November 2008 - Freeradius-Users - lists.freeradius.org

Make error
by Olavo 03 Dec '08

03 Dec '08

Hello all, I am trying again with this issue hoping that someone can take a look at it. I am trying to compile on a RedHat ES5, 64 bits. Any help will be very much appreciated. thanks Olavo Hi again, It didn't "make" . It has returned errors. .libs/radmin.o: In function `main': /usr/src/freeradius-server-2.1.1/src/main/radmin.c:489: undefined reference to `readline' /usr/src/freeradius-server-2.1.1/src/main/radmin.c:411: undefined reference to `using_history' /usr/src/freeradius-server-2.1.1/src/main/radmin.c:412: undefined reference to `rl_insert' /usr/src/freeradius-server-2.1.1/src/main/radmin.c:412: undefined reference to `rl_bind_key' /usr/src/freeradius-server-2.1.1/src/main/radmin.c:498: undefined reference to `add_history' collect2: ld returned 1 exit status gmake[4]: *** [radmin] Error 1 gmake[4]: Leaving directory `/usr/src/freeradius-server-2.1.1/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/src/freeradius-server-2.1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/src/freeradius-server-2.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/src/freeradius-server-2.1.1' make: *** [all] Error 2 Olavo > -----Original Message----- > From: > freeradius-users-bounces+jsantos5954=gmail.com(a)lists.freeradiu > s.org > [ <mailto:freeradius-users-bounces+jsantos5954=gmail.com@lists.f> mailto:freeradius-users-bounces+jsantos5954=gmail.com@lists.f > reeradius.org] On Behalf Of Alan DeKok > Sent: Wednesday, November 19, 2008 1:14 PM > To: FreeRadius users mailing list > Subject: Re: configure error > > > Olavo wrote: > > I downloaded version 2.1 from <http://freeradius.org/download.html> http://freeradius.org/download.html . > > When configuring ( ./configure) I got several errors on config.log. > > The only reason to look at that file is to debug the > "configure" scripts. The log is SUPPOSED to be full of > errors, because it's testing for platforms other than the one > you're using. > > Don't look at it. > > Perhaps you could explain if there are *other* errors. > Like maybe you're trying to do something... ? Right now, all > it looks like is you're trying to understand the contents of > "config.log", which is a complete waste of time. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > <http://www.freeradius.org/list/users.html> http://www.freeradius.org/list/users.html >

10 31

Check on bytes used
by Saeed Akhtar 02 Dec '08

02 Dec '08

Hi all, I want to create a check on user monthly usage in (MB/GB etc.). Is there any module available to do so. yes or not what attribute will be sent to client, like session-timeout attribute gives the time in second. waiting for reply. thanks Regards, Saeed Akhtar

5 5

Restricting user to specific NAS Port
by Sean Preston 01 Dec '08

01 Dec '08

Hi I have gone through the archives and either I am searching on the wrong terms or there is not much on this topic. I am using FreeRadius 1.1.3 on Debian with a database backend to FreeRadius and I need to restrict some ADSL users to specific NAS Ports. I found that adding an entry to radcheck like: blah1(a)example.com NAS-Port-Id == abc restricts the user to this port Now how do I add additional NAS ports so that they still authenticate because the same useraccount needs to be able to log in from multiple NAS ports. I tried putting in multiple entries but it does not seem to work. I get an authentication accepted response for the first port and then additional ones always reject. Any help or pointers would be greatly appreciated. Regards Sean -- Sean Preston

5 10

pls help: restrict authentication for certain realms from particular clients
by ST Wong (ITSC) 01 Dec '08

01 Dec '08

Hi all, We just upgraded our freeradius server from 1.7 to 2.1.1. I'd like to restrict authentication requests as following: client A accepts: @realm1, @realm2 client B accepts: @realm2, @realm3 so that requests like follwoing will be rejected: @realm3 to client A @realm1 to client B Would anyone please help? Sorry for newbie question. Thank you very much. /ST Wong

3 3

Problem with SMC Access Point in Client Mode using EAP-TLS and Freeradius-2.1.1
by Harald Schreiber 30 Nov '08

30 Nov '08

Hello, I'm running a Freeradius-Server 2.1.1 on my SuSE Linux 11.0 Box to control the access to my WLAN using EAP-TLS. This works fine with my notebook. But now I have bought a SMC EZ Connect N Pro Access Point which I have configured as a WLAN client using EAP-TLS too. When this WLAN client tries to authenticate itself at the Freeradius Server the authentication fails and I get the message rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request in the Freeradius log file. Can someone please tell me what's going wrong there? Any help is appreciated. Here is the output of radiusd -X when an authentication request of the SMC access point comes in: rad_recv: Access-Request packet from host 192.168.254.1 port 1024, id=1, length=125 User-Name = "harald" NAS-IP-Address = 192.168.254.1 Called-Station-Id = "0014bf3bcd8a" Calling-Station-Id = "0013f7ca60de" NAS-Identifier = "0014bf3bcd8a" NAS-Port = 52 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000b01686172616c64 Message-Authenticator = 0x543152e558b443afb9430d9fd02aa75f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "harald", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry harald at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.254.1 port 1024 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7139c4e57138c9bf5d9926d441f8680e Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.254.1 port 1024, id=1, length=200 Cleaning up request 6 ID 1 with timestamp +1123 User-Name = "harald" NAS-IP-Address = 192.168.254.1 Called-Station-Id = "0014bf3bcd8a" Calling-Station-Id = "0013f7ca60de" NAS-Identifier = "0014bf3bcd8a" NAS-Port = 52 Framed-MTU = 1400 State = 0x7139c4e57138c9bf5d9926d441f8680e NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100440d800000003a160301003501000031030163c2a49b798675d7c211a92ace77bde2102205aefca9044d7fc1ab18323a627d00000a0035002f000a000400050100 Message-Authenticator = 0x2f0e13f531634f6696098de4ecf6dfca +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "harald", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 68 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry harald at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 58 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0035], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 05fb], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 0091], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.254.1 port 1024 EAP-Message = 0x010204000dc0000006c5160301002a020000260301492dce64477d25af22eea4fd4d959b5969a18f53653bebd1acb9136964e5a0bc0000350016030105fb0b0005f70005f400028730820283308201eca003020102020108300d06092a864886f70d0101050500307f310b3009060355040613024445310c300a060355040813034e5257310f300d0603550407130641616368656e311b3019060355040a1312486172616c64734379626572467265616b733119301706035504031310486172616c64205363687265696265723119301706092a864886f70d010901160a684072616c642e6e6574301e170d3037313232313233333730385a170d3039 EAP-Message = 0x313232303233333730385a3077310b3009060355040613024445310c300a060355040813034e5257310f300d0603550407130641616368656e311b3019060355040a1312486172616c64734379626572467265616b733111300f06035504031308626c697a7a6172643119301706092a864886f70d010901160a684072616c642e6e657430819f300d06092a864886f70d010101050003818d0030818902818100a4c3faac47f1cebf599f6433f5e6c1e3bcaae35f0f331376a4dd97f5127dfeb6a49b58ebd7ce517ec260fa6d3e6774e11a02a9a2dee2f82f4eefca6dc4f72e2945667a4f1ea3842ac99edd33bf4be8d5fe8f54ef901c397844b57f8d EAP-Message = 0xa9ddfe26d6b22420136a7daa27b3ba904b4c27ff1164155068385e76e09319fcea07c24f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100591a7cda98a98824bba908f67ecba91fa8c5b108effe7368313a5b7f89ba4246bebd69e51249844ebe9b9dc16f22c3a4bef4441465a7e4b800adf3318ee23ed6cf924388f6a78675eaf3f92a899aedfa43b186630e4155758559562a52141587d709e71333a8b4be631a35b0d498afcda15c4213454ce3688fbbc46378bd404000036730820363308202cca003020102020900dfcd0dfb0e951628300d06092a864886f70d010104 EAP-Message = 0x0500307f310b3009060355040613024445310c300a060355040813034e5257310f300d0603550407130641616368656e311b3019060355040a1312486172616c64734379626572467265616b733119301706035504031310486172616c64205363687265696265723119301706092a864886f70d010901160a684072616c642e6e6574301e170d3035313231373139333235365a170d3135313231353139333235365a307f310b3009060355040613024445310c300a060355040813034e5257310f300d0603550407130641616368656e311b3019060355040a1312486172616c64734379626572467265616b73311930170603550403131048617261 EAP-Message = 0x6c6420536368726569626572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7139c4e5703bc9bf5d9926d441f8680e Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.254.1 port 1024, id=1, length=138 Cleaning up request 7 ID 1 with timestamp +1123 User-Name = "harald" NAS-IP-Address = 192.168.254.1 Called-Station-Id = "0014bf3bcd8a" Calling-Station-Id = "0013f7ca60de" NAS-Identifier = "0014bf3bcd8a" NAS-Port = 52 Framed-MTU = 1400 State = 0x7139c4e5703bc9bf5d9926d441f8680e NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0x45eb23701fb6bcbe430512689ce99aa1 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "harald", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry harald at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.254.1 port 1024 EAP-Message = 0x010302d90d80000006c53119301706092a864886f70d010901160a684072616c642e6e657430819f300d06092a864886f70d010101050003818d0030818902818100c230fad1501053fa9d4e7af119979d2dabfca054a985830d0da415d7001fd0af897687fad6adcb26fb06a2137c24dcb52a27df6ffc9281aa40d7f525d8669d51794486ff24b46565428842de83512f0a4005bf707854d5a1df8b7dd901bbb4ef7997927cbe5a797da4c670e8ebd4162699c5b83dfd45a4fcc00c7aea5bb0eb710203010001a381e63081e3301d0603551d0e041604142eb59a09ae8a1fe82961d44d33dc1d90652f489d3081b30603551d230481ab3081a880142e EAP-Message = 0xb59a09ae8a1fe82961d44d33dc1d90652f489da18184a48181307f310b3009060355040613024445310c300a060355040813034e5257310f300d0603550407130641616368656e311b3019060355040a1312486172616c64734379626572467265616b733119301706035504031310486172616c64205363687265696265723119301706092a864886f70d010901160a684072616c642e6e6574820900dfcd0dfb0e951628300c0603551d13040530030101ff300d06092a864886f70d0101040500038181000b7e2f9395ee1fee0e969c5d0982887d5832a4acaa7961228c0a5a654d7122070c751c00b23ca4f31b7487ac91235e462c15ca909fc0ab EAP-Message = 0xd786ca2d48078d6c34c45666ae966c4b8d52806adc07f6a25cf7e72f6a953f1e40046d8934b0b2a074f158d9c85f0025c21fac551f8659ec8d254744d5927662dec81eb10d102f0c0a16030100910d0000890301024000830081307f310b3009060355040613024445310c300a060355040813034e5257310f300d0603550407130641616368656e311b3019060355040a1312486172616c64734379626572467265616b733119301706035504031310486172616c64205363687265696265723119301706092a864886f70d010901160a684072616c642e6e65740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7139c4e5733ac9bf5d9926d441f8680e Finished request 8. Going to the next request Waking up in 4.9 seconds. Cleaning up request 8 ID 1 with timestamp +1123 Ready to process requests. rad_recv: Access-Request packet from host 192.168.254.1 port 1024, id=1, length=200 User-Name = "harald" NAS-IP-Address = 192.168.254.1 Called-Station-Id = "0014bf3bcd8a" Calling-Station-Id = "0013f7ca60de" NAS-Identifier = "0014bf3bcd8a" NAS-Port = 52 Framed-MTU = 1400 State = 0x7139c4e5733ac9bf5d9926d441f8680e NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200440d800000003a160301003501000031030163c2a49b798675d7c211a92ace77bde2102205aefca9044d7fc1ab18323a627d00000a0035002f000a000400050100 Message-Authenticator = 0x25fd4ab36c6ba9a789644e5a77225539 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "harald", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 68 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry harald at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [harald/<via Auth-Type = EAP>] (from client blizzard port 52 cli 0013f7ca60de) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> harald attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 1 to 192.168.254.1 port 1024 Waking up in 4.9 seconds. Cleaning up request 9 ID 1 with timestamp +1131 Ready to process requests.

2 1

Xlat from config-items
by Venkatesh K 29 Nov '08

29 Nov '08

Hello, I would like to send a reply based on an attribute(s) in request config-items. It seems, from unlang man page, this is not supported. Any thoughts or ideas? Thanks, Venkatesh. K

2 2

help needed --- jradius configuration with freeradius 2.1.1
by Saeed Akhtar 29 Nov '08

29 Nov '08

Hi, I want to configure jradius with freeradius 2.1.1. I added jradius in modules section of freeradius radiusd.conf file... also added jradius in authorize section. Now when I run send request to freeradius its trace is like this: rlm_jradius: Reserving JRadius socket id: 7 rlm_jradius: packing attribute User-Name (type: 1; len: 7) rlm_jradius: packing attribute User-Password (type: 2; len: 5) rlm_jradius: packing attribute NAS-IP-Address (type: 4; len: 4) rlm_jradius: packing attribute Message-Authenticator (type: 80; len: 16) rlm_jradius: packing packet with code: 1 (attr length: 80) rlm_jradius: packing packet with code: 0 (attr length: 0) rlm_jradius: sending 121 bytes to socket 7 rlm_jradius: error sending request with socket 7 rlm_jradius: Closing JRadius connection 7 rlm_jradius: reconnecting socket id 7 rlm_jradius: sending 121 bytes to socket 7 rlm_jradius: error sending request with socket 7 rlm_jradius: problem packing the data[socket_send/first_read] rlm_jradius: Closing JRadius connection 7 rlm_jradius: Released JRadius socket id: 7 +++[jradius] returns noop On the other side I got exception in jradius with is as: java.io.EOFException at java.io.DataInputStream.readFully(DataInputStream.java:180) at java.io.DataInputStream.readFully(DataInputStream.java:152) at net.sf.jradius.packet.PacketFactory.parsePacket(PacketFactory.java:136) at net.sf.jradius.packet.PacketFactory.parse(PacketFactory.java:167) at net.sf.jradius.freeradius.FreeRadiusProcessor.parseRequest(FreeRadiusProcessor.java:76) at net.sf.jradius.freeradius.FreeRadiusProcessor.processRequest(FreeRadiusProcessor.java:55) at net.sf.jradius.server.Processor.process(Processor.java:119) at net.sf.jradius.server.Processor.run(Processor.java:91) net.sf.jradius.freeradius.FreeRadiusProcessor(7): process() method threw an exception: java.lang.NegativeArraySizeException java.lang.NegativeArraySizeException at net.sf.jradius.freeradius.FreeRadiusProcessor.parseRequest(FreeRadiusProcessor.java:79) at net.sf.jradius.freeradius.FreeRadiusProcessor.processRequest(FreeRadiusProcessor.java:55) at net.sf.jradius.server.Processor.process(Processor.java:119) at net.sf.jradius.server.Processor.run(Processor.java:91) Can anyone please help me where is the problem?? Thanks Regards, Saeed Akhtar

1 1

Service-Type based on Unix group of the user
by Artur Rodrigues 29 Nov '08

29 Nov '08

Hi, I am running FreeRADIUS Version 1.1.7 for host i386-redhat-linux-gnu and I have finally managed to get it to work. I use Allied Telesyn routers and used SSH to authenticate to it. To get a more flexible method I decided to go to Radius authentication, using the passwd of the server in wich FreeRADIUS is installed to authenticate the people who need to access the router. Each person who access it have an Unix account on the server. My users file is: DEFAULT Auth-Type = System Service-Type = 7, Login-Service = Telnet The main problem now is that not everyone who have an account in the server should be able to access the router. So I wanted to change the Service-Type parameter according to the group of each user. Is that possible? Thank you for your support and sorry for the bad english.

2 3

Linux radiusclients and Gigaword
by NiTr0 29 Nov '08

29 Nov '08

Is there a Linux radiusclient with pppd module, that supports Gigaword attributes in interim packets?

1 0

Class attribute
by Alexandre Chapellon 29 Nov '08

29 Nov '08

Hello, This message is more precisely direted to Alan. I have noticed that the "Class" attribute as defined in rfc2865 is a string value, but looking at dictionary that comes with freeradius i saw that it's an octet value. As far as I know none of the rfc updating 2865 redefine the class attribute. Is there a reason for this, is it safe to make it a string value?

3 4