February 2014 - Freeradius-Users - lists.freeradius.org

status server
by nicolas.clo＠ricoh-industrie.fr 06 Feb '14

06 Feb '14

Hi List, I encountering a problem when i want load the virtual server "status" : i searched for a solution in conf file but i haven't found it. can anybody help me ? freeradius: FreeRADIUS Version 3.1.0 (git #65de468), for host i486-pc-linux-gnu, built on Feb 6 2014 at 12:57:04 server status { # from file /etc/freeradius/sites-enabled/status # Creating Autz-Type = Status-Server # Loading authorize {...} } # server status server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading virtual module split_domain_host # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Loading virtual module ssid # Loading virtual module log_eap_error } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 3812 } listen { type = "status" /etc/freeradius/sites-enabled/status[31]: No dictionary entry for protocol status Nicolas.

2 2

rlm_sql_sqlite issue on CentOS 6.x with sqlite3_create_function_v2
by stefan.paetow＠diamond.ac.uk 06 Feb '14

06 Feb '14

Hi Alan/Arran, We have discovered a problem with the SQLite module. During the compilation, you look for sqlite3_open_v2, but not for sqlite3_create_function_v2. On CentOS, the most recent version of SQLite is 3.6.20 (as per "sqlite3 -version"), and the sqlite3_create_function_v2 function was only added in version 3.7.3 as per http://freecode.com/projects/sqlite/releases/323290. In https://github.com/FreeRADIUS/freeradius-server/blob/f95aa0da8b512c4e36ab5b… you've wrapped the use of that function in a nice IFDEF, but I'm guessing the setting of that IFDEF needs to be updated to check for that function as well? : : checking for x86_64-redhat-linux-gnu-gcc... no checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for sqlite3_open in -lsqlite3... yes checking for sqlite3_open_v2 in -lsqlite3... yes checking for sqlite3.h... yes : : Without that check, we get this error: Could not link driver rlm_sql_sqlite: /usr/lib64/freeradius/rlm_sql_sqlite.so: undefined symbol: sqlite3_create_function_v2 Make sure it (and all its dependent libraries!)are in the search path of your system's ld. We discovered this as part of a Moonshot test. Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

2 4

Аccounting two databases
by Юрий Колесник 06 Feb '14

06 Feb '14

Hello! Have FreeRADIUS Version 2.1.10 and Oracle database. Is it possible to configure sql accounting is to write two different databases ? I need to duplicate accounting recording on two different servers .

2 1

Re: Does FreeRADIUS 2.1.12's ECDH support include ECDH-RSA-AES128-SHA?
by William M. Koos Jr. 05 Feb '14

05 Feb '14

I'm having exactly the same "no shared cipher" problem with freeradius 2.1.12 running under Centos6. Like you, I verified the suites on both ends and in the client hello message. Among the many (22) that are present on both ends and in the client hello I see cipher 0xc00a, ECDHE-ECDSA-AES256-SHA. Did you resolve the issue? Billy

1 0

Core dump on start of FR3.0.1
by Palmer J.D.F. 05 Feb '14

05 Feb '14

Hello, I've just compiled FR3.0.1 from source but it is core dumping on start-up, I have copied the debug output below. I'm using the same config as I was with FR3.0.0. Has anyone else encountered such issues? [root@radauth3 raddb]# pkill radiusd ; radiusd -XX Fri Jan 17 11:10:50 2014 : Info: radiusd: FreeRADIUS Version 3.0.1, for host i686-pc-linux-gnu, built on Jan 17 2014 at 11:06:21 Fri Jan 17 11:10:50 2014 : Debug: Server was built with: Fri Jan 17 11:10:50 2014 : Debug: accounting Fri Jan 17 11:10:50 2014 : Debug: authentication Fri Jan 17 11:10:50 2014 : Debug: ascend binary attributes Fri Jan 17 11:10:50 2014 : Debug: coa Fri Jan 17 11:10:50 2014 : Debug: control-socket Fri Jan 17 11:10:50 2014 : Debug: detail Fri Jan 17 11:10:50 2014 : Debug: dhcp Fri Jan 17 11:10:50 2014 : Debug: dynamic clients Fri Jan 17 11:10:50 2014 : Debug: proxy Fri Jan 17 11:10:50 2014 : Debug: regex-posix Fri Jan 17 11:10:50 2014 : Debug: session-management Fri Jan 17 11:10:50 2014 : Debug: stats Fri Jan 17 11:10:50 2014 : Debug: tcp Fri Jan 17 11:10:50 2014 : Debug: threads Fri Jan 17 11:10:50 2014 : Debug: tls Fri Jan 17 11:10:50 2014 : Debug: unlang Fri Jan 17 11:10:50 2014 : Debug: vmps Fri Jan 17 11:10:50 2014 : Debug: Server core libs: Fri Jan 17 11:10:50 2014 : Debug: talloc : 2.0.* Fri Jan 17 11:10:50 2014 : Debug: ssl : OpenSSL 1.0.0e-fips 6 Sep 2011 Fri Jan 17 11:10:50 2014 : Info: Copyright (C) 1999-2014 The FreeRADIUS server project and contributors Fri Jan 17 11:10:50 2014 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Fri Jan 17 11:10:50 2014 : Info: PARTICULAR PURPOSE Fri Jan 17 11:10:50 2014 : Info: You may redistribute copies of FreeRADIUS under the terms of the Fri Jan 17 11:10:50 2014 : Info: GNU General Public License Fri Jan 17 11:10:50 2014 : Info: For more information about these matters, see the file named COPYRIGHT Fri Jan 17 11:10:50 2014 : Info: Starting - reading configuration files ... Fri Jan 17 11:10:50 2014 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/mods-enabled/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/preprocess Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/detail Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/utf8 Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/detail.log Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/echo Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/soh Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/linelog Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/pap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/exec Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/always Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/ldap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/unix Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/passwd Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/files Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/realm Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/chap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/radutmp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/mschap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/replicate Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/dhcp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/logintime Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/expiration Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/digest Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/expr Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-enabled/sql Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/mods-config/sql/main/mysql/queries.conf Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/policy.d/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/accounting Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/operator-name Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/eap Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/filter Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/cui Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/control Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/dhcp Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/policy.d/canonicalization Fri Jan 17 11:10:50 2014 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/SetRealm.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/format-callstaid.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/poolacc.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/StripUserName.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/SetRealm.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/format-callstaid.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/dosomestuff.conf Fri Jan 17 11:10:50 2014 : Debug: including configuration file /usr/local/etc/raddb/scripts/poolacc.conf Fri Jan 17 11:10:50 2014 : Debug: main { Fri Jan 17 11:10:50 2014 : Debug: security { Fri Jan 17 11:10:50 2014 : Debug: allow_core_dumps = no Fri Jan 17 11:10:50 2014 : Debug: } Fri Jan 17 11:10:50 2014 : Debug: } Fri Jan 17 11:10:50 2014 : Debug: main { Fri Jan 17 11:10:50 2014 : Debug: name = "radiusd" Segmentation fault (core dumped) Many thanks, Jezz.

4 20

Problem with expire_on_login module and users with large connection periods
by Antonio Fernández Pérez 05 Feb '14

05 Feb '14

Hi list, Sorry, the last email had subject empty. I think that there are a mistake in sqlcounter_expire_on_login module with large uses. I have detected that users with three duration months could navigate more than three months. The problem is with the use of TIME_DIFF function that is limited to the range allowd for TIME's values. By default, TIME's range is '-838:59:59' to '838:59:59', thirty four days, more or less. So if you have a username of two months and this uses expre_on_login module, there are a problem! I have fixed the problem modifying the query on module file: I have replaced "TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))" by "TIMESTAMPDIFF(SECOND, acctstarttime, NOW())" and now works fine. Please, let me know if this is a bug in FreeRADIUS or If I have a mistake in my configuration (In MySQL or FreeRADIUS services). Thanks in advance. Regards, Antonio.

2 2

(no subject)
by Antonio Fernández Pérez 05 Feb '14

05 Feb '14

Hi list, I think that there are a mistake in sqlcounter_expire_on_login module with large uses. I have detected that users with three duration months could navigate more than three months. The problem is with the use of TIME_DIFF function that is limited to the range allowd for TIME's values. By default, TIME's range is '-838:59:59' to '838:59:59', thirty four days, more or less. So if you have a username of two months and this uses expre_on_login module, there are a problem! I have fixed the problem modifying the query on module file: I have replaced "TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))" by "TIMESTAMPDIFF(SECOND, acctstarttime, NOW())" and now works fine. Please, let me know if this is a bug in FreeRADIUS or If I have a mistake in my configuration (In MySQL or FreeRADIUS services). Thanks in advance. Regards, Antonio.

1 0

Authenticate users different Domain using LDAP group search
by Luis Diaz 05 Feb '14

05 Feb '14

Hi there! First of all, I'd like to thank everybody in this forum for the help you provide. This forum has been very helpful for me in order to deploy and make my FreeRADIUS server work. However, I'm facing a config problem that I couldn't solve just searching on this forum. So, I need a little bit of help with it. I'm running FreeRADIUS Version 2.2.0 and I've managed to make the server work to authenticate users against our AD. I'm using ntlm_auth + mschap + ldap. Everything works very fine with domain users. I have no problem. I use the ldap module in order to authenticate just some users inside specific groups and also, assigning the VLAN dynamically. The issue comes when I try to authenticate users from a different domain. I highlight that both domains share a trust relationship. I read on the forum that just configuring NTLM module adding the trusted domain would work, but for the moment, it doesn't work. I'll show you part of my config for this purpose: NTLM_AUTH Module: exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} --domain=%{%{mschap:NT-Domain}:-MAIN-DOMAIN} --domain=%{%{mschap:NT-Domain}:-TRUSTED-DOMAIN}--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } If I exec the command: ntlm_auth --request-nt-key --domain=TRUSTED-DOMAIN --username=USER-TURSTED-DOMAIN --password=******** NT_STATUS_OK: Success (0x0) As you can see, ntlm module works. However, when the request comes through the radius I get a prompt from ldap module saying "object (user) not found". This is the error from the debug output: [ldap] object not found rlm_ldap::ldap_groupcmp: search failed The user from the trusted domain is inside the same group for users from my domain. The ldap search works for user form my domain, but fails when it tries to search a user from the trusted domain. I guess the problem lies on the ldap module. However, I don't fully understand where the config problem can be. Any help would be appreciate it very much. Thank you so much in advance. And have a great day!

2 3

Wimax-AAA-Session-Id
by Khalid Tawfik Kasem 04 Feb '14

04 Feb '14

Dears, Is "WiMAX-AAA-Session-Id" generated by the NAS and sent to freeRADIUS or generated by freeRADIUS and sent to the NAS? Best Regards, Khaled Qasem

2 1

Virtual server clients collision
by Stanislav Lorenc 04 Feb '14

04 Feb '14

Hi, i have two (and more) virtual servers. Each server has own business logic, port and defined separate clients. I completely use SQL modules. Clients are stored in database. I have one client using two different freeradius virtual server First for ppp. Second for login into device. Adding client into NAS 1 : rlm_sql (overovani_sql): Read entry nasname=192.168.1.10,shortname=rb1_pentagon::wlan1::192.168.1.10,secret=heslo rlm_sql (overovani_sql): Adding client 192.168.1.10 (rb1_pentagon::wlan1::192.168.1.10, server=overovani) to clients list Adding client into NAS 2: lm_sql (auth_cernovice_net_sql): Read entry nasname=192.168.1.10,shortname=rb1_pentagon::wlan1::192.168.1.10,secret=cernovice_net_nas_device rlm_sql (auth_cernovice_net_sql): Adding client 192.168.1.10 (rb1_pentagon::wlan1::192.168.1.10, server=auth_cernovice_net) to clients list Failed to add duplicate client rb1_pentagon::wlan1::192.168.1.10 rlm_sql (auth_cernovice_net_sql): Released sql socket id: 4 rlm_sql (auth_cernovice_net_sql): Failed to add client 192.168.1.10 (rb1_pentagon::wlan1::192.168.1.10) to clients list. Maybe there's a duplicate? Virtual server name in debug message is right. I think, clients are shared between virtual servers. Clients aren`t duplicates. Clients has different passwords and are placed within different virtual servers. How I get separate client list? Regards, Stanislav Lorenc

2 1