April 2007 - Freeradius-Users - lists.freeradius.org

Re: SQL for return attributes only?
by Hugh Messenger 30 Apr '07

30 Apr '07

Phil Mayers <p.mayers(a)imperial.ac.uk> wrote: > Hugh Messenger wrote: >> Is it possible with freeradius to use SQL to retrieve certain return >> attributes (in this case rate limiting values for PPPOE sessions), >> whilst still handling authentication through PAM? > > > Yes. Great! Thanks for the pointers, very much appreciated. I got the basic AD authentication going with pam/winbind, about to dive head first into the SQL docs, armed with your suggestions and a powerful need to get this going by Friday. No doubt I'll be back soon with more questions, but I'll give it The Good Old College Try before I bug you any more. -- hugh

1 0

Maximum Attribute Size
by Matt Dunkin 30 Apr '07

30 Apr '07

Is there any maximum size for the value of an attribute? Thanks, Matt

2 1

FreeRADIUS crash on Solaris 10 after start
by Peter Micunek 30 Apr '07

30 Apr '07

Hi all, I built FreeRADIUS on Solaris 10 ./configure --prefix=/usr/local/freeradius --with-mysql-include-dir=/usr/local/mysql/include/mysql --with-mysql-lib-dir=/usr/local/mysql/lib/mysql --with-openssl-includes=/usr/sfw/include --with-openssl-libraries=/usr/sfw/lib --without-rlm_perl --without-threads make make install and when I want to start FreeRADIUS it crash: # radiusd -X Config: including file: /usr/local/freeradius/etc/raddb/radiusd.conf Config: including file: /usr/local/freeradius/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius/etc/raddb/clients.conf Config: including file: /usr/local/freeradius/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius/etc/raddb/eap.conf Config: including file: /usr/local/freeradius/etc/raddb/sql.conf Config: including file: /usr/local/freeradius/etc/raddb/sql/mysql- dialup.conf FreeRADIUS Version 2.0.0-pre0, for host sparc-sun-solaris2.10, built on Apr 30 2007 at 11:11:35 Starting - reading configuration files ... read_config_files: reading dictionary zsh: bus error (core dumped) radiusd -X # dbx - core Corefile specified executable: "/usr/local/freeradius/sbin/radiusd" For information about new features see `help changes' To remove this message, put `dbxenv suppress_startup_message 7.5' in your .dbxrc Reading radiusd core file header read successfully Reading ld.so.1 Reading libradius-2.0.0-pre0.so Reading libnsl.so.1 Reading libresolv.so.2 Reading libsocket.so.1 Reading libcrypt_i.so.1 Reading libltdl.so.3.1.0 Reading libdl.so.1 Reading libssl.so.0.9.7 Reading libcrypto.so.0.9.7 Reading libc.so.1 Reading libgcc_s.so.1 Reading libgen.so.1 Reading libc_psr.so.1 program terminated by signal BUS (invalid address alignment) Current function is lrad_isaac (optimized) 37 rngstep( a<<13, a, b, mm, m, m2, r, x); I have same problem with FR 1.1.6. Can you help me fix this problem? My settings: # gcc -v Using built-in specs. Target: sparc-sun-solaris2.10 Configured with: /net/tibia/export/bldmstr/nightly/20061019_mars_gcc.s10.opt.tarbuild/src/configure --prefix=/opt/gcc --enable-shared --with-system-zlib --enable-checking=release --disable-libmudflap --enable-languages=c,c++ --enable-version-specific-runtime-libs --with-gxx-include-dir=/opt/gcc/include/c++/4.0.3 --with-cpu=v9 Thread model: posix gcc version 4.0.3 (gccfss) LD_LIBRARY_PATH=/lib:/usr/local/lib:/usr/sfw/lib:/usr/ccs/lib:/usr/lib:/usr/local/mysql/lib/mysql:/usr/local/freeradius/lib LDFLAGS=-L/usr/local/lib -R/usr/local/lib -L/usr/local/mysql/lib/mysql -R/usr/local/mysql/lib/mysql -L/usr/sfw/lib -R/usr/sfw/lib -L/usr/ccs/lib -R/usr/ccs/lib -L/usr/local/freeradius/lib -R/usr/local/freeradius/lib PATH=/opt/gcc/bin:/usr/local/bin:/usr/sbin:/usr/bin:/usr/local/mysql/bin:/usr/local/sbin:/opt/csw/bin:/opt/csw/sbin:/usr/sfw/bin:/usr/sfw/sbin:/usr/local/freeradius/sbin:/usr/local/freeradius/bin:/usr/ccs/bin best regards Peter Micunek

2 3

No available IP Addresses in the pool ...
by Florin 30 Apr '07

30 Apr '07

Hello everyone, FreeRadius 1.0.1 from RHEL 4. I get the following error (only shown in debug mode) after 1-2 weeks of server working fine, without any issues: rlm_ippool: Searching for an entry for nas/port: 172.25.254.218/9931392 rlm_ippool: No available ip addresses in pool. modcall[post-auth]: module "<pool_name>" returns notfound for request 0 The outcome of this error is that the client is not issued any IP address (which is a show stopper). Here is the pool declaration: # IP pool used by ************ #---------------------------------- ippool *************** { range-start = 172.26.4.1 range-stop = 172.26.5.254 netmask = 255.255.254.0 cache-size = 300 session-db = ${raddbdir}/ippools/*********-db.ippool ip-index = ${raddbdir}/ippools/*********-db.ipindex override = no maximum-timeout = 86400 } The only fix so far was to remove the pool files and recreate them again. Any thoughts of what could be wrong ? Many thanks in advance. Regards, Florin

3 2

checkrad + NoCat
by Milan Holub 30 Apr '07

30 Apr '07

Hi all, I was wondering whether nocat (http://nocat.net/) could be queried for simultaneous use somehow. I've found only some outdated patch on http://lists.nocat.net/pipermail/nocat/2003-October/003795.html I've inspired from the idea and attached is a patch to checkrad.pl.in. You need additional perl module HTTP::Lite(downloadable from CPAN). I've tested and it's working well. In order to deploy checkrad you need to set your nas type to "nocat" and enable simultaneous-use checking for your user(Simultaneous-Use:=1 in users file|radcheck|radgroupcheck) and your freeradius server has to be allowed in NAS firewall to access http://$nas_ip:$nas_port/status NAS> iptables -A INPUT -p tcp --dport <$nas_port> -s <$radius_server> -j ACCEPT I hope this can help someone... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

1 0

request from unknown NAS vulnerability
by Milan Holub 30 Apr '07

30 Apr '07

Hi Alan, with latest cvs head: * NASes in database * when sending 1 access request from NAS not defined in NAS table I get following repeating error message (-X) flooding my screen: Nothing to do. Sleeping until we see a request. Ignoring request from unknown client <IP_NOT_IN_NAS_TABLE> port 43508 Server does not react on HUPs and stops responding to NASes defined correctly in NAS table. Is there something wrong with request cleanup for unknown client? Please advise. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

Accounting packets & segmentation fault
by Milan Holub 30 Apr '07

30 Apr '07

Hi Alan, I'm back with my bug reports:) In latest cvs head: When sending following packet: `cat ./admin_reset_acct.txt`: NAS-Port = 5282 NAS-IP-Address = <IP_IN_NAS_TABLE> Acct-Status-Type = Accounting-On Acct-Terminate-Cause = Admin-Reset ... but it looks like it behaves the same for all accounting packets! I'm getting segmentation fault: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1024 (LWP 18106)] 0x08052d67 in acct_socket_recv (listener=0x815be70, pfun=0xbfffe9fc, prequest=0xbfffea00) at listen.c:500 500 switch(packet->code) { (gdb) (gdb) (gdb) bt #0 0x08052d67 in acct_socket_recv (listener=0x815be70, pfun=0xbfffe9fc, prequest=0xbfffea00) at listen.c:500 #1 0x0805923f in main (argc=2, argv=0xbffffb94) at radiusd.c:643 (gdb) list 495 } 496 497 /* 498 * Some sanity checks, based on the packet code. 499 */ 500 switch(packet->code) { 501 case PW_ACCOUNTING_REQUEST: 502 RAD_SNMP_CLIENT_INC(listener, client, requests); 503 fun = rad_accounting; 504 break; (gdb) print packet->code Cannot access memory at address 0x1016e67 (gdb) print packet $1 = (RADIUS_PACKET *) 0x1016e33 gdb) print packet->src_ipaddr Cannot access memory at address 0x1016e37 (gdb) print packet->src_port Cannot access memory at address 0x1016e5f (gdb) print packet->id Cannot access memory at address 0x1016e63 (gdb) print packet->sockfd Cannot access memory at address 0x1016e33 (gdb) print packet->timestamp Cannot access memory at address 0x1016e7f Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 1

perl app
by Jacob Jarick 30 Apr '07

30 Apr '07

1 0

Thanks alot everyone
by Jacob Jarick 30 Apr '07

30 Apr '07

Thanks very much everyone, specially Phil, Alan and the rest who helped me but I cant recall just now. I Have fiiinally got it going (properly this time to). Here is a quick outline of my setup, I may write a detailed howto later on. Windows XP home client -> cisco wap -> freeradius on Fedora -> Windows 2003 ADS FREERADIUS: I used EAP-TTLS as the encryption / tunneling. Used certs (needed for TTLS) that came with rpm. Used PAP inside of EAP-TTLS (sends plain text password which ldap expects) WINDOWS SERVER: * Add 1 user with password for ldap searching (cant remember if user needs special permision to search LDAP). * Fortunately not much config is needed on the server, enabling anonymous LDAP searching is very handy when figuring out a new domain and its users. WINDOWS XP CLIENTS: I reccomend using SecureW2 on XP clients as it allows you to use PAP inside of EAP. Configure clients with these options: My windows client details: Network Authentication: Open Data Encryption: WEP the key is provided for me automatically: (ticked) EAP type: SecureW2 Authenticate as a computer: (unticked) Authenticate as a guest: (unticked) Securew2 config details: use alternate outer identity: (unticked) verify server cert: (unticked) Select Authentication Method: PAP Prompt user for credentials: (ticked) http://www.securew2.com/

1 0

Help please: "auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user"
by Jacob Jarick 30 Apr '07

30 Apr '07

radiusd.conf: http://pastebin.ca/465399 radius -X output: http://pastebin.ca/465404 After following phils guide on the weekend I successfully got both radtest and radping to return auth-accept packets. The default windows client wouldnt auth but they dont do PAP as I undertstand. I am currently using http://www.securew2.org to enable PAP though I am getting this error. ERROR: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user My windows client details: Network Authentication: Open Data Encryption: WEP the key is provided for me automatically: (ticked) EAP type: SecureW2 Authenticate as a computer: (unticked) Authenticate as a guest: (unticked) Scurew2 config details: use alternate outer identity: (unticked) verify server cert: (unticked) Select Authentication Method: PAP Prompt user for credentials: (ticked) I am using the SecureW2 client / extension because I have been told numerous times that LDAP only supports PAP and its been suggested that I get PAP working before anything else (let me know if Im on the right track with SecureW2). So Im guessing here, but the reason it fails is because I do not have eap & pap modules configured ? Thanks for the help again guys.

1 1