October 2008 - Freeradius-Users - lists.freeradius.org

Compile Error :FreeRadius v 2.1.1 RPM build error
by Syed Anwarul Hasan 02 Oct '08

02 Oct '08

Hi Ala, Ivan and all, Alan as I having backtrace problem in my FreeRadius v 2.0.5. I deleted all the old binaries and libraries for the earlier version.Then I got the latest FreeRadius v 2.1.1 tarball (Compresses tar.bz2) from freeradius.orgwebsite and started to build on SLES 10 SP2. And I copied the freeradius.spec in SPECS folder. When I try to compile, I got an rpm build error and compilation stopped. Please help me in this regard. SYED pc1138: /usr/src/packages/SOURCES # *rpmbuild -ba /usr/src/packages/SPECS/freeradius.spec* Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.25117 + umask 022 + cd /usr/src/packages/BUILD + cd /usr/src/packages/BUILD + rm -rf freeradius-server-2.1.1 + /usr/bin/bzip2 -dc /usr/src/packages/SOURCES/freeradius-server-2.1.1.tar.bz2 + tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd freeradius-server-2.1.1 ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chown -Rhf root . ++ /usr/bin/id -u + '[' 0 = 0 ']' + /bin/chgrp -Rhf root . + /bin/chmod -Rf a+rX,u+w,g-w,o-w . ++ find . -name CVS + rm -rf + exit 0 Executing(%build): /bin/sh -e /var/tmp/rpm-tmp.27085 + umask 022 + cd /usr/src/packages/BUILD + /bin/rm -rf /var/tmp/freeradius-server-2.1.1-build ++ dirname /var/tmp/freeradius-server-2.1.1-build + /bin/mkdir -p /var/tmp + /bin/mkdir /var/tmp/freeradius-server-2.1.1-build + cd freeradius-server-2.1.1 + export 'CFLAGS=-O2 -g -m32 -march=i586 -mtune=i686 -fmessage-length=0 -D_FORTIFY_SOURCE=2 -fno-strict-aliasing -DLDAP_DEPRECATED -fPIC -DPIC' + CFLAGS='-O2 -g -m32 -march=i586 -mtune=i686 -fmessage-length=0 -D_FORTIFY_SOURCE=2 -fno-strict-aliasing -DLDAP_DEPRECATED -fPIC -DPIC' + autoreconf configure.in:1140: warning: AC_CONFIG_SUBDIRS: you should use literals autoconf/status.m4:1077: AC_CONFIG_SUBDIRS is expanded from... configure.in:1140: the top level configure.in:1140: warning: AC_CONFIG_SUBDIRS: you should use literals autoconf/status.m4:1077: AC_CONFIG_SUBDIRS is expanded from... configure.in:1140: the top level configure.in:1140: warning: AC_CONFIG_SUBDIRS: you should use literals autoconf/status.m4:1077: AC_CONFIG_SUBDIRS is expanded from... configure.in:1140: the top level configure.in:547: error: possibly undefined macro: AC_LIB_READLINE If this token and others are legitimate, please use m4_pattern_allow. * * See the Autoconf documentation.* autoreconf: /usr/bin/autoconf failed with exit status: 1 error: Bad exit status from /var/tmp/rpm-tmp.27085 (%build)* *RPM build errors: Bad exit status from /var/tmp/rpm-tmp.27085 (%build)*

2 2

FW: FreeRadius
by Marcel Grandemange 02 Oct '08

02 Oct '08

>I have a working FreeRadius installation used for PPPOE clients using a Mikrotik NAS (Essentialy Linux) >I am using Freeradius to limit data a user can send/receive within a month and automatically reset it every month. >I used an example from chilliuspot hotspot for this. >However what im noticing is sometimes a customer gets denied access because he has exceeded he's monthly allowance, however when I check the >Db this is not the case cause it's the beginning of month. >This only happens sometimes so im lost! >I use sqlcounter.conf for the counter part of things and INCLUDE this from radius.conf. >sqlcounter monthlytraffic { > counter-name = Monthly-Traffic > check-name = Max-Monthly-Traffic > reply-name = Mikrotik-Xmit-Limit-Gigawords > sqlmod-inst = sql > key = User-Name > reset = monthly >query = "SELECT SUM(AcctInputOctets - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0))+ SUM(AcctOutputOctets -GREATEST((%b - >UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" >} >Anybody for input? I would greately appreciate help here! A Work around is to simply increase he's allowance till he is allowed to connect! Here is an update. I have created an entirely new account that has NO history and yet I get same issue. Following in radius.log Wed Oct 1 17:51:46 2008 : Auth: Invalid user (rlm_sqlcounter: Maximum monthly usage time reached): [njale/<CHAP-Password>] (from client OldPPPOES port 40541 cli 00:0C:29:0B:44:66) I kept increasing the data limit via dialupadmin till it allowed me to connect. Ideas? __________ NOD32 3485 (20081001) Information __________ This message was checked by NOD32 antivirus system. http://www.eset.com

4 14

Checking NAS-Identifier in the radgroupcheck table
by super_tomtom 02 Oct '08

02 Oct '08

Hi ! I am actually setting up a freeradius server that will manage authentication from different places (hotels actually). I am just a beginner toward that technology, and i have one problem : I need to create some accounts that can be enabled at different places: for example you have an account in a hotel in London, then you could use the same account in another hotel of the same chain in ... Madrid for example. But, you could not not use this account in another hotel using the same solution (all my hotels will talk to the same freeradius server). ... I hope you understand my English, sorry about that... So here is the point: I need to check for each account in the radcheck table where does the Access-Request comes from. As some of the NAS will get their IP dynamically from their ISP, I cannot use the NAS-IP-Address parameter, so I would like to use the NAS-Identifier. As some of my accounts could be active for requests coming from several NAS, I thought I could use the radgroupcheck table, in a way like that : radgroupcheck table : groupname | attribute | op | value myGroup | NAS-Identifier | == | myNASName This parameter works in the radcheck tables, if the request comes from a wrong NAS Identifier freeradius sends a Access-Reject, but in the radgroupcheck table, nothing happens ... Does anyone have an idea about that ? Thanks ! -- View this message in context: http://www.nabble.com/Checking-NAS-Identifier-in-the-radgroupcheck-table-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 9

eap ttls certificate config
by Jehan PROCACCIA 02 Oct '08

02 Oct '08

hello, I try to configure my freeradius-2.0.3-3.el5 to read our certicate chain with no success :-( . neither CA_file or CA_path directives works as expected in eap.conf . here's my config: /etc/raddb/eap.conf tls { certdir = ${confdir}/certs cadir = ${confdir}/certs/CA private_key_password = secret private_key_file = ${certdir}/radiux-pkiit-2008.key.pass.pem certificate_file = ${certdir}/radiux-pkiit-2008.pem CA_file = ${certdir}/pki-chain.pem #CA_path = ${cadir}/ pki-chain.pem contain the concatenation of our 3 level pki hierarchy ( cat itClass1.crt > pki-chain.pem ; cat itClass2.crt >> pki-chain.pem ; cat itClass3.crt >> pki-chain.pem ) itClass1.crt is self-signed, it signed class2 , then class2 signed class3 CA and finnaly class3 signed radiux-pkiit-2008.pem SSL server . Then, how can I tell freeradius to load that pki-chain.pem ? setting it in CA_file doesn't seem to work, as clients with itClass1.crt loaded cannot negociate TLS handshake with the freeradius server :-( Using the CA_path directive with a certs/CA directory containing the 3 classes certificate in PEM format + a hash on them , generate a segmentation fault on the start of radiusd :-( . is CA_path deprecated ? how should the certificate and hash in that CA_path should be presented ? I heard about C_rehash but cannot find it. Please let me know how to tell radiusd/eap to load my self signed 3 level hierarchy pki . Thanks.

4 9

FreeRadius
by Marcel Grandemange 02 Oct '08

02 Oct '08

I have a working FreeRadius installation used for PPPOE clients using a Mikrotik NAS (Essentialy Linux) I am using Freeradius to limit data a user can send/receive within a month and automatically reset it every month. I used an example from chilliuspot hotspot for this. However what im noticing is sometimes a customer gets denied access because he has exceeded he's monthly allowance, however when I check the Db this is not the case cause it's the beginning of month. This only happens sometimes so im lost! I use sqlcounter.conf for the counter part of things and INCLUDE this from radius.conf. sqlcounter monthlytraffic { counter-name = Monthly-Traffic check-name = Max-Monthly-Traffic reply-name = Mikrotik-Xmit-Limit-Gigawords sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctInputOctets - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0))+ SUM(AcctOutputOctets -GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } Anybody for input? I would greately appreciate help here! A Work around is to simply increase he's allowance till he is allowed to connect!

2 2

Logging level
by Arrigo Savio 02 Oct '08

02 Oct '08

Hi everybody. I installed Freeradius 2.1.0 on a Fedora 9 server. I'm trying to understand if is it possible to set the logging level in radius.log log file. Where can I set up a "radius -X like" level also in radius.log file? Is it eventually possible to change this level "on the fly"? I mean without restarting the whole radius process.... Thanks,Arryxyz

2 6

The client does not connect _*_*_*_
by Martin Silvero 02 Oct '08

02 Oct '08

hello!! Well, as was the theme for the month so again clarify the principle also returned thread. The server is installed and tested it with the "test" and walk in perfect condition. I configured the radius in the client (access point) and a local user testing, the user is in a notebook in which I installed the certificates created for that user ( "ca.der" - "client.p12") as detailed in the HOWTO wiki. Well, when I want to connect from the notebook to the network radius, asking me to configure the profile to the type of authentication, and so on. what set everything is ready and when I try to connect but does not connect to the server and are not recorded requests. What could be the problem?

2 1

Conditionals in FreeRadius
by Tom Cooper 02 Oct '08

02 Oct '08

Hi All, We have ADSL users to authenticate on freeradius which reads the user info via an OpenLDAP server. Now when the user has used a certain amount of data he must be flagged as blocked. His connection is disconnected and upon reconnection he is assigned a different IP address with restricted connectivity until he tops up his account. I can see that his information needs to be changed in LDAP to maybe assign him to a different uid, something like this: uid=xxxxxx,dc=radius,dc=example,dc=com (Original) changed to uid=xxxxxx,dc=blocked,dc=radius,dc=example,dc=com. My question is now how do I accomplish this, because on the client side he will still try to authenticate as uid=xxxxxx,dc=radius,dc=example,dc=com and I can not control what credentials are sent? Is it maybe better accomplished from freeradius than from LDAP? The record needs to be changed in LDAP for our admin portal to make use of this to check the client's status. My radius version used is freeradius-1.1.3-1.2.el5 Regards, To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

2 1

proxy.conf in freeradius 2.1.1
by Olaf Gellert 02 Oct '08

02 Oct '08

Hi, I am just updating from an old freeradius (1.1.x) to a new one (2.1.1). Currently we have old style entries in the proxy.conf, some entries like: realm DEFAULT { type = radius authhost = 111.222.111.222:1812 accthost = 111.222.111.222:1813 secret = whatever nostrip } The old radius gave us (from time to time) log messages like: radius.log.6:Mon Sep 22 15:58:14 2008 : Proxy: marking accounting server 111.222.111.222:1813 for realm DEFAULT dead Using the same configuration file (which should still be supported), we get: Tue Sep 30 17:19:28 2008 : Error: PROXY: Marking home server 111.222.111.222 port 1813 as zombie (it looks like it is dead). For both servers (auth at 111.222.111.222:1812 and acc at port 1813) it reports "Marking _home_ server", so does it not differentiate between both? Or is this just an oversimplification? Could someone spread some light how a new configuration (using home_server and home_server_pool etc) should look like? In our setting we use the radius for authentication of local users and we use two proxies for users of other organisations (= two DEFAULT realms in proxy.conf). Thanks, cheers, Olaf -- Olaf Gellert Universitaet Hamburg Regionales Rechenzentrum Kommunikationsnetze Schlueterstrasse 70 20146 Hamburg Tel.: ++49 (0)40 42838 4694 Fax: ++49 (0)40 42838 3096 E-Mail: Olaf.Gellert(a)rrz.uni-hamburg.de

4 5

MySQL tables for 2.1.1
by Karl Auer 02 Oct '08

02 Oct '08

Hi all. This is the third of my three questions. The second one solved itself (I read the docs - again). 2.1.1 is installed and running it as root, with the user "radius" and the group "radius" have been specified as the user and group in radiusd.conf. I've had to fix permissions on about ten files - various files in /usr/local/etc/raddb needed to be made readable by the "radius" group, and I had to set up and set permissions on the logging directory. That's just what I've found so far. Is this an indication that I did the install incorrectly? Or do most people run the server as root, so these problems do not arise? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

2 1