September 2009 - Freeradius-Users - lists.freeradius.org

Version 1.1.8 has been released
by Alan DeKok 21 Sep '09

21 Sep '09

We have released version 1.1.8 to fix an issue with the handling of Tunnel-Password. This is the same issue that was found in version 0.9.2, and which managed to return. Version 2.X is *not* affected by this issue. The difference between 1.1.7 and this release is the patch to fix that bug. The only other changes are that the version number has changed from 1.1.7 to 1.1.8 in a number of files. Alan DeKok.

4 4

Re: Lower case to Upper case in Calling-Station-Id at policy.conf
by Hilton Guaraldi 21 Sep '09

21 Sep '09

Hi, It´s me again... I updated to 2.1.6. Example.pl with $RAD_REQUEST{'Calling-Station-Id'} = uc($RAD_REQUEST{'Calling-Station-Id'}); line in sub authorize. Perl module under authorize in default file like this: authorize { preprocess ... sql ... perl ----> After SQL? ... } When I start the command radiusd -X a new problem again..... :-( I guess I am getting crazy :-), but I have a lot of patience... Can't load '/usr/lib/perl5/5.10.0/i586-linux-thread-multi/auto/Data/Dumper/Dumper.so' for module Data::Dumper: /usr/lib/perl5/5.10.0/i586-linux-thread-multi/auto/Data/Dumper/Dumper.so: undefined symbol: Perl_sv_cmp at /usr/lib/perl5/5.10.0/i586-linux-thread-multi/XSLoader.pm line 64. at /usr/lib/perl5/5.10.0/i586-linux-thread-multi/Data/Dumper.pm line 36 Compilation failed in require at /etc/raddb/example.pl line 30. BEGIN failed--compilation aborted at /etc/raddb/example.pl line 30. rlm_perl: perl_parse failed: /etc/raddb/example.pl not found or has syntax errors. /etc/raddb/modules/perl[7]: Instantiation failed for module "perl" /etc/raddb/sites-enabled/default[187]: Failed to find module "perl". /etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. Errors initializing modules A little piece of example.pl with line 30... use strict; # use ... # This is very important ! Without this script will not get the filled hashesh from main. use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); use Data::Dumper; <------------ Here is the line 30... # This is hash wich hold original request from radius #my %RAD_REQUEST; # In this hash you add values that will be returned to NAS. #my %RAD_REPLY; #This is for check items #my %RAD_CHECK; How can I resolve this new problem? Guaraldi 2009/9/18 Ivan Kalik <tnt(a)kalik.net>: > You should upgrade to current version. Many improvements were made to perl > module since 2.1.1. > > You can add perl to modules directory in 2.1.1. You have example on the wiki: > > http://wiki.freeradius.org/Rlm_perl > > Ivan Kalik > Kalik Informatika ISP > >> Thanks Saraev, >> Again, a new problem emerged... :-( >> >> In /etc/raddb/modules I do not see perl module... :-( >> >> I am running opensuse 11.1 and freeradius 2.1.1-1.27 from opensuse >> repository. >> >> Is there a way to get this problem solved, i.e. , perl module missing >> in modules subdirectory? >> Is there a way to supply it? >> >> Guaraldi >> >> >> 2009/9/18 Stefan Saraev <seo(a)link.bg>: >>> -----BEGIN PGP SIGNED MESSAGE----- >>> Hash: SHA1 >>> >>> that _should_ work for you: >>> >>> - -- cut -- >>> use vars qw(%RAD_REQUEST %RAD_REPLY %RAD_CHECK); >>> sub authorize { >>> $RAD_REQUEST{'Calling-Station-Id'} = >>> uc($RAD_REQUEST{'Calling-Station-Id'}); >>> } >>> >>> sub preacct { >>> $RAD_REQUEST{'Calling-Station-Id'} = >>> uc($RAD_REQUEST{'Calling-Station-Id'}); >>> } >>> - -- cut -- >>> >>> and add "perl" in preacct { } section after preprocess in radiusd.conf >>> >>> >>> - ----------------- >>> Regards >>> Stefan Saraev >>> Link+ Ltd. >>> +359 899 19 15 34 >>> >>> >>> >>> - ----- Original Message ----- >>> From: Hilton Guaraldi >>> [mailto:guaraldi@gmail.com] >>> To: FreeRadius users mailing list >>> [mailto:freeradius-users@lists.freeradius.org] >>> Sent: Fri, 18 Sep 2009 >>> 20:12:34 +0300 >>> Subject: Re: Lower case to Upper case in Calling-Station-Id >>> at policy.conf >>> >>> -----BEGIN PGP SIGNATURE----- >>> Version: GnuPG v1.4.9 (GNU/Linux) >>> >>> iEYEARECAAYFAkqz14AACgkQRAN48r0+OnqSKQCghcDigoyUZFXMTvsLDFJ6lMMg >>> +fwAoIyDW+Ik5UVhoGih0AOIHOGqZBrv >>> =2IlH >>> -----END PGP SIGNATURE----- >>> >>> >>>> Ok... >>>> >>>> I tried $RAD_REQUEST{'Calling-Station-Id'} = >>>> uc($RAD_REQUEST{'Calling-Station-Id'}). >>>> I guess in the sub authorize of example.pl ..............The only file >>>> I saw sub authorize in... >>>> If I am wrong, please help me what is the correct file! >>>> >>>> Running radiusd -X nothing happens in MAC address. If it is >>>> 00-18-e7-41-ad-c2, it remains the same, not 00-18-E7-41-AD-C2, :-( >>>> >>>> Must I "include" example.pl to radius in order to do >>>> $RAD_REQUEST{'Calling-Station-Id'} = >>>> uc($RAD_REQUEST{'Calling-Station-Id'}) work? >>>> >>>> Guaraldi >>>> >>>> >>>> 2009/9/18 Alexander Clouter <alex(a)digriz.org.uk>: >>>> > Hi, >>>> > >>>> > Hilton Guaraldi <guaraldi(a)gmail.com> wrote: >>>> >> >>>> >> How can I use uc function below in order to change lower case to >>>> upper >>>> case? >>>> >> >>>> >> Ex. 00-18-e7-41-ad-c2 ---> 00-18-E7-41-AD-C2 >>>> >> >>>> >> In the policy.conf: >>>> >> >>>> > When I last nosied through the source code there is no way. I >>>> normally >>>> > make sure all the polies are case insensitive *in* FreeRADIUS and >>>> when >>>> > things get spat out to my SQL server I slip 'lower(...)' around the >>>> MAC >>>> > addresses going in that direction. >>>> > >>>> > The only other way is to have a Perl script doing the work for you, >>>> but >>>> > as you can use case insensitive regex to replace string matching, I >>>> > would say it is not worth it. >>>> > >>>> > Cheers >>>> > >>>> > -- >>>> > Alexander Clouter >>>> > .sigmonster says: Idleness is the holiday of fools. >>>> > >>>> > - >>>> > List info/subscribe/unsubscribe? See >>>> http://www.freeradius.org/list/users.html >>>> > >>>> - >>>> List info/subscribe/unsubscribe? See >>>> http://www.freeradius.org/list/users.html >>>> >>> >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >>> >> > > >

2 3

unsuscribe
by if06016＠students.del.ac.id 20 Sep '09

20 Sep '09

---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

Re: Re: Cisco WLC PEAP/MSCHAPv2 - unnecessary ldap lookups?
by Brian Wilson 19 Sep '09

19 Sep '09

When I did the upgrade I had just copied-pasted my old configuration and it worked without issue, so I completely missed the inner-tunnel. Making those changes helped alot and reduced the LDAP calls to 3 - Thanks!! I would like to drop this further, as it seems that 2 of them are from the authorize section. I can't seem to remove it from the authorize section, though, as doing so pisses off mschap (can't find NT-password) and removing mschap pisses off FR (no auth-type defined). Also, I use a LDAP huntgroup, where users in an LDAP group are allowed to attached to a special SSID, which i think is part of the authorization process.... So here is my new configuration, perhaps someone can spot something i'm missing? (tried looking through documentation, can't seem to find my error). default file: authorize { preprocess auth_log mschap suffix ntdomain eap { ok = return } files { notfound = reject noop = reject fail = reject } expiration logintime } authenticate { eap } and inner-tunnel: authorize { unix suffix ntdomain update control { Proxy-To-Realm := LOCAL } eap { ok = return } files redundant-load-balance { LDAPsvr1 LDAPsvr2 } expiration logintime } authenticate { Auth-Type LDAP { redundant-load-balance { LDAPsvr1 LDAPsvr2 } } unix eap } >Hi, >> I will need to do some more research on inner-tunnels, as i'm not too familiar with them. How would I add the ldap components? as >part of the peap module itself? > >no - you simply configure the required part of the inner-tunnel virtual server - inner-tunnel >virtual server gets called as part of the EAP config - and _only_ as part of EAP with default config - check the default raddb config >alan

2 1

radwho and location
by Phil Pierotti 19 Sep '09

19 Sep '09

Hi All, I've just started with FreeRADIUS and noticed that when running radwho the 'location' field seems empty. (FreeRADIUS 2.1.7 from the source on Ubuntu 8.04LTS) There doesn't seem to be a configuration option/tweak anywhere I can find, or am I missing something? The reason I'm interested is that we're wanting to limit simultaneous-use on some kind of 'grouping' not per-unique-username and I'm wondering if radwho/location might be an obvious place to track that (if I could just work out how to get the info in there). Thanks, Phil P

2 1

First steps towards RadSec support
by Alan DeKok 19 Sep '09

19 Sep '09

Now that version 2.1.7 has been released, the git repository has been updated with the first step to RadSec support. For now, it only provides RADIUS transport over TCP, as per the following document: http://tools.ietf.org/html/draft-dekok-radext-tcp-transport-01 Using "bare" TCP without TLS is't a good idea in most cases. But it's useful for testing, and can help with the transition to RadSec. Alan DeKok.

3 6

How to increase the accouting rate sent via Proxy?
by Cristina Miyata 18 Sep '09

18 Sep '09

Dear FreeRADIUS Users, We are only using FreeRADIUS to proxy accounting to 2 different home servers. We are experiencing the problem of being able to send accounting to one of the home servers in a rate higher or equal to the rate it receives the accountings to be proxied. It was observed that we loose per hour about 10 accounting requests send to this problematic home server. We collected for 8 minutes all accounting requests received and sent in our FreeRADIUS server, and we got the following: - 73,56 requests / second received from NAS - 40 requests / second sent to the home server via Proxy We configured the proxy to use load_factor = 40.~ Is there any other configuration we can change to increase the accouting rate sent via Proxy? Any help appreciated! Thanks in advance. Cristina Miyata

1 0

Lower case to Upper case in Calling-Station-Id at policy.conf
by Hilton Guaraldi 18 Sep '09

18 Sep '09

Hi, How can I use uc function below in order to change lower case to upper case? Ex. 00-18-e7-41-ad-c2 ---> 00-18-E7-41-AD-C2 In the policy.conf: mac-phase { if("%{request:Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9A-F]{2})/i){ update request { Calling-Station-Id := "%{1}-%{2}-%{3}-%{4}-%{5}-%{6}" } } else { noop } } Best regards

5 8

Can't autenticate on ldap with PEAP
by Oscar Pacheco 18 Sep '09

18 Sep '09

Hello, we can't authenticate using ldap on eap/mschapv2, the user exists in the ldap database and with the radtest utility sends a ok reply. Here is a part of the debug using the -X option when we try to validate a user using windows xp

2 2

custom module not found
by James Devine 18 Sep '09

18 Sep '09

I have a custom module that I am having problems getting loaded. It works fine on a freebsd machine, I just built 2.1.6 on an ubuntu machine, which appears to put the modules in /usr/local/lib, so I built the custom module and added it to /usr/local/lib and it cannot find it: Fri Sep 18 14:15:30 2009 : Error: /usr/local/etc/raddb/modules/gwis[11]: Failed to link to module 'rlm_gwis': file not found rlm_gwis-2.1.6.so and rlm_gwis.so exist in /usr/local/lib and I have set libdir = /usr/local/lib/ in radiusd.conf, any idea how to find out where it is trying to find that file?

2 1