr/include Please help .. thanks in advance Amin BEN ABDALLAH

2 1

huntgroups & Calling-Station-ID
by tnt＠kalik.co.yu 26 Feb '07

26 Feb '07

We have a problem with filtering users from a telco exchange that isn't sending us CallerID's. We have on-line account opening, and all new accounts have 5 hours access. Users with full CallerID's are easily stopped from abusing the system and using extra accounts. If the exchange isn't sending full Calling-Station-ID, but only 4 or 5 numbers we can filter the users by using hungroups: goodone Calling-Station-ID = 12345, User-Name = gooduser SQL-Group = dial (this will let that user connect) banthem Calling-Station-ID = 12345 SQL-Group = reject (this will stop all others) What can we do when NAS doesn't have any Calling-Station-ID to send? Ivan

2 4

Re: Installing Error
by Erol Toksöz 26 Feb '07

26 Feb '07

İt does not produce any error. Configure proccess does not recognize that gcc-3.46 is installed, only says that there is no gcc installed. ---------------------------------------------------------------------------- -------------- Date: Thu, 22 Feb 2007 17:11:03 +0200 From: Peter Nixon <listuser(a)peternixon.net> Subject: Re: ?nstalling error To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200702221711.03940.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-9" On Thu 22 Feb 2007 09:21, Erol Toks?z wrote: > Hi, > > I am trying to install Freeradius server on my SUN Solaris 2.8 unix > server. After installed gcc.2.95. During ./configure it gives error below > > .... > .... > checking for gmake... no > checking for make... /usr/ccs/bin/make > configure: error: GNU Make is not installed. Please download and install > it from ftp://prep.ai.mit.edu/pub/gnu/make/ before continuing. > > > I visited this site and found make.3.81 but it needs gcc3.46 or higher > version. > But freeradius installer doesn't like gcc3.46. I am happily compiling with many different gcc versions. My notebook runs gcc-4.1.3 for example. What error message did you receive with gcc-3.46? ---------------------------------------------------------------------------- -------------------------------------- Erol Toksöz Araştırmacı TÜBİTAK MAM Bilişim Teknolojileri Enstitüsü Tel: +90(262)677 2625 Fax:+90(262)646 3187 <mailto:erol.toksoz@bte.mam.gov.tr> www.mam.gov.tr

2 1

Latest CVS - compilation error - conffile.c:902: error: conflicting types for 'cf_section_parse'
by tzieleniewski 26 Feb '07

26 Feb '07

Hi ! I tried to install the latest cvs version of freeradius, I did make clean ./configure make - and here I got the following error: conffile.c:902: error: conflicting types for 'cf_section_parse' /home/radius/src/radiusd/src/freeradius-devel/conffile.h:56: error: previous declaration of 'cf_section_parse' was here conffile.c: In function 'cf_section_parse': conffile.c:933: warning: passing argument 1 of 'cf_section_parse' discards qualifiers from pointer target type conffile.c: In function 'cf_pair_find': conffile.c:1312: warning: assignment discards qualifiers from pointer target type conffile.c: In function 'cf_pair_find_next': conffile.c:1395: warning: passing argument 1 of 'cf_pairtoitem' discards qualifiers from pointer target type make[4]: *** [conffile.lo] Błąd 1 make[3]: *** [common] Błąd 2 make[2]: *** [all] Błąd 2 make[1]: *** [common] Błąd 2 make: *** [all] Błąd 2 I have never had such problem before. What did I miss?? Bests -Tomasz

2 1

ippool support for eap/tls
by Graeme Crawford 26 Feb '07

26 Feb '07

Hi, i read a post from 2004 where freeradius' ippool does not support assigning ip's to eap/tls supplicants and was wondering if that is still the case? Regards, g|c

3 2

Newbie question
by M. Onur ERGiN 26 Feb '07

26 Feb '07

Hello, I am pretty new to radius.. I have installed the latest version on Fedora Core 5. I configured my AP. But now, I can't figure out how will the wireless clients authenticate. How will they enter their username/passwords? Thanks, Onur. --------------------------------- Looking for earth-friendly autos? Browse Top Cars by "Green Rating" at Yahoo! Autos' Green Center.

5 5