September 2009 - Freeradius-Users - lists.freeradius.org

Configuration of FreeRADIUS on Ubuntu/Debian with OPEN-LDAP Authentication
by Ryaz Khan 28 Sep '09

28 Sep '09

Hello everyone, I am the new member of this list, I just joined today and this is my first question so please ignore any unknown mistake(s) ! I have *Ubuntu Server edition 8.04.3* configured with samba with * open-ldap(slapd)* authentication which works pretty well I also installed *FreeRADIUS 2.1.7*, I was able to configure it but very basic like I am using users file for user names and passwords etc. Now I am trying to setup freeradius for ldap authentication so I dont have to add separate users in users file but can use ldap users instead, for Free-radius authentication I am a student so just want to do it for learning purposes. I would appreciate if someone can help me with that or can direct me to the right directions, howtos etc.. I googled it lot but did not come to any comprehensive solution. Thanks guys -- Ryaz Khan

3 2

Re: Start Freeradius at boot
by Paul.Blalock＠gmail.com 28 Sep '09

28 Sep '09

did you install FreeRADIUS via yum and a repository or from source? > Downloaded freeradius-server-2.1.7.tar.gz, extracted to home directory, > and then ./configure, make, make install. if from the repsository you should have a selectable service with eg the standard Fedora system startup tools - maybe they've decided to call it 'freeradius' or 'freeradius2' rather than radiusd? > There is a "Startup Applications" where I can add programs, but it > doesn't start > them until you log on to the machine and this doesn't work unless you log > into > the gui as root. if from source, then the install part (make install) wont handle your OS directory - you'll need to copy the script (and maybe edit it according to install path choices made) from the contrib directory eg redhat/rc.radiusd-redhat to the correct place - /etc/init.d/ i'd note now that its not just the startup item - theres also a logrotate script which ties into the system logrotate cron stuff to ensure that freeradius logs (eg /var/log/radius/ get rotated when needed - eg each day for 90 days retention) alan

3 2

Reminder: Webinar with FreeRADIUS and MySQL: Sept. 30
by Alan DeKok 28 Sep '09

28 Sep '09

I will be giving a Webinar with MySQL on September 30. Registration is available at: http://www.mysql.com/news-and-events/web-seminars/display-419.html The webinar will be given via Webex. You will need an account on mysql.com in order to register and see webex details. The full announcement is below. Alan DeKok. +++++++++++++++++++++++++++++++++++++++++++++++++++++++ FreeRADIUS & MySQL Cluster: Scalable and Highly Available AAA Services Wednesday, September 30, 2009 As network use grows and services become more dynamic, so existing Authentication, Authorization and Accounting (AAA) environments can struggle to keep pace with demand Tune into this webinar where you can hear from the Alan DeKok, one of the founders of the FreeRADIUS project and CEO of Network RADIUS, discuss the concepts and implementation of RADIUS services using the FreeRADIUS server and the MySQL Cluster database to deliver highly available and scalable AAA services In this session, you will learn about: - potential AAA limitations as network environments grow - advantages of deploying FreeRADIUS with MySQL Cluster - Performance, sizing and deployment of an AAA environment using FreeRADIUS with MySQL Cluster - customer case studies - how to get started WHO: * Alan DeKok, Founder of FreeRADIUS and CEO of Network RADIUS * Matthew Keep, MySQL Cluster Product Management WHAT: FreeRADIUS & MySQL Cluster: Scalable and Highly Available AAA Services WHEN: Wednesday, September 30, 2009: 09:30 Pacific time (America) 06:30 Hawaii time 10:30 Mountain time (America) 11:30 Central time (America) 12:30 Eastern time (America) 16:30 UTC 17:30 Western European time 18:30 Central European time 19:30 Eastern European time The presentation will be approximately 45 minutes long followed by Q&A. WHERE: Simply access the web seminar from the comfort of your own office. WHY: To learn more about how you can use FreeRADIUS and MySQL Cluster 7.0 to deliver highly available and scalable AAA Services

1 0

Build failure on arch Linux
by Leighton Man 28 Sep '09

28 Sep '09

Hi, Foolishly, I said earlier today, that building on Linux should be a breeze. I should have kept quiet!! I downloaded 2.1.7 and it failed to build rlm_krb5 with messages about structure members. I reran configure with --without-rlm-krb5 and got: In function 'setup_modules': undefined ref to lt__PROGRAM__LTX_preloaded_symbols in src/main/modules.c. I notice in the bug fixes for 2.1.7 there's a workaround added. Seems it doesn't work for me. Any suggestions please. Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

4 5

Re: Start Freeradius at boot
by Paul.Blalock＠gmail.com 28 Sep '09

28 Sep '09

Hi, > I am trying to get freeradius to start at boot time so that I don't have > to log in for it to start up. I saw a previous post that said to > “Manually add the links in /etc/rc[0-6].d.” > I am not sure what links this is referring to though, so I am at a > standstill as to how to do this. dpends on what OS you have - and, under Linux, which distro you have. if you have installed from a package, then that package should have supplied the required start/stop scripts for the system and then you can use the OS's chosen service solution to configure whether/when the service is started. if you have built from source, then there are a few scripts supplied in the source tarball that can be used - eg there is a script for RedHat - just copy that script into /etc/init.d and do a 'chkconfig radiusd on' alan Guess I did forget to include that. I am using Fedora 11, installed from CD, and when I do a 'chkconfig radiusd on', it says no such file or directory. Paul

2 1

Start Freeradius at boot
by Paul.Blalock＠gmail.com 28 Sep '09

28 Sep '09

I am trying to get freeradius to start at boot time so that I don't have to log in for it to start up. I saw a previous post that said to “Manually add the links in /etc/rc[0-6].d.” I am not sure what links this is referring to though, so I am at a standstill as to how to do this. Thanks Paul Blalock

2 1

Freeradius certificate not chain problem
by trevor obba 28 Sep '09

28 Sep '09

I am trying to in an install an SSL certificate issued by Janet on a freeradius (open source radius application). The installation and the configuration went fine however Microsoft windows vista and Apple Mac machines are prompting that the certificate is not chain. Here my TLS configuration in /etc/raddb/eap.conf private_key_password = uc123uc private_key_file = ${certdir}/jaguar.key certificate_file = ${certdir}/cert.pem CA_file = ${cadir}/sureserverEDU.pem The CA_file is pointing at the intermediate root certificate however windows vista and Apple Mac client are informing me that the certificate is not chained. I even tried concatenating all certificate in one file like: but no joy cat sureserverEDU.pem > mycert.pem cat cert.pem >> mycert.pem I also tried concatenating all certificate in one file like cat ct_root.der > mycert.pem cat sureserverEDU.pem >> mycert.pem cat cert.pem >> mycert.pem But this is not working either, Can you shad some light on this please? Thank again. Note ct_root.der is the GTE CyberTrust Global Root sureserverEDU.pem is the Cybertrust Educational CA cert.pem is my globalsign certificate

2 1

(no subject)
by Kamil Semavi 28 Sep '09

28 Sep '09

n Sep 28 05:01:23 2009 : Error: Dropping conflicting packet from client private-network-2:45456 - ID: 102 due to unfinished request 73062 Mon Sep 28 05:01:24 2009 : Error: Dropping conflicting packet from client private-network-2:46646 - ID: 6 due to unfinished request 73055 Mon Sep 28 05:01:24 2009 : Error: WARNING: Unresponsive child (id 2811198352) for request 73046 (in component accounting module rlm_sql) Mon Sep 28 05:01:24 2009 : Error: Dropping conflicting packet from client private-network-2:58451 - ID: 70 due to unfinished request 73070 Mon Sep 28 05:01:25 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:25 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:25 2009 : Error: Dropping conflicting packet from client private-network-2:57058 - ID: 8 due to unfinished request 73066 Mon Sep 28 05:01:26 2009 : Error: Dropping conflicting packet from client private-network-2:2059 - ID: 39 due to unfinished request 73067 Mon Sep 28 05:01:26 2009 : Error: WARNING: Unresponsive child (id 2863647632) for request 73047 (in component accounting module rlm_sql) Mon Sep 28 05:01:26 2009 : Error: Dropping conflicting packet from client private-network-2:58451 - ID: 70 due to unfinished request 73070 Mon Sep 28 05:01:27 2009 : Error: WARNING: Unresponsive child (id 2779728784) for request 73048 (in component accounting module rlm_sql) Mon Sep 28 05:01:27 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:27 2009 : Error: Dropping conflicting packet from client private-network-2:1667 - ID: 193 due to unfinished request 73072 Mon Sep 28 05:01:28 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:28 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:28 2009 : Error: Discarding duplicate request from client private-network-2:34244 - ID: 112 due to unfinished request 73074 Mon Sep 28 05:01:28 2009 : Error: Dropping conflicting packet from client private-network-2:34244 - ID: 112 due to unfinished request 73074 Mon Sep 28 05:01:29 2009 : Error: Dropping conflicting packet from client private-network-2:1667 - ID: 193 due to unfinished request 73072 Mon Sep 28 05:01:29 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:30 2009 : Error: Dropping conflicting packet from client private-network-2:60655 - ID: 71 due to unfinished request 73075 Mon Sep 28 05:01:31 2009 : Error: Dropping conflicting packet from client private-network-2:33747 - ID: 7 due to unfinished request 73058 Mon Sep 28 05:01:31 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:32 2009 : Error: Dropping conflicting packet from client private-network-2:60655 - ID: 71 due to unfinished request 73075 Mon Sep 28 05:01:33 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:33 2009 : Error: Dropping conflicting packet from client private-network-2:45456 - ID: 102 due to unfinished request 73062 Mon Sep 28 05:01:35 2009 : Error: Dropping conflicting packet from client private-network-2:3494 - ID: 92 due to unfinished request 73071 Mon Sep 28 05:01:35 2009 : Error: WARNING: Unresponsive child (id 3084983184) for request 73055 (in component accounting module rlm_sql) Mon Sep 28 05:01:35 2009 : Error: WARNING: Unresponsive child (id 2979036048) for request 73054 (in component accounting module rlm_sql) Mon Sep 28 05:01:35 2009 : Error: WARNING: Unresponsive child (id 2832178064) for request 73053 (in component accounting module rlm_sql) Mon Sep 28 05:01:35 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:35 2009 : Error: Dropping conflicting packet from client private-network-2:57058 - ID: 8 due to unfinished request 73066 Mon Sep 28 05:01:36 2009 : Error: Dropping conflicting packet from client private-network-2:2059 - ID: 39 due to unfinished request 73067 Mon Sep 28 05:01:37 2009 : Error: Dropping conflicting packet from client private-network-2:36362 - ID: 9 due to unfinished request 73073 Mon Sep 28 05:01:37 2009 : Error: WARNING: Unresponsive child (id 2790218640) for request 73056 (in component accounting module rlm_sql) Mon Sep 28 05:01:37 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:39 2009 : Error: Dropping conflicting packet from client private-network-2:32873 - ID: 159 due to unfinished request 73080 Mon Sep 28 05:01:40 2009 : Error: Dropping conflicting packet from client private-network-2:56532 - ID: 120 due to unfinished request 73076 Mon Sep 28 05:01:41 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:41 2009 : Error: WARNING: Unresponsive child (id 3062954896) for request 73058 (in component accounting module rlm_sql) Mon Sep 28 05:01:41 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:41 2009 : Error: Dropping conflicting packet from client private-network-2:3211 - ID: 75 due to unfinished request 73081 Mon Sep 28 05:01:41 2009 : Error: Dropping conflicting packet from client private-network-2:32873 - ID: 159 due to unfinished request 73080 Mon Sep 28 05:01:42 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Sep 28 05:01:43 2009 : Error: Dropping conflicting packet from client private-network-2:3211 - ID: 75 due to unfinished request 73081 Mon Sep 28 05:01:43 2009 : Error: WARNING: Unresponsive child (id 3052465040) for request 73059 (in component accounting module rlm_sql) Mon Sep 28 05:01:43 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Why I am having this error messages? Here is my radiusd.conf Thanks. Kamil

4 8

Hi guys,
by Kamil Semavi 28 Sep '09

28 Sep '09

I am trying to write user disconnections or every login to the sql. Can someone help me how can I do this? Thanks, K.

2 2

Re:
by Thor Spruyt 28 Sep '09

28 Sep '09

Hi, I tried to get this working also and I found that if you let the ldap module *not* check the password_header, then the password incl. the header is put in the User-Password attribute. If you then use auto_header = yes for the pap module, it should figure out automatically to do crypt... unless the uppercase CRYPT is causing issues... Here's some sample debug output to check your setup: [ldap] Password header not found in password {crypt}XXXXXXXXXXX for user test [ldap] Added User-Password = {crypt}XXXXXXXXXXX in check items [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap] returns ok ++- group returns ok ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "xxxx" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok Regards, Thor. >----- Oorspronkelijk bericht ----- >Van : wessam seleem [mailto:wessam.seleem@gmail.com] >Verzonden : donderdag , september 24, 2009 02:16 PM >Aan : tnt(a)kalik.net, 'FreeRadius users mailing list' >Onderwerp : Re: "known good" error > >Thanks Ivan for your reply. Here is the ldap configuration section: > >ldap { >server = "x.x.x.x" >identity = "cn=username" >password = password >basedn = "ou=email,o=data,c=eg" >filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" >password_header = "{CRYPT}" >ldap_connections_number = 100 >timeout = 15 >timelimit = 10 >net_timeout = 5 > >tls { >start_tls = no >} > >profile_attribute = "radiusProfileDn" > access_attr = "dialupAccess" >dictionary_mapping = ${confdir}/ldap.attrmap >password_attribute = radiususerPassword >} > > > >and here is the debug message > > >++[ldap] returns ok >Found Auth-Type = PAP >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >!!! Replacing User-Password in config items with Cleartext-Password. >!!! >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >!!! Please update your configuration so that the "known good" >!!! >!!! clear text password is in Cleartext-Password, and not in User-Password. >!!! >!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >+- entering group PAP {...} >[pap] login attempt with password "123456" >[pap] Using clear text password "&^%$%$%JGjgjg(&%%^njahjahs" >[pap] Passwords don't match >++[pap] returns reject >Failed to authenticate the user. >Using Post-Auth-Type Reject >+- entering group REJECT {...} >[attr_filter.access_reject] expand: %{User-Name} -> username > attr_filter: Matched entry DEFAULT at line 11 >++[attr_filter.access_reject] returns updated >Delaying reject of request 0 for 1 seconds >Going to the next request >Waking up in 0.9 seconds. >Sending delayed reject for request 0 > > > >Thanks for your support. >Wessam > > >On Thu, Sep 24, 2009 at 1:37 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > >> > I decided to install free radius 2.1.6-2 to test it and then to >> upgrade >> > my existing versions in my servers. I configured my free radius to use >> > ldap. >> > When I tried to authenticate from the new radius it gave me the following >> > message "from radius -X". >> > >> > Replacing User-Password in config items with Cleartext-Password. !!! >> > >> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! >> > !!! Please update your configuration so that the "known good" >> > !!! >> > !!! clear text password is in Cleartext-Password, and not in >> > User-Password. >> > !!! >> > >> > >> > Note that when I wrote the password encrypted "like >> > *%@&ksjd%@sdgsadgjhsb" >> > I was able to login but when I wrote the password in clear text "like >> > test" >> > I failed to login. >> >> Password in ldap probably has a header. You can ignore the message then, >> because server will convert User-Password to appropriate password >> attribute on it's own (Crypt-Password for {crypt}, SHA-Password for {sha} >> etc.) if auto-header is enabled. Post the whole debug. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

4 5