September 2018 - Freeradius-Users - lists.freeradius.org

Problem connecting oracle database with odbc connector
by Saurabh Lahoti 20 Sep '18

20 Sep '18

Hi, While debugging freeradius build, following error is interpreted with odbc connector: rlm_sql_unixodbc: IM002 [unixODBC][Driver Manager]Data source name not found and no default driver specified rlm_sql_unixodbc: Connection failed rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sqlADSL): Opening connection failed (0) rlm_sql (sqlADSL): Removing connection pool /usr/app/radius/etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sqlADSL" My SQL config is as below: sql sqlADSL { driver = "rlm_sql_unixodbc" server = "RadiusDbProd" port = 3306 login = "radius" password = <<< secret >>> radius_db = "RADSP01" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "" logfile = "/usr/app/Radiuslogs/anathana/sqltrace_ADSL.sql" default_user_profile = "" client_query = "SELECT id,nasname,shortname,type,secret FROM nas" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = ".query" type { accounting-on { } accounting-off { } start { } interim-update { } stop { } } } post-auth { reference = ".query" } } Could you help please..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

2 1

Re: Freeradius-LDAP module failed to compile
by Saurabh Lahoti 19 Sep '18

19 Sep '18

Hi , Many thanks..!! Solved. ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

1 0

Freeradius-LDAP module failed to compile
by Saurabh Lahoti 19 Sep '18

19 Sep '18

Hi, While compiling freeradius, ldap module failed to build with below error interpreted with configure: === configuring in src/modules/rlm_ldap (/home/u5496622/freeradius-server-release_3_0_17/src/modules/rlm_ldap) configure: running /bin/sh ./configure --disable-option-checking '--prefix=/usr/app/radius' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for ldap_init in -lldap... no checking for ldap_init in -lldap in /usr/local/lib... no checking for ldap_init in -lldap in /opt/lib... no checking for ldap.h... no checking for ldap.h in /usr/local/include/... no checking for ldap.h in /opt/include/... no checking for sasl/sasl.h... no checking for sasl/sasl.h in /usr/local/include/... no checking for sasl/sasl.h in /opt/include/... no configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap ldap.h. configure: creating ./config.status config.status: creating all.mk config.status: creating config.h config.status: config.h is unchanged Which additional package is needed to complete ldap build..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

3 3

Installing from RPM with Samba4
by Norman Elton 19 Sep '18

19 Sep '18

Hi, First, apologies for what is more a RPM/YUM problem than a FreeRADIUS problem. I've been using the RedHat-supplied RPMs for many years on our RHEL6 servers, but am trying to move toward networkradius-supplied packages, in order to keep up to date with more recent FreeRADIUS releases. We currently have the samba4 packages installed: # rpm -qa | grep samba samba4-winbind-clients-4.2.10-15.el6.x86_64 samba4-libs-4.2.10-15.el6.x86_64 samba4-winbind-4.2.10-15.el6.x86_64 samba4-common-4.2.10-15.el6.x86_64 samba4-4.2.10-15.el6.x86_64 The samba4-libs package provides /usr/lib64/samba/libwbclient.so.0. When I try to install the newer version of FreeRADIUS, it's not happy with this dependency, and tries to install samba-winbind-clients, resulting in a conflict: --> Processing Dependency: libwbclient.so.0()(64bit) for package: freeradius-3.0.17-2.el6.x86_64 ---> Package samba-winbind-clients.x86_64 0:3.6.23-51.el6 will be installed Error: samba4-common conflicts with samba-common-3.6.23-51.el6.x86_64 Looking at the specfile on github, I see this nugget: %{?el7:Requires: libwbclient} %{?el6:Requires: samba4-libs} %{?el6:Requires: samba4-winbind-clients} Since I'm RHEL6, I'm not sure where the libwbclient dependency is coming from. Using repoquery, I can show the requirements of freeradius: # repoquery --requires freeradius | grep libwbclient libwbclient.so.0()(64bit) libwbclient.so.0(WBCLIENT_0.12)(64bit) libwbclient.so.0(WBCLIENT_0.9)(64bit) And what samba4-libs provides: # repoquery --provides samba4-libs | grep libwbclient libwbclient.so.0(SAMBA_4.2.10)(64bit) libwbclient.so.0(WBCLIENT_0.10)(64bit) libwbclient.so.0(WBCLIENT_0.11)(64bit) libwbclient.so.0(WBCLIENT_0.12)(64bit) libwbclient.so.0(WBCLIENT_0.9)(64bit) They're not quite the same, and I'm not sure what the part inside the parentheses actually does. All that said ... any ideas how to install FreeRADIUS alongside samba4? Thanks Norman

3 9

sending Group-Name in accounting Packets to FortiGate
by Somanath Mishra 18 Sep '18

18 Sep '18

Hi, I am forwarding accounting packets to fortiGate , but Group-Name is missing in this packet. Group-Name is coming in radacct table. So to show Group-Name i modified radacct table, after that it showed. So same need to do , i guess. Can you suggest where need to modify to get Group-Name in forwarding packet?

2 3

attr_rewrite replaced by ulang
by Gabriel Marais 18 Sep '18

18 Sep '18

Hi Guys We are in the process of setting up a test environment so we can migrate from 2.x to 3.x Reading the documentation, attr_rewrite is obsolete and should be replaced by ulang... I have this in my sites-available/default authorized { realmchange ... } realmchange is referenced back to:- attr_rewrite realmchange { attribute = realm searchin = packet searchfor = ".+" replacewith = %{Called-Station-Id} maxmatches = 1 new_attribute = yes } 1. How do I write this in ulang? 2. Do I put the ulang section under authorize { ... } section? Many thanks, Gabriel

2 1

Could not link driver rlm_sql_unixodbc
by Saurabh Lahoti 18 Sep '18

18 Sep '18

Hi, While compiling freeradius 3.0.17 with sql & perl, below error interpreted with debug mode: Could not link driver rlm_sql_unixodbc: /usr/app/radius/lib/rlm_sql_unixodbc.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld Which additional package needs to be installed for unixodbc module..? ---- *Thanks & Kind Regards,* Saurabh LAHOTI. *Ideas enlighten Innovation**!!!* Please consider the environment before printing this mail..!!

2 1

LDAP-UserDN is not unique per ldap module instance (auth problem when multiple ldap module instances used)
by Kostas Zorbadelos 17 Sep '18

17 Sep '18

Hello all, in my current authentication policy, I use 2 instances of the LDAP module. The first instance queries the directory in a specific branch and gets information used in later checks. The other instance is used to authorize the user (and also authenticate him in some rare situations) and queries another branch. The problem is that when the second LDAP module is used for the authentication, it tries to bind with an LDAP-UserDN attribute obtained from the first module. I need to rewrite control:LDAP-UserDN for this to work. Tracing a bit the source, I saw that LDAP-UserDN is set with the '=' operator: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/src/modules/rlm… Is this by design? I would expect each module instance to have its own LDAP-UserDN and use that when used in authentication. Am I missing something, or is this something worth of raising a github issue? Regards, Kostas -- Kostas Zorbadelos http://gr.linkedin.com/in/kzorba

2 8

Receive EAP and proxy out with PEAP
by Christian Salway 16 Sep '18

16 Sep '18

Hello, My client doesn't support PEAP but the NPS server is configured to only use PEAP, so I was wondering if freeRadius could be used as a proxy to receive EAP-MSCHAPv2 and proxy using PEAP-MSCHAPv2? Thanks,Christian

2 1

Authenticating against Active Directory using winbind
by Christoffer Jönsson 15 Sep '18

15 Sep '18

Hello! I used this guide a year ago to enable 802.1x on my switches and APs and it worked without any problems to authenticate to my Samba4 AD/DC: https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind. Today I am having trouble getting it to work because it wont accept the password when running this command or connecting from switches: "radtest -t mschap adtest Password1 127.0.0.1 0 testing123". And winbind returns this result: "NTLM CRAP authentication for user [auth.chrjsn.se]\[adtest] returned NT_STATUS_WRONG_PASSWORD". But running this command, it authenticates with this result: ntlm_auth --username=adtest --domain=auth.chrjsn.se Password: NT_STATUS_OK: Success (0x0): "Plain-text authentication for user AUTH.CHRJSN.SE\adtest returned NT_STATUS_OK (PAM: 0)" Radiusd reports that password has expired, when it has not. I have reset the password for adtest and administrator with same results. I don't know if there's any new settings or something and I'm really stuck here. It also doesn't matter which version of samba/freeradius I'm using. Thanks!

4 10