June 2009 - Freeradius-Users - lists.freeradius.org

Any free Java APIs to access freeRadius server?
by kpani 22 Jun '09

22 Jun '09

Hi, I am using freeRadius server for authentication. I am able to authenticate for ssh login. I want to authenticate my java application using radius server. Is there any java libraries/APIs available to access and authenticate directly. Please advise me. Thanks in advance. Regards, Dhandapani -- View this message in context: http://www.nabble.com/Any-free-Java-APIs-to-access-freeRadius-server--tp241… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 5

rlm_python - Unresponsive child
by Mike Tkachuk 22 Jun '09

22 Jun '09

Hello Freeradius-users, I'm trying to use Freeradius 2.1.6 release with rlm_python (python 2.6.2) on FreeBSD. I use default radiusd_test.py bundled with rlm_python. All is fine when I start radius in debug mode with -X, however in normal forked mode next error appear: Error: WARNING: Unresponsive child for request 0, in module python component authenticate < few seconds later > Info: [python] Child is still stuck for request 0 Any ideas what can be wrong? How to debug this? And is rlm_python ok for commercial productional environment? What other problems I can face? Thanks. -- Mike Tkachuk

3 6

NAS-IP-Address modified during Access-Request process
by kevin leblanc 22 Jun '09

22 Jun '09

Hi everybody, I have a big problem in freeradius installed in version 1.1.4 on RHEL 5, and today it's the third day i'm looking for a solution :( Here is the problem: I configured Freeradius to look in openldap directory to auth and auth an user. The authentication phase is OK During the auth phase, a ldap search is done : if the user is member of a group identified by the host ip he wants to connect, the user is authorized. The problem is here : freeradius receives an Access-Request packet with a NAS-IP-Address (the good one) and to search in the ldap, it doesn't send the ip received in the packet but another one ! Why this attribute is modified ? Is there any cache (the other ip comes from another equipment) ? Thanks for any helpful idea Here are /etc/raddb/users (I also tried with ldap-group == "%{NAS-IP-Address}" ) -------------------------------------------------------- DEFAULT ldap-group == "%{Client-Ip-Address}", Auth-Type := LDAP Service-Type = 1, Fall-Through = no DEFAULT Auth-Type := Reject Fall-Through = no, Reply-Message = "You are not authorized to log in to this host :(" -------------------------------------------------------- /etc/raddb/clients.conf -------------------------------------------------------- client 126.50.0.0/8 { secret = secretsecret shortname = shortname } -------------------------------------------------------- radius LOG (with radiusd -X) -------------------------------------------------------- rad_recv: Access-Request packet from host *126.50.0.148*:1645, id=17, length=82 NAS-IP-Address = *126.50.0.148* NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "testadmin" Calling-Station-Id = "XX.XX.XX.XX" User-Password = "XXXXXXXXX" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=example,dc=com' radius_xlat: '(uid=testadmin)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testadmin) rlm_ldap: ldap_search() failed: LDAP connection lost. rlm_ldap: Attempting reconnect rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: starting TLS rlm_ldap: bind as uid=radius,ou=applications,dc=example,dc=com/radiuspass to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testadmin) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=uid\3dtestAdmin\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestAdmin\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (&(cn=* 126.50.0.147* )(|(&(objectClass=GroupOfNames)(member=uid\3dtestAdmin\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestAdmin\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom)))) rlm_ldap::ldap_groupcmp: User found in group 126.50.0.147 rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 3 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for testadmin radius_xlat: '(uid=testadmin)' radius_xlat: 'dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testadmin) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testadmin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "testadmin" with password "XXXXXXXXX" rlm_ldap: user DN: uid=testAdmin,uid=test01,ou=users,dc=example,dc=com rlm_ldap: (re)connect to 127.0.0.1:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: starting TLS rlm_ldap: bind as uid=testAdmin,uid=test01,ou=users,dc=example,dc=com/XXXXXXXXX to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user testadmin authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 4 modcall: leaving group LDAP (returns ok) for request 4 Login OK: [testadmin/XXXXXXXXX] (from client petitnom port 1 cli 126.100.100.6) Sending Access-Accept of id 17 to 126.50.0.148 port 1645 Service-Type = Login-User Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... -------------------------------------------------------- -- KeV

2 3

RE: rlm_raw not included in compile
by Eric Geier 22 Jun '09

22 Jun '09

Thank you, Johan. I'll give it a try. > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of Johan Meiring > Sent: Monday, June 22, 2009 9:26 AM > To: FreeRadius users mailing list > Subject: Re: rlm_raw not included in compile > > Eric Geier wrote: > > Johan, > > > > I'm a Linux/freeradius newbie, and I don't understand what you meant > by "had > > to run autogen.sh first". > > > > I had to do the following: > > 1) dump rlm_raw in src/modules > 2) run "touch src/modules/rlm_raw/configure" from the freeradius source > root directory. > 3) run "./autoconf.sh" from the freeradius source root directory. > 4) I use debian so I edited debian/rules > looked for the "configure" line, and added: > --with-modules=rlm_raw \ > --with-experimental-modules \ > If you do a manual compile, add this to you configure line. > If you use something else, ask them how to add it to configure. > > > > I'm actually using 1.1.7.so I don't think I need to make the two > changes you > > mentioned. > > > > Also, what did you mean by "touch src/modules/rlm_raw/configure" and > "added > > rlm_raw to debian configure by editing debian/rules" in a previous > post? > > > > Thanks! > > Eric > > > >> -----Original Message----- > >> From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > >> [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] > On > >> Behalf Of Johan Meiring > >> Sent: Friday, May 29, 2009 12:16 PM > >> To: FreeRadius users mailing list > >> Subject: Re: rlm_raw not included in compile > >> > >> Alan DeKok wrote: > >>>> Does anyone have a clue how to add rlm_raw to the current git tar > >> file? > >>> $ tar -zxf freeradius-server-2.1.7.tar.gz > >>> << add rlm_raw >> > >>> $ tar -zcf freeradius-server-2.1.7.tar.gz freeradius-server-2.1.7 > >>> > >> It wasn't that simple because rlm_raw did not contain a configure > >> script. > >> > >> You had to run autogen.sh first. > >> > >> > >>>> PS:he rlm_raw I'm using comes from > >>>> http://lists.cistron.nl/pipermail/freeradius-devel/2005- > >> January/007873.html > >>> That was before version 2.0 was released. You'll likely have to > >>> update the module to use the new API's && header files in 2.0. > >>> > >> Using my "copy and paste" method of c coding (I know VERY little > about > >> c) I maneged to copy the code from the old rlm_raw into rlm_example. > >> > >> I needed to make two changes to get it to compile. > >> > >> 1) replace strNcpy with strncpy > >> 2) replace radlib_safeprint with fr_print_string > >> > >> It compiled and IT WORKS!!! > >> > >>> Alan DeKok. > >> > > > -- > > > Johan Meiring > Cape PC Services CC > Tel: (021) 883-8271 > Fax: (021) 886-7782 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - www.avg.com > Version: 8.5.339 / Virus Database: 270.12.87/2195 - Release Date: > 06/22/09 06:54:00

1 0

FreeRADIUS as a general authentication system
by Lloyd 22 Jun '09

22 Jun '09

Hi FreeRADIUS list, In our "system" there is a need for an authentication server. The required characteristics of the server are *) The authentication client will be a custom built one. It may be running on *NIX,Windows and Mac. Is it possible to write a client using the FreeRADIUS client library? (The client will have much more other functionalities, not related to authentication) *) Is it possible to extentd the server? As an example, in our case, each time a client wants to communicate with other clients, it will request a "session key" to the server, and the server will send the key to all clients which take part in the communication. (The aim of this is to encrypt the communication session with the new session key generated, so that only the clients who know the session key can decrypt the message) So, is it possible to introduce a key generation system as well as a "request interpretation" system to the FreeRADIUS server? *) Or is there a better way inplemented in FreeRADIUS to accomplish the above requirements? Thanks in advance, Lloyd ______________________________________ Scanned and protected by Email scanner

2 1

freeradius on 64 bits
by Rakotomandimby Mihamina 22 Jun '09

22 Jun '09

Hi all, I see FreeRADIUS is Debian packaged for amd64 http://packages.debian.org/search?keywords=freeradius&searchon=names&suite=… Are there limitations or known bugs about using it on x86_64 (intel/amd only)? -- Architecte Informatique: Administration Système, Recherche et Développement. Phone: +261 33 11 207 36

5 4

i can't stop freeradius
by Ayşe GİR 22 Jun '09

22 Jun '09

(i love freeradius but i don't lovefreeradius on ubuntu ...) i install freeradius on ubuntu 9.4 but i can't stop freeradius... what can i do ? my console out root@blacky:/etc/init.d# freeradius stop root@blacky:/etc/init.d# ps -aux | grep freeradius Warning: bad ps syntax, perhaps a bogus '-'? See http://procps.sf.net/faq.html root 5193 0.0 0.0 106828 2556 ? Ssl Jun19 0:00 freeradius root 16823 0.0 0.0 7524 892 pts/2 R+ 14:13 0:00 grep freeradius root@blacky:/etc/init.d# ( i use freeradius on centos everything is ok but on ubuntu everything is bad. :( ) i'm sorry for my bad english :) thank you for everything....

5 5

RE: rlm_raw not included in compile
by Eric Geier 22 Jun '09

22 Jun '09

Johan, I'm a Linux/freeradius newbie, and I don't understand what you meant by "had to run autogen.sh first". I'm actually using 1.1.7.so I don't think I need to make the two changes you mentioned. Also, what did you mean by "touch src/modules/rlm_raw/configure" and "added rlm_raw to debian configure by editing debian/rules" in a previous post? Thanks! Eric > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of Johan Meiring > Sent: Friday, May 29, 2009 12:16 PM > To: FreeRadius users mailing list > Subject: Re: rlm_raw not included in compile > > Alan DeKok wrote: > >> > >> Does anyone have a clue how to add rlm_raw to the current git tar > file? > > > > $ tar -zxf freeradius-server-2.1.7.tar.gz > > << add rlm_raw >> > > $ tar -zcf freeradius-server-2.1.7.tar.gz freeradius-server-2.1.7 > > > > It wasn't that simple because rlm_raw did not contain a configure > script. > > You had to run autogen.sh first. > > > >> PS:he rlm_raw I'm using comes from > >> http://lists.cistron.nl/pipermail/freeradius-devel/2005- > January/007873.html > > > > That was before version 2.0 was released. You'll likely have to > > update the module to use the new API's && header files in 2.0. > > > > Using my "copy and paste" method of c coding (I know VERY little about > c) I maneged to copy the code from the old rlm_raw into rlm_example. > > I needed to make two changes to get it to compile. > > 1) replace strNcpy with strncpy > 2) replace radlib_safeprint with fr_print_string > > It compiled and IT WORKS!!! > > > Alan DeKok. > > > -- > > > Johan Meiring > Cape PC Services CC > Tel: (021) 883-8271 > Fax: (021) 886-7782 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - www.avg.com > Version: 8.5.339 / Virus Database: 270.12.45/2141 - Release Date: > 05/29/09 06:28:00

2 1

Re: Please help me (Ivan Kalik)
by josgeorge thaikudathil 22 Jun '09

22 Jun '09

Hi , Thank you very much for the response but still i am getting same error can you please suggest accordingly .I had done 3 different tries in my user file those tries and output is given below Also i more think i remember while my installation db.ippool file and db.index file where not formed then i had to created those files in respective directory and i had given appropriate permission for that whether it will create any problem ?.... Also while useing command *rlm_ippool_tool -a ip-pool.db ip-index.db *i am getting output as 0 whether is it any problem ?... * DEFAULT Pool-Name := main_pool Fall-Through = Yes* ** *steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP* modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 81 users: Matched steve at 84 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find nas port information. Return NOOP. modcall[post-auth]: module "main_pool" returns noop for request 0 modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 2 to 10.143.71.15:3734 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 2 with timestamp 4a3f7d84 Nothing to do. Sleeping until we see a request. -------------------------------------------------------------------------- *steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP,* * Fall-Through = Yes DEFAULT Pool-Name := main_pool* Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched steve at 82 users: Matched DEFAULT at 94 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find nas port information. Return NOOP. modcall[post-auth]: module "main_pool" returns noop for request 0 modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 3 to 10.143.71.15:3740 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 3 with timestamp 4a3f7e1c Nothing to do. Sleeping until we see a request. ----------------------------------------------------------------------------------------------------------------- *DEFAULT Fall-Through = Yes steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP,* ** *DEFAULT Pool-Name := main_pool* ** Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched steve at 83 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "main_pool" returns noop for request 0 modcall: group post-auth returns noop for request 0 Sending Access-Accept of id 4 to 10.143.71.15:3751 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 4 with timestamp 4a3f7ed7 ----------------------------------------------------------------------------------------------------------- Thanks and regards Jos george. 9844459056

1 0

Please help me
by josgeorge thaikudathil 22 Jun '09

22 Jun '09

Hi , I am useing a free radius version available with redhat 4.5 ,RPM name is freeradius-1.0.1-3.RHEL4.3.i386.rpm I am trying to use ippool configuration configurations i had made is in radiusd.conf file ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start =10.143.71.15 range-stop =10.143.71.25 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = yes # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } accounting { main_pool } post-auth { main_pool } ------------------------------------------------------------------------------------------------------------------------------------------ in users file steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP DEFAULT Pool-Name := "main_pool" -------------------------------------------------------------------------------------------------------------------------------------------------------------- in clients file <nas ip> <secret key> ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- and i am getting errors when i run /usr/sbin/radiusd -A -X modcall: entering group post-auth for request 0 rlm_ippool: Could not find Pool-Name attribute. modcall[post-auth]: module "main_pool" returns noop for request 0 rlm_ippool: Could not find Pool-Name attribute. I am suspecting some problem with users file ... Can you please help me to find out what is missing -- Thanks and regards Jos george. 9844459056

3 3