April 2007 - Freeradius-Users - lists.freeradius.org

FR + openldap + WPA, auth fails
by matthew zeier 18 Apr '07

18 Apr '07

With nearly the same config files as I had working on 1.0.1, I'm having problems with 1.1.6 authenticating WPA users. Probably something to do with this: rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for mzeier(a)mozilla.com with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: leaving group MS-CHAP (returns reject) for request 7 eap.conf - http://pastebin.mozilla.org/10218 radiusd.conf - http://pastebin.mozilla.org/10223 If there are other relevant files, let me know. Box is more or less a stock RHEL4. -- matthew zeier | Network Engineer | Mozilla Corp. | (650)903-0800 x219

2 6

Quick HOWTO : Ch31 : Centralized Logins Using LDAP and RADIUS - Fails on Fedora 6 + debug info
by Jacob Jarick 18 Apr '07

18 Apr '07

Just added debug output to help. Fedora 6, openldap rpms installed via smart package manager. slapd.conf: http://pastebin.ca/445851 tfxschool.internal.lidf: http://pastebin.ca/445852 root.ldif: http://pastebin.ca/445854 ldapusers.ldif: http://pastebin.ca/445855 "ldapadd -d9 -x -D "cn=Manager,dc=tfxschool,dc=internal" -W -f /etc/openldap/tfxschool.internal.ldif" -> http://pastebin.ca/445899 I decided to try setting up openldap in hopes of learning more about my error. I followed this howto http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch31_:_Cent… step by step and rechecked all configs etc when I got the following error. [root@fedora ~]# ldapadd -x -D "cn=Manager,dc=tfxschool,dc=internal" -W -f /etc/openldap/tfxschool.internal.ldif Enter LDAP Password: ldap_bind: Invalid credentials (49) additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece It seems to be similar if not the same problem I am having with FR refusing to auth via ldap to our ADS server. I am stuck though I have no idea how to resolve this error and unfortunately the howto assumes it just works. Google suggests that it may be the result of my domain string dc=tfxschool,dc=interternal, which looks correct to me. Our test domain is tfxschool.internal . any help / suggestions/ insight would be greatly appreciated. Thanks.

2 2

Quick HOWTO : Ch31 : Centralized Logins Using LDAP and RADIUS - Fails on Fedora 6
by Jacob Jarick 17 Apr '07

17 Apr '07

Fedora 6, openldap rpms installed via smart package manager. slapd.conf: http://pastebin.ca/445851 tfxschool.internal.lidf: http://pastebin.ca/445852 root.ldif: http://pastebin.ca/445854 ldapusers.ldif: http://pastebin.ca/445855 I decided to try setting up openldap in hopes of learning more about my error. I followed this howto http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch31_:_Cent… step by step and rechecked all configs etc when I got the following error. [root@fedora ~]# ldapadd -x -D "cn=Manager,dc=tfxschool,dc=internal" -W -f /etc/openldap/tfxschool.internal.ldif Enter LDAP Password: ldap_bind: Invalid credentials (49) additional info: 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece It seems to be similar if not the same problem I am having with FR refusing to auth via ldap to our ADS server. I am stuck though I have no idea how to resolve this error and unfortunately the howto assumes it just works. Google suggests that it may be the result of my domain string dc=tfxschool,dc=interternal, which looks correct to me. Our test domain is tfxschool.internal . any help / suggestions/ insight would be greatly appreciated. Thanks.

1 0

Help stuck on error: rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf
by Jacob Jarick 17 Apr '07

17 Apr '07

radiusd -X -A output: http://pastebin.ca/444201 radiusd.conf: http://pastebin.ca/444205 I am slowly setting up FR to work with ADS, I had ntlm_auth working fine but have been requested to swap to ldap my current freeradius user is \admins\radius\freeradius admins being an orgnisational unit, radius being an ou inside admins. I get this error when freeradius trys to confirm the user/passwd against the ADS. "rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf"

1 1

Re: compiling 1.1.6 on solaris problem
by Norbert Wegener 17 Apr '07

17 Apr '07

Alan DeKok schrieb: > ... > >> In file included from /root/freeradius-1.1.6/src/include/radiusd.h:31, >> from rlm_dbm_parser.c:52: >> /usr/include/netinet/in.h:302: warning: `INADDR_ANY' redefined >> /root/freeradius-1.1.6/src/include/missing.h:73: warning: this is the >> location of the previous definition >> /usr/include/netinet/in.h:303: warning: `INADDR_LOOPBACK' redefined >> /root/freeradius-1.1.6/src/include/missing.h:77: warning: this is the >> location of the previous definition >> > > The include file order is wrong. I've fixed this in the CVS head, but > in 1.1.6, the best thing to do is: > > $ ./configure --without-rlm_dbm > This leads to a related problem in another context: /root/freeradius-1.1.6/libtool --mode=link gcc -o radeapclient radeapclient.lo libeap/libeap.la -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypto -lssl -lcrypto^M gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/libeap.so /root/freeradius-1.1.6/src/lib/.libs/libradius.so -lcrypt -lnsl -lresolv -lsocket -lposix4 -lpthread -lssl -lcrypto -Wl,--rpath -Wl,/usr/local/lib^M /root/freeradius-1.1.6/src/lib/.libs/libradius.so: undefined reference to `crypt(a)SUNW_1.1'^M collect2: ld returned 1 exit status^M gmake[6]: *** [radeapclient] Error 1^M gmake[6]: Leaving directory `/root/freeradius-1.1.6/src/modules/rlm_eap'^M gmake[5]: *** [common] Error 2^M gmake[5]: Leaving directory `/root/freeradius-1.1.6/src/modules'^M gmake[4]: *** [all] Error 2^M gmake[4]: Leaving directory `/root/freeradius-1.1.6/src/modules'^M gmake[3]: *** [common] Error 2^M gmake[3]: Leaving directory `/root/freeradius-1.1.6/src'^M gmake[2]: *** [all] Error 2^M gmake[2]: Leaving directory `/root/freeradius-1.1.6/src'^M gmake[1]: *** [common] Error 2^M gmake[1]: Leaving directory `/root/freeradius-1.1.6'^M make: *** [all] Error 2^M Again, the whole output is at http://www.wegener-net.de/fr Norbert Wegener > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Freeradius + 3Com switch 4500
by Patti Riccardo 17 Apr '07

17 Apr '07

Hi all, Has anyone a sample configuration of 3Com 4500 switch to work with Freeradius? THX in adv. Riccardo

2 1

Re: compiling 1.1.6 on solaris problem
by Norbert Wegener 17 Apr '07

17 Apr '07

A.L.M.Buxey(a)lboro.ac.uk schrieb: > hi, > > do you have OpenSSL installed or using a Solaris derivation? I am not really familiar with Solaris. root@sunfire:/# openssl version OpenSSL 0.9.7b 10 Apr 2003 Is this information sufficient? Norbert Wegener > alan > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Segmentation fault for SNMP query
by Milan Holub 17 Apr '07

17 Apr '07

Hi all, when I've compiled in snmp support (--with-snmp) on current cvs head I got following segmentation fault(does not matter whether NAS are stored in DB or in clients.conf): >>>DEBUG OUTPUT START ... Ready to process requests. Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 12 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. SMUX read start SMUX read len: 40 SMUX message received type: 161 rest len: 36 SMUX_GETNEXT SMUX GET message parse: len 36 SMUX GET reqid: 182 len: 32 SMUX GET errstat 0 len: 29 SMUX GET errindex 0 len: 26 SMUX var parse: len 26 SMUX var parse: type 48 len 22 SMUX var parse: type must be 48 Request OID: 1.3.6.1.2.1.67.1.1.1.1.15.1.2.1 SMUX val_type: 5 ASN_NULL SMUX function call index is 2 SMUX function call index is 3 Segmentation fault >>>DEBUG OUTPUT END when debugging(I can attach the gdb output if needed) I've found that it fails somewhere on reading internal nas clients data structure. As I'm not interested in nas clients obtained via snmp(I keep them in mysql DB) following is the little patch which basically just ads "return NULL" when snmp asks for next nas client: Index: src/main/radius_snmp.c =================================================================== RCS file: /source/radiusd/src/main/radius_snmp.c,v retrieving revision 1.31 diff -u -r1.31 radius_snmp.c --- src/main/radius_snmp.c 10 Apr 2007 14:21:24 -0000 1.31 +++ src/main/radius_snmp.c 11 Apr 2007 14:41:08 -0000 @@ -194,6 +194,8 @@ RADCLIENT *c; int i, len; + return NULL; + len = *objid_len - v->namelen; if (!mainconfig.clients) Hope this helps someone. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

3 18

compiling 1.1.6 on solaris problem
by Norbert Wegener 17 Apr '07

17 Apr '07

Setting up 1.1.6 on a Sun with `uname -a` giving SunOS sunfire 5.10 Generic_118822-26 sun4u sparc SUNW,Ultra-30 configure does not show errors, only warnings. Unfortunately make dies with: .... creating rlm_dbm.la (cd .libs && rm -f rlm_dbm.la && ln -s ../rlm_dbm.la rlm_dbm.la) /root/freeradius-1.1.6/libtool --mode=compile gcc -g -O2 -I/root/freeradius-1.1.6/src/include -DHAVE_NDBM_H -c rlm_dbm_parser.c gcc -g -O2 -I/root/freeradius-1.1.6/src/include -DHAVE_NDBM_H -c rlm_dbm_parser.c -fPIC -DPIC -o .libs/rlm_dbm_parser.o In file included from /root/freeradius-1.1.6/src/include/radiusd.h:31, from rlm_dbm_parser.c:52: /usr/include/netinet/in.h:302: warning: `INADDR_ANY' redefined /root/freeradius-1.1.6/src/include/missing.h:73: warning: this is the location of the previous definition /usr/include/netinet/in.h:303: warning: `INADDR_LOOPBACK' redefined /root/freeradius-1.1.6/src/include/missing.h:77: warning: this is the location of the previous definition rlm_dbm_parser.c: In function `storecontent': rlm_dbm_parser.c:165: warning: assignment discards qualifiers from pointer target type gcc -g -O2 -I/root/freeradius-1.1.6/src/include -DHAVE_NDBM_H -c rlm_dbm_parser.c -o rlm_dbm_parser.o >/dev/null 2>&1 /root/freeradius-1.1.6/libtool --mode=link gcc \ -o rlm_dbm_parser rlm_dbm_parser.lo ../../lib/libradius.la -lnsl -lresolv -lsocket -lposix4 -lpthread gcc -o .libs/rlm_dbm_parser .libs/rlm_dbm_parser.o ../../lib/.libs/libradius.so -lcrypt -lnsl -lresolv -lsocket -lposix4 -lpthread -Wl,--rpath -Wl,/usr/local/lib ../../lib/.libs/libradius.so: undefined reference to `crypt(a)SUNW_1.1' collect2: ld returned 1 exit status gmake[6]: *** [rlm_dbm_parser] Error 1 gmake[6]: Leaving directory `/root/freeradius-1.1.6/src/modules/rlm_dbm' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/freeradius-1.1.6/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-1.1.6/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-1.1.6/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-1.1.6/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-1.1.6' make: *** [all] Error 2 sh-3.00# exit autoconf --version autoconf (GNU Autoconf) 2.61 root@sunfire:/root/freeradius-1.1.6# automake --version automake (GNU automake) 1.8 The complete output of configure / make can be found at: http://www.wegener-net.de/fr/ Any idea? Norbert Wegener

3 2

FW: Login for any user
by Galuschka Christoph 17 Apr '07

17 Apr '07

Hello, well I guess I can't do that with MySQL-Queries. Anybody got an idea on how the entry in the users-file has to look like. thanks and regards Chris -----Ursprüngliche Nachricht----- Von: Galuschka Christoph Gesendet: Dienstag, 17. April 2007 14:04 An: 'freeradius-users(a)lists.freeradius.org' Betreff: Login for any user Hello, I would like to create a login user on my database backend which allows everybody - regardless of username - to login as long as the password is correct. Is there a way to create such a user? thanks and regards Christoph --------------------------------------------------- Ing. Christoph Galuschka TIWAG-Tiroler Wasserkraft AG ITT LAN/WAN - VPN-/Firewallsysteme Eduard-Wallnöfer-Platz 2 6010 Innsbruck T: +43 (0)50607 21832 F: +43 (0)50607 41832 www.tiroler-wasserkraft.at Ti.econet: Hotline: +43 (0)50607 21405 eMail: econet(a)tiwag.at www.tieconet.at ---------------------------------------------------

4 4