March 2010 - Freeradius-Users - lists.freeradius.org

debug only for rlm_xxx (rlm_perl)
by bitte＠antworte.me 18 Mar '10

18 Mar '10

Hello list, is there an option in radiusd.conf how to enable debug logging only for several rlm_modules, e.g. I have rlm_perl and I only want debug messages for this. Thanks for your reply in advance. T.

3 6

Re: /usr/local/sbin/radiusd -X problem
by gmani 18 Mar '10

18 Mar '10

gmani wrote: > > The same Problem I am getting My Solaris Servers while starting the radius > server. How can I fix this . > > can U give me detailed explanation. > > > > > shivashankar wrote: >> >> hi All, >> >> i am using freeradius2.1.6 >> >> on solaris 10 >> >> when i run server i am getting following error >> >> >> bash-3.00# /usr/local/sbin/radiusd -X >> FreeRADIUS Version 2.1.6, for host sparc-sun-solaris2.10, built on Jul 30 >> 2009 at 20:25:20 >> Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. >> There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A >> PARTICULAR PURPOSE. >> You may redistribute copies of FreeRADIUS under the terms of the >> GNU General Public License v2. >> Starting - reading configuration files ... >> including configuration file /usr/local/etc/raddb/radiusd.conf >> including configuration file /usr/local/etc/raddb/proxy.conf >> including configuration file /usr/local/etc/raddb/clients.conf >> including files in directory /usr/local/etc/raddb/modules/ >> including configuration file /usr/local/etc/raddb/modules/acct_unique >> including configuration file /usr/local/etc/raddb/modules/always >> including configuration file /usr/local/etc/raddb/modules/attr_filter >> including configuration file /usr/local/etc/raddb/modules/attr_rewrite >> including configuration file /usr/local/etc/raddb/modules/chap >> including configuration file /usr/local/etc/raddb/modules/checkval >> including configuration file /usr/local/etc/raddb/modules/counter >> including configuration file /usr/local/etc/raddb/modules/detail >> including configuration file >> /usr/local/etc/raddb/modules/detail.example.com >> including configuration file /usr/local/etc/raddb/modules/detail.log >> including configuration file /usr/local/etc/raddb/modules/digest >> including configuration file /usr/local/etc/raddb/modules/echo >> including configuration file /usr/local/etc/raddb/modules/etc_group >> including configuration file /usr/local/etc/raddb/modules/exec >> including configuration file /usr/local/etc/raddb/modules/expiration >> including configuration file /usr/local/etc/raddb/modules/expr >> including configuration file /usr/local/etc/raddb/modules/files >> including configuration file /usr/local/etc/raddb/modules/inner-eap >> including configuration file /usr/local/etc/raddb/modules/ippool >> including configuration file /usr/local/etc/raddb/modules/krb5 >> including configuration file /usr/local/etc/raddb/modules/ldap >> including configuration file /usr/local/etc/raddb/modules/linelog >> including configuration file /usr/local/etc/raddb/modules/logintime >> including configuration file /usr/local/etc/raddb/modules/mac2ip >> including configuration file /usr/local/etc/raddb/modules/mac2vlan >> including configuration file /usr/local/etc/raddb/modules/otp >> including configuration file /usr/local/etc/raddb/modules/mschap >> including configuration file /usr/local/etc/raddb/modules/pam >> including configuration file /usr/local/etc/raddb/modules/pap >> including configuration file /usr/local/etc/raddb/modules/passwd >> including configuration file /usr/local/etc/raddb/modules/perl >> including configuration file /usr/local/etc/raddb/modules/policy >> including configuration file /usr/local/etc/raddb/modules/preprocess >> including configuration file /usr/local/etc/raddb/modules/radutmp >> including configuration file /usr/local/etc/raddb/modules/realm >> including configuration file /usr/local/etc/raddb/modules/smbpasswd >> including configuration file /usr/local/etc/raddb/modules/smsotp >> including configuration file /usr/local/etc/raddb/modules/sql_log >> including configuration file >> /usr/local/etc/raddb/modules/sqlcounter_expire_on_login >> including configuration file /usr/local/etc/raddb/modules/sradutmp >> including configuration file /usr/local/etc/raddb/modules/unix >> including configuration file /usr/local/etc/raddb/modules/wimax >> including configuration file /usr/local/etc/raddb/eap.conf >> including configuration file /usr/local/etc/raddb/policy.conf >> including files in directory /usr/local/etc/raddb/sites-enabled/ >> including configuration file /usr/local/etc/raddb/sites-enabled/default >> including configuration file >> /usr/local/etc/raddb/sites-enabled/inner-tunnel >> including configuration file >> /usr/local/etc/raddb/sites-enabled/control-socket >> including dictionary file /usr/local/etc/raddb/dictionary >> main { >> prefix = "/usr/local" >> localstatedir = "/usr/local/var" >> logdir = "/usr/local/var/log/radius" >> libdir = "/usr/local/lib" >> radacctdir = "/usr/local/var/log/radius/radacct" >> hostname_lookups = no >> max_request_time = 30 >> cleanup_delay = 5 >> max_requests = 1024 >> allow_core_dumps = no >> pidfile = "/usr/local/var/run/radiusd/radiusd.pid" >> checkrad = "/usr/local/sbin/checkrad" >> debug_level = 0 >> proxy_requests = yes >> log { >> stripped_names = no >> auth = no >> auth_badpass = no >> auth_goodpass = no >> } >> security { >> max_attributes = 200 >> reject_delay = 1 >> status_server = yes >> } >> } >> radiusd: #### Loading Realms and Home Servers #### >> proxy server { >> retry_delay = 5 >> retry_count = 3 >> default_fallback = no >> dead_time = 120 >> wake_all_if_all_dead = no >> } >> home_server localhost { >> ipaddr = 127.0.0.1 >> port = 1812 >> type = "auth" >> secret = "testing123" >> response_window = 20 >> max_outstanding = 65536 >> require_message_authenticator = no >> zombie_period = 40 >> status_check = "status-server" >> ping_interval = 30 >> check_interval = 30 >> num_answers_to_alive = 3 >> num_pings_to_alive = 3 >> revive_interval = 120 >> status_check_timeout = 4 >> irt = 2 >> mrt = 16 >> mrc = 5 >> mrd = 30 >> } >> home_server_pool my_auth_failover { >> type = fail-over >> home_server = localhost >> } >> realm example.com { >> auth_pool = my_auth_failover >> } >> realm LOCAL { >> } >> radiusd: #### Loading Clients #### >> client localhost { >> ipaddr = 127.0.0.1 >> require_message_authenticator = no >> secret = "testing123" >> nastype = "other" >> } >> client 192.168.0.0/24 { >> require_message_authenticator = no >> secret = "testing123-1" >> shortname = "private-network-1" >> } >> client 192.168.0.0/16 { >> require_message_authenticator = no >> secret = "testing123-2" >> shortname = "private-network-2" >> } >> client 10.232.170.228/16 { >> require_message_authenticator = no >> secret = "testing123" >> shortname = "private-network-2" >> } >> client 10.232.170.228 { >> require_message_authenticator = no >> secret = "testing123" >> shortname = "liv1" >> nastype = "livingston" >> } >> radiusd: #### Instantiating modules #### >> instantiate { >> Module: Linked to module rlm_exec >> Module: Instantiating exec >> exec { >> wait = no >> input_pairs = "request" >> shell_escape = yes >> } >> Module: Linked to module rlm_expr >> Module: Instantiating expr >> Module: Linked to module rlm_expiration >> Module: Instantiating expiration >> expiration { >> reply-message = "Password Has Expired " >> } >> Module: Linked to module rlm_logintime >> Module: Instantiating logintime >> logintime { >> reply-message = "You are calling outside your allowed timespan " >> minimum-timeout = 60 >> } >> } >> radiusd: #### Loading Virtual Servers #### >> server inner-tunnel { >> modules { >> Module: Checking authenticate {...} for more modules to load >> Module: Linked to module rlm_pap >> Module: Instantiating pap >> pap { >> encryption_scheme = "auto" >> auto_header = no >> } >> Module: Linked to module rlm_chap >> Module: Instantiating chap >> Module: Linked to module rlm_mschap >> Module: Instantiating mschap >> mschap { >> use_mppe = yes >> require_encryption = no >> require_strong = no >> with_ntdomain_hack = no >> } >> Module: Linked to module rlm_unix >> Module: Instantiating unix >> unix { >> radwtmp = "/usr/local/var/log/radius/radwtmp" >> } >> Module: Linked to module rlm_eap >> Module: Instantiating eap >> eap { >> default_eap_type = "md5" >> timer_expire = 60 >> ignore_unknown_eap_types = no >> cisco_accounting_username_bug = no >> max_sessions = 2048 >> } >> Module: Linked to sub-module rlm_eap_md5 >> Module: Instantiating eap-md5 >> Module: Linked to sub-module rlm_eap_leap >> Module: Instantiating eap-leap >> Module: Linked to sub-module rlm_eap_gtc >> Module: Instantiating eap-gtc >> gtc { >> challenge = "Password: " >> auth_type = "PAP" >> } >> Module: Linked to sub-module rlm_eap_tls >> Module: Instantiating eap-tls >> tls { >> rsa_key_exchange = no >> dh_key_exchange = yes >> rsa_key_length = 512 >> dh_key_length = 512 >> verify_depth = 0 >> pem_file_type = yes >> private_key_file = "/usr/local/etc/raddb/certs/server.pem" >> certificate_file = "/usr/local/etc/raddb/certs/server.pem" >> CA_file = "/usr/local/etc/raddb/certs/ca.pem" >> private_key_password = "whatever" >> dh_file = "/usr/local/etc/raddb/certs/dh" >> random_file = "/usr/local/etc/raddb/certs/random" >> fragment_size = 1024 >> include_length = yes >> check_crl = no >> cipher_list = "DEFAULT" >> make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" >> cache { >> enable = no >> lifetime = 24 >> max_entries = 255 >> } >> } >> /usr/local/etc/raddb/certs/bootstrap: make: not found >> /usr/local/etc/raddb/certs/bootstrap: openssl: not found >> Exec-Program output: >> Exec-Program: returned: 1 >> rlm_eap: Failed to initialize type tls >> /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" >> /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find >> module "eap". >> /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing >> authenticate section. >> Errors initializing modules >> >> >> plz hlp me out >> >> >> > > -- View this message in context: http://old.nabble.com/-usr-local-sbin-radiusd--X-problem-tp24737309p2794202… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory
by John 18 Mar '10

18 Mar '10

Hello, We want to setup freeRADIUS with Peap/MSCHAPv2 talk to Apple Open Directory. I found this option 'use_open_directory'. But looks we need to install freeRADIUS on the same machine with Open Directory.(https://lists.freeradius.org/pipermail/freeradius-users/2010-Feb… Do we have to run freeRADIUS on the same machine with OpenDirectory? Is there a work-around that we can run freeRADIUS seperate from OpenDirectory? Best. John

2 2

freeradius and vlan assignment
by omega bk 18 Mar '10

18 Mar '10

hi, assume that the switch does not support the "auth-fail" and has 2 vlan ( vlan inside and vlan outside ), is it possible in the users file to put a condition like: if (user belong to Ldap-group=inside) assign to vlan = inside else assign to vlan = outside is that possible ? thanks

2 2

framed-ip-address based on nas-ip-address
by power159 18 Mar '10

18 Mar '10

Hi , As there was a mistake in my previous email title and as I had big improvement in processing my problem I am sending a new email . As I said in previous email I want to configure freeradius to reply different framed-ip-addresses based on nas servers . I found following email in the archive which helped a lot : http://lists.cistron.nl/pipermail/freeradius-users/2009-January/msg00630.ht… the only problem that I have is if user is membership of 2 groups . freeradius is processing none of them ! even if both are matching ! but if I remove one of groups its working without any problem ! and assigning ip from ip pool read-groups is on here is my tables : select * from radcheck; +----+----------+---------------+----+--------+ | id | username | attribute | op | value | +----+----------+---------------+----+--------+ | 4 | test1 | User-Password | := | 123456 | +----+----------+---------------+----+--------+ select * from radgroupcheck; +----+-----------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+-------------+ | 1 | group1 | Nas-IP-Address | == | 192.168.1.5 | | 2 | group1 | Pool-Name | := | pool1 | | 3 | group2 | Nas-IP-Address | == | 192.168.1.6 | | 4 | group2 | Pool-Name | := | pool2 | +----+-----------+----------------+----+-------------+ select * from radusergroup; +----------+-----------+----------+ | username | groupname | priority | +----------+-----------+----------+ | test1 | group1 | 0 | | test1 | group2 | 0 | +----------+-----------+----------+ select * from radippool; +----+-----------+-----------------+--------------+-----------------+------------------+-------------+----------+----------+ | id | pool_name | framedipaddress | nasipaddress | calledstationid | callingstationid | expiry_time | username | pool_key | +----+-----------+-----------------+--------------+-----------------+------------------+-------------+----------+----------+ | 1 | pool1 | 90.90.90.1 | | | | NULL | | 0 | | 2 | pool1 | 90.90.90.2 | | | | NULL | | | | 5 | pool2 | 91.90.90.1 | | | | NULL | | 0 | | 6 | pool2 | 91.90.90.2 | | | | NULL | | | +----+-----------+-----------------+--------------+-----------------+------------------+-------------+----------+----------+

2 2

(no subject)
by Richie Lee 18 Mar '10

18 Mar '10

http://sagunnthecompany.com/TNJHLhOER9.html _________________________________________________________________ Stay in touch. http://go.microsoft.com/?linkid=9712959

1 0

Re: Talking to Windows 2003 AD
by Iain Grant 18 Mar '10

18 Mar '10

Thanks Alan, The double '==' in the ntlm_auth command was the culprit. Things are working today. p.s. I had already stripped the usernames and verified the password so that was fine. Iain Grant Linux System Administrator Scottish Crop Research Institute Date: Wed, 17 Mar 2010 17:23:37 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Subject: Re: Talking to Windows 2003 AD To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20100317172337.GA16756(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Now when I go to the next step and enable this in /etc/raddb/modules/mschap > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username==%{%{Stripped-User-Name}:-%{User-Name:-None}} --domain=%{%{mschap:NT-Domain}:-OURDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" radiusd -X and show us at least that bit where that command is called. you have 2 == is your command. is that intentional? you are allowing usernames that havent been sanitised or are blank (none) - is that intentional? alan ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

1 0

Building modules in C++ modules
by Abu Marcose 18 Mar '10

18 Mar '10

Is it possible to build modules in C++ (g++ compiler)? I have taken the rlm_example.c file, renamed as cpp and then run make and I see some errors reported in the libradius header files. Before I spend time trying to figure out what the errors are, just wanted to make sure that this has been done before. Here are the errors reported in any case... g++ -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -DIE_LIBTOOL_DIE -I/home/marcose/Downloads/freeradius-server-2.1.8/src -I/usr/include -c rlm_grid.cpp -fPIC -DPIC -o .libs/rlm_grid.o In file included from /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:30, from rlm_grid.cpp:27: /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/libradius.h:160: error: expected type-specifier before ';' token /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/libradius.h:339: error: expected ')' before 'operator' /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/libradius.h:339: error: expected initializer before 'operator' In file included from /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:33, from rlm_grid.cpp:27: /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/conffile.h:94: error: expected ',' or '...' before 'template' In file included from rlm_grid.cpp:27: /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:246: error: declaration of 'home_server* auth_req::home_server' /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/realms.h:88: error: changes meaning of 'home_server' from 'typedef struct home_server home_server' /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:582: error: expected ')' before 'operator' /home/marcose/Downloads/freeradius-server-2.1.8/src/freeradius-devel/radiusd.h:582: error: expected initializer before 'operator' rlm_grid.cpp: In function 'int grid_instantiate(CONF_SECTION*, void**)': rlm_grid.cpp:76: error: invalid conversion from 'void*' to 'rlm_grid_t*' rlm_grid.cpp: In function 'int grid_authorize(void*, REQUEST*)': rlm_grid.cpp:108: error: 'pairmake' was not declared in this scope make: *** [rlm_grid.lo] Error 1

2 3

RADIUS_CLIENT_MAX_WAIT does not work
by R C 18 Mar '10

18 Mar '10

Hi, I am testing my radius server with eapol_test that comes with the wpa_supplicant. If the radius server is down, I want the eapol_test to not give up trying to talk to the radius server. So, i set the parameter RADIUS_CLIENT_MAX_WAIT to 99999 seconds and the eapol_test timeout to 10000. But, still, it will stop just before the next client retransmit that is in 48 seconds. Is there any other parameter that i should modify? thanks for your help. Following is taken from src/radius/radius_client.c from wpa_supplicant. /* Defaults for RADIUS retransmit values (exponential backoff) */ #define RADIUS_CLIENT_FIRST_WAIT 3 /* seconds */ #define RADIUS_CLIENT_MAX_WAIT99999 /* seconds */ #define RADIUS_CLIENT_MAX_RETRIES 10 /* maximum number of retransmit attempts * before entry is removed from retransmit * list */ #define RADIUS_CLIENT_MAX_ENTRIES 30 /* maximum number of entries in retransmit * list (oldest will be removed, if this * limit is exceeded) */ #define RADIUS_CLIENT_NUM_FAILOVER 4 /* try to change RADIUS server after this * many failed retry attempts */ Thanks, RC.

1 0

Automatic Radius Accounting when Authenticated
by Teguh Kurniawan 18 Mar '10

18 Mar '10

Hi, Is possible in FR 2.x doing automatic accounting when client is authenticated. Thank's Teguh Kurniawan

3 5