January 2009 - Freeradius-Users - lists.freeradius.org

Freeradius crashes with Ubuntu init script
by lowbassman＠gmail.com 21 Jan '09

21 Jan '09

I can reliably reproduce crashing the freeradius 1.1.7 daemon on my Ubuntu Dapper box by sending it a dozen or so LDAP auth requests in a short period of time. However, this only happens when freeradius is started with the Ubuntu init script that uses start-stop-daemon. This simply runs: start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $PROGRAM However, if I simply run "freeradius" or "freeradius -X" on the command line, the server doesn't crash. When I run gdb, I see that freeradius is actually getting a TERM signal. Has anyone seen this or know what's special about start-stop-daemon that would cause freeradius to exit?

2 1

eap-ttls and require a certificate along with username/password
by Sandra H. 21 Jan '09

21 Jan '09

How can i make freeradius require a certificate along with username/password with eap-ttls? Im using the latest version of FR. We need it to do the two step auth for our current backend user management. Thanks

2 1

Re: FreeRADIUS + Alvarion 4Motion
by Yoni Levin 21 Jan '09

21 Jan '09

On 2009-01-16 16:46, Alan DeKok wrote: > Kristoffer Milligan wrote: > > My battle to make FreeRADIUS work with the Alvarion 4Motion system > > continues. I have been in contact with one of their engineers, and the > > only thing he saw that seemed invalid was a couple of missing attributes > > in the Access Accept response. > > > > Please look at the following url: > > > > https://www.norgespost.no/aaalog > > > > Now, in the tunneled response, there are two attributes: > > > > MS-MPPE-Encryption-Policy = 0x00000001 > > MS-MPPE-Encryption-Types = 0x00000006 > > > > Why aren't these attributes passed to the access accept? > > Because they are needed only for MS-CHAP authentication. They are > *not* needed anywhere else. > > Perhaps Alvarion could explain why they need these attributes. They > are *not* needed in the WiMAX spec, so far as I recall. FreeRADIUS > works with a number of WiMAX systems (Nokia, Motorola, etc.) > > What's so different about Alvarion? > > > Has anyone here integrated FreeRADIUS with the 4Motion system before? > > There has been little mention of it here. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > Hi Alan and the forum. I have been doing effort in the same direction right now. I failed to make 4 motion to work with freeradius. The fact that everything works OK but the key derivation is different looks amazing. I checked All possible Bs counters and everything looks just fine. Have you found something new since? Or we have no other choice but to use different radius for 4motion such as Bridgewater which declares Alvarion compatibility? Thanks, Yonatan.

2 1

freeRADIUS does not "see" openssl
by rosect190＠yahoo.com 21 Jan '09

21 Jan '09

I have a problem with freeRADIUS version 2.1.3. I have openssl installed in /usr/local/ssl. T? build the freeRADIUS server, I used this command: ./configure --with-openssl-include=/usr/local/ssl/include --with-openssl-libraries=/usr/local/ssl/lib However, the freeRADIUS just does not see the openssl and reports the followings: 1. configure: skipping test for openssl/ssl.h? -- why skip? Because it was told? 2. Checking OpenSSL support... no What configuration did I miss such that the server did does not see the openssl? Thanks.

2 1

unlang question
by Evgeniy Kozhuhovskiy 21 Jan '09

21 Jan '09

Is it possible to parse a string in unlang? For now, home server gives to my radius-proxy such avp: Something-Vendor-Specific = "a b" and i need to translate it to: Something-Other-Vendor-Specific-1 = "a" Something-Other-Vendor-Specific-2 = "b" --

2 1

Freeradius 2.0 + postgresql 8.3
by Igor Levchuk 21 Jan '09

21 Jan '09

Hello, I have an error: freeradius -X ....... rlm_sql (sql): sql_set_user escaped user --> 'testo' expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval # WHERE nasipaddress = '%{NAS-IP-Address}' # AND pool_key = '%{Calling-Station-Id}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', expiry_time = 'now'::timestamp(0) - '1 second'::interval # WHERE nasipaddress = '194.44.252.230' # AND pool_key = '' rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error operator does not exist: timestamp without time zone # rlm_sql_postgresql: Postgresql Fatal Error: [42883: UNDEFINED FUNCTION] Occurred!! #radtest testo test localhost 1 xxxxx Can you help me fix it ? -- ISP UARNet[Rivne] 000, +38(0362) 26-44-74, +38(0362) 26-97-82 E-mail: igor(a)rv.uar.net, tech(a)mail.rv.ua Regards, Igor Levchuk

2 2

freeRADIUS does not "find" openssl
by rosect190＠yahoo.com 21 Jan '09

21 Jan '09

I have a problem with freeRADIUS version 2.1.3. I have openssl installed in /usr/local/ssl. Tｏ build the freeRADIUS server, I used this command: ./configure --with-openssl-include=/usr/ｌｏｃａｌ／ｓｓｌ／ｉｎｃｌｕｄｅ－－ｗｉｔｈ－ｏｐｅｎｓｓｌ－ｌｉｂｒａｒｉｅｓ=/usr/local/ssl/lib However, the freeRADIUS just does not see the openssl and reports ｔｈｉｓ： 1. configure: skipping test for openssl/ssl.h -- why skip? Because it was told? 2. ｃｈｅｃｋｉｎｇ　ｆｏｒ　ＯｐｅｎＳＳＬ　ｓｕｐｐｏｒｔ　．．．　ｎｏ What configuration did I miss such that the server did does not see the openssl? Thanks.

2 1

Users-file and LDAP backend mixing questions
by Куприянов Максим 21 Jan '09

21 Jan '09

Hello! I'm using FreeRadius 2.1.3 with LDAP (eDirectory) and plain-text (users file) backends and I don't know how to solve a couple of problems :( 1. Is possible to mix users with same names, but different passwords from LDAP and from users file? There are some old time users in my org, who don't belong to eDirectory tree and there are users in eDirectory with same names that should not be treated like old-time ones. 2. I need some special DEFAULT with Fall-Through=yes rules that should match only users, authenticated by LDAP backend. I've tried Ldap-UserDn in check section of users file, but it seems to me, that Ldap-UserDn attribute is empty everytime :( 3. Also i need a reject rule for those users, who was authenticated by LDAP and do not belong to any ldap-group. I've tried Ldap-Group !*, but this attribute always exists for every user :( Please help. --- Sincerely yours, Maxim

3 14

LDAP connection lost
by Sergio Belkin 21 Jan '09

21 Jan '09

Hi, I have a problem that even is not fatal, still I haven't found why it happens. Users can get Access-Accept with no problems (apparently) but Radius logs says: tail -f /var/log/radius/radius.log Sun Jan 18 11:02:03 2009 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Sun Jan 18 11:02:03 2009 : Info: rlm_ldap: Attempting reconnect Mon Jan 19 09:19:42 2009 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Mon Jan 19 09:19:42 2009 : Info: rlm_ldap: Attempting reconnect Mon Jan 19 15:30:37 2009 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Mon Jan 19 15:30:37 2009 : Info: rlm_ldap: Attempting reconnect Tue Jan 20 09:37:47 2009 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Tue Jan 20 09:37:47 2009 : Info: rlm_ldap: Attempting reconnect Tue Jan 20 10:12:53 2009 : Info: Exiting normally. Tue Jan 20 12:01:51 2009 : Info: Ready to process requests. On http://pastebin.com/m156e39cd you can see the debug messages when running radiusd -X with some lines changed for obvious reasons: (Please bear in mind that my ldap server has in slapd.conf: idletimeout 0 timelimit 300, is not enough?) Thanks in advance!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Other or Custom Attribute similar to Class Attribute
by Danny Stemmet 21 Jan '09

21 Jan '09

Hi List, We are investigating inserting an attribute as part of the Access-Accept, which will then be returned in the Accounting Request. We know that the Class Attribute can do this. Are there any other attributes that we could use? We are using looking at using these attributes, to trigger some accounting processing (on a separate Server). -- Danny Stemmet <danny(a)msbmicro.com> MSB Micro Systems

2 1