December 2009 - Freeradius-Users - lists.freeradius.org

MySQL user reject by date
by Cristophe DECOR 04 Dec '09

04 Dec '09

Hi, can i reject (and how ?) a demand by date (it's too late or too early to connect) with Mysql users (in raddcheck table) and of course where can i store these two fields (date_begin and date_end) in mysql radius database (new table ?, new field ?) thanks -- Cristophe DECOR Montpellier Supagro Unité Informatique Réseau LAN 2 place VIALA 34060 MONTPELLIER Tel : 0499612797

2 1

query about users file and Radius restarting
by Yagnesh Dave 04 Dec '09

04 Dec '09

Hi All, I want to know that do we need to restart the radius server once we add a new user in the users file or it is automatically taken in affect. Because at the moment I re-start the freeRadius every time I add a new user. Regards, Dave.

2 1

RE: Freeradius-Users Digest, Vol 56, Issue 34
by Nadir M. Aliyev 04 Dec '09

04 Dec '09

Hello all, I installed freeradius-1.1.7_4 with only pgsql support. When I start radius on normal mode or on debug mode this errors appears: /libexec/ld-elf.so.1: /usr/local/lib/rlm_sqlippool-1.1.7.so: Undefined symbol "sql_get_socket"

2 1

Missing dependency operator when start make
by Andrew Rikhlivsky 04 Dec '09

04 Dec '09

After downloading latest freeradius v2.1.7 sources, and configuring (./configure --without-openssl --without-snmp) i start make and see next messages: # make "Make.inc", line 82: Missing dependency operator "Make.inc", line 85: Need an operator "Make.inc", line 87: Missing dependency operator "Make.inc", line 90: Need an operator "Make.inc", line 92: Missing dependency operator "Make.inc", line 93: Missing dependency operator "Make.inc", line 94: Need an operator "Make.inc", line 95: Need an operator "Make.inc", line 97: Need an operator "Make.inc", line 98: Need an operator "Make.inc", line 106: Missing dependency operator "Make.inc", line 108: Need an operator "Makefile", line 70: Missing dependency operator "Makefile", line 71: Missing dependency operator "Makefile", line 88: Need an operator "Makefile", line 89: Need an operator make: fatal errors encountered -- cannot continue OS FreeBSD 8.0. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for g++... g++ checking whether we are using the GNU C++ compiler... yes checking whether g++ accepts -g... yes checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for AIX... no checking whether gcc needs -traditional... no checking whether we are using SUNPro C... no checking for ranlib... ranlib checking for special C compiler options needed for large files... no checking for _FILE_OFFSET_BITS value needed for large files... no checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking whether byte ordering is bigendian... no checking for gmake... yes checking for gmake... /usr/local/bin/gmake checking for lt_dlinit in -lltdl... no checking build system type... x86_64-unknown-freebsd8.0 checking host system type... x86_64-unknown-freebsd8.0 checking for a sed that does not truncate output... /usr/bin/sed checking for ld used by gcc... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognize dependent libraries... pass_all checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking how to run the C++ preprocessor... g++ -E checking for g77... no checking for xlf... no checking for f77... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for xlf90... no checking for f90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for xlf95... no checking for f95... no checking for fort... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 196608 checking command to parse /usr/bin/nm -B output from gcc object... ok checking for objdir... .libs checking for ar... ar checking for ranlib... (cached) ranlib checking for strip... strip checking if gcc supports -fno-rtti -fno-exceptions... no checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking whether the gcc linker (/usr/bin/ld) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... freebsd8.0 ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking for shl_load... no checking for shl_load in -ldld... no checking for dlopen... yes checking whether a program can dlopen itself... yes checking whether a statically linked program can dlopen itself... no checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure: creating libtool appending configuration tag "CXX" to libtool checking for ld used by g++... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking whether the g++ linker (/usr/bin/ld) supports shared libraries... yes checking for g++ option to produce PIC... -fPIC checking if g++ PIC flag -fPIC works... yes checking if g++ static flag -static works... yes checking if g++ supports -c -o file.o... yes checking whether the g++ linker (/usr/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... freebsd8.0 ld.so (cached) (cached) checking how to hardcode library paths into programs... immediate appending configuration tag "F77" to libtool checking docdir... ${datadir}/doc/freeradius checking logdir... ${localstatedir}/log/radius checking radacctdir... ${logdir}/radacct checking raddbdir... ${sysconfdir}/raddb checking for perl... /usr/bin/perl checking for snmpget... no checking for snmpwalk... no checking for rusers... /usr/bin/rusers checking for locate... /usr/bin/locate checking for dirname... /usr/bin/dirname checking for grep... (cached) /usr/bin/grep checking pthread.h usability... yes checking pthread.h presence... yes checking for pthread.h... yes checking for pthread_create in -lpthread... yes checking for library containing sem_init... none required checking for getsockname in -lsocket... no checking for inet_aton in -lresolv... no checking for inet_ntoa in -lnsl... no checking for htonl in -lws2_32... no checking for pcap_open_live in -lpcap... yes checking for a readline compatible library... -lreadline checking readline.h usability... no checking readline.h presence... no checking for readline.h... no checking readline/readline.h usability... yes checking readline/readline.h presence... yes checking for readline/readline.h... yes checking whether readline supports history... no checking for dirent.h that defines DIR... yes checking for library containing opendir... none required checking for ANSI C header files... (cached) yes checking whether time.h and sys/time.h may both be included... yes checking for sys/wait.h that is POSIX.1 compatible... yes checking for unistd.h... (cached) yes checking crypt.h usability... no checking crypt.h presence... no checking for crypt.h... no checking errno.h usability... yes checking errno.h presence... yes checking for errno.h... yes checking resource.h usability... no checking resource.h presence... no checking for resource.h... no checking sys/resource.h usability... yes checking sys/resource.h presence... yes checking for sys/resource.h... yes checking getopt.h usability... yes checking getopt.h presence... yes checking for getopt.h... yes checking malloc.h usability... no checking malloc.h presence... no checking for malloc.h... no checking utmp.h usability... yes checking utmp.h presence... yes checking for utmp.h... yes checking utmpx.h usability... no checking utmpx.h presence... no checking for utmpx.h... no checking signal.h usability... yes checking signal.h presence... yes checking for signal.h... yes checking sys/select.h usability... yes checking sys/select.h presence... yes checking for sys/select.h... yes checking syslog.h usability... yes checking syslog.h presence... yes checking for syslog.h... yes checking for inttypes.h... (cached) yes checking for stdint.h... (cached) yes checking stdio.h usability... yes checking stdio.h presence... yes checking for stdio.h... yes checking netdb.h usability... yes checking netdb.h presence... yes checking for netdb.h... yes checking semaphore.h usability... yes checking semaphore.h presence... yes checking for semaphore.h... yes checking arpa/inet.h usability... yes checking arpa/inet.h presence... yes checking for arpa/inet.h... yes checking netinet/in.h usability... yes checking netinet/in.h presence... yes checking for netinet/in.h... yes checking for sys/types.h... (cached) yes checking sys/socket.h usability... yes checking sys/socket.h presence... yes checking for sys/socket.h... yes checking winsock.h usability... no checking winsock.h presence... no checking for winsock.h... no checking sys/time.h usability... yes checking sys/time.h presence... yes checking for sys/time.h... yes checking for sys/wait.h... (cached) yes checking sys/security.h usability... no checking sys/security.h presence... no checking for sys/security.h... no checking fcntl.h usability... yes checking fcntl.h presence... yes checking for fcntl.h... yes checking sys/fcntl.h usability... yes checking sys/fcntl.h presence... yes checking for sys/fcntl.h... yes checking sys/prctl.h usability... no checking sys/prctl.h presence... no checking for sys/prctl.h... no checking sys/un.h usability... yes checking sys/un.h presence... yes checking for sys/un.h... yes checking glob.h usability... yes checking glob.h presence... yes checking for glob.h... yes checking prot.h usability... no checking prot.h presence... no checking for prot.h... no checking pwd.h usability... yes checking pwd.h presence... yes checking for pwd.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking sia.h usability... no checking sia.h presence... no checking for sia.h... no checking siad.h usability... no checking siad.h presence... no checking for siad.h... no checking for net/if.h... yes checking regex.h usability... yes checking regex.h presence... yes checking for regex.h... yes checking pcap.h usability... yes checking pcap.h presence... yes checking for pcap.h... yes checking for off_t... yes checking for pid_t... yes checking for size_t... yes checking for uid_t in sys/types.h... yes checking for socklen_t... yes checking for uint8_t... yes checking for uint16_t... yes checking for uint32_t... yes checking for struct in6_addr... yes checking for struct sockaddr_storage... yes checking for struct sockaddr_in6... yes checking for struct addrinfo... yes checking for getopt_long... yes checking for lockf... yes checking for strsignal... yes checking for sigaction... yes checking for sigprocmask... yes checking for pthread_sigmask... yes checking for snprintf... yes checking for vsnprintf... yes checking for setsid... yes checking for strncasecmp... yes checking for strcasecmp... yes checking for localtime_r... yes checking for ctime_r... yes checking for gmtime_r... yes checking for strsep... yes checking for inet_aton... yes checking for inet_pton... yes checking for inet_ntop... yes checking for setlinebuf... yes checking for setvbuf... yes checking for getusershell... yes checking for initgroups... yes checking for getaddrinfo... yes checking for getnameinfo... yes checking for closefrom... yes checking for gettimeofday... yes checking for getpeereid... yes checking for setuid... yes checking for setresuid... yes checking for getresuid... yes checking for strlcat... yes checking for strlcpy... yes checking whether crypt must be declared... no checking whether strncasecmp must be declared... no checking whether strcasecmp must be declared... no checking whether inet_aton must be declared... no checking whether setlinebuf must be declared... no checking whether getusershell must be declared... no checking whether endusershell must be declared... no checking return type of signal handlers... void checking for ipi_addr in struct in_pktinfo... no checking for ipi6_addr in struct in6_pktinfo... yes checking for an ANSI C-conforming const... yes checking type of OS... FreeBSD checking for developer gcc flags... no. checking for TLS... yes checking for crypt in -lcrypt... yes checking for setkey in -lcipher... no checking gethostbyaddr_r() syntax... checking whether gethostbyaddr_r is declared... yes GNU-style checking gethostbyname_r() syntax... GNU-style checking ctime_r() syntax... POSIX-style top_builddir=/usr/local/free configure: creating ./config.status config.status: creating ./Make.inc config.status: creating ./src/include/build-radpaths-h config.status: creating ./src/main/Makefile config.status: creating ./src/main/checkrad.pl config.status: creating ./src/main/radlast config.status: creating ./src/main/radtest config.status: creating ./scripts/rc.radiusd config.status: creating ./scripts/radwatch config.status: creating ./scripts/radiusd.cron.daily config.status: creating ./scripts/radiusd.cron.monthly config.status: creating ./scripts/cryptpasswd config.status: creating ./raddb/dictionary config.status: creating ./raddb/radrelay.conf config.status: creating ./raddb/radiusd.conf config.status: creating src/include/autoconf.h config.status: src/include/autoconf.h is unchanged config.status: executing stamp-h commands config.status: executing build-radpaths-h commands config.status: executing main-chmod commands config.status: executing scripts-chmod commands === configuring in libltdl (/usr/local/free/libltdl) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for gawk... no checking for mawk... no checking for nawk... nawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... none checking for an ANSI C-conforming const... yes checking for inline... inline checking build system type... x86_64-unknown-freebsd8.0 checking host system type... x86_64-unknown-freebsd8.0 checking for a sed that does not truncate output... /usr/bin/sed checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for ld used by gcc... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for /usr/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognise dependent libraries... pass_all checking how to run the C preprocessor... gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking dlfcn.h usability... yes checking dlfcn.h presence... yes checking for dlfcn.h... yes checking for g++... g++ checking whether we are using the GNU C++ compiler... yes checking whether g++ accepts -g... yes checking dependency style of g++... none checking how to run the C++ preprocessor... g++ -E checking for g77... no checking for f77... no checking for xlf... no checking for frt... no checking for pgf77... no checking for cf77... no checking for fort77... no checking for fl32... no checking for af77... no checking for f90... no checking for xlf90... no checking for pgf90... no checking for pghpf... no checking for epcf90... no checking for gfortran... no checking for g95... no checking for f95... no checking for fort... no checking for xlf95... no checking for ifort... no checking for ifc... no checking for efc... no checking for pgf95... no checking for lf95... no checking for ftn... no checking whether we are using the GNU Fortran 77 compiler... no checking whether accepts -g... no checking the maximum length of command line arguments... 196608 checking command to parse /usr/bin/nm -B output from gcc object... ok checking for objdir... .libs checking for ar... ar checking for ranlib... ranlib checking for strip... strip checking if gcc supports -fno-rtti -fno-exceptions... no checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking whether the gcc linker (/usr/bin/ld) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... freebsd8.0 ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes configure: creating libtool appending configuration tag "CXX" to libtool checking for ld used by g++... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking whether the g++ linker (/usr/bin/ld) supports shared libraries... yes checking for g++ option to produce PIC... -fPIC checking if g++ PIC flag -fPIC works... yes checking if g++ static flag -static works... yes checking if g++ supports -c -o file.o... yes checking whether the g++ linker (/usr/bin/ld) supports shared libraries... yes checking dynamic linker characteristics... freebsd8.0 ld.so checking how to hardcode library paths into programs... immediate appending configuration tag "F77" to libtool checking for dirent.h that defines DIR... yes checking for library containing opendir... none required checking which extension is used for loadable modules... .so checking which variable specifies run-time library path... LD_LIBRARY_PATH checking for the default library search path... /lib /usr/lib checking for objdir... .libs checking whether libtool supports -dlopen/-dlpreopen... yes checking for shl_load... no checking for shl_load in -ldld... no checking for dlopen in -ldl... no checking for dlerror... yes checking for _ prefix in compiled symbols... no checking whether deplibs are loaded by dlopen... unknown checking argz.h usability... no checking argz.h presence... no checking for argz.h... no checking for error_t... no checking for argz_append... no checking for argz_create_sep... no checking for argz_insert... no checking for argz_next... no checking for argz_stringify... no checking assert.h usability... yes checking assert.h presence... yes checking for assert.h... yes checking ctype.h usability... yes checking ctype.h presence... yes checking for ctype.h... yes checking errno.h usability... yes checking errno.h presence... yes checking for errno.h... yes checking malloc.h usability... no checking malloc.h presence... no checking for malloc.h... no checking for memory.h... (cached) yes checking for stdlib.h... (cached) yes checking stdio.h usability... yes checking stdio.h presence... yes checking for stdio.h... yes checking for unistd.h... (cached) yes checking dl.h usability... no checking dl.h presence... no checking for dl.h... no checking sys/dl.h usability... no checking sys/dl.h presence... no checking for sys/dl.h... no checking dld.h usability... no checking dld.h presence... no checking for dld.h... no checking mach-o/dyld.h usability... no checking mach-o/dyld.h presence... no checking for mach-o/dyld.h... no checking for string.h... (cached) yes checking for strchr... yes checking for strrchr... yes checking for memcpy... yes checking for memmove... yes checking for strcmp... yes checking for closedir... yes checking for opendir... yes checking for readdir... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands === configuring in src/modules/rlm_acctlog (/usr/local/free/src/modules/rlm_acctlog) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking stdio.h usability... yes checking stdio.h presence... yes checking for stdio.h... yes configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_attr_rewrite (/usr/local/free/src/modules/rlm_attr_rewrite) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking regex.h usability... yes checking regex.h presence... yes checking for regex.h... yes configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_checkval (/usr/local/free/src/modules/rlm_checkval) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_counter (/usr/local/free/src/modules/rlm_counter) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E checking for gdbm.h... yes checking for gdbm_open in -lgdbm... yes checking to see GDBM_SYNC status... checking for egrep... grep -E SYNCs by default. checking for gdbm_fdesc... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in src/modules/rlm_dbm (/usr/local/free/src/modules/rlm_dbm) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E checking for ndbm.h... yes checking for dbm in default lib... yes configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_eap (/usr/local/free/src/modules/rlm_eap) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed configure: creating ./config.status config.status: creating Makefile configure: configuring in ./types/rlm_eap_ikev2 configure: running /bin/sh './configure' --prefix=/usr/local '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' '--cache-file=/dev/null' '--srcdir=.' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking malloc.h usability... no checking malloc.h presence... no checking for malloc.h... no checking for ikev2_set_log_callback in -leap-ikev2... no checking EAPIKEv2/connector.h usability... no checking EAPIKEv2/connector.h presence... no checking for EAPIKEv2/connector.h... no configure: creating ./config.status config.status: creating Makefile configure: configuring in ./types/rlm_eap_peap configure: running /bin/sh './configure' --prefix=/usr/local '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' '--cache-file=/dev/null' '--srcdir=.' --cache-file=/dev/null --srcdir=. checking for OpenSSL support... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged configure: configuring in ./types/rlm_eap_tls configure: running /bin/sh './configure' --prefix=/usr/local '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' '--cache-file=/dev/null' '--srcdir=.' --cache-file=/dev/null --srcdir=. checking for OpenSSL support... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged configure: configuring in ./types/rlm_eap_tnc configure: running /bin/sh './configure' --prefix=/usr/local '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' '--cache-file=/dev/null' '--srcdir=.' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for exchangeTNCCSMessages in -lTNCS... no configure: creating ./config.status config.status: creating Makefile configure: configuring in ./types/rlm_eap_ttls configure: running /bin/sh './configure' --prefix=/usr/local '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' '--cache-file=/dev/null' '--srcdir=.' --cache-file=/dev/null --srcdir=. checking for OpenSSL support... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in src/modules/rlm_ippool (/usr/local/free/src/modules/rlm_ippool) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E checking for gdbm.h... yes checking for gdbm_open in -lgdbm... yes checking to see GDBM_SYNC status... checking for egrep... grep -E SYNCs by default. checking for gdbm_fdesc... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in src/modules/rlm_krb5 (/usr/local/free/src/modules/rlm_krb5) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for krb5.h... yes checking for krb5_encrypt_data in -lk5crypto... no checking for DH_new in -lcrypto... yes checking for set_com_err_hook in -lcom_err... yes checking for krb5_init_context in -lkrb5... no configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_ldap (/usr/local/free/src/modules/rlm_ldap) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for pthread_create in -lpthread... yes checking for ldap_init in -lldap_r... no checking for ldap.h... no configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_otp (/usr/local/free/src/modules/rlm_otp) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E checking for egrep... grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for inttypes.h... (cached) yes checking for SSL_new in -lssl... yes checking openssl/des.h usability... yes checking openssl/des.h presence... yes checking for openssl/des.h... yes checking openssl/hmac.h usability... yes checking openssl/hmac.h presence... yes checking for openssl/hmac.h... yes checking openssl/md4.h usability... yes checking openssl/md4.h presence... yes checking for openssl/md4.h... yes checking openssl/md5.h usability... yes checking openssl/md5.h presence... yes checking for openssl/md5.h... yes checking openssl/sha.h usability... yes checking openssl/sha.h presence... yes checking for openssl/sha.h... yes configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_pam (/usr/local/free/src/modules/rlm_pam) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E checking for dlopen in -ldl... no checking for pam_start in -lpam... yes checking for egrep... grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking security/pam_appl.h usability... yes checking security/pam_appl.h presence... yes checking for security/pam_appl.h... yes checking pam/pam_appl.h usability... no checking pam/pam_appl.h presence... no checking for pam/pam_appl.h... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in src/modules/rlm_perl (/usr/local/free/src/modules/rlm_perl) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for perl... yes checking for EXTERN.h... yes checking for perl.h... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in src/modules/rlm_python (/usr/local/free/src/modules/rlm_python) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E checking for python2.3... no checking for python2.2... no checking for python2.1... no checking for python1.5... no checking for python... python checking for Python.h... yes checking for Py_Initialize in -lpython2.6... yes configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_radutmp (/usr/local/free/src/modules/rlm_radutmp) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E checking for egrep... grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking sys/mman.h usability... yes checking sys/mman.h presence... yes checking for sys/mman.h... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in src/modules/rlm_sql (/usr/local/free/src/modules/rlm_sql) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed configure: creating ./config.status config.status: creating ./Makefile config.status: creating ./drivers/Makefile === configuring in ./drivers/rlm_sql_iodbc (/usr/local/free/src/modules/rlm_sql/./drivers/rlm_sql_iodbc) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for SQLConnect in -liodbc... no checking for isql.h... no configure: creating ./config.status config.status: creating Makefile === configuring in ./drivers/rlm_sql_mysql (/usr/local/free/src/modules/rlm_sql/./drivers/rlm_sql_mysql) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for mysql_config... yes checking for pthread_create in -lpthread... yes checking for mysql_init in -lmysqlclient_r (using mysql_config)... yes checking for mysql.h (using mysql_config --cflags)... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in ./drivers/rlm_sql_postgresql (/usr/local/free/src/modules/rlm_sql/./drivers/rlm_sql_postgresql) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking for libpq-fe.h... no checking for PQconnectdb in -lpq... no configure: creating ./config.status config.status: creating Makefile === configuring in ./drivers/rlm_sql_oracle (/usr/local/free/src/modules/rlm_sql/./drivers/rlm_sql_oracle) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for oci.h... checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed no configure: creating ./config.status config.status: creating Makefile === configuring in ./drivers/rlm_sql_unixodbc (/usr/local/free/src/modules/rlm_sql/./drivers/rlm_sql_unixodbc) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for SQLConnect in -lodbc... no checking for sql.h... no configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_sqlcounter (/usr/local/free/src/modules/rlm_sqlcounter) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ANSI C... none needed checking how to run the C preprocessor... gcc -E configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_sqlippool (/usr/local/free/src/modules/rlm_sqlippool) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. configure: creating ./config.status config.status: creating Makefile === configuring in src/modules/rlm_unix (/usr/local/free/src/modules/rlm_unix) configure: running /bin/sh ./configure '--prefix=/usr/local' '--without-openssl' '--without-snmp' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for system password file... /etc/passwd checking for system shadow password file... no /etc/shadow file. checking for grep that handles long lines and -e... /usr/bin/grep checking for egrep... /usr/bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking shadow.h usability... no checking shadow.h presence... no checking for shadow.h... no checking pwd.h usability... yes checking pwd.h presence... yes checking for pwd.h... yes checking grp.h usability... yes checking grp.h presence... yes checking for grp.h... yes checking for getspnam... no checking for getusershell... yes checking for getpwnam... yes checking for getspnam in -lshadow... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged

2 2

debug lofile
by Yagnesh Dave 04 Dec '09

04 Dec '09

Hello, I wanted know that is there any way by which we can direct the debug logs of the radius server to a file created with date extension on daily basis...similar to the detail-%Y%m%d. Regards, Dave.

1 0

inner/outer-session users in sql
by Maciej Łukasz Wojszkun 04 Dec '09

04 Dec '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, i'm using FR 2.0.4. In my configuration (PEAP) connected users are logged into postgres database. And there is logged username from outer tunnel; i want to logging username from inner tunnel. How i can do it? - -- Regards Maciej Łukasz Wojszkun tel. +48698611234 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJLGNTIAAoJELZ0XRdrHMhcDKIH/2g5Xy8xJRel2YuBfnsjFSg5 a5eB7ZpLCzrf94m/CMZdm0/GAXEaQ2H2dFOj8rPk9JYjmntminoZJJex5Yem/OXB rEJqyf0NjLn5MZrpeA4cYsJU7uTIlw77urjEALturgi7NAiV0Aivpo62xyGTKori SWFh8LLAxJi/fElPiOTT2yHwa0BvRtyniWbMO+GvPiq4TRQ7SVZmdIi8mCWsT9jG YWu0mhIB8Nk2rq/SqaUlqVfN8qO4BH8vNh3V6HsCFg75mGlrX2x9iFPviZUINfir 7XNPO1UEUWonwSc2+CvZPk/g4ldOawxMssnKUFz/retz0YwVo+DrFTjOYkf5Brs= =P6K9 -----END PGP SIGNATURE-----

1 0

Active directory ldap groups
by Leighton Man 04 Dec '09

04 Dec '09

Hi, In modules/ldap, I have: ldap ldap_staff{ Queries the staff ou in AD } ldap ldap_student{ Queries the student ou in AD } In authorise section of inner tunnel virtual server I have: ldap_staff if (ok) { update reply { Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = 141 } } else { ldap_student if (ok) { update reply { Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = 142 } } else { reject } } All working OK and happily authorising any user who exists in Active Directory and instructs the NAS which vlan to put them into. Now I'm trying to authorise/authenticate users in a particular AD group for console access to the NAS (cisco switch) In default virtual server I have, after pap: $INCLUDE local/default_policy And in local/default_policy: if(!control:Auth-Type && request:NAS-Port-Type == Async && Ldap-Group == ADGROUP) { update control { Auth-Type = "ntlm_auth" } } ADGROUP is replaced with whichever group has the appropriate users If I don't have the Ldap-Group condition everything works except any valid username/password pair works. When I add the condition, radiusd -x shows rlm_ldap: performing search in ou=students, dc=ad, dc=hud, dc=ac, dc=uk, with filter (sAMAccountName=user) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed First question - How do I tell rlm_ldap to query the staff ou without breaking the bit that is already working Second question - Is there any reason I shouldn't use the "$INCLUDE local/default_policy" construct. The idea is to make the policies easy to find as they get more complex; there are several more groups of users to go yet. Thanks in advance, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 2

Idle Time-out- Session time-out/ Acct start-stop packet
by Sylvain De Muynck 04 Dec '09

04 Dec '09

Thanks for your reply Ivan. Can you advice me where this re-authentication settings could be ? Thanks for your help. Furthermore, I would like to know if I change my AAA architecture, could my NAS (as proxy) forward (alvarion BTS) the interim-update package? Regards Sylvain Message: 4 Date: Tue, 1 Dec 2009 19:48:05 -0000 (UTC) From: tnt(a)kalik.net Subject: Re: Idle Time-out- Session time-out/ Aacct start-stop packet To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <58274.87.194.16.13.1259696885.squirrel(a)www.kalik.net> Content-Type: text/plain;charset=iso-8859-1 > Unfortunately, that did not work and now, I am still stuck to figure out > how could I do that. > To sum up this issue, I got Alvarion NAS, You have our sincere condolences. > from my users, I can see > accounting start and accounting stop packet, every 10 minutes, I got an > accounting packet stop from my users with everytime the same termination > cause = lost-carrier. So timeouts are not responsible and changing them will achieve nothing. You need to see why is NAS dropping connections. Perhaps some re-authentication setting? Ivan Kalik

5 6

Downloadable Access List Not Getting Applied
by Satyam Mathura 03 Dec '09

03 Dec '09

Guys, I currently have FreeRadius working with a MySQL back-end to authenticate VPN users on my 2800 Cisco router. I have been trying to get the download-able access list feature working but am hitting a brick wall. If i enable cisco-avpair:=ipsec:inacl=185 i can see the radius server responding with the access-list but it does not get applied on the connecting vpn client which is then unable to successfully connect. My router config and radius debug are below. Your help is greatly appreciated. Router Config: aaa authentication login default group radius local aaa authentication login vpnauth group radius local aaa authorization exec default group radius local aaa authorization network vpnautho local ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 ! crypto isakmp client configuration group test key test dns 200.12.240.9 domain greendottt.net pool ippool ! ! crypto ipsec transform-set MD5_3DES esp-3des esp-md5-hmac ! crypto dynamic-map VPNClientMap 1 set transform-set MD5_3DES reverse-route ! ! crypto map Remoteusers client authentication list vpnauth crypto map Remoteusers isakmp authorization list vpnautho crypto map Remoteusers client configuration address respond crypto map Remoteusers 10 ipsec-isakmp dynamic VPNClientMap ! ! ! ! interface FastEthernet0/0 description External ip address 192.168.74.46 255.255.255.0 duplex auto speed auto crypto map Remoteusers radius-server host 192.168.74.45 auth-port 1812 acct-port 1813 key cisco access-list 185 permit ip any any Router debug: *Feb 28 23:00:35.791: AAA/BIND(0000006B): Bind i/f *Feb 28 23:00:36.039: AAA/AUTHOR (0x6B): Pick method list 'vpnautho' *Feb 28 23:00:36.103: AAA/BIND(0000006C): Bind i/f RouterB# *Feb 28 23:00:39.147: RADIUS/ENCODE(0000006C):Orig. component type = VPN_IPSEC *Feb 28 23:00:39.151: RADIUS: AAA Unsupported Attr: interface [157] 13 *Feb 28 23:00:39.155: RADIUS: 31 39 32 2E 31 36 38 2E 37 34 2E [192.168.74.] *Feb 28 23:00:39.155: RADIUS/ENCODE(0000006C): dropping service type, "radius-server attribute 6 on-for-login-auth" is off *Feb 28 23:00:39.159: RADIUS(0000006C): Config NAS IP: 0.0.0.0 *Feb 28 23:00:39.163: RADIUS/ENCODE(0000006C): acct_session_id: 108 *Feb 28 23:00:39.163: RADIUS(0000006C): sending *Feb 28 23:00:39.171: RADIUS/ENCODE: Best Local IP-Address 192.168.74.46 for Radius-Server 192.168.74.45 *Feb 28 23:00:39.179: RADIUS(0000006C): Send Access-Request to 192.168.74.45:1812 id 1645/56, len 96 *Feb 28 23:00:39.183: RADIUS: authenticator 39 23 30 9E 12 B5 1A 85 - E8 FF 5E 4D 13 99 6C 73 *Feb 28 23:00:39.183: RADIUS: User-Name [1] 10 "smathura" *Feb 28 23:00:39.187: RADIUS: User-Password [2] RouterB# 18 * *Feb 28 23:00:39.187: RADIUS: Calling-Station-Id [31] 15 "192.168.74.43" *Feb 28 23:00:39.191: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Feb 28 23:00:39.195: RADIUS: NAS-Port [5] 6 0 *Feb 28 23:00:39.195: RADIUS: NAS-Port-Id [87] 15 "192.168.74.46" *Feb 28 23:00:39.199: RADIUS: NAS-IP-Address [4] 6 192.168.74.46 *Feb 28 23:00:39.383: RADIUS: Received from id 1645/56 192.168.74.45:1812, Access-Accept, len 49 *Feb 28 23:00:39.387: RADIUS: authenticator 28 AB B2 01 8C 17 3C E2 - AD 2C 98 DD 91 0D CF 6D *Feb 28 23:00:39.387: RADIUS: Service-Type [6] 6 NAS Prompt [7] *Feb 28 23:00:39.391: RADIUS: Vendor, Cisco [26] 23 *Feb 28 23:00:39.391: RADIUS: Cisco AVpair [1] 17 "ipsec:inacl=185" *Feb 28 23:00:39.399: RADIUS(0000006C): Received from id 1645/56 Radius Server Debug rad_recv: Access-Request packet from host 192.168.74.46 port 1645, id=56, length=96 User-Name = "smathura" User-Password = "xxxxxxxxx" Calling-Station-Id = "192.168.74.43" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "192.168.74.46" NAS-IP-Address = 192.168.74.46 +- entering group authorize ++[preprocess] returns ok rlm_sql (sql): - sql_xlat expand: %{User-Name} -> smathura rlm_sql (sql): sql_set_user escaped user --> 'smathura' expand: SELECT groupname FROM radhuntgroup WHERE nasipaddress="%{NAS-IP-Address}" AND nasportid LIKE IF (SUBSTRING("%{NAS-Port-Id}", 1, 3) = 'tty', 'tty', "%{NAS-Port-Id}") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "%{User-Name}") -> SELECT groupname FROM radhuntgroup WHERE nasipaddress="192.168.74.46" AND nasportid LIKE IF (SUBSTRING("192.168.74.46", 1, 3) = 'tty', 'tty', "192.168.74.46") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "smathura") rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 3 expand: %{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress="%{NAS-IP-Address}" AND nasportid LIKE IF (SUBSTRING("%{NAS-Port-Id}", 1, 3) = 'tty', 'tty', "%{NAS-Port-Id}") AND usergroup IN (SELECT groupname FROM radusergroup where username LIKE "%{User-Name}") } -> vpn ++[request] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "smathura", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 211 ++[files] returns ok expand: %{User-Name} -> smathura rlm_sql (sql): sql_set_user escaped user --> 'smathura' rlm_sql (sql): Reserving sql socket id: 2 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'smathura' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'smathura' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'smathura' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'engineering' ORDER BY id rlm_sql (sql): User found in group engineering expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'engineering' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Normalizing SHA-Password from hex encoding rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [smathura] (from client R1 port 0 cli 192.168.74.43) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 56 to 192.168.74.46 port 1645 Service-Type := NAS-Prompt-User Cisco-AVPair := "ipsec:inacl=185" Finished request 15. Going to the next request Waking up in 4.9 seconds. Cleaning up request 15 ID 56 with timestamp +2444 Ready to process requests.

2 1

Lock Out Users
by Satyam Mathura 03 Dec '09

03 Dec '09

Hey Guys, With FreeRadius, is it possible to lock out users after a specified number of failed login attempts? Can someone please point me in the right direction. Thanks.

2 2