January 2010 - Freeradius-Users - lists.freeradius.org

rlm_sqlippool required?
by John Kane 11 Jan '10

11 Jan '10

Is the rlm_sqlippool required when allocating IPs from an SQL DB? I am trying to set this up on a 1.1.3 install, and don't see that module. Thanks, John This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

3 4

My Static IP Client conf. not work
by Tevfik Ceydeliler 11 Jan '10

11 Jan '10

Hi, I have a client, when I put this client into an IP pool everything is ok. But when I move him for framed-Ip (static IP),he can't get that IP address. Note: I use a secovid as realm and NAS is Telecom Operator (For APN) I dont know what i should check. Can you help me to start? ################################################################# Here is the user configuration: FOR POOL --> tevfikceydeliler Service-Type == Framed-User,Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Pool-Name := BirmasGPRS For Static IP --> tevfikceydeliler Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Framed-IP-Address == 172.30.65.90, Framed-IP-Netmask == 255.255.255, Framed-MTU = 1500, Framed-Routing = None, Framed-Protocol = PPP, Service-Type = Framed, Fall-Through = Yes AND DEFAULTS --> DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP DEFAULT Auth-Type := Accept ################################################### Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

Cisco-AVpair accounting client-mac-address with unlang
by Joe Maimon 10 Jan '10

10 Jan '10

I have this in preacct, and it works. if ("%{Cisco-AVpair[3]}" =~ /^client-mac-address=(.+)$/) { if (!Calling-Station-Id) { update request { Calling-Station-Id := "%{1}" } } } However this is ugly. I dont want to have to know which Cisco-AVpair it is, it should work whichever the order or number there is. It does not seem to work any other way. I know other directions to head include cisco_vsa_hack or the rlm_policy and others. I would appreciate any tips. Thanks, Joe

4 11

RE: Re: Design question considering 802.1x + edirectory + Active Directory
by Ramm-Ericson, Johannes 10 Jan '10

10 Jan '10

Alan DeKok wrote: >> - Is there any downloadable Freeradius + LDAP virtual machine for testing ?? > > No. Download a virtual machine, and install FreeRADIUS on it. Actually; there is: http://www.vmware.com/appliances/directory/69328 Having said that; I haven't tested it myself, I don't know which version of FreeRadius is installed, I can't see much in the way of documentation, etc. So, if you test this be aware that there are limitations and all things considered it may be better to start with a clean virtual machine and install the latest version of FreeRadius on it as suggested. Regards, J.

2 1

winbindd_privileged error?
by freeradius＠corwyn.net 09 Jan '10

09 Jan '10

I had everything working fine, and now it's not. (I use the ldap module to auth) When I look through the logs, I'm getting a winbindd_privileged error. I've seen that before, where you apply: chgrp radiusd /var/cache/samba/winbindd_privileged chmod g+rw /var/cache/samba/winbindd_privileged but that doesn't seem to be resolving in this case. I believe I did run yum update today and it updated samba. winbind won't start. Jan 8 17:09:45 ns5 winbindd[2086]: initialize_winbindd_cache: clearing cache and re-creating with version number 1 Jan 8 17:09:45 ns5 winbindd[2086]: [2010/01/08 17:09:45, 0] lib/util_sock.c:create_pipe_sock(1280) Jan 8 17:09:45 ns5 winbindd[2086]: invalid permissions on socket directory /var/cache/samba/winbindd_privileged Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 3

two user authentication groups for one AS
by Eric 09 Jan '10

09 Jan '10

Yes you are right but I have some problems in config: I set a vpn server address in client.conf and in users as: DEFAULT Client-IP-Address == 192.168.20.13, Auth-Type := Vpn, Autz-Type := Vpn, in radiusd.conf: ldap ldap-Vpn{ server = "192.168.10.1" ..... profile_attribute = "vpnProfileDn" access_attr = "vpnAccess" .... } sqlcounter monthly-Vpn { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql-Vpn key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > %b " } Autz-Type Vpn{ ldap-Vpn monthly-Vpn } Auth-Type Vpn{ ldap-Vpn } Acct-Type Vpn { sql-Vpn } Now the users that come from this vpn server are the same but there are parameters in ldap server that are different in admins and other users. I want give to admins' session-timeout different amount than others, but counter gives remain of monthly-count to users as session-timeout. It is good for regular users but how and where I should give this parameter to admins as different amount?

1 0

Design question considering 802.1x + edirectory + Active Directory
by Ric2009 09 Jan '10

09 Jan '10

Hello, I would like to know if anyone could help me with the design of this implementation : Requirements : - 802.1x Authentication for wired and wireless clients ( Windows XP with Novell Client ) - Single sign on login to Novell eDirectory and Active Directory - Radius Authentication should run over FreeRadius or IAS but not both, if it's possible. - High Availability is required for Radius service - Virtualization of the Radius servers is recommended Questions : - I have been looking at multi-platform 802.1x clients like Juniper Networks Odyssey Access Client ( OAC ) for multiplaform 802.1x login. But I don't know if it's possible to do the same without it. - Is there any downloadable Freeradius + LDAP virtual machine for testing ?? Thanks a lot !!!!! Ric2009 -- View this message in context: http://old.nabble.com/Design-question-considering-802.1x-%2B-edirectory-%2B… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

ld.so.1: radiusd: fatal: relocation error: file /usr/local/lib/rlm_sql_mysql-2.1.7.so: symbol mysql_next_result: referenced symbol not found
by Nereida Bernal 09 Jan '10

09 Jan '10

Hi all! I am testing my FreeRADIUS configuration using the NTRadPing Test Utility, but as soon as I send the user/password to the server I get the the error "ld.so.1: radiusd: fatal: relocation error: file /usr/local/lib/rlm_sql_mysql-2.1.7.so: symbol mysql_next_result: referenced symbol not found" and process radiusd is killed. I am not familiar with FreeRADIUS (This is my first installation) Could you help me? SUN Netra 210 FreeRADIUS Version 2.1.7 SO Solaris 10 MySQL 5.0.88 (32 bits) Packages installed: - SMCdb db - SMCgcc gcc - SMClgcc346 libgcc - SMClibidl libidl - SMClibt libtool - SMCliconv libiconv - SMCmake make - SMCmysql mysql - SMColdap openldap - SMCossl openssl - SMCsasl sasl Here's what I got from the radiusd debug bash-3.00# rad_recv: Access-Request packet from host 147.1.4.228 port 4138, id=4, length=44 User-Name = "test" User-Password = "radius123" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id ld.so.1: radiusd: fatal: relocation error: file /usr/local/lib/rlm_sql_mysql-2.1.7.so: symbol mysql_next_result: referenced symbol not found [1]+ Killed radiusd -X This is how I executed the configure command: /opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7 bash-3.00# ./configure --with-mysql-lib-dir=/usr/local/mysql/lib --with-mysql-include-dir=/usr/local/mysql/include --with-openssl --with-openssl-includes=/usr/sfw/include/openssl --with-openssl-libraries=/usr/sfw/bin/openssl | grep WARNI config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: silently not building rlm_eap_peap. configure: WARNING: FAILURE: rlm_eap_peap requires: OpenSSL. configure: WARNING: silently not building rlm_eap_tls. configure: WARNING: FAILURE: rlm_eap_tls requires: OpenSSL. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_eap_ttls. configure: WARNING: FAILURE: rlm_eap_ttls requires: OpenSSL. configure: WARNING: neither krb5 'k5crypto' nor 'crypto' libraries are found! configure: WARNING: the comm_err library isn't found! configure: WARNING: silently not building rlm_krb5. configure: WARNING: FAILURE: rlm_krb5 requires: krb5.h. configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-libs openssl-includes openssl-includes openssl-includes openssl-includes openssl-includes. configure: WARNING: silently not building rlm_perl. configure: WARNING: FAILURE: rlm_perl requires: EXTERN.h perl.h libperl.so libperl.so. configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h libpython2.3. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. Thanks! Nere

2 3

rlm_perl symbol lookup errors
by Alexander Clouter 08 Jan '10

08 Jan '10

Hi, Running 2.1.8 on Debian lenny and recently have been playing around with rlm_perl. Got the following when I include Net::LDAP or Data::Dumper in my perl module: ---- Net::LDAP ---- garibaldi:/home/ac56# freeradius -X [snipped] freeradius: symbol lookup error: /usr/lib/perl/5.10/auto/IO/IO.so: undefined symbol: Perl_Istack_sp_ptr ------------------- ---- Data::Dumper ---- Can't load '/usr/lib/perl/5.10/auto/Data/Dumper/Dumper.so' for module Data::Dumper: /usr/lib/perl/5.10/auto/Data/Dumper/Dumper.so: undefined symbol: Perl_sv_cmp at /usr/lib/perl/5.10/XSLoader.pm line 64. at /usr/lib/perl/5.10/Data/Dumper.pm line 36 Compilation failed in require at /usr/src/otp-perl/rfc2289.pm line 8. BEGIN failed--compilation aborted at /usr/src/otp-perl/rfc2289.pm line 8. rlm_perl: perl_parse failed: /usr/src/otp-perl/rfc2289.pm not found or has syntax errors. /etc/freeradius/LOCAL/gtc-trial.perl[7]: Instantiation failed for module "gtc-trial.perl" /etc/freeradius/sites-enabled/gtc-trial[46]: Failed to find module "gtc-trial.perl". /etc/freeradius/sites-enabled/gtc-trial[46]: Failed to parse "gtc-trial.perl" entry. ---------------------- I am guessing this is probably all due to the previously reported libtool 'fun' issues[1]? I'm only curious if what I am seeing is to be expected or have I borked something with my install? Is there is a more formal 'fix' than just to run freeradius with "LD_PRELOAD=/usr/lib/libperl.so.5.10" prepended to it? Happy New Year All. Cheers [1] http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg56983.… P.S. seems there is a missing </li> on the freeradius homepage so the recent news after the first item is left wedged over -- Alexander Clouter .sigmonster says: Your supervisor is thinking about you.

3 3

Ang: Re: Does FreeRadius support different replies for same user via check-attributes?
by Tobbe & Millan 08 Jan '10

08 Jan '10

Thanks! Can "unlang" be used directly when reply attribute is set? I do not want to have a if-statement for each user. It would cause problems if I have hundreds of users... My hopes was that in mySQL (which I'm using) I could have 2 check attributes (for Go1 and Go2) and then directly set the corresponding service in a value in the "radreply" table. Could unlang be used in a common way for all users? Best regards, Tobian ----Ursprungligt meddelande---- Från: jjj.hooper(a)bristol.ac.uk Datum: 2010-jan-08 15:46 Till: "FreeRadius users mailing list"<freeradius-users@lists. freeradius.org> Ärende: Re: Does FreeRadius support different replies for same user via check-attributes --On Friday, January 08, 2010 03:35:00 PM +0100 Tobbe & Millan <ejp252l(a)tninet.se> wrote: > Hi! > > I would like a specific request item to set which attribute to reply. > > For example... > IF; > A request comes with User-Name: "XXX", Password: "YYY" and Attribute > A = "Go1" > The Access-Accept should include Attribute Go="Service1" > BUT IF; > A request comes with User-Name: "XXX", Password: "YYY" and Attribute > A = "Go2" > The Access-Accept should include Attribute Go="Service2" > > Is this possible? It is. <http://freeradius.org/radiusd/man/unlang.html> -James -- James J J Hooper Network Specialist Information Services University of Bristol http://www.wireless.bristol.ac.uk http://www.jamesjj.net -- - List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html

2 1