March 2007 - Freeradius-Users - lists.freeradius.org

Help needed with Realms (Freeradius) Urgent!
by virulence 19 Mar '07

19 Mar '07

Currently I have my multiple realms up at proxy.conf up and going but everytime I do a radtest my user is able to authenticate with the multiple realms which I do not want to after stripping the realm. e.g. abc(a)company.com : login ok abc(a)company1500.com :login ok Is there a way to just "bind" the user abc to auth to just company.com and prevent cross authentication. Any help is appreciated or does anyone know how to specify a user to a single realm. Thanks -- View this message in context: http://www.nabble.com/Help-needed-with-Realms-%28Freeradius%29-Urgent%21-tf… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 18

Re : CA.all
by Eshun Benjamin 19 Mar '07

19 Mar '07

Who has CA.all script for generating test certificates for testng purpose on radius. Link me up. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 19 Mars 2007, 9h31mn 22s Objet : Re: Authentication against an executable and mysql Kenneth Penza wrote: > I am trying to get user authenticated against a > shell script. I have added the following configuration > to freeradius: > > under the modules section i have added > exec myauth { > wait = yes > program = > "/etc/raddb/myscripts/auth.sh %{User-Name}" > input_pairs = request > output_pairs = reply > packet_type = Access-Request > } > and under the authorize section I have added > myauth And what's in the "authenticate" section? You say you want to authenticate, but you haven't touched any of the "authenticate" configuration. If you're just executing a shell script, see "Exec-Program-Wait", it's in the documentation. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

2 1

Mysql failover
by Luis Galán 19 Mar '07

19 Mar '07

Hello! I have configured mysql failover on my Freeradius and it seems to do starnge things. 1.- If my mysql server 1 is down and mysql server 2 is up. And I try to start the freeradius daemon, it returns me an error like that: Fri Mar 16 12:06:37 2007 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Mar 16 12:06:37 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Mar 16 12:06:37 2007 : Info: rlm_sql (sql1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Mar 16 12:06:37 2007 : Info: rlm_sql (sql1): Attempting to connect to raduser1@mysql01.es.clara.net:/radius Fri Mar 16 12:06:37 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Mar 16 12:06:37 2007 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server raduser1@mysql01.es.clara.net:radius Fri Mar 16 12:06:37 2007 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on 'mysql01.es.clara.net' (111)' Fri Mar 16 12:06:37 2007 : Error: rlm_sql (sql1): Failed to connect DB handle #0 Fri Mar 16 12:06:37 2007 : Info: rlm_sql (sql1): There are no DB handles to use! skipped 5, tried to connect 0 Fri Mar 16 12:06:37 2007 : Error: rlm_sql (sql1): generate_sql_clients() returned error Fri Mar 16 12:06:37 2007 : Error: radiusd.conf[14]: sql1: Module instantiation failed. Fri Mar 16 12:06:37 2007 : Error: radiusd.conf[1590] Unknown module "sql1". Fri Mar 16 12:06:37 2007 : Error: radiusd.conf[1590] Failed to parse "sql1" subsection. Fri Mar 16 12:06:37 2007 : Error: radiusd.conf[1517] Failed to parse authorize section. 2.- If I start freeradius daemon and my 2 mysql server is up, all works fine (obviously), but if my mysql server 1 fails, freeradius still works (Great!!). Then it seems that the problem is only at the start time. Is it Right? Is it a bug? Do I have misconfigured anything? Any idea? Thanks. Luis

4 4

Freeradius-mysql and freeradius 1.1.5
by posticchio＠inwind.it 19 Mar '07

19 Mar '07

Hi, i have installed freeradius 1.1.5 on debian machine now how i can install freeradius-mysql package? When i try 'apt-get install freeradius-mysql' this is the error: Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: freeradius-mysql Depends: freeradius(= 1.0.2-4sarge3) but 1.1.3 is to be installed E: Broken packages Help i can't use mysql 5 database with freeradius in this situation. i need freeradius-mysql. Andrea ------------------------------------------------------ Leggi GRATIS le tue mail con il telefonino i-mode di Wind http://i-mode.wind.it

2 1

How do I not set Auth-Type?
by John T. Guthrie 19 Mar '07

19 Mar '07

Hello all, I have a configuration where I allow users to get onto the wireless network by authenticating with EAP-TLS or with EAP-GTC inside of EAP-TTLS. If they have a cert, then they authenticate with EAP-TLS, and if they have a password, then they authenticate with EAP-TTLS/EAP-GTC which in turn authenticates against Kerberos. In addition, there are some admins who need to log into the access point's command shell. I would like these to be authenticated against the same Kerberos server, but everyone else should get rejected. As it turns out, I have a configuration that accomplishes all of this *perfectly*. In radiusd.conf, I have: modules { ... krb5 { } ... } ... authenticate { ... Auth-Type Kerberos { krb5 } ... } Then, in the users file, I have: "admin1" NAS-Port-Type == "Virtual", Auth-Type = Kerberos "admin2" NAS-Port-Type == "Virtual", Auth-Type = Kerberos ... DEFAULT NAS-Port-Type == "Virtual", Auth-Type := Reject # This authenticates wireless users DEFAULT NAS-Port-Type == "Wireless-802.11", Auth-Type = Kerberos I should stress, this accomplishes *exactly* what I want. That said, it also involves explicit setting of Auth-Type. I have seen in more than one place that this is a Bad Thing(TM). My first question is how do I accomplish what the above configuration does without this explicit Auth-Type setting? (Or is the above configuration marginally acceptable because it only sets Auth-Type when it isn't already set?) Should I only be defining one authentication module that involves User-PAssword? More generally, suppose that you have two different authentication modules, say unix and krb5, that use User-Password. How does FreeRADIUS tell which users are supposed to use unix and which are supposed to use krb5? (Assuming that you want some to use one, and some to use the other.) That is, how does RADIUS know what the "right thing" is in that case with being told explicitly? Thanks in advance. P.S. Before anyone says anything, I have read the documentation. More than once. It could very easily be that I have missed something totally obvious though. -- John Guthrie guthrie(a)counterexample.org

3 6

Authentication against an executable and mysql
by Kenneth Penza 19 Mar '07

19 Mar '07

People, How can I make the RADIUS server check that two conditions, the result of the authentication against MySQL (already working) and on the exit status of an executable (the executable that sets the exit status depending on the outcomes of the check). I want the authentication to success if both tests are successful otherwise I want it to fail. Regards Kenneth ____________________________________________________________________________________ Bored stiff? Loosen up... Download and play hundreds of games for free on Yahoo! Games. http://games.yahoo.com/games/front

2 3

authentication against script problem
by Kenneth Penza 19 Mar '07

19 Mar '07

People, I am trying to get user authenticated against a shell script. I have added the following configuration to freeradius: under the modules section i have added exec myauth { wait = yes program = "/etc/raddb/myscripts/auth.sh %{User-Name}" input_pairs = request output_pairs = reply packet_type = Access-Request } and under the authorize section I have added myauth The contents of the script: [root@fedora5 raddb]# cat /etc/raddb/myscripts/auth.sh #!/bin/bash echo $1 >> /tmp/myauth.out exit 0 [root@fedora5 raddb]# On restarting the server,and attempting to connect to the radius server I get [root@fedora5 ~]# echo "User-Name=user1,User-Password=pass1" |radclient -x localhost:1812 auth testing123 Sending Access-Request of id 244 to 127.0.0.1:1812 User-Name = "user1" User-Password = "pass1" rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=244, length=20 [root@fedora5 ~]# and in the session from I have started he radius server using /usr/sbin/radiusd -X -A I get: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32772, id=244, length=45 User-Name = "user1" User-Password = "pass1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: '/etc/raddb/myscripts/auth.sh user1' Exec-Program: /etc/raddb/myscripts/auth.sh user1 Exec-Program output: Exec-Program: returned: 0 modcall[authorize]: module "myauth" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [user1/pass1] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 244 to 127.0.0.1:32772 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 244 with timestamp 45fd3d21 Nothing to do. Sleeping until we see a request. I am missing some configuration? Thanks in advance for you help Kenneth ____________________________________________________________________________________ Looking for earth-friendly autos? Browse Top Cars by "Green Rating" at Yahoo! Autos' Green Center. http://autos.yahoo.com/green_center/

1 0

howto define Auth-Type in perl script?
by Markus Krause 18 Mar '07

18 Mar '07

Hi list! i am writing a perl script to authorize and authenticate users. authorization works (so the script itself works and seems to be used by freeradius as expected) but as i do not know how to define the Auth-Type with the perl script i get the following error message "no Auth-Type found" when running radiusd -XAs. How can i set "Auth-Type" from a perl script or how is this done correctly? Thanks in advance for any hints! regards, markus +-----------------------------------------------------------------+ | Markus Krause, Mogli-Soft | | Support for Mac OS X, Webmail/Horde, LDAP, RADIUS, MySQL | | by order of the | | Computing Center of the Max-Planck-Institute of Biochemistry | +--------------------------------+--------------------------------+ | E-Mail: krause(a)biochem.mpg.de | Tel.: 089 - 89 40 85 99 | | markus.krause(a)mac.com | Fax.: 089 - 89 40 85 98 | | Skype: markus.krause | iChat: markus.krause(a)mac.com | +--------------------------------+--------------------------------+ ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Problem with fr1.1.5
by Ronaldo Zhou 18 Mar '07

18 Mar '07

Hi everyone, I download freeradius1.1.5 and compiled with no problem on my FC4, but when I try to start radiusd, I got: [root@localhost freeradius-1.1.5]# radiusd bash: radiusd: command not found [root@localhost freeradius-1.1.5]# whereis radiusd radiusd: /usr/local/sbin/radiusd [root@localhost freeradius-1.1.5]# /usr/local/sbin/radiusd Mon Mar 19 07:35:06 2007 : Info: Starting - reading configuration files ... *** glibc detected *** /usr/local/sbin/radiusd: double free or corruption (fasttop): 0x09557e68 *** ======= Backtrace: ========= /lib/libc.so.6[0x5b1424] /lib/libc.so.6(__libc_free+0x77)[0x5b195f] /usr/local/lib/libltdl.so.3[0x692a50] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xc3)[0x69351f] /usr/local/sbin/radiusd(find_module_instance+0x1bd)[0xc84fb5] /usr/local/sbin/radiusd(setup_modules+0x1c0)[0xc857b0] /usr/local/sbin/radiusd(main+0x3b0)[0xc88814] /lib/libc.so.6(__libc_start_main+0xc6)[0x562de6] /usr/local/sbin/radiusd[0xc7dcb5] ======= Memory map: ======== 00111000-0012b000 r-xp 00000000 08:02 2710181 /lib/ld-2.3.5.so 0012b000-0012c000 r--p 00019000 08:02 2710181 /lib/ld-2.3.5.so 0012c000-0012d000 rw-p 0001a000 08:02 2710181 /lib/ld-2.3.5.so 0012d000-0013c000 r-xp 00000000 08:02 2710187 /lib/libresolv-2.3.5.so 0013c000-0013d000 r--p 0000e000 08:02 2710187 /lib/libresolv-2.3.5.so 0013d000-0013e000 rw-p 0000f000 08:02 2710187 /lib/libresolv-2.3.5.so 0013e000-00140000 rw-p 0013e000 00:00 0 00140000-0014e000 r-xp 00000000 08:02 2710185 /lib/libpthread-2.3.5.so 0014e000-0014f000 r--p 0000d000 08:02 2710185 /lib/libpthread-2.3.5.so 0014f000-00150000 rw-p 0000e000 08:02 2710185 /lib/libpthread-2.3.5.so 00150000-00152000 rw-p 00150000 00:00 0 00152000-00165000 r-xp 00000000 08:05 1763352 /usr/local/lib/libradius- 1.1.5.so 00165000-00166000 rw-p 00013000 08:05 1763352 /usr/local/lib/libradius- 1.1.5.so 00166000-00167000 rw-p 00166000 00:00 0 00167000-0019c000 r-xp 00000000 08:02 2710192 /lib/libssl.so.0.9.7f 0019c000-0019f000 rw-p 00035000 08:02 2710192 /lib/libssl.so.0.9.7f 0019f000-00297000 r-xp 00000000 08:02 2710191 /lib/libcrypto.so.0.9.7f 00297000-002a9000 rw-p 000f8000 08:02 2710191 /lib/libcrypto.so.0.9.7f 002a9000-002ac000 rw-p 002a9000 00:00 0 002ac000-0031b000 r-xp 00000000 08:05 4116627 /usr/lib/libkrb5.so.3.2 0031b000-0031e000 rw-p 0006e000 08:05 4116627 /usr/lib/libkrb5.so.3.2 0031e000-00320000 r-xp 00000000 08:05 1763454 /usr/local/lib/rlm_exec- 1.1.5.so 00320000-00321000 rw-p 00001000 08:05 1763454 /usr/local/lib/rlm_exec- 1.1.5.so 00340000-00363000 r-xp 00000000 08:05 4116626 /usr/lib/libk5crypto.so.3.0 00363000-00364000 rw-p 00023000 08:05 4116626 /usr/lib/libk5crypto.so.3.0 0054e000-00672000 r-xp 00000000 08:02 2710182 /lib/libc-2.3.5.so 00672000-00674000 r--p 00124000 08:02 2710182 /lib/libc-2.3.5.so 00674000-00676000 rw-p 00126000 08:02 2710182 /lib/libc-2.3.5.so 00676000-00678000 rw-p 00676000 00:00 0 0068c000-0068e000 r-xp 00000000 08:02 2710184 /lib/libdl-2.3.5.so 0068e000-0068f000 r--p 00001000 08:02 2710184 /lib/libdl-2.3.5.so 0068f000-00690000 rw-p 00002000 08:02 2710184 /lib/libdl-2.3.5.so 00690000-00695000 r-xp 00000000 08:05 1763347 /usr/local/lib/libltdl.so.3.1.4 00695000-00696000 rw-p 00004000 08:05 1763347 /usr/local/lib/libltdl.so.3.1.4 006b0000-006c2000 r-xp 00000000 08:02 2710193 /lib/libnsl-2.3.5.so 006c2000-006c3000 r--p 00011000 08:02 2710193 /lib/libnsl-2.3.5.so 006c3000-006c4000 rw-p 00012000 08:02 2710193 /lib/libnsl-2.3.5.so 006c4000-006c6000 rw-p 006c4000 00:00 0 006e0000-006e5000 r-xp 00000000 08:02 2710199 /lib/libcrypt-2.3.5.so 006e5000-006e6000 r--p 00004000 08:02 2710199 /lib/libcrypt-2.3.5.so 006e6000-006e7000 rw-p 00005000 08:02 2710199 /lib/libcrypt-2.3.5.so 006e7000-0070e000 rw-p 006e7000 00:00 0 0099f000-009a1000 r-xp 00000000 08:02 2710190 /lib/libcom_err.so.2.1 009a1000-009a2000 rw-p 00001000 08:02 2710190 /lib/libcom_err.so.2.1 00c79000-00c95000 r-xp 00000000 08:05 1763568 /usr/local/sbin/radiusd 00c95000-00c96000 rw-p 0001c000 08:05 1763568 /usr/local/sbin/radiusd 00c96000-00c97000 rw-p 00c96000 00:00 0 00cb1000-00cba000 r-xp 00000000 08:02 2709173 /lib/libnss_files-2.3.5.so 00cba000-00cbb000 r--p 00008000 08:02 2709173 /lib/libnss_files-2.3.5.so 00cbb000-00cbc000 rw-p 00009000 08:02 2709173 /lib/libnss_files-2.3.5.so 00de7000-00de8000 r-xp 00de7000 00:00 0 00dfc000-00dfe000 r-xp 00000000 08:05 4115774 /usr/lib/libkrb5support.so.0.0 00dfe000-00dff000 rw-p 00001000 08:05 4115774 /usr/lib/libkrb5support.so.0.0 00dff000-00e15000 r-xp 00000000 08:05 4116628 /usr/lib/libgssapi_krb5.so.2.2 00e15000-00e16000 rw-p 00016000 08:05 4116628 /usr/lib/libgssapi_krb5.so.2.2 00f56000-00f5f000 r-xp 00000000 08:02 2710186 /lib/libgcc_s- 4.0.0-20050520.so.1 00f5f000-00f60000 rw-p 00009000 08:02 2710186 /lib/libgcc_s- 4.0.0-20050520.so.1 00f70000-00f82000 r-xp 00000000 08:05 4116618 /usr/lib/libz.so.1.2.2.2 00f82000-00f83000 rw-p 00011000 08:05 4116618 /usr/lib/libz.so.1.2.2.2 094e8000-095cf000 rw-p 094e8000 00:00 0 [heap] b7d00000-b7d21000 rw-p b7d00000 00:00 0 b7d21000-b7e00000 ---p b7d21000 00:00 0 b7f01000-b7f05000 rw-p b7f01000 00:00 0 b7f17000-b7f19000 rw-p b7f17000 00:00 0 bfae5000-bfb19000 rw-p bfae5000 00:00 0 [stack] Does anyone know how it comes? Thanks! -- Ronaldo

1 0

Re : version 2; I cant wait
by Eshun Benjamin 18 Mar '07

18 Mar '07

Alan, great!!!!, I cant wait for the magic ......:-). ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Samedi, 17 Mars 2007, 17h46mn 18s Objet : Re: version 2 Norbert Wegener wrote: > On http://wiki.freeradius.org/Fail-over > I find an interesting feature, that would be very useful in some > configurations: ... > As mentioned there, it is available in version 2 of the server. > Is it already foreseeable, when approximately the version 2 of > freeradius will be available? Soon. I know I've been saying that for a while (too long now), but it looks pretty good. I have some code that has cleaned up a lot of the odd things in the server core, so I'm much more comfortable releasing a 2.0. So far, the features look like: - if/then/else in radiusd.conf - full IPv6 support - much more stable handling of home servers - separation of realms from home servers - addition of "home server pools", for failover & load balancing - magic feature 1 - magic feature 2 - :) I won't say what the magic features are. One will cause mild surprise. The other will cause great surprise. My plan right now is to test the code privately with a few early adopters who are sworn to secrecy. Once it looks like it works, the code will be made public, and a 2.0-pre0 will be announced. From my research on Google, the features will quadruple FreeRADIUS's potential install base. The features will also enable network administrators to do things that are currently impossible to do with open source software. And it looks like it's only 3k-4k lines of code. :) Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0