March 2012 - Freeradius-Users - lists.freeradius.org

freeradius packages for RedHat Entreprise 6?
by Mohamed Lrhazi 13 Mar '12

13 Mar '12

Does anyone know why I can't find freeradius or freeradius2 rpms for RedHat Entreprise 6.x? Googling I found a document that seems to indicate they do have such rpms: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.1_Techn… But I cant seem to locate them in the normal channel! Thanks a lot, Mohamed.

2 1

[SOLVED] RE: Centos 6 Compile error
by David Peterson 13 Mar '12

13 Mar '12

Thanks for the expert advices guys! That worked like a charm. David -----Original Message----- From: freeradius-users-bounces+davidp=wirelessconnections.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+davidp=wirelessconnections.net@lists.freera dius.org] On Behalf Of David Peterson Sent: Tuesday, March 13, 2012 8:01 AM To: FreeRadius users mailing list Subject: RE: Centos 6 Compile error I am checking out the master, should I be using something earlier? David -----Original Message----- From: Fajar A. Nugraha [mailto:list@fajar.net] Sent: Tuesday, March 13, 2012 7:21 AM To: David Peterson-WirelessConnections; FreeRadius users mailing list Subject: Re: Centos 6 Compile error On Tue, Mar 13, 2012 at 6:12 PM, David Peterson <davidp(a)wirelessconnections.net> wrote: > Has anyone seen this error? I am not sure what might be missing: > > In file included from rlm_eap_pwd.h:37, > from rlm_eap_pwd.c:39: > eap_pwd.h:42:24: error: openssl/ec.h: No such file or directory You didn't mention which version you're compiling. 2.1.12 compiles just fine. Anyway, I'd start on that last line. You're probably missing openssl-devel or something similar (try "yum provides */ec.h") -- Fajar - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Centos 6 Compile error
by David Peterson 13 Mar '12

13 Mar '12

Has anyone seen this error? I am not sure what might be missing: In file included from rlm_eap_pwd.h:37, from rlm_eap_pwd.c:39: eap_pwd.h:42:24: error: openssl/ec.h: No such file or directory In file included from rlm_eap_pwd.h:37, from rlm_eap_pwd.c:39: eap_pwd.h:93: error: expected specifier-qualifier-list before 'EC_GROUP' rlm_eap_pwd.c: In function 'free_session': rlm_eap_pwd.c:143: error: 'pwd_session_t' has no member named 'private_value' rlm_eap_pwd.c:144: error: 'pwd_session_t' has no member named 'peer_scalar' rlm_eap_pwd.c:145: error: 'pwd_session_t' has no member named 'my_scalar' rlm_eap_pwd.c:146: error: 'pwd_session_t' has no member named 'k' rlm_eap_pwd.c:147: warning: implicit declaration of function 'EC_POINT_free' rlm_eap_pwd.c:147: warning: nested extern declaration of 'EC_POINT_free' rlm_eap_pwd.c:147: error: 'pwd_session_t' has no member named 'my_element' rlm_eap_pwd.c:148: error: 'pwd_session_t' has no member named 'peer_element' rlm_eap_pwd.c:149: warning: implicit declaration of function 'EC_GROUP_free' rlm_eap_pwd.c:149: warning: nested extern declaration of 'EC_GROUP_free' rlm_eap_pwd.c:149: error: 'pwd_session_t' has no member named 'group' rlm_eap_pwd.c:150: error: 'pwd_session_t' has no member named 'pwe' rlm_eap_pwd.c:151: error: 'pwd_session_t' has no member named 'order' rlm_eap_pwd.c:152: error: 'pwd_session_t' has no member named 'prime' rlm_eap_pwd.c: In function 'eap_pwd_initiate': rlm_eap_pwd.c:245: error: 'pwd_session_t' has no member named 'private_value' rlm_eap_pwd.c:246: error: 'pwd_session_t' has no member named 'peer_scalar' rlm_eap_pwd.c:247: error: 'pwd_session_t' has no member named 'my_scalar' rlm_eap_pwd.c:248: error: 'pwd_session_t' has no member named 'k' rlm_eap_pwd.c:249: error: 'pwd_session_t' has no member named 'my_element' rlm_eap_pwd.c:250: error: 'pwd_session_t' has no member named 'peer_element' rlm_eap_pwd.c:251: error: 'pwd_session_t' has no member named 'group' rlm_eap_pwd.c:252: error: 'pwd_session_t' has no member named 'pwe' rlm_eap_pwd.c:253: error: 'pwd_session_t' has no member named 'order' rlm_eap_pwd.c:254: error: 'pwd_session_t' has no member named 'prime' rlm_eap_pwd.c:294: warning: pointer targets in passing argument 1 of 'strcpy' differ in signedness /usr/include/string.h:128: note: expected 'char * __restrict__' but argument is of type 'unsigned char *' rlm_eap_pwd.c: In function 'eap_pwd_authenticate': rlm_eap_pwd.c:436: warning: pointer targets in passing argument 2 of '__builtin_strncpy' differ in signedness rlm_eap_pwd.c:436: note: expected 'const char *' but argument is of type 'unsigned char *' rlm_eap_pwd.c:525: warning: implicit declaration of function 'EC_POINT_get_affine_coordinates_GFp' rlm_eap_pwd.c:525: warning: nested extern declaration of 'EC_POINT_get_affine_coordinates_GFp' rlm_eap_pwd.c:525: error: 'pwd_session_t' has no member named 'group' rlm_eap_pwd.c:526: error: 'pwd_session_t' has no member named 'my_element' rlm_eap_pwd.c:536: error: 'pwd_session_t' has no member named 'order' rlm_eap_pwd.c:537: error: 'pwd_session_t' has no member named 'prime' rlm_eap_pwd.c:545: error: 'pwd_session_t' has no member named 'prime' rlm_eap_pwd.c:548: error: 'pwd_session_t' has no member named 'prime' rlm_eap_pwd.c:549: error: 'pwd_session_t' has no member named 'prime' rlm_eap_pwd.c:552: error: 'pwd_session_t' has no member named 'prime' rlm_eap_pwd.c:553: error: 'pwd_session_t' has no member named 'order' rlm_eap_pwd.c:553: error: 'pwd_session_t' has no member named 'my_scalar' rlm_eap_pwd.c:554: error: 'pwd_session_t' has no member named 'my_scalar' rlm_eap_pwd.c:575: error: 'pwd_session_t' has no member named 'my_confirm' rlm_eap_pwd.c:588: error: 'pwd_session_t' has no member named 'my_confirm' gmake[9]: *** [rlm_eap_pwd.lo] Error 1 gmake[8]: *** [rlm_eap_pwd] Error 2 gmake[7]: *** [all] Error 2 gmake[6]: *** [types] Error 2 gmake[5]: *** [rlm_eap] Error 2 gmake[4]: *** [all] Error 2 gmake[3]: *** [modules] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [src] Error 2 make: *** [all] Error 2 David

4 5

Conditional attributes with AD
by Scott McLane Gardner 13 Mar '12

13 Mar '12

I've successfully gotten AD auth working, and now I'd like to be able to assign VLAN's based on group membership, but I'm having a hard time figuring out where and how to do that. Where do I put the "if" statements to check group membership? Does AD auth even work like this, or do I need to be using LDAP auth? Thank you, -Scott

5 14

Re: Freeradius crashes everyday
by Morteza Milani 13 Mar '12

13 Mar '12

@Tim et al: Actually running radius -X is not possible because It generates a lot of output and I don't know when it goes into sleep. It may take a day or more. Can you read that long log?!! @Phil I'm using 2.1.11 according to VERSION file. Is that too old? Yes I use mysql for accounting. But mysql works just fine. I don't know how to use that tools you mentioned. May I ask you for a good guide/tutorial link on how to use them? > Which version are you running? > What sort of config do you have - do you do any proxying? SQL? LDAP? > As others have said, you should run it in debug mode - "radiusd -X" and > see what happens. However, you may find this generates a lot out output > before it stops working, so investigate other tools to inspect the > "sleeping" daemon - gdb, strace, etc. > > I'm betting you're running an older version with bugs in it. 2.1.12 is > the latest.

3 2

[pap] Found unknown header {{MD4}}: Not doing anything
by Mohamed Lrhazi 13 Mar '12

13 Mar '12

Hello, My LDAP server has the passwords stored in MD4 encoded format, which I am suspecting is the same as NT format... Is there a way to tell freeradius to treat {MD4} as it it was {NT} ? I am using: radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Jan 5 2012 at 18:31:23 Thanks a lot, Mohamed.

2 2

Freeradius crashes everyday
by Morteza Milani 13 Mar '12

13 Mar '12

Hi, I don't know what's wrong with freeradius. It's running but does not handle authentication requests. After restarting, it works fine but after a while it goes to sleep;) Does freeradius log details somewhere to see what happens?

4 3

Add Users in MySQL database
by Fabricio Flores 12 Mar '12

12 Mar '12

Hi everyone... I have a little problem... I want to add users in the MySQL database, but before everything (before AAA) what module i need to edit o configuring to add a script that manage the mysql? -- Fabricio A. Flores G.

1 0

Unknown Auth-Type "LDAP" in authenticate sub-section
by up＠3.am 12 Mar '12

12 Mar '12

Hi: Trying to set up a new RADIUS 2.1.12 server with LDAP. It configured and built all the modules I need, including rlm_ldap, once I installed the dependencies. I took all of the same config files that I have working on servers running 2.1.9 and 2.1.10, but 2.1.12 rlm_ldap doesn't seem to finish instantiating. Here's most of the debug: FreeRADIUS Version 2.1.12, for host x86_64-unknown-linux-gnu, built on Mar 8 2012 at 21:44:43 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/etc/raddb/radiusd.conf including configuration file /usr/etc/raddb/clients.conf including configuration file /usr/etc/raddb/eap.conf including configuration file /usr/etc/raddb/policy.conf including files in directory /usr/etc/raddb/sites-enabled/ including configuration file /usr/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/etc/raddb/sites-enabled/default main { user = "root" group = "wheel" allow_core_dumps = no } including dictionary file /usr/etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/usr/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/usr/var/run/radiusd" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 5 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { <SNIP CLIENTS> radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/etc/raddb/radiusd.conf exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/etc/raddb/radiusd.conf Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/etc/raddb/radiusd.conf expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/etc/raddb/radiusd.conf logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /usr/etc/raddb/radiusd.conf modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/etc/raddb/radiusd.conf pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/etc/raddb/radiusd.conf Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/etc/raddb/radiusd.conf mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_pam Module: Instantiating module "pam" from file /usr/etc/raddb/radiusd.conf pam { pam_auth = "radiusd-auth" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/etc/raddb/radiusd.conf unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating module "ldap1" from file /usr/etc/raddb/radiusd.conf ldap ldap1 { server = "ldap1.domain.com" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=domain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = no } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap1-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 rlm_ldap: reading ldap<->radius mappings from file /usr/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP shadowMax mapped to RADIUS Shadow-Max-Age rlm_ldap: LDAP shadowLastChange mapped to RADIUS Shadow-Last-Change rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x958cf20 Module: Instantiating module "ldap2" from file /usr/etc/raddb/radiusd.conf ldap ldap2 { server = "ldap2.domain.com" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=domain,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/usr/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = no } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap2-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 rlm_ldap: reading ldap<->radius mappings from file /usr/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password <SNIP most attr maps> rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x958f390 /usr/etc/raddb/sites-enabled/default[241]: Unknown Auth-Type "LDAP" in authenticate sub-section.

5 16

Is this a possible project?
by 甄鹏 12 Mar '12

12 Mar '12

Hello Everybody: Recently,I got a project,it requires set a Radius Server in the company,and 100 APs in 100 Restarants in the city,all the APs of course connected to its own router. I want to the customers who want to use wifi in any of these restarant need to get authentication through the Radius Server locate in my company rather than the traditional wpa/wpa2 ways. for honestly,i am new to freeRadius,i even not really sure if is it a possible project? The radius server could have a static WAN ip address,but all the APs could only got a LAN ip address like 192.168.*.*,when I set up the freeRadius+Mysql system,how could i distinguish different AP?because,i know in the LAN,i set the IP address for different AP for the nasname option in nas.sql. sorry for too many questions here, thank you in advanced Joey

3 2