March 2009 - Freeradius-Users - lists.freeradius.org

same user on different service
by "Николай Г. Петров" 26 Mar '09

26 Mar '09

Hello! I have a question about same 'username' from different services. Task: 1) Troublefree login users with same username, from different places(therefore different attribute) at the same time: - cisco console login(radius for cisco); - ppp(radius for dialup). 2) In some way delineate radius log for cisco from ppp radius log. aaa must be done on single freeradius server(...we have a one aaa server). May be use a different group or realm? Please, I'd like to listen our recommendation or link that this explained. [freeradius version 1.1.3, latest I can't,only this!!!] Thanks!

2 1

API
by David N'DAKPAZE 26 Mar '09

26 Mar '09

Hello, I'd like to know how to create an API which will permit me to create or delete a user on freeradius. Thank you for your help

4 5

Cdv D has sent you a private message
by Cdv D 25 Mar '09

25 Mar '09

1 0

Cdv D has sent you a private message
by Cdv D 25 Mar '09

25 Mar '09

1 0

undefined reference to `lt_preloaded_symbols'
by Nick Jones 25 Mar '09

25 Mar '09

I am running Ubuntu 8.10 and trying to build the debian package for FreeRADIUS 2.1.4 as described on the FreeRADIUS web site. When I issue the command: fakeroot dpkg-buildpackage -b -uc The process starts but at some point along the way, I get this error message: libtool: link: gcc .libs/radiusdS.o -Wl,-Bsymbolic-functions -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /home/parsond/Desktop/freeradius-server-2.1.4/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -ldl -lssl -lcrypto -Wl,-rpath -Wl,/usr/lib/freeradius .libs/modules.o: In function `setup_modules': /home/parsond/Desktop/freeradius-server-2.1.4/src/main/modules.c:1039: undefined reference to `lt_preloaded_symbols' collect2: ld returned 1 exit status make[5]: *** [radiusd] Error 1 make[5]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src/main' make[4]: *** [common] Error 2 make[4]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src' make[2]: *** [common] Error 2 make[2]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4' make: *** [build-arch-stamp] Error 2 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 I have searched online for fixes to the 'undefined reference to lt_preloaded_symbols', I know it is related to the libtool I am using, but I don't know where to begin to get this resolved. I hope someone can help! I am have libtool 2.2.4 and libltdl7 2.2.4 installed, if this helps.

2 1

Two Simultaneous-Use on Same NAS Port
by Smith, Mark J 25 Mar '09

25 Mar '09

I'm trying to limit a single username to logon 2 times on the same NAS Port/NAS Port ID. Our test environment consists of a single FreeRadius Server (Version 2.1.5/4), MySQL Server 5.0.45, and a Cisco 7200VXR with IOS 12.2(31)SB13. The main issue now is that a single user name with Simultaneous-Use set too 2 is able to login an unlimited number of times on the same NAS Port/NAS Port ID. However, if the same user logon through a different NAS Port/NAS Port ID, Simultaneous-Use checks work as expected. Please, note the following radwho and radiusd -X outputs. radwho -R Output after first user logged in: User-Name = "test1" Acct-Session-Id = "00003377" NAS-IP-Address = X.X.X.X NAS-Port = 2097152 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = X.X.X.X radwho -R Output after second user logged in: User-Name = "test1" Acct-Session-Id = "00003378" NAS-IP-Address = X.X.X.X NAS-Port = 2097152 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = X.X.X.X Acct-Session-Time = 72 **Note the lack of the first user identified by Acct-Session-ID 00003377. radwho -R Output with second user logged in through a different NAS Port/NAS Port ID: User-Name = "test1" Acct-Session-Id = "00003378" NAS-IP-Address = 66.109.238.133 NAS-Port = 2097152 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 66.216.191.36 Acct-Session-Time = 476 User-Name = "test1" Acct-Session-Id = "00003379" NAS-IP-Address = 66.109.238.133 NAS-Port = 1610625913 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 66.216.191.37 Acct-Session-Time = 70 Acct-Session-Id 00003377 radiusd -X output: +- entering group session {...} [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok rad_recv: Accounting-Request packet from host 66.109.238.133 port 1646, id=88, length=136 Acct-Session-Id = "00003377" Framed-Protocol = PPP Framed-Route = "255.255.255.0" Framed-Route = "255.255.255.0" Framed-IP-Address = X.X.X.X User-Name = "test1" X-Ascend-Connect-Progress = LAN-Session-Up Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = 32 NAS-Port = 2097152 NAS-Port-Id = "0/0/2/0" Service-Type = Framed-User NAS-IP-Address = X.X.X.X Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok Acct-Session-Id 00003378 radiusd -X output: +- entering group session {...} [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> test1 ++[radutmp] returns ok rad_recv: Accounting-Request packet from host 66.109.238.133 port 1646, id=89, length=136 Acct-Session-Id = "00003378" Framed-Protocol = PPP Framed-Route = "255.255.255.0" Framed-Route = "255.255.255.0" Framed-IP-Address = X.X.X.X User-Name = "test1" X-Ascend-Connect-Progress = LAN-Session-Up Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = 32 NAS-Port = 2097152 NAS-Port-Id = "0/0/2/0" Service-Type = Framed-User NAS-IP-Address = X.X.X.X Acct-Delay-Time = 0 +- entering group preacct {...} Cisco Radius Configuration: aaa authentication login default local group tacacs+ aaa authentication enable default group tacacs+ enable aaa authentication ppp default local group radius aaa authorization exec default local group tacacs+ aaa authorization commands 1 default local group tacacs+ aaa authorization commands 15 default local group tacacs+ aaa authorization network default local group radius aaa accounting delay-start vrf default aaa accounting delay-start all aaa accounting exec default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group radius aaa accounting system default start-stop broadcast group radius group tacacs+ radius-server attribute nas-port format e SSSSAPPPUUUUUUUUUUUUUUUUUUUUUUUU radius-server attribute nas-port format e SSSSAPPPIIIIIIIICCCCCCCCCCCCCCCC type 30 radius-server attribute nas-port format e SSSSAPPPIIIIIIIICCCCCCCCCCCCCCCC type 31 radius-server attribute nas-port format e SSSSAAAAPPPPVVVVVVVVVVVVVVVVVVVV type 32 radius-server attribute nas-port format e SSSSAPPPVVVVVVVVVVVVVVVVVVVVVVVV type 33 radius-server attribute nas-port format e SSSSAPPPQQQQQQQQQQQQVVVVVVVVVVVV type 34 radius-server attribute 61 extended radius-server host X.X.X.X auth-port 1812 acct-port 1813 non-standard key Please, let me know if any additional information is needed. Thank you, Mark **DISCLAIMER This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business.

2 1

Problem with SQL and LDAP
by Sebastian Heil 25 Mar '09

25 Mar '09

Hello everybody, It seems, as if we have the same issue as described here: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg51505.… Is there already a patch/solution available to use the Ldap-Group as attribute? Sebastian -- Neu: GMX FreeDSL Komplettanschluss mit DSL 6.000 Flatrate + Telefonanschluss für nur 17,95 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

2 2

VMPS compile error with freeradius-server-2.1.4
by Christopher Sheldon 25 Mar '09

25 Mar '09

Hello I'm getting a compile error with 2.1.4 when building --without-vmps The issue looks to be src/main/listen.c:1795. It seems to be missing the #ifdef WITH_VMPS and the accompanying #endif. Sorry if this has been mentioned before. Thanks, Chris. -- csh(a)ninex.net

2 1

custom sql query
by Sandra H. 25 Mar '09

25 Mar '09

Hello, We have a database that contains usernames and password that we want to auth from using a web app we have. I have tried all kinds of config's in the sql.conf file and still get fails I have turned on sqltrace and here is the error we currently get, its not much... rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 Right now to retrieve username and password...(sql script) we use this from sql query select Username, Password from Contact where length(Username) > 0; How do I slap that into sql.conf to make it work for simply just username/password auth? Any help would be appreciated.

3 2

Re: SAML support for freeRadius
by ALVAREZ SANTANA, LUIS MIGUEL 25 Mar '09

25 Mar '09

Hi Stefan and everybody I´m trying to get an architecture of federation-id in which are involved, layer 2 communications, RADIUS (like FreeRadius) and IdP server, but I have some doubts about it. Searching for information I read this thread, and I decided claim for help.I´m really interested in scenarios 2&3 which were described before > 2) a user logs in with a non-SAML credential. FreeRADIUS should be able > to use a SAML-enabled backend to verify these credentials. > 3) a user logs in with a non-SAML credential. FreeRADIUS uses a non-SAML > backend, but transports a SAML assertion to the user which the user can > later use to enter SAML-enabled resources. In fact, what I was wondering is if it would be possible a mixture between secenarios 2 and 3, I mean, a user logs in with a non-SAML credential (x509 certificate), FreeRADIUS verify the credentials in a SAML-enabled backend (IdP), AND transports a SAML assertion to the user which the user can later use to enter SAML-enabled resources. ¿Is there any way for getting a succesful "SAML-conversation" between FreeRADIUS and an IdP, in which the assertions were sent to FreeRADIUS and since there to the client (in layer 2)? As regards to the use of a layer 2 protocol/method to send SAML attributes, I´ve heard about DAIDALOS that uses PEAPv2 to send and receive SAML assertions between the edges of an EAP layer 2 communication. I´m not sure the latter is contradictory with your previous answer > In that case though, the equally sad answer is that > there is no defined transport to send SAML within RADIUS. What you'd > need then is a means to send SAML payloads in RADIUS attributes. The > most logical way of doing so would be some kind of "EAP-SAML" - but such > a thing doesn't exist as an IETF standard today. So if authenticating > via SAML assertions is something you want to do - please present your > use case loudly to IETF people - they might listen and get going :-) Does it mean that is not possible send SAML assertions in any EAP-method, or only has to do with SAML payloads in RADIUS attributes? Thank you very much for your attention and sorry for that awful English language that I have. Greetings Luis M. Álvarez -- Universidad Carlos III de Madrid

1 0