June 2008 - Freeradius-Users - lists.freeradius.org

Active Directory Integration
by pingouin osmolateur 30 Jun '08

30 Jun '08

Hi every body I try to authenticate my user with an AD so I'm following the FreeRADIUS Active Directory Integration HOWTO (http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO) I succeded to insert the machine to a Windows domain [root@NETFLTR1 raddb]# ntlm_auth --username=TOTO password: NT_STATUS_OK: Success (0x0) Here is my radius.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } Here is my /etc/raddb/eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 } mschapv2 { } } I have in mysql table mysql> select * from radcheck ; +----+----------------------------------------+-----------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------------------------------------+-----------+----+---------+ | 10 | TOTO@MYDOMAIN | Auth-Type | := | MS-CHAP | +----+----------------------------------------+-----------+----+---------+ 1 row in set (0.00 sec) mysql> In debug mode I obtain [root@NETFLTR1 raddb]# /usr/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "testprc" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=192.48.19.111,shortname=NANATESTPRC,secret=titi; rlm_sql (sql): Adding client 192.48.19.111 (NANATESTPRC) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.48.19.111:49154, id=0, length=108 User-Name = "TOTO@MYDOMAIN" User-Password = "toto" Cisco-AVPair = "shell:priv-lvl=1" NAS-IP-Address = 192.48.19.111 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "TOTO@MYDOMAIN" rlm_realm: No such realm "MYDOMAIN" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'TOTO@SMYDOMAIN' rlm_sql (sql): sql_set_user escaped user --> 'TOTO@MYDOMAIN' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'TOTO@MYDOMAIN' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'TOTO@MYDOMAIN' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'TOTO@MYDOMAIN' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'TOTO@MYDOMAIN' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.48.19.111 port 49154 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 4868adc8 Nothing to do. Sleeping until we see a request. What's wrong ? Thanks in advance to help me. Best regards _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Active Directory Integration
by pingouin osmolateur 30 Jun '08

30 Jun '08

Hi every body I try to authenticate my user with an AD so I'm following the FreeRADIUS Active Directory Integration HOWTO (http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO) I succeded to insert the machine to a Windows domain [root@NETFLTR1 raddb]# ntlm_auth --username=TOTO password: NT_STATUS_OK: Success (0x0) Here is my radius.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } Here is my /etc/raddb/eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 } mschapv2 { } } I have in mysql table mysql> select * from radcheck ; +----+----------------------------------------+-----------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------------------------------------+-----------+----+---------+ | 10 | TOTO@MYDOMAIN | Auth-Type | := | MS-CHAP | +----+----------------------------------------+-----------+----+---------+ 1 row in set (0.00 sec) mysql> In debug mode I obtain [root@NETFLTR1 raddb]# /usr/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "testprc" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=192.48.19.111,shortname=NANATESTPRC,secret=titi; rlm_sql (sql): Adding client 192.48.19.111 (NANATESTPRC) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.48.19.111:49154, id=0, length=108 User-Name = "TOTO@MYDOMAIN" User-Password = "toto" Cisco-AVPair = "shell:priv-lvl=1" NAS-IP-Address = 192.48.19.111 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "TOTO@MYDOMAIN" rlm_realm: No such realm "MYDOMAIN" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'TOTO@SMYDOMAIN' rlm_sql (sql): sql_set_user escaped user --> 'TOTO@MYDOMAIN' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'TOTO@MYDOMAIN' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'TOTO@MYDOMAIN' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'TOTO@MYDOMAIN' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'TOTO@MYDOMAIN' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.48.19.111 port 49154 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 4868adc8 Nothing to do. Sleeping until we see a request. What's wrong ? Thanks in advance to help me. Best regards _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

EAP failure since upgrade
by Jonathan Gazeley 30 Jun '08

30 Jun '08

Hello, Until a couple of days ago, my FreeRadius setup was working perfectly normally - running FreeRadius 2.0.1 on a Centos 5 server. FreeRadius was compiled from source, not installed from a repository. Two days ago I received some automatic updates from standard Centos repo, and since then Radius has not worked. Running eapol test gives some output, including this (more of the output can be supplied on demand): EAPOL: SUPP_BE entering state RECEIVE Received 44 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=9 length=44 Attribute 79 (EAP-Message) length=6 Value: 04 09 00 04 Attribute 80 (Message-Authenticator) length=18 Value: 43 9e 23 c8 74 b1 a0 9f 8c 3b 83 be e8 36 a8 30 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.20 sec RADIUS packet matching with station decapsulated EAP packet (code=4 id=9 len=4) from RADIUS server: EAP Failure EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: success=0 EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit ENGINE: engine deinit MPPE keys OK: 0 mismatch: 1 FAILURE I checked and verified all the Freeradius configs. I recompiled 2.0.1 , and later compiled and installed 2.0.5 but this shows identical symptoms. I have attached the relevant section of my yum.log to show which packages were updated. The Radius server was tested once every minute by authenticating with a test account. This was first reported to fail at 10:48 I do not know which package could have caused this behaviour - has anyone else seen anything like this? It is quite urgent that I get this fixed asap as it is a production box at Bristol university. Currently we are running on the backup box, where I was luckily able to disable automatic updates before they were applied. Any advice will be gratefully received. Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ---------------------------- Jun 24 13:45:09 Updated: libgcc.i386 4.1.2-42.el5 Jun 24 13:45:25 Updated: glibc-common.i386 2.5-24 Jun 24 13:45:32 Updated: glibc.i686 2.5-24 Jun 24 13:45:34 Updated: bash.i386 3.2-21.el5 Jun 24 13:45:35 Updated: libselinux.i386 1.33.4-5.el5 Jun 24 13:45:36 Updated: chkconfig.i386 1.3.30.1-2 Jun 24 13:45:37 Updated: audit-libs.i386 1.6.5-9.el5 Jun 24 13:45:37 Updated: popt.i386 1.10.2-48.el5 Jun 24 13:45:42 Updated: shadow-utils.i386 2:4.0.17-13.el5 Jun 24 13:45:43 Updated: device-mapper.i386 1.02.24-1.el5 Jun 24 13:45:44 Updated: e2fsprogs-libs.i386 1.39-15.el5 Jun 24 13:45:44 Updated: libstdc++.i386 4.1.2-42.el5 Jun 24 13:45:51 Updated: perl.i386 4:5.8.8-10.el5_2.3 Jun 24 13:45:52 Updated: dbus.i386 1.0.0-7.el5 Jun 24 13:45:53 Updated: libX11.i386 1.0.3-9.el5 Jun 24 13:45:54 Updated: nspr.i386 4.7.0.99.2-1.el5 Jun 24 13:46:14 Updated: nss.i386 3.11.99.5-2.el5.centos Jun 24 13:46:15 Updated: freetype.i386 2.2.1-20.el5_2 Jun 24 13:46:16 Updated: cairo.i386 1.2.4-5.el5 Jun 24 13:46:16 Updated: libacl.i386 2.2.39-3.el5 Jun 24 13:46:20 Updated: coreutils.i386 5.97-14.el5 Jun 24 13:46:22 Updated: pam.i386 0.99.6.2-3.27.el5 Jun 24 13:46:23 Updated: krb5-libs.i386 1.6.1-25.el5 Jun 24 13:46:25 Updated: openssl.i686 0.9.8b-10.el5 Jun 24 13:46:30 Updated: python.i386 2.4.3-21.el5 Jun 24 13:46:31 Updated: module-init-tools.i386 3.3-0.pre3.1.37.el5 Jun 24 13:46:31 Updated: newt.i386 0.52.2-10.el5 Jun 24 13:46:32 Updated: cups-libs.i386 1:1.2.4-11.18.el5_2.1 Jun 24 13:46:36 Updated: gtk2.i386 2.10.4-20.el5 Jun 24 13:46:37 Updated: udev.i386 095-14.16.el5 Jun 24 13:46:39 Updated: util-linux.i386 2.13-0.47.el5 Jun 24 13:46:41 Updated: binutils.i386 2.17.50.0.6-6.el5 Jun 24 13:46:42 Updated: bind-libs.i386 30:9.3.4-6.P1.el5 Jun 24 13:46:43 Updated: mysql.i386 5.0.45-7.el5 Jun 24 13:46:44 Updated: kpartx.i386 0.4.7-17.el5 Jun 24 13:46:45 Updated: procps.i386 3.2.7-9.el5 Jun 24 13:46:45 Updated: hwdata.noarch 0.213.6-1.el5 Jun 24 13:46:46 Updated: pciutils.i386 2.2.3-5 Jun 24 13:46:47 Updated: e2fsprogs.i386 1.39-15.el5 Jun 24 13:46:48 Updated: iptables.i386 1.3.5-4.el5 Jun 24 13:46:49 Updated: psmisc.i386 22.2-6 Jun 24 13:46:49 Updated: make.i386 1:3.81-3.el5 Jun 24 13:46:50 Updated: diffutils.i386 2.8.1-15.2.3.el5 Jun 24 13:46:51 Updated: iproute.i386 2.6.18-7.el5 Jun 24 13:46:52 Updated: pcsc-lite-libs.i386 1.4.4-0.1.el5 Jun 24 13:46:53 Updated: dmraid.i386 1.0.0.rc13-9.el5 Jun 24 13:46:56 Updated: libgcj.i386 4.1.2-42.el5 Jun 24 13:46:57 Updated: libuser.i386 0.54.7-2.el5.5 Jun 24 13:46:58 Updated: usermode.i386 1.88-3.el5.1 Jun 24 13:46:59 Updated: libvolume_id.i386 095-14.16.el5 Jun 24 13:46:59 Updated: libgomp.i386 4.1.2-42.el5 Jun 24 13:47:00 Updated: libnl.i386 1.0-0.10.pre5.5 Jun 24 13:47:01 Updated: file.i386 4.17-13 Jun 24 13:47:02 Updated: libgfortran.i386 4.1.2-42.el5 Jun 24 13:47:03 Updated: iptables-ipv6.i386 1.3.5-4.el5 Jun 24 13:47:04 Updated: device-mapper-multipath.i386 0.4.7-17.el5 Jun 24 13:47:05 Updated: paps.i386 0.6.6-18.el5 Jun 24 13:47:05 Updated: yum-metadata-parser.i386 1.1.2-2.el5 Jun 24 13:47:06 Updated: libselinux-python.i386 1.33.4-5.el5 Jun 24 13:47:06 Updated: audit-libs-python.i386 1.6.5-9.el5 Jun 24 13:47:07 Updated: wpa_supplicant.i386 1:0.4.8-10.2.el5 Jun 24 13:47:09 Updated: samba-common.i386 3.0.28-0.el5.8 Jun 24 13:47:10 Updated: audit.i386 1.6.5-9.el5 Jun 24 13:47:11 Updated: nscd.i386 2.5-24 Jun 24 13:47:13 Updated: nss-tools.i386 3.11.99.5-2.el5.centos Jun 24 13:47:14 Updated: e2fsprogs-devel.i386 1.39-15.el5 Jun 24 13:47:15 Updated: net-tools.i386 1.60-78.el5 Jun 24 13:47:16 Updated: libselinux-devel.i386 1.33.4-5.el5 Jun 24 13:47:17 Updated: krb5-devel.i386 1.6.1-25.el5 Jun 24 13:47:19 Updated: openssl-devel.i386 0.9.8b-10.el5 Jun 24 13:47:20 Updated: gzip.i386 1.3.5-10.el5.centos Jun 24 13:47:20 Updated: pkgconfig.i386 1:0.21-2.el5 Jun 24 13:47:22 Updated: kernel-headers.i386 2.6.18-92.1.1.el5 Jun 24 13:47:23 Updated: glibc-headers.i386 2.5-24 Jun 24 13:47:25 Updated: glibc-devel.i386 2.5-24 Jun 24 13:47:25 Updated: centos-release-notes.i386 5.2-2 Jun 24 13:47:26 Updated: centos-release.i386 10:5-2.el5.centos Jun 24 13:47:28 Updated: initscripts.i386 8.45.19.EL-1.el5.centos.1 Jun 24 13:47:30 Updated: pcsc-lite.i386 1.4.4-0.1.el5 Jun 24 13:47:32 Updated: kbd.i386 1.12-20.el5 Jun 24 13:47:32 Updated: openssh.i386 4.3p2-26.el5 Jun 24 13:47:33 Updated: dhclient.i386 12:3.0.5-13.el5 Jun 24 13:47:34 Updated: coolkey.i386 1.1.0-6.el5 Jun 24 13:47:35 Updated: nss_ldap.i386 253-12.el5 Jun 24 13:47:36 Updated: nss_db.i386 2.2-35.3 Jun 24 13:47:37 Updated: crash.i386 4.0-5.0.3.el5.centos Jun 24 13:47:39 Updated: at-spi.i386 1.7.11-3.el5 Jun 24 13:47:39 Installed: python-iniparse.noarch 0.2.3-4.el5 Jun 24 13:47:40 Installed: gamin-python.i386 0.1.7-8.el5 Jun 24 13:47:40 Updated: libpcap.i386 14:0.9.4-12.el5 Jun 24 13:47:41 Updated: sudo.i386 1.6.8p12-12.el5 Jun 24 13:47:44 Updated: libstdc++-devel.i386 4.1.2-42.el5 Jun 24 13:47:45 Updated: parted.i386 1.8.1-17.el5 Jun 24 13:47:45 Updated: apr-util.i386 1.2.7-7.el5 Jun 24 13:47:46 Installed: device-mapper-event.i386 1.02.24-1.el5 Jun 24 13:47:48 Updated: lvm2.i386 2.02.32-4.el5 Jun 24 13:47:49 Updated: cpp.i386 4.1.2-42.el5 Jun 24 13:47:51 Updated: gcc.i386 4.1.2-42.el5 Jun 24 13:47:51 Updated: nash.i386 5.1.19.6-28 Jun 24 13:47:52 Updated: mkinitrd.i386 5.1.19.6-28 Jun 24 13:48:02 Installed: kernel.i686 2.6.18-92.1.1.el5 Jun 24 13:48:04 Updated: systemtap-runtime.i386 0.6.2-1.el5 Jun 24 13:48:06 Updated: systemtap.i386 0.6.2-1.el5 Jun 24 13:48:07 Updated: gcc-c++.i386 4.1.2-42.el5 Jun 24 13:48:08 Updated: gcc-gfortran.i386 4.1.2-42.el5 Jun 24 13:48:09 Updated: openssh-clients.i386 4.3p2-26.el5 Jun 24 13:48:10 Updated: openssh-server.i386 4.3p2-26.el5 Jun 24 13:48:11 Updated: irqbalance.i386 2:0.55-10.el5 Jun 24 13:48:13 Updated: sysklogd.i386 1.4.1-44.el5 Jun 24 13:48:14 Installed: dhcpv6-client.i386 1.0.10-4.el5_2.2 Jun 24 13:48:17 Updated: cups.i386 1:1.2.4-11.18.el5_2.1 Jun 24 13:48:21 Updated: samba.i386 3.0.28-0.el5.8 Jun 24 13:48:21 Updated: microcode_ctl.i386 1:1.17-1.47.el5 Jun 24 13:48:22 Updated: freetype-devel.i386 2.2.1-20.el5_2 Jun 24 13:48:23 Updated: mysql-devel.i386 5.0.45-7.el5 Jun 24 13:48:24 Updated: amtu.i386 1.0.6-1.el5 Jun 24 13:48:25 Updated: system-config-securitylevel-tui.i386 1.6.29.1-2.1.el5 Jun 24 13:48:26 Updated: authconfig.i386 5.3.21-3.el5 Jun 24 13:48:35 Updated: frysk.i686 0.0.1.2008.03.19.rh1-1.el5 Jun 24 13:48:36 Updated: grub.i386 0.97-13.2 Jun 24 13:48:37 Updated: autofs.i386 1:5.0.1-0.rc2.88 Jun 24 13:48:39 Updated: mysql-server.i386 5.0.45-7.el5 Jun 24 13:48:40 Updated: bind-utils.i386 30:9.3.4-6.P1.el5 Jun 24 13:48:42 Updated: oprofile.i386 0.9.3-16.el5 Jun 24 13:48:43 Updated: nfs-utils.i386 1:1.0.9-33.el5 Jun 24 13:48:44 Updated: krb5-workstation.i386 1.6.1-25.el5 Jun 24 13:48:46 Updated: pygtk2.i386 2.10.1-12.el5 Jun 24 13:48:48 Updated: notification-daemon.i386 0.3.5-9.el5 Jun 24 13:48:48 Updated: ntsysv.i386 1.3.30.1-2 Jun 24 13:48:50 Updated: m2crypto.i386 0.16-6.el5.2 Jun 24 13:48:52 Updated: ntp.i386 4.2.2p1-8.el5.centos.1 Jun 24 13:48:53 Updated: tcpdump.i386 14:3.9.4-12.el5 Jun 24 13:48:55 Updated: Deployment_Guide-en-US.noarch 5.2-9.el5.centos Jun 24 13:48:56 Updated: logwatch.noarch 7.3-6.el5 Jun 24 13:48:57 Updated: ksh.i386 20060214-1.7 Jun 24 13:48:58 Updated: xorg-x11-xinit.i386 1.0.2-15.el5 Jun 24 13:48:59 Updated: acl.i386 2.2.39-3.el5 Jun 24 13:49:01 Updated: libX11-devel.i386 1.0.3-9.el5 Jun 24 13:49:01 Updated: redhat-rpm-config.noarch 8.0.45-24.el5 Jun 24 13:49:02 Updated: cpuspeed.i386 1:1.2.1-3.el5 Jun 24 13:49:04 Updated: xorg-x11-server-Xvfb.i386 1.1.1-48.41.el5_2.1 Jun 24 13:49:05 Updated: shared-mime-info.i386 0.19-5.el5 Jun 24 13:49:07 Updated: gdb.i386 6.5-37.el5_2.2 Jun 24 13:49:08 Updated: mdadm.i386 2.6.4-1.el5 Jun 24 13:49:08 Updated: htmlview.noarch 4.0.0-2.el5 Jun 24 13:49:09 Updated: traceroute.i386 3:2.0.1-3.el5 Jun 24 13:49:10 Updated: ltrace.i386 0.5-7.45svn.el5 Jun 24 13:49:10 Updated: diffstat.i386 1.41-1.2.3.el5 Jun 24 13:49:11 Updated: checkpolicy.i386 1.33.1-4.el5 Jun 24 13:49:12 Installed: libhugetlbfs.i386 1.2-5.el5 Jun 24 13:49:13 Updated: hal.i386 0.5.8.1-35.el5 Jun 24 13:49:16 Updated: rpm.i386 4.4.2-48.el5 Jun 24 13:49:17 Updated: rpm-libs.i386 4.4.2-48.el5 Jun 24 13:49:18 Updated: policycoreutils.i386 1.33.12-14.el5 Jun 24 13:49:19 Updated: rpm-python.i386 4.4.2-48.el5 Jun 24 13:49:20 Updated: oddjob-libs.i386 0.27-9.el5 Jun 24 13:49:21 Updated: kudzu.i386 1.2.57.1.17-1 Jun 24 13:49:22 Updated: pm-utils.i386 0.99.3-6.el5.centos.19 Jun 24 13:49:24 Updated: selinux-policy.noarch 2.4.6-137.el5 Jun 24 13:49:25 Updated: bind.i386 30:9.3.4-6.P1.el5 Jun 24 13:49:26 Updated: NetworkManager.i386 1:0.6.4-8.el5 Jun 24 13:49:27 Updated: oddjob.i386 0.27-9.el5 Jun 24 13:49:28 Updated: bind-chroot.i386 30:9.3.4-6.P1.el5 Jun 24 13:50:11 Updated: selinux-policy-targeted.noarch 2.4.6-137.el5 Jun 24 13:50:13 Updated: system-config-network-tui.noarch 1.3.99.10-2.el5 Jun 24 13:50:14 Updated: rpm-build.i386 4.4.2-48.el5 Jun 24 13:50:15 Updated: smartmontools.i386 1:5.36-4.el5 Jun 24 13:50:16 Updated: yum.noarch 3.2.8-9.el5.centos.2.1 Jun 24 13:50:17 Installed: yum-fastestmirror.noarch 1.1.10-9.el5.centos Jun 24 13:50:17 Updated: yum-updatesd.noarch 1:0.9-2.el5 Jun 24 13:51:23 Erased: dhcpv6_client Jun 24 13:52:04 Erased: libhugetlbfs-lib Jun 24 13:52:30 Updated: Deployment_Guide-en-US.noarch 5.2-9.el5.centos Jun 24 13:52:31 Updated: bind-chroot.i386 30:9.3.4-6.P1.el5

6 11

sqlippool error
by Deep Purple 29 Jun '08

29 Jun '08

Hello Please Help me sqlippool error select FramedIPAddress,NASIPAddress,CallingStationID,username from radippool; FramedIPAddress| NASIPAddress | CallingStationID | username 172.16.2.1 | 127.0.0.1 | 121.111.111.123 | user1 172.16.2.2 | 127.0.0.1 | 121.111.111.123 | user2 172.16.2.3 | empty | empty | user6 radwho Login Name What TTY When From Location user1 user1 PPP S0 Sat 12:47 127.0.0.1 172.16.2.1 user2 user2 PPP S1 Wed 10:05 127.0.0.1 172.16.2.2 user3 user3 PPP S2 Sun 17:42 127.0.0.1 172.16.2.3 ==> long time connecting ________________________________________________________ 180도 달라진 야후! 메일 - 여러 개의 메시지를 동시에 확인? 새로운 야후! 메일의 탭으로 가능해집니다. http://kr.content.mail.yahoo.com/cgland

2 1

about freeradius support
by Sergio Yébenes Moreno 29 Jun '08

29 Jun '08

I'm configuring freeradius server with opensc client-side. I'd like to say if freeradius has support for PKCS#11. In wpa_supplicant log I see how client writes TLS-ChangeCipherSpec and TLS-Finished. This means that the server has authenticated but freeradius show TLS error because client do not send certificate. I think it's because PKCS#11. I'm not sure, but I really need to know. I'm using freeradius-server-2.0.4 Thanks a lot

3 3

freeradius accepts anybody
by Sergio Yébenes Moreno 29 Jun '08

29 Jun '08

Hi, using freeradius with EAP-TLS, the CommonName field of client certificate contains this: "pepe" If my file raddb/users constains this: "pepe123" Auth-Type := EAP Radius sends an Access-Acept and they shouldn't. Can anybody help me? Thanks a lot

3 4

FreeRadius Mysql Problem Solaris
by Umar 29 Jun '08

29 Jun '08

I tried to install FreeeRadius 2 on Solaris 10_X86. But it got error on make here is the error. localtime_r 0x153a /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_time.o) time 0x1528 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_time.o) __divdi3 0x16ed /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_time.o) realloc 0x1c /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_realloc.o) getcwd 0x35 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_getwd.o) chdir 0x11a /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_getwd.o) fgets 0x2b8 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) fgets 0x603 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) printf 0x10a6 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) printf 0x10cb /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) puts 0x10e3 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) puts 0x1248 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) puts 0x12b0 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) puts 0x1322 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) puts 0x13e5 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(default.o) finite 0x1e6 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(strtod.o) strrchr 0xf /usr/local/mysql/lib/mysql/libmysqlclient_r.a(mf_fn_ext.o) fileno 0x1a /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_fopen.o) fileno 0x11e /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_fopen.o) fileno 0x142 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_fopen.o) fileno 0x174 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_fopen.o) fclose 0x24 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_fopen.o) fopen64 0x108 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_fopen.o) fdopen 0x2ab /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_fopen.o) fdopen 0x33e /usr/local/mysql/lib/mysql/libmysqlclient_r.a(my_fopen.o) __fixunssfdi 0x3aa4 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(libmysql.o) __fixunsdfdi 0x3b4e /usr/local/mysql/lib/mysql/libmysqlclient_r.a(libmysql.o) __fixunsdfdi 0x3fd6 /usr/local/mysql/lib/mysql/libmysqlclient_r.a(libmysql.o) ld: fatal: relocations remain against allocatable but non-writable sections collect2: ld returned 1 exit status gmake[10]: *** [rlm_sql_mysql.la] Error 1 gmake[10]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[9]: *** [common] Error 2 gmake[9]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src/modules/rlm_sql/drivers' gmake[8]: *** [all] Error 2 gmake[8]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src/modules/rlm_sql/drivers' gmake[7]: *** [common] Error 2 gmake[7]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src/modules/rlm_sql' gmake[6]: *** [build-module] Error 2 gmake[6]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src/modules/rlm_sql' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/umar/freeradius-server-2.0.3/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/export/home/umar/freeradius-server-2.0.3' make: *** [all] Error 2 mysql 5.0.51a is install through source. Please help me what should i do? -- View this message in context: http://www.nabble.com/FreeRadius-Mysql-Problem-Solaris-tp18126620p18126620.… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

dhcp server - some bugs ?
by EvilEzh 29 Jun '08

29 Jun '08

1. As i understand responses is hardcoded(preset) to discover and request. DHCP-Message-Type = ... in config file is ignored, so i can't respond to RELEASE, INFORM, DECLINE. Always is NAK. Response to request also could be NAK, not always ACK. It is possible respond to request with NAK if change RLM_UPDATED to rejected or something like this. Would be nice if dhcp server check for DHCP-Message-Type is set. 2. in dhcp.c ... when checking for know packet type. (packet->data[242] >=8) should be > 8 so inform messages also be passed to proces. 3. I'd suggest #define DEFAUL_PACKET_SIZE (300), some clients refuse large packets silently. 4. couldn't find out why, but packet incoming from real ip addresses to broadcast are ignored. 0.0.0.0 -> 255.255.255.255 - processed, 10.1.0.3 -> 255.255.255.255 - ignored. Harlads

3 9

dialup admin httpd/error_log
by Deep Purple 29 Jun '08

29 Jun '08

Hello Fedora 5 httpd 2.2.2 ( Release: 1.3) php 5.1.6 ( Release : 1.6) /var/log/httpd/error_log PHP Notice: import_request_variables() [<a href='function.import-request-variables'>function.import-request-variables</a>]: No prefix specified - possible security hazard in /usr/local/dialup_admin/conf/config.php3 on line 8, PHP Notice: Use of undefined constant general_username_mappings_file - assumed 'general_username_mappings_file' in /usr/local/dialup_admin/conf/config.php3 PHP Notice: Undefined index: ua in /usr/local/dialup_admin/lib/attrshow.php3 Use of undefined constant sql_use_user_info_table - assumed 'sql_use_user_info_table' in /usr/local/dialup_admin/lib/sql/functions.php3 ________________________________________________________ 180도 달라진 야후! 메일 - 여러 개의 메시지를 동시에 확인? 새로운 야후! 메일의 탭으로 가능해집니다. http://kr.content.mail.yahoo.com/cgland

1 0

Dear freeradius-users@lists.freeradius.org June 86% 0FF
by VIAGRA � Official Site 28 Jun '08

28 Jun '08

1 0