November 2008 - Freeradius-Users - lists.freeradius.org

Could not link driver rlm_sql_oracle: libclntsh.so.10.1
by Ilya 24 Nov '08

24 Nov '08

hello, i've got Linux 2.6.9-22 and freeRADIUS server v.2.1.1. after installing and configured FreeRADIUS i try to to start the daemon with -X parametr and get the error: Could not link driver rlm_sql_oracle: libclntsh.so.10.1: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[152]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section can anyone please help to solve this problem or push me to the right way? thanks in advance ilya

4 3

Re: Problems in TLS
by Martin Silvero 24 Nov '08

24 Nov '08

But that means that the authentication is successful? If I have the NAS and Supplicant improperly set, I do not understand because it rejects the response radius. What do these lines?: rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" Thanks Alan.

5 5

FreeRADIUS + Cisco Aironet WAP
by Tim Gustafson 24 Nov '08

24 Nov '08

Hey, I know this is a bit off-topic, but I was wondering if anyone on the list might be able to help with configuring a Cisco Aironet WAP to authenticate wireless users against a FreeRADIUS server? Thanks in advance! Tim Gustafson SOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

4 3

configure error
by Olavo 24 Nov '08

24 Nov '08

Hi all, I downloaded version 2.1 from http://freeradius.org/download.html . When configuring ( ./configure) I got several errors on config.log. I pasted below part of the log. This a RedHat ES5 , 64 bits. Basically the errors are configure:21137: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lnsl -lresolv -lpthread -ledit -ltermcap >&5 /usr/bin/ld: cannot find -ledit and conftest.c:8:28: error: ac_nonexistent.h: No such file or directory configure:3318: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" and configure:4488: gcc -c -g -O2 conftest.c >&5 conftest.c: In function 'main': conftest.c:25: error: 'not' undeclared (first use in this function) conftest.c:25: error: (Each undeclared identifier is reported only once conftest.c:25: error: for each function it appears in.) conftest.c:25: error: expected ';' before 'big' configure:4494: $? = 1 Anybody can help thanks Olavo Parts of log below uname -m = x86_64 uname -r = 2.6.18-92.el5 uname -s = Linux uname -v = #1 SMP Tue Apr 29 13:16:15 EDT 2008 /usr/bin/uname -p = unknown /bin/uname -X = unknown /bin/arch = x86_64 conftest.c:8:28: error: ac_nonexistent.h: No such file or directory configure:3318: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | /* end confdefs.h. */ | #include <ac_nonexistent.h> configure:3351: result: gcc -E configure:3380: gcc -E conftest.c configure:3386: $? = 0 configure:3417: gcc -E conftest.c conftest.c:8:28: error: ac_nonexistent.h: No such file or directory configure:3423: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | /* end confdefs.h. */ | #include <ac_nonexistent.h> more stuf .... ... configure:4488: gcc -c -g -O2 conftest.c >&5 conftest.c: In function 'main': conftest.c:25: error: 'not' undeclared (first use in this function) conftest.c:25: error: (Each undeclared identifier is reported only once conftest.c:25: error: for each function it appears in.) conftest.c:25: error: expected ';' before 'big' configure:4494: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | /* end confdefs.h. */ | #include <sys/types.h> | #include <sys/param.h> | | int | main () | { | #if BYTE_ORDER != BIG_ENDIAN | not big endian | #endif | | ; | return 0; | } more stuuf ... conftest.cpp:19:28: error: ac_nonexistent.h: No such file or directory configure:5949: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | #define HAVE_DLFCN_H 1 | /* end confdefs.h. */ | #include <ac_nonexistent.h> configure:5982: result: g++ -E configure:6011: g++ -E conftest.cpp configure:6017: $? = 0 configure:6048: g++ -E conftest.cpp conftest.cpp:19:28: error: ac_nonexistent.h: No such file or directory configure:6054: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | #define HAVE_DLFCN_H 1 | /* end confdefs.h. */ | #include <ac_nonexistent.h> more stuff .... ..... configure:9596: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | #define HAVE_DLFCN_H 1 | /* end confdefs.h. */ | /* Define shl_load to an innocuous variant, in case <limits.h> declares shl_load. | For example, HP-UX 11i <limits.h> declares gettimeofday. */ | #define shl_load innocuous_shl_load ....more stuf /usr/bin/ld: cannot find -ldld collect2: ld returned 1 exit status configure:9659: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | #define HAVE_DLFCN_H 1 | /* end confdefs.h. */ /usr/src/freeradius-server-2.1.1/conftest.c:53: undefined reference to `shl_load' collect2: ld returned 1 exit status configure:9596: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | #define HAVE_DLFCN_H 1 | /* end confdefs.h. */ | /* Define shl_load to an innocuous variant, in case <limits.h> declares shl_load. | For example, HP-UX 11i <limits.h> declares gettimeofday. */ | #define shl_load innocuous_shl_load configure:9659: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | #define HAVE_DLFCN_H 1 | /* end confdefs.h. */ configure:9738: gcc -o conftest -g -O2 conftest.c >&5 /tmp/ccksqVmY.o: In function `main': /usr/src/freeradius-server-2.1.1/conftest.c:53: undefined reference to `dlopen' collect2: ld returned 1 exit status configure:9744: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 -- INSERT -- configure: In function 'main': configure:10164: warning: incompatible implicit declaration of built-in function 'exit' /tmp/ccA6DLTc.o: In function `main':/usr/src/freeradius-server-2.1.1/configure:10152: warning: Using 'dlopen' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking configure:20574: checking for getsockname in -lsocket configure:20609: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lsocket -lpthread >&5 /usr/bin/ld: cannot find -lsocket collect2: ld returned 1 exit status configure:20615: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 -- INSERT -- /usr/bin/ld: cannot find -lws2_32 collect2: ld returned 1 exit status configure:20987: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | #define HAVE_DLFCN_H 1 | #define ASCEND_BINARY configure:21018: checking for pcap_open_live in -lpcap configure:21053: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lpcap -lnsl -lresolv -lpthread >&5 /usr/bin/ld: cannot find -lpcap collect2: ld returned 1 exit status configure:21059: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 configure:21088: WARNING: pcap library not found, silently disabling the RADIUS sniffer. configure:21094: checking for a readline compatible library configure:21137: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lnsl -lresolv -lpthread -lreadline >&5 /usr/bin/ld: cannot find -lreadline collect2: ld returned 1 exit status configure:21143: $? = 1 configure: failed program was: configure:21137: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lnsl -lresolv -lpthread -lreadline -ltermcap >&5 /usr/bin/ld: cannot find -lreadline collect2: ld returned 1 exit status configure:21143: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" /usr/bin/ld: cannot find -lreadline collect2: ld returned 1 exit status configure:21143: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" configure:21137: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lnsl -lresolv -lpthread -lreadline -lncurses >&5 /usr/bin/ld: cannot find -lreadline collect2: ld returned 1 exit status configure:21143: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" configure:21137: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lnsl -lresolv -lpthread -ledit >&5 /usr/bin/ld: cannot find -ledit collect2: ld returned 1 exit status configure:21143: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" configure:21137: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lnsl -lresolv -lpthread -ledit -ltermcap >&5 /usr/bin/ld: cannot find -ledit collect2: ld returned 1 exit status configure:21143: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" |

3 4

Re: Problems in TLS
by Martin Silvero 24 Nov '08

24 Nov '08

then what I want to say is that this configuration is for users who are not in a domain. But if users are in a domain? besides, I need is a certified master who serves me, or for users who are not in a domain. What sugeris me?

2 1

MediaProxy can't Closing expired calls, 404 Requested Dialog not found
by john li 24 Nov '08

24 Nov '08

Hi, I'm trying to enable MediaProxy to close expired calls but got an error Does anyone have any suggestions? Thanks a lot John here is the log: DBG:mi_datagram:identify_command: dtgram->len is 21 Nov 24 16:05:54 localhost media-dispatcher[3638]: [RelayServerProtocol,0, 127.0.0.1] Got statistics: {'from_tag': '353485446', 'callee_packets': {'audio': 432}, *'dialog_id': '795:0',* 'start_time': 1227513882.5899999, 'timed_out': True, 'caller_bytes': {'audio': 110400}, 'callee_bytes': {'audio': 86400}, 'call_id': '1440081054(a)192.168.1.8', 'to_tag': '1072710660', 'streams': [{'status': 'conntrack timeout', 'caller_codec': 'G711u', 'pdd': 0.54283404350300002, 'callee_codec': 'G711u', 'start_time': 0, 'caller_bytes': 110400, 'callee_bytes': 86400, 'callee_remote': ' 192.168.1.6:28802', 'caller_remote': '192.168.1.6:28556', 'media_type': 'audio', 'callee_local': '192.168.1.8:50090', 'timeout_wait': 60, 'caller_local': '192.168.1.8:50088', 'end_time': 71}], 'caller_packets': {'audio': 552}, 'duration': 71, 'to_uri': '01088888888(a)192.168.1.8', 'from_uri': '1000(a)192.168.1.8', 'callee_ua': 'YATE/2.0.0', 'caller_ua': 'YATE/2.0.0'} Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:identify_command: dtgram->len is 7 Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_server: we have a valid command Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_server: after identifing the command, the received datagram is 795 0 Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_server: parsing the command's params Nov 24 16:05:54 localhost cdrtool[3394]: DebitBalance CallId=1440081054(a)192.168.1.8 From=sip:1000@192.168.1.8<sip%3A1000(a)192.168.1.8>To= sip:01088888888@192.168.1.6:3212 Gateway=127.0.0.1 Duration=71 Nov 24 16:05:54 localhost cdrtool[3394]: ConnectFee=0.0000 CallId=1440081054(a)192.168.1.8 Span=1 Duration=71 DestId=8610 domain= 192.168.1.8 Profile=551 Period=weekday Rate=551 Interval=0-18 Cost=0.1200/60 Price=0.1420 Nov 24 16:05:54 localhost cdrtool[3394]: Price=0.1420 Duration=71 CallId=1440081054(a)192.168.1.8 BillingParty=1000(a)192.168.1.8 DestId=8610 MaxSessionTime=0 Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: the remaining datagram to be parsed is 795 0 and 7 in length Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: the string is not just a quoted string Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: found newline before attr_separator--we have just the attribute's value Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: empty name, attr not quoted value <795> found Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: 1 data->len is 7 Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: 2 data->len is 3 Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_tree: adding node <> ; val <795> Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_tree: the remaining datagram has 3 bytes Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: the remaining datagram to be parsed is 0 and 3 in length Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: the string is not just a quoted string Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: found newline before attr_separator--we have just the attribute's value Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: empty name, attr not quoted value <0> found Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: 1 data->len is 3 Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: 2 data->len is 1 Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_tree: adding node <> ; val <0> Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_tree: the remaining datagram has 1 bytes Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_parse_node: the remaining datagram to be parsed is and 1 in length Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_server: done parsing the mi tree Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:dialog:*mi_terminate_dlg: h_entry 795 h_id 0 *Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:dialog:lookup_dlg: *no dialog id=0 found on entry 795* Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_server: command process (dlg_end_dlg)succeded Nov 24 16:05:54 localhost /usr/sbin/opensips[11958]: DBG:mi_datagram:mi_datagram_server: the response: 404 Requested Dialog not found has been sent in 31 octets Nov 24 16:05:54 localhost media-dispatcher[3638]: [mediaproxy.interfaces.opensips.UNIXSocketProtocol (UDP)] error: failed to end dialog: *404 Requested Dialog not found *

2 1

LDAP login failed: check identity, password settings in ldap section of radiusd.conf, (re)connection attempt failed
by hsuan 24 Nov '08

24 Nov '08

Hi all : I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. I have set the radiusd configuration file (/usr/local/etc/raddb/radius.conf) about ldap information as follows : ldap { server = "localhost" identity = "cn=Manager，dc=nchc，dc=org，dc=tw" password = hsuan basedn = "dc=nchc，dc=org，dc=tw" filter = (&(!(objectClass=alias))(uid=%{Stripped-User-Name:-%{User-Name}}))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 ldap_connections_number = 5 password_header = "{crypt}" password_attribute =User-Password timeout = 4 timelimit = 3 net_timeout = 1 } But when I using “radius -X” to start the radius server ,and in the client I using “radtest ldapuser ldapuser radius_server_ip 0 secret” , The server shown the message : [ldap] performing user authorization for ldapuser [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(!(objectClass=alias))(uid=%{Stripped-User-Name:-%{User-Name}}))" -> (&(!(objectClass=alias))(uid=ldapuser))" [ldap] expand: dc=nchc??dc=org??dc=tw -> dc=nchc??dc=org??dc=tw rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager??dc=nchc??dc=org??dc=tw/hsuan to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [ldapuser/ldapuser] (from client my_radius_client_pc port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ldapuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 128 to 192.168.2.1 port 49351 Waking up in 4.9 seconds. Cleaning up request 3 ID 128 with timestamp +135542 Then the client receive the “rad_recv: Access-Reject packet from host 192.168.2.1 port 1812, id=22, length=20” What’s the problem ? how can I fix the error ? Regards, Vicky

2 1

802.1x and framed-ip-address attribute
by Andrew Rikhlivsky 24 Nov '08

24 Nov '08

Hello All, I'm using 802.1x for authenticating users. How can I use Framed-Ip-Address attribute to assign client ip address?

2 1

Bind to ldap with the current auticated user
by Ram Akuka 23 Nov '08

23 Nov '08

Hi, i am trying to bind to LDAP server with my the current auth user .. so i added the following to the ldap module: identity = "uid=%{Stripped-User-Name:-%{User-Name}},ou=people,o=XXX,o=XXX" password = "%{%{User-Password}:-%{Chap-Password}}" but insted of compressing the unlang string and using the uid i get the fallowing error: rlm_ldap: uid=%{Stripped-User-Name:-%{User-Name}},ou=people,o=XXX.,o=XXX bind to LDAPSERVER.XXX.com:389 failed No such object rlm_ldap: (re)connection attempt failed can some one help me here and tell me what i am doing wrong here???? thanks in advance , Ram

3 2

Access-Reject in attempted PAP cleartext setup?
by Vincent Fox 23 Nov '08

23 Nov '08

Hello! I am unable to make even a simple PAP cleartext setup work and cannot figure out what I am doing wrong. The note about it should "just work" well not for me so far..... I simply did an apt-get and settings are nearly all defaults. I did add a secret to clients.conf for 127.0.0.1 I tried both settings in modules/pap for auto_header of yes and no. I get this error: root@slim:/etc/raddb# radtest vf5 testing123 localhost 1812 testing123 Sending Access-Request of id 214 to 127.0.0.1 port 1812 User-Name = "vf5" User-Password = "testing123" NAS-IP-Address = 10.70.1.9 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=214, length=32 Reply-Message = "Hello, vf5" Simple entry added to default users file: vf5 Cleartext-Password := "testing123" Reply-Message = "Hello, %{User-Name}" proot@slim:/etc/raddb/modules# apt-cache show freeradius Package: freeradius Priority: optional Section: net Installed-Size: 2668 Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss(a)lists.ubuntu.com> Original-Maintainer: Stephen Gran <sgran(a)debian.org> Architecture: i386 Version: 2.1.0+dfsg-0ubuntu2 Provides: radius-server Depends: lsb-base (>= 3.0-6), libc6 (>= 2.4), libfreeradius2 (= 2.1.0+dfsg-0ubuntu2), libgdbm3, libltdl7 (>= 2.2.4), libpam0g (>= 0.99.7.1), libperl5.10 (>= 5.10.0), python2.5 (>= 2.5), freeradius-common Recommends: freeradius-utils Suggests: freeradius-ldap, freeradius-mysql, freeradius-krb5, freeradius-postgresql Filename: pool/main/f/freeradius/freeradius_2.1.0+dfsg-0ubuntu2_i386.deb Size: 1148040 MD5sum: 7576890ba8dccbfb9078b92ba4680bc8 SHA1: 9255fee9508af63e2cf0ff09fe22be8c3b10055f SHA256: 1e1d156ebe3b3bded135adc4b752a62a703dd8cb7253a60f2ec754c1ee0f932a Description: a high-performance and highly configurable RADIUS server A high-performance RADIUS server with support for... - many vendor-specific attributes - proxying and replicating requests by any criteria - authentication on system passwd, SQL, Kerberos, LDAP, users file, or PAM - multiple DEFAULT configurations - regexp matching in string attributes and lots more. Bugs: mailto:ubuntu-users@lists.ubuntu.com Origin: Ubuntu And radiusd -XXX output shows: Sat Nov 22 20:14:09 2008 : Debug: Listening on authentication address * port 1812 Sat Nov 22 20:14:09 2008 : Debug: Listening on accounting address * port 1813 Sat Nov 22 20:14:09 2008 : Debug: Listening on proxy address * port 1814 Sat Nov 22 20:14:09 2008 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 53924, id=214, length=55 User-Name = "vf5" User-Password = "testing123" NAS-IP-Address = 10.70.1.9 NAS-Port = 1812 Sat Nov 22 20:14:19 2008 : Info: +- entering group authorize {...} Sat Nov 22 20:14:19 2008 : Info: ++[preprocess] returns ok Sat Nov 22 20:14:19 2008 : Info: ++[chap] returns noop Sat Nov 22 20:14:19 2008 : Info: ++[mschap] returns noop Sat Nov 22 20:14:19 2008 : Info: [suffix] No '@' in User-Name = "vf5", looking up realm NULL Sat Nov 22 20:14:19 2008 : Info: [suffix] No such realm "NULL" Sat Nov 22 20:14:19 2008 : Info: ++[suffix] returns noop Sat Nov 22 20:14:19 2008 : Info: [eap] No EAP-Message, not doing EAP Sat Nov 22 20:14:19 2008 : Info: ++[eap] returns noop Sat Nov 22 20:14:19 2008 : Info: ++[unix] returns updated Sat Nov 22 20:14:19 2008 : Info: [files] users: Matched entry vf5 at line 93 Sat Nov 22 20:14:19 2008 : Debug: expand: Hello, %{User-Name} -> Hello, vf5 Sat Nov 22 20:14:19 2008 : Info: ++[files] returns ok Sat Nov 22 20:14:19 2008 : Info: ++[expiration] returns noop Sat Nov 22 20:14:19 2008 : Info: ++[logintime] returns noop Sat Nov 22 20:14:19 2008 : Info: ++[pap] returns updated Sat Nov 22 20:14:19 2008 : Info: Found Auth-Type = PAP Sat Nov 22 20:14:19 2008 : Info: +- entering group PAP {...} Sat Nov 22 20:14:19 2008 : Info: [pap] login attempt with password "testing123" Sat Nov 22 20:14:19 2008 : Info: [pap] Using CRYPT encryption. Sat Nov 22 20:14:19 2008 : Info: [pap] Passwords don't match Sat Nov 22 20:14:19 2008 : Info: ++[pap] returns reject Sat Nov 22 20:14:19 2008 : Info: Failed to authenticate the user. Sat Nov 22 20:14:19 2008 : Info: Using Post-Auth-Type Reject Sat Nov 22 20:14:19 2008 : Info: +- entering group REJECT {...} Sat Nov 22 20:14:19 2008 : Debug: expand: %{User-Name} -> vf5 Sat Nov 22 20:14:19 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Nov 22 20:14:19 2008 : Info: ++[attr_filter.access_reject] returns updated Sat Nov 22 20:14:19 2008 : Info: Delaying reject of request 0 for 3 seconds Sat Nov 22 20:14:19 2008 : Debug: Going to the next request Sat Nov 22 20:14:19 2008 : Debug: Waking up in 0.9 seconds. Sat Nov 22 20:14:20 2008 : Debug: Waking up in 1.9 seconds. Sat Nov 22 20:14:22 2008 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 214 to 127.0.0.1 port 53924 Reply-Message = "Hello, vf5" Sat Nov 22 20:14:22 2008 : Debug: Waking up in 4.9 seconds. Sat Nov 22 20:14:27 2008 : Info: Cleaning up request 0 ID 214 with timestamp +10 Sat Nov 22 20:14:27 2008 : Debug: Ready to process requests.

2 2