June 2008 - Freeradius-Users - lists.freeradius.org

Problems compiling Freeradius 2.0.4 on Fedora 8.
by Piero Giobbi 07 Jun '08

07 Jun '08

Hi all. Trying to upgrade my radiusd from 1.1.7 to 2.0.4. When i try make i get this at the end: /root/freeradius-server-2.0.4/libtool --mode=link gcc -o radeapclient radeapclient.lo libeap/libfreeradius-eap.la -lnsl - lresolv -lpthread -lcrypto -lssl -lcrypto gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/ libfreeradius-eap.so /root/freeradius-server-2.0.4/src/lib/.libs/ libfreeradius-radius.so -lnsl -lresolv -lpthread -lssl -lcrypto -Wl,-- rpath -Wl,/usr/local/lib libeap/.libs/libfreeradius-eap.so: undefined reference to `BIO_test_flags' libeap/.libs/libfreeradius-eap.so: undefined reference to `EVP_MD_size' collect2: ld returned 1 exit status gmake[6]: *** [radeapclient] Error 1 gmake[6]: Leaving directory `/root/freeradius-server-2.0.4/src/modules/ rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/freeradius-server-2.0.4/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-server-2.0.4/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-server-2.0.4/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-server-2.0.4/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-server-2.0.4' make: *** [all] Error 2 I really have no clue why or what to do.. Any help apreciated. Regards p

2 1

Compiling FreeRADIUS 2.0.4 on Solaris 10u4 x86
by Zilon X 06 Jun '08

06 Jun '08

When running 'configure' on a Solaris 10u4 x86 container, with version 2.0.4, the modules rlm_krb5 and rlm_python do not get configured - with either Sun Studio 12 ou GCC 3.4.6, and even using CPPFLAGS or --with-rlm-FOO-etc. Also, where can I find reasonable information about how make the rlm_eap_ikev2? Thank you for any advice. checking for DH_new in -lcrypto... yes checking for set_com_err_hook in -lcom_err... no configure: WARNING: the comm_err library isn't found! checking for krb5_init_context in -lkrb5... yes configure: WARNING: silently not building rlm_krb5. configure: WARNING: FAILURE: rlm_krb5 requires: krb5.h. checking for Py_Initialize in -lpython2.3... no configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h libpython2.3.

1 0

How to get extra attribute
by Reginaldo Russinholi 06 Jun '08

06 Jun '08

4 8

Simultaneos-Use in login for same mac-address
by Jean Carlos Oliveira Guandalini 06 Jun '08

06 Jun '08

Hello, we have a problem of mac-address clone, and we use the Simultaneous-Use: = 1 option to not allow double login, but when this is a case of the clone mac-address the freeradius allows the connection. Log of sql.trace: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'userlogin', '290476', 'Access-Accept', NOW()); INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('81b00935', 'bcc93b20ea389f59', 'userlogin', '', '10.0.6.10', '2447', 'Ethernet', '2008-06-06 11:08:45', '0', '0', 'RADIUS', '', '', '0', '0', 'INTERNET', '00:4F:62:0A:1F:BF', '', 'Framed-User', 'PPP', '111.111.111.111', '0', '0'); UPDATE radacct SET AcctStopTime = '2008-06-06 11:08:46', AcctSessionTime = '0', AcctInputOctets = '0', AcctOutputOctets = '0', AcctTerminateCause = '', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '81b00935' AND UserName = 'userlogin' AND NASIPAddress = '10.0.6.10'; INSERT into radpostauth (id, user, pass, reply, date) values ('', 'userlogin', '290476', 'Access-Accept', NOW()); INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('81b00936', '3f7c1d06dbd205d4', 'userlogin', '', '10.0.6.10', '2448', 'Ethernet', '2008-06-06 11:08:49', '0', '0', 'RADIUS', '', '', '0', '0', 'INTERNET', '00:4F:62:0A:1F:BF', '', 'Framed-User', 'PPP', '111.111.111.111', '0', '0'); Queries in sql.conf: simul_count_query = "SELECT COUNT(*) FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM ${acct_table1} WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" despite the mac-address to match are two different users, and the second to connect without first disconnecting was before. Is there any possibliidade to block it? Thanks Sorry for my english (By Google Tradutor) -- Jean Carlos Oliveira Guandalini Dep. de Redes e Infra-estrutura VisãoNet Tecnologia e Telecomunicações 0800-643-5025

3 5

FreeRadius/eDirectory/802.1X authentication issue
by Newall, Bryce 06 Jun '08

06 Jun '08

1 0

text "files" authentcation fails (2.0.3)
by oz 06 Jun '08

06 Jun '08

Hello group, I try to migrate a freeradius-Server from 1.1.7 to 2.0.3 using the new 2.0 syntax. Authentication uses the plain textfile /etc/raddb/users. Although my test-user matches an entry, I get an error-message "auth: No authenticate method (Auth-Type)..." I have no idea how to change this Auth-Type. The exact error you can see in an excerpt of radiusd -X: #radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 3 2008 at 13:33:47 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... [...] files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "cistron" } [/usr/local/etc/raddb/users]:1 Cistron compatibility checks for entry odsl ... Changing 'Password =' to 'Password ==' Changing 'Huntgroup-Name =' to 'Huntgroup-Name ==' Changing 'Simultaneous-Use =' to 'Simultaneous-Use +=' [...] Ready to process requests. [...] Going to the next request Ready to process requests. User-Password = "XYZ8AB" User-Name = "odsl" Acct-Session-Id = "erx GigabitEthernet 6/0.44:44:0004269184" Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 00:a0:c5:53:c9:40" Calling-Station-Id = "#erx705#E60#44" NAS-Port-Type = Ethernet NAS-Port = 1610612780 NAS-Port-Id = "GigabitEthernet 6/0.44:44" NAS-IP-Address = XX.XX.XX.XX NAS-Identifier = "erx705" +- entering group authorize ++[preprocess] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry odsl at line 1 ++[files] returns ok auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [odsl/XYZ8AB] (from client testerx port 1610612780 cli #erx705#E60#44) Delaying reject of request 0 for 1 seconds Going to the next request I have nothing special in my authorize and authenticate sections, because there was no need for it in 1.1.7 (no pap-settings for example). In short these entries: /etc/raddb/radiusd.conf: [...] files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = cistron } [...] $INCLUDE sites-enabled/ /etc/raddb/sites-available/default: authorize { preprocess } authenticate { } [...] Do I need rlm_pap now in 2.0.3 for using "files"-authentication? Any ideas, how I can make users/files authentication work again? Greetings, oz

3 4

SQL Statements
by Anders Holm 06 Jun '08

06 Jun '08

So, I'm getting closer to my end goal. I have a few questions though regarding SQL statements and what impacts there may be if I go about changing them.. My lovely DBA is telling me the expected traffic figures I have given them may put some interesting load on the DB backend. They'd love for me to change the SQL statements to be just INSERTS for all the accounting traffic. That would be for all the START, STOP and any intermediate accounting traffic I'd receive on the Freeradius platform. (Sorry, but I can't give the interesting figures) We're not planning on using any of the command line tools to check who's got a session or anything like that, but instead we'd use the database to get that information. Needless to say, the database will be replicated, and their queries would go to another instance than what I'll be writing to, so their queries shouldn't impact the performance of the instance I'm using. Would there be any interesting problems I may run into? The consumers of the data are fully aware they will have to correlate all that data themselves, I'm just providing it to them. So, I'm more curious about potential impact on the radius side... Thanks! //anders

2 1

Re: rlm_ippool fail
by tg_melo＠bol.com.br 06 Jun '08

06 Jun '08

>> Does the file exist? FreeRADIUS is at the mercy of the OS here. If >>the OS says "no such file or directory", it means "no such file or >>directory". No amount of playing with the FreeRADIUS configuration will >>make the file suddenly exist. >> Does the db.ippool file exist? >> >> Alan DeKok. >You are suposed to delete those files when you are changing ip pool >range. Module should be able to start without them. > >Ivan Kalik >Kalik Informatika ISP First of all, thanks for your reply Alan and Ivan. But Alan, the deal is what Ivan said. And it was tested with the 1.1.7 version. If you delete the file or it doesn't exist, freeradius creates another one, in order to follow your IP distribution config. And mainly, if you consider that neither the source or the ports install comes with the file. I also tried to put another previously created file there, and even an empty one. But without any result unless the error described. Executing the server as root or freeradius permissions doesn't create the file. If you have any other idea, I'll be thankful. I'm realy in trouble here.

2 1

Two Daemons on One Box?
by Kevin J 06 Jun '08

06 Jun '08

Folks, I need to run two different configurations on one box. I guess the only way is to run two daemons on different ports. Any advice or concern? I also want to hear if there is known issues, bugs, or performance matters when more than one daemon run on the same box. Thanks, Kevin

3 2

Need help on FreeRadius & CDR Tool
by Do Nguyen Ha 06 Jun '08

06 Jun '08

Hi manage the Cisco BTS 10200 system, and now i am assigned a task to work with the Radius i choose the FreeRadius to work with Cisco BTS system modify some config in radiusd.conf & clients.conf first, BTS send message Access Request to FreeRadius and then Freeradius send message Access Accept, they working properly when BTS send message Account Start to Radius, there are a lot attribute and freeradius save them in the radacct table this is the account start message structure: Attribute ID Vendor ID Sub Attribute ID Status Attribute Name Type Value 1 M- User-Name String ANI 4 M- NAS-IP-Address IP Address BTS IP address 6 M- Service-Type Integer Service Type = Outbound 25 C+ Class String CLASS Attribute 26 9 1 M- h323-incoming-conf-id=value String A unique number for identifying a calling session on a gateway, where a session is closed when the calling party hangs up. 26 9 24 M+ h323-conf-id String Unique call identifier generated by the BTS. Used to distinguish the separate billable events (calls) within a single calling session. 26 9 25 M- h323-setup-time String hh:mm:ss.mmm ZON DDD MMM ## YYYY Setup time in NTP format. 26 9 28 M- h323-connect-time String hh:mm:ss.mmm ZON DDD MMM ## YYYY Connect time in NTP format. 26 9 27 M+ h323-call-type String Telephony,VOIP 30 C- Called-Station-ID String DNIS 31 C+ Calling-Station-ID String ANI 40 M+ Acct-Status-Type Integer Acct-Status-Type = Start (1) 44 M+ Acct-Session-ID String Accounting Session ID 55 M+ Event-Timestamp Integer Event Time Stamp 61 M- NAS-Port-Type Integer Ethernet (15) but in radacct , there some columm doesn't match with the message Account Start, i want to change the name of some columm to match the message what should i need to edit the sql.conf for this issue On the CDR Tool, what should i need to edit to working properly Thanks Ha`

2 1