August 2008 - Freeradius-Users - lists.freeradius.org

How to link radiusd statically?
by abhay＠clearcrypt.com 05 Aug '08

05 Aug '08

Hi, I would like to build radiusd with all necessary libraries statically linked in. I have tried the following command ./configure --enable-shared=no --enable-static=yes During linking phase, there are a bunch of problems; 1. libperl.a is not found (that has been fixed by downloading Perl 5.8.8 and building it locally); 2. many undefined functions, mainly in libkrb5.a Is this a way to go? Has anyone successfully built freeradius 2.0.5 with static linkage? Thanks! Abhay

4 3

Re: Seek through several RADIUS severs without realms
by Alan DeKok 05 Aug '08

05 Aug '08

Ronen Kfir wrote: > I would like to use FreeRADIUS as proxy to IAS servers. The question now > is how do I create those FreeRADIUS groups and how do I manage the > groups membership within FreeRADIUS. Read "man rlm_passwd"? This is documented. Alan DeKok.

1 0

rlm_ippool.so missing ?
by Xiaochen Jing 05 Aug '08

05 Aug '08

Hello all, When I was trying to run Freeradius, I got the following errors. It says no "rlm_ippool.so" exists. I took a look into /usr/local/lib, and there is no such file. Could someone help me on this? Thanks so much. I need to let Freeradius assign dynamic IP address from IP_Pool to PPPoE clients. Here is the error message: /usr/local/etc/raddb/radiusd.conf[1739]: Failed to link to module 'rlm_ippool': rlm_ippool.so: cannot open shared object file: No such file or directory /usr/local/etc/raddb/sites-enabled/default[354]: Failed to find module "main_pool". /usr/local/etc/raddb/sites-enabled/default[352]: Errors parsing post-auth section.

2 2

Re: Seek through several RADIUS severs without realms
by Ronen Kfir 05 Aug '08

05 Aug '08

> Unfortunately I lost the previous message of this thread, where Alan > Dekok's respond is presented. > Anyway, the content of it was he offered to use groups membership. He > also gave a specific file: rlm_passwd which should be configured in > order to achieve groups membership as an indication which IAS server > would respond each authentication request. No. You configure groups on the FREERADIUS server. > The thing is, though went over the help file of rlm_passwd a couple of > times, I didn't see clear explanation how to configure it when working > in IAS-Active Directory environment. If you're using IAS and not FreeRADIUS, don't ask questions here. If you're using FreeRADIUS a proxy to IAS, you can configure groups on FreeRADIUS, and apply policies there. Alan DeKok. Ronen Kfir: I would like to use FreeRADIUS as proxy to IAS servers. The question now is how do I create those FreeRADIUS groups and how do I manage the groups membership within FreeRADIUS.

1 0

simultaneous-use check via sql
by Oguzhan Kayhan 05 Aug '08

05 Aug '08

Hello I am trying to run Simultaneous-Use parameter on freeradius 2.0.5 which i have 2 virtual servers on. There can be same usernames on both virtual servers, so im not sure about how it works but i prefer to use sql instead of radutmp file for simultaneous check. Anyway, I added the following lines to users file as it is said /usr/share/doc/freeradius/Simultaneous-Use file. DEFAULT Simultaneous-Use := 0 Fall-Through = 1 I made the value 0 for testing purposes.. But no success.It still authenticates the user without any sim. check parameter. And I also wonder where did the Simul.Use queries in sql.conf in 1.1.7 version dissapeared? My virtual server config as follows..: server dormnet { authorize { preprocess files sql_dormnet } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } accounting { unix radutmp sql_dormnet } session { radutmp sql_dormnet } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } }

3 5

radacct insert issue.
by S Adrian 05 Aug '08

05 Aug '08

Ok, thanks, I got the latest git .. and I get this upon compilation :| gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -DEAPLIB -I. -I.. -I/root/radiusd/src -DOPENSSL_NO_KRB5 -c eap_tls.c -o eap_tls.o >/dev/null 2>&1 /usr/bin/libtool --mode=link gcc -release 2.0.6 \ -export-dynamic -o libfreeradius-eap.la -rpath /usr/local/lib eapcommon.lo eapcrypto.lo eapsimlib.lo fips186prf.lo cb.lo eap_tls.lo mppe_keys.lo tls.lo \ /root/radiusd/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread libtool: link: `eapcommon.lo' is not a valid libtool object gmake[7]: *** [libfreeradius-eap.la] Error 1 gmake[7]: Leaving directory `/root/radiusd/src/modules/rlm_eap/libeap' gmake[6]: *** [common] Error 2 /usr/bin/libtool --mode=link gcc -release 2.0.6 \ -export-dynamic -o libfreeradius-eap.la -rpath /usr/local/lib eapcommon.lo eapcrypto.lo eapsimlib.lo fips186prf.lo cb.lo eap_tls.lo mppe_keys.lo tls.lo \ /root/radiusd/src/lib/libfreeradius-radius.la -lnsl -lresolv -lpthread libtool: link: `eapcommon.lo' is not a valid libtool object gmake[7]: *** [libfreeradius-eap.la] Error 1 gmake[7]: Leaving directory `/root/radiusd/src/modules/rlm_eap/libeap' gmake[6]: *** [libeap/freeradius-eap.la] Error 2 gmake[6]: Leaving directory `/root/radiusd/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/radiusd/src/modules' gmake[4]: *** [all] Error 2 which isn't good .. but still regarding my initial issue .. is the rp-pppoe server sending 2 accounting requests ? :| why would he do that ?! Thanks again for the quick answer. Adrian.

2 1

groupmembership and vlan assignment
by Matt Ashfield 05 Aug '08

05 Aug '08

Hello We have been using the groupmembership attribute in radius.conf to assign users to the appropriate vlans. Up until now we've done it based on the type of LDAP user they are (ie, staff, student, faculty, etc..): groupmembership_attribute = eduPersonPrimaryAffiliation, (where eduPersonPrimaryAffliation=staff, student, facult, etc..) Unfortunately, our student vlans have grown significantly large and we want to take measures to make them smaller. We have looked into using LDAP entitlement fields. There are however a few issues here: - The eduPersonEntitlement attribute is not unique. A user record can have multiple instances of this attribute for each different entitlement they have. - The eduPersonEntitlement attribute has a value that is not simply the name of a vlan. It is typically something like: eduPersonEntitlement: urn:mace:uni.ca:wireless?vlan=student1 So I'd need to parse the value as well to pull out the vlan name, in this case "student1". I'm unsure how to get around these two issues. Any suggestions are welcome. Thanks Matt mda(a)unb.ca

2 8

Using ntlm_auth with AD subdomains
by Dow, Corey 05 Aug '08

05 Aug '08

Hi All, I have an environment where I'm trying to use FreeRADIUS to authenticate with two Active Directory domains at the same time. The problem I'm encountering is that I can authenticate one domain at a time, but not both, by manipulating the ntlm_auth syntax in radiusd.conf. For example, my parent AD domain is idmcorp.net (IDMCORP), and my subdomain is sub.idmcorp.net (SUB). The redhat linux system is joined to the parent domain and I can authenticate users via the ntlm_auth command line executable as shown. ProCurve RADIUS(ms):/etc/raddb # ntlm_auth --nt-request-key --username=codo password: NT_STATUS_OK: Success (0x0) ProCurve RADIUS(ms):/etc/raddb # ntlm_auth --nt-request-key --username='SUB\subusr1' password: NT_STATUS_OK: Success (0x0) I have two test systems which are Windows XP, configured for machine authentication, and each joined to one of the AD domains. The following radiusd.conf ntlm_auth configuration will allow machines in idmcorp.net to authenticate successfully, but not sub.idmcorp.net. If I change the --domain to sub.idmcorp.net, then that domain can authentication successfully but not idmcorp.net. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{NT-Domain:-idmcorp.net} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" The bottom line when I look at radiusd -X is that the challenge fails because only idmcorp.net is applied: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=subusr1' WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{NT-Domain} radius_xlat: '--domain=idmcorp.net' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: b2 radius_xlat: '--challenge=f5ba542c686e9959' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=dfdebeef4582ae2ee49bba789b110a6af1507b67abc97e5e' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 I thought removing the domain argument from ntlm_auth might work, but this fails as well: radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=subusr1' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 49 radius_xlat: '--challenge=dcadf8974326b238' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=804ebd5ea2b41d58ee34f221268885086ca958434d969593' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 Sorry so wordy. Can anyone think of a way to get this working for both the parent/child domains ? Thanks, Corey Corey Dow Security Solutions Test Engineer ProCurve Networking Hewlett-Packard Company 8000 Foothills Blvd. (MS 5549) Roseville, CA 95747

2 1

radacct insert issue.
by S Adrian 05 Aug '08

05 Aug '08

Hi everybody ... After banging my head against the table all day long for a few days now I decided it's time to give up and ask someone who might actually know what they're doing, so here it goes: I'm using freeradius 2.0.5 with rp-pppoe on a gentoo x86_64 box to auth .. works ok so far .. the only thing I don't get is why does it insert into radacct 2 sessions, can be seen here: http://d3xt3r01.tk/~dexter/rad/radius.log .. when the user disconnects .. it only updates the latest ( the one with 01 in the end ) session ! .. so I don't get it ! radiusd.conf http://d3xt3r01.tk/~dexter/rad/radiusd.conf sites-enabled/default http://d3xt3r01.tk/~dexter/rad/default I have another issue with making snmp work but that'll be in another thread after this is fixed. Thanks in advance, Adrian.

2 1

access to multiple value from rlm_exec
by Dmitry Goncharov 04 Aug '08

04 Aug '08

Hi! please help me, how can access to multiple value from rlm_exec? radius receive packet such this: Mon Aug 4 16:32:06 2008 Acct-Session-Id = "55E86035000A015A" Cisco-AVPair = "client-mac-address=0050.0430.4c23" Framed-Protocol = PPP Framed-IP-Address = xx.xx.xx.xx User-Name = "xxxx" Cisco-AVPair = "connect-progress=LAN Ses Up" Acct-Session-Time = 22796 Acct-Input-Octets = 2565126 Acct-Output-Octets = 23229624 Acct-Input-Packets = 23808 Acct-Output-Packets = 25356 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Virtual Cisco-NAS-Port = "0/0/1/570" NAS-Port = 0 Service-Type = Framed-User NAS-IP-Address = xx.xx.xx.xx Acct-Delay-Time = 0 Client-IP-Address = xx.xx.xx.xx Acct-Unique-Session-Id = "2252af4ea3eae1d8" Timestamp = 1217853126 however, from rlm_exec, printenv show: ACCT_INPUT_OCTETS=5545038 CLIENT_IP_ADDRESS=xx.xx.xx.xx NAS_PORT_TYPE=Virtual FRAMED_PROTOCOL=PPP SERVICE_TYPE=Framed-User ACCT_STATUS_TYPE=Interim-Update ACCT_INPUT_PACKETS=26107 ACCT_SESSION_ID="55E860350009FEC8" ACCT_OUTPUT_OCTETS=13415143 NAS_PORT=0 ACCT_SESSION_TIME=24230 ACCT_AUTHENTIC=RADIUS FRAMED_IP_ADDRESS=xx.xx.xx.xx NAS_IP_ADDRESS=xx.xx.xx.xx USER_NAME="xxxxxx" CISCO_NAS_PORT="0/0/1/555" ACCT_OUTPUT_PACKETS=25996 CISCO_AVPAIR="connect-progress=LAN Ses Up" ACCT_UNIQUE_SESSION_ID="3ca7cb358d495772" ACCT_DELAY_TIME=0 in first example, value Cisco-AVPair exist twice, in second - once. i`m use freeradius-1.1.6, -- Dmitry, son of Anatoly

2 3