March 2011 - Freeradius-Users - lists.freeradius.org

Compiling master branch
by Kristoffer Milligan 03 Mar '11

03 Mar '11

Due to the need for nested TLVs I'm trying to compile FreeRADIUS from the master branch: git clone git://git.freeradius.org/freeradius-server.git Also, I'm using FR for a WiMAX network, so I need the experimental modules: ./configure --with-experimental-modules The configuration works fine, but when I try to compile the project, it fails: root@radius:~/freeradius-server# make ......... gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/freeradius-server/src -I/root/freeradius-server/src/modules/rlm_redis -c rlm_rediswho.c -fPIC -DPIC -o .libs/rlm_rediswho.o In file included from rlm_rediswho.c:32: /root/freeradius-server/src/modules/rlm_redis/rlm_redis.h:35:29: error: hiredis/hiredis.h: No such file or directory In file included from rlm_rediswho.c:32: /root/freeradius-server/src/modules/rlm_redis/rlm_redis.h:46: error: expected specifier-qualifier-list before 'redisContext' rlm_rediswho.c: In function 'rediswho_command': rlm_rediswho.c:124: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:125: error: 'REDIS_REPLY_INTEGER' undeclared (first use in this function) rlm_rediswho.c:125: error: (Each undeclared identifier is reported only once rlm_rediswho.c:125: error: for each function it appears in.) rlm_rediswho.c:127: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:129: error: 'REDIS_REPLY_STATUS' undeclared (first use in this function) rlm_rediswho.c:130: error: 'REDIS_REPLY_STRING' undeclared (first use in this function) rlm_rediswho.c:132: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c: In function 'rediswho_accounting_start': rlm_rediswho.c:264: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:264: error: 'REDIS_REPLY_INTEGER' undeclared (first use in this function) rlm_rediswho.c:265: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c: In function 'rediswho_accounting_alive': rlm_rediswho.c:281: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:281: error: 'REDIS_REPLY_INTEGER' undeclared (first use in this function) rlm_rediswho.c:282: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c: In function 'rediswho_accounting_stop': rlm_rediswho.c:299: error: 'REDISSOCK' has no member named 'reply' rlm_rediswho.c:299: error: 'REDIS_REPLY_INTEGER' undeclared (first use in this function) rlm_rediswho.c:300: error: 'REDISSOCK' has no member named 'reply' make[6]: *** [rlm_rediswho.lo] Error 1 make[6]: Leaving directory `/root/freeradius-server/src/modules/rlm_rediswho' make[5]: *** [rlm_rediswho] Error 2 make[5]: Leaving directory `/root/freeradius-server/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/freeradius-server/src/modules' make[3]: *** [modules] Error 2 make[3]: Leaving directory `/root/freeradius-server/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/freeradius-server/src' make[1]: *** [src] Error 2 make[1]: Leaving directory `/root/freeradius-server' make: *** [all] Error 2 What lib am I missing ? Or what flag can I throw at --without-XXXX to circumvent the problem? - Kristoffer Milligan

3 2

DHCP reply problem
by Александр Подрезенко 03 Mar '11

03 Mar '11

Hello all. I tried to configure freeradius to operate as dhcp server. I have one problem. Freeradius receives DHCP-Discover and DHCP-Request packets, but replies are not sent. In logs all OK, but strace output contains error EINVAL (Invalid argument) in packet sending via sendmsg. Freeradius version is 2.1.x from git. My config file: dhcp:=========================== listen { ipaddr = * port = 67 type = dhcp interface = eth0 broadcast = yes } dhcp DHCP-Discover { linelog update reply { DHCP-Message-Type = DHCP-Offer DHCP-Domain-Name-Server = 192.168.194.169 DHCP-Domain-Name-Server = 192.168.192.53 DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 192.168.194.126 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.194.105 DHCP-Your-IP-Address = 192.168.194.106 } linelog ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 192.168.194.169 DHCP-Domain-Name-Server = 192.168.192.53 DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 192.168.194.126 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.194.105 DHCP-Your-IP-Address = 192.168.194.106 } ok } dhcp:=========================== Log fragment: freeradius -X ================== Received DHCP-Discover of id f1b3e779 from 0.0.0.0:68 to 255.255.255.255:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 4055099257 DHCP-Number-of-Seconds = 31 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:22:15:30:16:7b DHCP-Message-Type = DHCP-Discover DHCP-Requested-IP-Address = 192.168.194.106 DHCP-Hostname = "capt-eee" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Search DHCP-Parameter-Request-List = DHCP-Hostname DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size DHCP-Parameter-Request-List = DHCP-Classless-Static-Route DHCP-Parameter-Request-List = DHCP-NTP-Servers server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} [linelog] expand: %{reply:DHCP-Message-Type} -> [linelog] ... expanding second conditional [linelog] expand: %{request:DHCP-Message-Type} -> DHCP-Discover [linelog] expand: %{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}} -> DHCP-Discover [linelog] expand: /var/log/radius/linelog -> /var/log/radius/linelog [linelog] expand: %{DHCP-Transaction-Id} DISCOVER: [%{DHCP-Client-Hardware-Address}] via (%{DHCP-Gateway-IP-Address}) %{DHCP-Hostname} -> 4055099257 DISCOVER: [00:22:15:30:16:7b] via (0.0.0.0) capt-eee ++[linelog] returns ok ++[reply] returns ok [linelog] expand: %{reply:DHCP-Message-Type} -> DHCP-Offer [linelog] expand: %{%{reply:DHCP-Message-Type}:-%{request:DHCP-Message-Type}} -> DHCP-Offer [linelog] expand: /var/log/radius/linelog -> /var/log/radius/linelog [linelog] expand: %{DHCP-Transaction-Id} OFFER: %{reply:DHCP-Your-IP-Address} to [%{DHCP-Client-Hardware-Address}] ... -> 4055099257 OFFER: 192.168.194.106 to [00:22:15:30:16:7b] ... ++[linelog] returns ok ++[ok] returns ok } # server dhcp Sending DHCP-Offer of id f1b3e779 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Subnet-Mask = 255.255.255.128 DHCP-Router-Address = 192.168.194.126 DHCP-Domain-Name-Server = 192.168.194.169 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.194.105 Finished request 5. Cleaning up request 5 ID -239868039 with timestamp +85 Going to the next request Ready to process requests. freeradius -X ================== STRACE output ================= write(1, "Ready to process requests.\n", 27) = 27 select(20, [11 13 14 15 16 17 18 19], NULL, NULL, NULL) = 1 (in [17]) getsockname(17, {sa_family=AF_INET, sin_port=htons(67), sin_addr=inet_addr("0.0.0.0")}, [16]) = 0 recvmsg(17, {msg_name(16)={sa_family=AF_INET, sin_port=htons(68), sin_addr=inet_addr("0.0.0.0")}, msg_iov(1)=[{"\1\1\6\0\361\263\347y\0\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\"\0250"..., 1460}], msg_controllen=32, {cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=, ...}, msg_flags=0}, 0) = 300 write(1, "Received DHCP-Discover of id f1b"..., 76) = 76 write(1, "\tDHCP-Opcode = Client-Message\n", 30) = 30 write(1, "\tDHCP-Hardware-Type = Ethernet\n", 31) = 31 write(1, "\tDHCP-Hardware-Address-Length = "..., 34) = 34 write(1, "\tDHCP-Hop-Count = 0\n", 20) = 20 write(1, "\tDHCP-Transaction-Id = 405509925"..., 34) = 34 write(1, "\tDHCP-Number-of-Seconds = 31\n", 29) = 29 write(1, "\tDHCP-Flags = 0\n", 16) = 16 write(1, "\tDHCP-Client-IP-Address = 0.0.0."..., 34) = 34 write(1, "\tDHCP-Your-IP-Address = 0.0.0.0\n", 32) = 32 write(1, "\tDHCP-Server-IP-Address = 0.0.0."..., 34) = 34 write(1, "\tDHCP-Gateway-IP-Address = 0.0.0"..., 35) = 35 write(1, "\tDHCP-Client-Hardware-Address = "..., 50) = 50 write(1, "\tDHCP-Message-Type = DHCP-Discov"..., 35) = 35 write(1, "\tDHCP-Requested-IP-Address = 80."..., 43) = 43 write(1, "\tDHCP-Hostname = \"capt-eee\"\n", 28) = 28 write(1, "\tDHCP-Parameter-Request-List = D"..., 48) = 48 write(1, "\tDHCP-Parameter-Request-List = D"..., 54) = 54 write(1, "\tDHCP-Parameter-Request-List = D"..., 48) = 48 write(1, "\tDHCP-Parameter-Request-List = D"..., 51) = 51 write(1, "\tDHCP-Parameter-Request-List = D"..., 48) = 48 write(1, "\tDHCP-Parameter-Request-List = D"..., 55) = 55 write(1, "\tDHCP-Parameter-Request-List = D"..., 50) = 50 write(1, "\tDHCP-Parameter-Request-List = D"..., 45) = 45 write(1, "\tDHCP-Parameter-Request-List = D"..., 57) = 57 write(1, "\tDHCP-Parameter-Request-List = D"..., 44) = 44 write(1, "\tDHCP-Parameter-Request-List = D"..., 55) = 55 write(1, "\tDHCP-Parameter-Request-List = D"..., 59) = 59 write(1, "\tDHCP-Parameter-Request-List = D"..., 48) = 48 write(1, "server dhcp {\n", 14) = 14 write(1, "Trying sub-section dhcp DHCP-Dis"..., 44) = 44 write(1, "+- entering group DHCP-Discover "..., 38) = 38 write(1, "[linelog] \texpand: %{reply:DHCP-"..., 50) = 50 write(1, "[linelog] \t... expanding second "..., 44) = 44 write(1, "[linelog] \texpand: %{request:DHC"..., 65) = 65 write(1, "[linelog] \texpand: %{%{reply:DHC"..., 96) = 96 write(1, "[linelog] \texpand: /var/log/radi"..., 70) = 70 open("/var/log/radius/linelog", O_WRONLY|O_CREAT|O_APPEND, 0600) = 20 write(1, "[linelog] \texpand: %{DHCP-Transa"..., 203) = 203 write(20, "4055099257 DISCOVER: [00:22:15:3"..., 64) = 64 close(20) = 0 write(1, "++[linelog] returns ok\n", 23) = 23 write(1, "++[reply] returns ok\n", 21) = 21 write(1, "[linelog] \texpand: %{reply:DHCP-"..., 60) = 60 write(1, "[linelog] \texpand: %{%{reply:DHC"..., 93) = 93 write(1, "[linelog] \texpand: /var/log/radi"..., 70) = 70 open("/var/log/radius/linelog", O_WRONLY|O_CREAT|O_APPEND, 0600) = 20 write(1, "[linelog] \texpand: %{DHCP-Transa"..., 182) = 182 write(20, "4055099257 OFFER: 80.91.194.106 "..., 59) = 59 close(20) = 0 write(1, "++[linelog] returns ok\n", 23) = 23 write(1, "++[ok] returns ok\n", 18) = 18 write(1, "} # server dhcp\n", 16) = 16 write(1, "Sending DHCP-Offer of id f1b3e77"..., 72) = 72 write(1, "\tDHCP-Subnet-Mask = 255.255.255."..., 36) = 36 write(1, "\tDHCP-Router-Address = 80.91.194"..., 37) = 37 write(1, "\tDHCP-Domain-Name-Server = 80.91"..., 41) = 41 write(1, "\tDHCP-IP-Address-Lease-Time = 86"..., 36) = 36 write(1, "\tDHCP-DHCP-Server-Identifier = 8"..., 45) = 45 sendmsg(17, {msg_name(16)={sa_family=AF_INET, sin_port=htons(68), sin_addr=inet_addr("255.255.255.255")}, msg_iov(1)=[{"\2\1\6\0\361\263\347y\0\0\0\0\0\0\0\0P[\302jP[\302i\0\0\0\0\0\"\0250"..., 300}], msg_controllen=32, {cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=, ...}, msg_flags=0}, 0) = -1 EINVAL (Invalid argument) write(1, "Finished request 5.\n", 20) = 20 write(1, "Cleaning up request 5 ID -239868"..., 55) = 55 write(1, "Going to the next request\n", 26) = 26 wait4(-1, NULL, 0, NULL) = -1 ECHILD (No child processes) write(1, "Ready to process requests.\n", 27) = 27 STRACE output =================

2 1

PAP problem?
by Matt Langthorpe 03 Mar '11

03 Mar '11

Hi list, I'm pretty sure this issue is straight forward but I've searched the list and cant come up with an answer. I'm usuing freeradius 2.19 on cent OS 5.5 Im trying to auth users from a NAC box (Bradford campus manager) against an AD domain using freeradius. All works fine when I point an AP at freeradius, but things fail when using our NAC to forward requests to FreeRadius. I suspect the problem is that the NAC is trying to use PAP, but im not sure how to really resolve the problem. Here are my logs: Ready to process requests. rad_recv: Access-Request packet from host 129.67.147.204 port 32960, id=174, length=78 User-Name = "SAMBA_TEST" User-Password = "password" NAS-Identifier = "pmbcm01.pmb.ox.ac.uk" NAS-IP-Address = 129.67.147.204 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/129.67.147.204/auth-detail-20110303 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/129.67.147.204/auth-detail-20110303 [auth_log] expand: %t -> Thu Mar 3 11:45:17 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SAMBA_TEST", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for SAMBA_TEST [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=SAMBA_TEST)) [ldap] expand: cn=Users,dc=PMB,dc=OX,dc=AC,dc=UK -> cn=Users,dc=PMB,dc=OX,dc=AC,dc=UK rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 129.67.147.225:389, authentication 0 rlm_ldap: bind as cn=samba,cn=Users,dc=PMB,dc=OX,dc=AC,dc=UK/password to 129.67.147.225:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in cn=Users,dc=PMB,dc=OX,dc=AC,dc=UK, with filter (&(sAMAccountName=SAMBA_TEST)) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user SAMBA_TEST authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> SAMBA_TEST attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 174 to 129.67.147.204 port 32960 Waking up in 4.9 seconds. Cleaning up request 0 ID 174 with timestamp + Cheers, Matt

2 1

Using an external CA certificate
by Matt Langthorpe 03 Mar '11

03 Mar '11

Hi List, Having a bit of trouble following the official freeradius wiki when it comes to certificates. Basically I have my own certificate which I want to use. I have a ***.crt file which was sent by my issuer, and a private.pem file which was created when I made my CSR request using openssl. I have uploaded the two files into my raddb/certs folder, but am unsure as to where to point to them in my eap.conf? I notice none of the cert files listed in eap.conf have a *.crt extension which is a bit confusing. Thanks in advance, Matt

2 2

AD LDS with MS-CHAP Question
by Liem Nguyen 03 Mar '11

03 Mar '11

Hi, Hope someone can help me with this. I was successfully able to get freeradius to work with Microsoft AD LDS (new version of ADAM) with PAP and LDAP authentication. Now I'm working on getting freeradius to work with AD LDS with MS-CHAP. Anybody know if this is possible and if you do can you give me some direction on this? Thanks! Liem

2 1

Mobile IP
by Shreya Shah 03 Mar '11

03 Mar '11

Hi, We have setup freeradius for our mobile customers and is also used to provide IP's to the handsets. We are planning to setup up roaming which requires Mobile IP's. Can anyone please tell me if freeradius supports Mobile IP ? Thanks, S.

3 4

help setting up radius
by Matthew Lemons 02 Mar '11

02 Mar '11

I'm trying to update my older radius to the new specs put out by our upline provider. I need someone to do this for me. I'm not good with Radius. Wish I was but am not. This is a paying deal. -- And I am the Iconoclast, an unconventional eccentric who marches to a different drummer... but you may call me Noodle Noggin.

1 0

New User and AD Question
by McNutt, Justin M. 02 Mar '11

02 Mar '11

New member to the list, here. I have a question about AD computer-based authentication. Basically, how is it accomplished? I have Googled and Googled, but only found references to the fact that it *can* be done (mostly from archives of this list), but little reference on HOW to do it, other than that it has something to do with editing the "realms" file. I also went to #freeradius on FreeNode, but it seemed there was rarely anyone in the channel. So here I am. I'm running FreeRADIUS 2.1.7 from the RHEL 5 RPM (freeradius2-2.1.7-7.el5). It's running on an RHEL 5 virtual machine that is a member of an AD domain via Samba 3.5.4 (which was required to talk to the 2008R2 domain controllers). We have a multi-domain, single forest environment. I'm running two virtual servers, based on the defaults. I have the "campus-main" virtual server that is pretty much the exact same as the default, except that I have LDAP authentication enabled. This works perfectly and is able to authenticate users for all domains. I also have the "campus-eap" and "campus-inner-tunnel" virtual servers for EAP authentication that are the same as the "default" and "inner-tunnel" servers except for the names. (I copied them so I could make changes to the "campus-XXX" virtual servers and still have the originals for reference.) The EAP functions for clients using EAP-TTLS and EAP-PEAP work just fine for all users in all domains (authenticated via ntlm_auth) EXCEPT for the "host\\computer.domain.name" users (the computer accounts). I'd like to make this work, partly because a large number of the failed login attempts in my logs are from hosts that are valid domain members. Sooo... help? What's the basic idea behind making this work? Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test.

8 57

freeradius install on mac server help
by Raymond Norton 02 Mar '11

02 Mar '11

I am trying to install freeradius-2.1.0 on a mac server (10.5.8). Make runs fine, until it gets to the errors below. I am not a mac guy, so not sure where to look for the cause of the error. Making all in rlm_perl... /usr/bin/make -C rlm_perl all /Users/raymond/Downloads/freeradius-server-2.1.10/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DDARWIN -Wall -D_GNU_SOURCE -DNDEBUG -I/Users/raymond/Downloads/freeradius-server-2.1.10/src -I/Users/raymond/Downloads/freeradius-server-2.1.10/libltdl `perl -MExtUtils::Embed -e ccopts` -c rlm_perl.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DDARWIN -Wall -D_GNU_SOURCE -DNDEBUG -I/Users/raymond/Downloads/freeradius-server-2.1.10/src -I/Users/raymond/Downloads/freeradius-server-2.1.10/libltdl -arch ppc -arch i386 -g -pipe -fno-common -DPERL_DARWIN -no-cpp-precomp -fno-strict-aliasing -Wdeclaration-after-statement -I/usr/local/include -I/System/Library/Perl/5.8.8/darwin-thread-multi-2level/CORE -c rlm_perl.c -fno-common -DPIC -o .libs/rlm_perl.o rlm_perl.c: In function 'rlm_perl_make_key': rlm_perl.c:246: warning: passing argument 2 of 'pthread_key_create' from incompatible pointer type rlm_perl.c: In function 'rlm_perl_make_key': rlm_perl.c:246: warning: passing argument 2 of 'pthread_key_create' from incompatible pointer type rlm_perl.c: In function 'perl_xlat': rlm_perl.c:373: warning: format '%d' expects type 'int', but argument 3 has type 'size_t' rlm_perl.c:373: warning: format '%d' expects type 'int', but argument 5 has type 'size_t' rlm_perl.c: In function 'perl_xlat': rlm_perl.c:373: warning: format '%d' expects type 'int', but argument 3 has type 'size_t' rlm_perl.c:373: warning: format '%d' expects type 'int', but argument 5 has type 'size_t' rlm_perl.c: In function 'perl_instantiate': rlm_perl.c:410: warning: unused variable 'envp' rlm_perl.c: In function 'perl_instantiate': rlm_perl.c:410: warning: unused variable 'envp' rlm_perl.c: In function 'perl_store_vps': rlm_perl.c:541: warning: assignment discards qualifiers from pointer target type rlm_perl.c: In function 'perl_store_vps': rlm_perl.c:541: warning: assignment discards qualifiers from pointer target type gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DDARWIN -Wall -D_GNU_SOURCE -DNDEBUG -I/Users/raymond/Downloads/freeradius-server-2.1.10/src -I/Users/raymond/Downloads/freeradius-server-2.1.10/libltdl -arch ppc -arch i386 -g -pipe -fno-common -DPERL_DARWIN -no-cpp-precomp -fno-strict-aliasing -Wdeclaration-after-statement -I/usr/local/include -I/System/Library/Perl/5.8.8/darwin-thread-multi-2level/CORE -c rlm_perl.c -o rlm_perl.o >/dev/null 2>&1 /Users/raymond/Downloads/freeradius-server-2.1.10/libtool --mode=link gcc -release 2.1.10 \ -module -export-dynamic -o rlm_perl.la \ -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /Users/raymond/Downloads/freeradius-server-2.1.10/src/lib/libfreeradius-radius.la `perl -MExtUtils::Embed -e ldopts` -framework DirectoryService -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /System/Library/Perl/5.8.8/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a is not portable! gcc ${wl}-flat_namespace ${wl}-undefined ${wl}suppress -o .libs/rlm_perl-2.1.10.so -bundle .libs/rlm_perl.o /Users/raymond/Downloads/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.dylib -L/usr/local/lib /System/Library/Perl/5.8.8/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a -L/System/Library/Perl/5.8.8/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lutil -lc -lresolv -lpthread -arch ppc -arch i386 -framework DirectoryService ld warning: in /Users/raymond/Downloads/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.dylib, file is not of required architecture dsymutil .libs/rlm_perl-2.1.10.so || : (cd .libs && rm -f rlm_perl.so && ln -s rlm_perl-2.1.10.so rlm_perl.so) ar cru .libs/rlm_perl.a /System/Library/Perl/5.8.8/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a rlm_perl.o ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (18) cpusubtype (0) is not an object file (bad magic number) ar: internal ranlib command failed make[6]: *** [rlm_perl.la] Error 1 make[5]: *** [rlm_perl] Error 2 make[4]: *** [all] Error 2 make[3]: *** [modules] Error 2 make[2]: *** [all] Error 2 make[1]: *** [src] Error 2 make: *** [all] Error 2

2 1

Use Hint file to proxy
by Difan Zhao 02 Mar '11

02 Mar '11

Hi experts, Long time no talk! I have another dilemma. For some reasons I want to try to use the hints file to do Proxy (the normal way of configuring realm and proxy.conf file works). So the following is my config: =============== hints =================== DEFAULT User-Name =~ "^host\/.*\.gtcorp\.com$" Hint = "Marriott" =============== users =================== DEFAULT Hint == "Marriott", Proxy-To-Realm := "~\.gtcorp\.com$" =============== proxy.conf =================== .... realm "~\.gtcorp\.com$" { nostrip auth_pool = Marriott_Auth_Pool acct_pool = Marriott_Acct_Pool } ============== module/realm ================ realm Marriott { format = suffix delimiter = "/" } Then I commented out the "Marriott" realm in the "authorize" section in the default server so the settings in the "realm" file shouldn't do anything. ============= sites-available/default ============== authorize { ... # Marriott ... } In the radius -X log I do see the requests are sent to the proxy server but I also see the following abnormal logs. The complete log is also attached. [eap] No pre-existing handler found ... rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. So is it possible to use the hints file to do proxy or I'm totally out of my mind?? If it's possible where I could do wrong? Thanks a lot! [cid:image002.gif@01CBD8B8.490E09F0]Difan Zhao M.Eng | CCNA CCNP CCSP | Network Engineer T: 403-509-1010 ext 3048 | M: 403-689-7514 | F: 403.509.1011 difan.zhao(a)guest-tek.com<mailto:difan.zhao@guest-tek.com> | www.guest-tek.com<http://www.guest-tek.com> The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

1 0