June 2008 - Freeradius-Users - lists.freeradius.org

compiler error / ld error
by Thomas Cornelsen 19 Jun '08

19 Jun '08

Hello together! i have a Problem compiling the Freeradius Version 2.0.4 I use the Solaris 9 Operating System Here is the Output of the "make" command : strncpy 0x1d94 /soft/ssl/lib//libcrypto.a(err.o) strncpy 0x338 /soft/ssl/lib//libcrypto.a(x509_obj.o) strncpy 0x5a0 /soft/ssl/lib//libcrypto.a(by_dir.o) strncpy 0x230 /soft/ssl/lib//libcrypto.a(v3_info.o) strncpy 0x238 /soft/ssl/lib//libcrypto.a(evp_key.o) getenv 0x5c /soft/ssl/lib//libcrypto.a(by_file.o) getenv 0x32c /soft/ssl/lib//libcrypto.a(by_dir.o) getenv 0xa0 /soft/ssl/lib//libcrypto.a(conf_api.o) getenv 0xbc /soft/ssl/lib//libcrypto.a(conf_api.o) stat 0xec /soft/ssl/lib//libcrypto.a(by_dir.o) ld: fatal: relocations remain against allocatable but non-writable sections collect2: ld returned 1 exit status make[9]: *** [rlm_eap_peap.la] Error 1 make[9]: Leaving directory `/export/home/users/freeradius-server-2.0.4/src/modules/rlm_eap/types/rlm_eap_peap' make[8]: *** [common] Error 2 make[8]: Leaving directory `/export/home/users/freeradius-server-2.0.4/src/modules/rlm_eap/types' make[7]: *** [all] Error 2 make[7]: Leaving directory `/export/home/users/freeradius-server-2.0.4/src/modules/rlm_eap/types' make[6]: *** [common] Error 2 make[6]: Leaving directory `/export/home/users/freeradius-server-2.0.4/src/modules/rlm_eap' make[5]: *** [common] Error 2 make[5]: Leaving directory `/export/home/users/freeradius-server-2.0.4/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/export/home/users/freeradius-server-2.0.4/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/export/home/users/freeradius-server-2.0.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/export/home/users/freeradius-server-2.0.4/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/export/home/users/freeradius-server-2.0.4' make: *** [all] Error 2 I really hope that someone has an answer for me! Thx in advance! Jetzt neu! Schützen Sie Ihren PC mit McAfee und WEB.DE. 30 Tage kostenlos testen. *http://www.pc-sicherheit.web.de/startseite/?mc=022220* [http://www.pc-sicherheit.web.de/startseite/?mc=022220]

2 1

post-auth and ippool
by Frank James Wilson 19 Jun '08

19 Jun '08

Hey, I'm trying to set up freeradius with our ISP's APN (mobile network) service. I've been using freeradius for sometime,and it works no problems. I'm using the system authentication module, and again,no problems here. My problem occurs when I want to use the 'dhcp' or ippool module. Here's my error; ----------------------------------------------------------------------------------- radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL Module: Instantiated ippool (mobile) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Listening on authentication *:1812 Ready to process requests. rad_recv: Access-Request packet from host 172.20.0.1:1812, id=122, length=122 NAS-Identifier = "ggsn3" User-Name = "mobile" User-Password = "xxxxxxxxx" NAS-IP-Address = 172.20.0.1 NAS-Port-Type = Virtual Called-Station-Id = "mdaxxxx" Calling-Station-Id = "474000xxxx" Acct-Session-Id = "d4118d7924abecce" Acct-Multi-Session-Id = "d4118d7900003472" Login OK: [mobile/Bama4ever] (from client ggsn3 port 0 cli 4740008077) rlm_ippool: Could not find Pool-Name attribute. Sending Access-Accept of id 122 to 172.20.0.1 port 1812 -------------------------------------------------------------------------------------- Now as you can see I get the error saying: rlm_ippool: Could not find Pool-Name attribute. Which I can't understand, since it is defined; radiusd.conf: --------------------------------------------------------------------------------------- ippool mobile { name = mobile range-start = 172.20.0.2 range-stop = 172.20.7.250 netmask = 255.255.248.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 #key = "172.20.0.1:1813" } ---------------------------------------------------------------------------------------------- And also in the users file: ----------------------------------------------------------------------------------------------- mobile Auth-Type = System, Pool-Name = mobile Service-Type == Login-User, Framed-Protocol = PPP, Fall-Through = Yes ------------------------------------------------------------------------------------------------ What am I doing wrong? Please advice.. best, Frank James Wilson

2 10

Expanding LDAP default_profile
by Giovanni Lovato 19 Jun '08

19 Jun '08

Maybe I'm wrong, but it seems default_profile option in LDAP configuration is not exandend, for example: default_profile = "cn=default,ou=profiles,ou=%{Realm},dc=example,dc=com" How can I make default_profile expanding? Thanks!

1 0

redundant_sql
by King, Adam 19 Jun '08

19 Jun '08

I have an if statement that checks if the Packet-Src-IP-Address matches that of the ones in the database table and the same process for the realm, before processing a user. This works fine to a local database, however I need redundancy setting up and it fails to authenticate to the second database but it does appear to connect. In the sites-enabled/default file I have: if("%{sql: SELECT COUNT(nas_ip) FROM `nas_ip` WHERE nas_ip='%{Packet-Src-IP-Address}' AND realm='%{Realm}'}" >0 ) { redundant { sql1 sql2 } } In radiusd.conf under instantiate { ..... Redundant { Sql1 Sql2 Handled } } And $INCLUDE sql1.conf $INCLUDE sql2.conf With the connection info for the databases in those 2 files. The output of radiusd -X is in the txt file attached Any help on how to get this working would be much appreciated. Adam King Network Engineer adam.king(a)intechnology.com InTechnology plc Support 0845 120 7070 Telephone 01423 850000 Facsimile 01423 858866 www.intechnology.com * Harrogate, Reading, London * 200 people, ?50m p.a. turnover * Over 500 corporate clients * Specialist Business Solutions & Services Provider This is an email from InTechnology plc, Central House, Beckwith Knowle, Harrogate, UK, HG3 1UG. Registered in England 3916586. The contents of this message may be privileged and confidential. If you have received this message in error, you may not use, disclose, copy or distribute its content in anyway. Please notify the sender immediately. All messages are scanned for all viruses.

3 3

dhcp server (udp checksum error)
by Haralds Ulmanis 19 Jun '08

19 Jun '08

for all dhcp server udp packets sent by server i got something like this while sniffing: Checksum: 0x9a54 [incorrect, should be 0x4777 (maybe caused by "UDP checksum offload"?)] Is that ok ?

2 1

sqlippool error duplicate IPs
by Deep Purple 19 Jun '08

19 Jun '08

freeradius-1.1.7.tar.gz pptpd-1.3.3-1.fc5 mysql 5.0.27 sqlippool user1 online ==> 172.16.1.30 next user connect user2 ==> 172.16.1.30 ( duplicate IPs ) Please Help Me ________________________________________________________ 180도 달라진 야후! 메일 - 여러 개의 메시지를 동시에 확인? 새로운 야후! 메일의 탭으로 가능해집니다. http://kr.content.mail.yahoo.com/cgland

2 1

dhcp relay agent
by Haralds Ulmanis 18 Jun '08

18 Jun '08

If i understand right DHCP-Gataway-Ip-Address = dhcp relay ip address. In dhcp offer (maybe ack / not tested) i can't set DHCP-Gateway-Ip-Address. By default it should contain same as in discover/request (???) DHCP-Gateway-Ip-Address. In offer it's set to 0.0.0.0 .

3 8

Problems with reject_delay in 2.0.5
by Flamur Rogova 18 Jun '08

18 Jun '08

Hi, I am testing 2.0.5 and found that my reject-delays are always close to zero ms (16ms, or 0ms). I use rlm_fastusers, and my reject_delay (in radiusd.conf) is 1. This happens in both debug and non-debug mode. Has anybody else had similar problems ? Thanks, Flamur

2 1

Strange behaviour of a NAS
by Michael Schwartzkopff 18 Jun '08

18 Jun '08

Hi list, We see a strange behaviour of a NAS. It sometimes sens out double accouting requests. See tcpdump below. Between the two packets there is a time difference of 40 microseconds(!) Has anybody a good explanation for this behaviour of the NAS? Any other theory? Misconfiguration? NAS type: Alcatel SMC. Thanks for any hint. --- dump --- 17:19:35.903233 IP xxx.206.254.10.17188 > xxx.217.246.173.1813: RADIUS, Accounting Request (4), id: 0x9b length: 362 17:19:35.903275 IP xxx.206.254.10.17188 > xxx.217.246.173.1813: RADIUS, Accounting Request (4), id: 0x9b length: 362 17:19:35.904208 IP xxx.217.246.173.1813 > xxx.206.254.10.17188: RADIUS, Accounting Response (5), id: 0x9b length: 20 These two incomming packets are really identical. Even if you look closer with -v option of tcpdump. Same authenticator. --- -- Dr. Michael Schwartzkopff MultiNET Services GmbH Addresse: Bretonischer Ring 7; 85630 Grasbrunn; Germany Tel: +49 - 89 - 45 69 11 0 Fax: +49 - 89 - 45 69 11 21 mob: +49 - 174 - 343 28 75 mail: misch(a)multinet.de web: www.multinet.de Sitz der Gesellschaft: 85630 Grasbrunn Registergericht: Amtsgericht München HRB 114375 Geschäftsführer: Günter Jurgeneit, Hubert Martens --- PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

1 0

FreeRADIUS 2 not listening on right port
by Casartello, Thomas 18 Jun '08

18 Jun '08

I just upgraded by FreeRADIUS server from the version 1 to version 2 family. I have the listen {} statements configured as follows: radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 1813 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 41045 Listening on accounting address * port 54893 Listening on proxy address * port 38374 Ready to process requests. However as you can see if always listens on random ports. What am I doing wrong? I am using version 2.0.2 which was distributed with Fedora 9. Thomas E. Casartello, Jr. Infrastructure Technician Linux Specialist Department of Information Technology Westfield State College Wilson 105-A (413) 572-8245 E-Mail: tcasartello(a)wsc.ma.edu Red Hat Certified Technician (RHCT)

10 41