- Freeradius-Users - lists.freeradius.org

git timeout
by tolik_shavlovsky＠mail.ru 09 Dec '11

09 Dec '11

Hi, i am making procedure for Alvarion IOT. freebsd# /usr/local/bin/git clone git://git.freeradius.org/freeradius-server.git Cloning into freeradius-server... git.freeradius.org[0: 88.190.25.44]: errno=Operation timed out fatal: unable to connect a socket (Operation timed out) are there other way? thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/git-timeout-tp5058438p5058438.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 11

Problem with accounting and sql
by Paul Thornton 09 Dec '11

09 Dec '11

Hi I've been trying to debug why accounting information isn't making it into the SQL database on our main FR server (2.1.11) - it seems that this has been the case since upgrading from version 1.something ancient a few months back. I have a fairly simple MySQL backed setup - and minimal changes of the config files to enable this; just to be clear this was a fresh install of the OS + FreeRADIUS so no danger of old configuration files still lurking around. sql is uncommented in both the authorization and accounting sections of the sites-available/default file (accounting section shown below), and the sql module is enabled in radiusd.conf - the server works just fine for auth via SQL as can be seen in the debug. accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # # If you receive stop packets with zero session length, # they will NOT be logged in the database. The SQL module # will print a message (only in debugging mode), and will # return "noop". # # You can ignore these packets by uncommenting the following # three lines. Otherwise, the server will not respond to the # accounting request, and the NAS will retransmit. # # if (noop) { # ok # } # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # Cisco VoIP specific bulk accounting # pgsql-voip # For Exec-Program and Exec-Program-Wait exec # Filter attributes from the accounting response. attr_filter.accounting_response # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } I can see accounting requests being received, but there seems to be no sql module action happening to insert them into the database; but I cannot see why from the debug. I've not changed any of the pre-defined SQL queries. The debug log attached (it was a bit big to post inline) has had three minor hand-amendments: - SQL server password removed. - Shared secret for the two clients removed. - The very long list of clients loaded from SQL reduced to the router being tested. Any pointers/suggestions gratefully received. Regards, Paul.

2 2

Radius Client vs. Radius Client-NG
by Nick Khamis 09 Dec '11

09 Dec '11

Hello Everyone, When installing the client, some documentation point to: radiusclient-ng 0.5.6: http://developer.berlios.de/projects/radiusclient-ng/, and freeradius-client-1.1.6.tar: ftp://ftp.freeradius.org/pub/freeradius/ Is there a difference between the two? Is one recommended or have benefits over the other? Thanks in Advance, Nicholas.

3 2

FreeRADIUS with LDAP Support
by Nick Khamis 08 Dec '11

08 Dec '11

Hello Everyone, I tried to compile FreeRADIUS with LDAP support however, rlm_ldap has not been compiled. Are libldap-2.4-2 libldap-dev not sufficent? Do I need to install OpenLDAP? Thanks in Advance, Nick.

4 4

Linking Shared/Static library in Freeradius Module
by Resit Sahin 08 Dec '11

08 Dec '11

Hello, I am writing a FreeRadius (Version 2) module for version Freeradius 2.1.10 . The module works fine. When i want to link a shared/static library from the Makefile of the module i get errors. I link to a static library and i run radius server with the module ( radiusd -X) then i get the error: /usr/local/etc/raddb/radiusd.conf[665]: Failed to link to module 'rlm_itap': file not found makefile of the freeradius module : *VERS = 2.1.10 CFLAGS = -DNDEBUG -Wall -I/usr/include \ -I/usr/ports/net/freeradius2/work/freeradius-server-$(VERS)/src LIBS = -lc -L. icc-wrapper.a ALL: rlm_itap.o rlm_itap-$(VERS).so* rlm_itap is the name of my module. When i remove *icc-wrapper.a , everything works fine. *For the shared library case. Everything works fine until the function from the shared library is called inside the module. I got the error: /libexec/ld-elf.so.1: /usr/local/lib/freeradius-2.1.10/rlm_itap.so: Undefined symbol "sendiccmsg" in that case. sendiccmsg is the only function i have in my shared library. The makefile of the freeradius module: VERS = 2.1.10 CFLAGS = -DNDEBUG -Wall -I/usr/include \ -I/usr/ports/net/freeradius2/work/freeradius-server-$(VERS)/src LIBS = -lc icc-wrapper.so ALL: rlm_itap.o rlm_itap-$(VERS).so rlm_itap.o: rlm_itap.c cc -g -fPIC -DPIC -c $(CFLAGS) rlm_itap.c rlm_itap-$(VERS).so: rlm_itap.o cc -g -shared -Wl,-soname,rlm_itap-$(VERS).so \ -o rlm_itap-$(VERS).so rlm_itap.o $(LIBS) install: ALL install rlm_itap-$(VERS).so /usr/local/lib/freeradius-$(VERS) ln -fs rlm_itap-$(VERS).so /usr/local/lib/freeradius-$(VERS)/rlm_itap.so clean: rm rlm_itap*.o rlm_itap*.so The static/shred library i am using is compiled as a C++ library with extern "C" in front of function definitions. Regards Resit Sahin

5 11

Re: Getting NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) when using ntlm_auth
by Alan Buxey 08 Dec '11

08 Dec '11

You certainly dont need to set anything in your users file for 802.1X with an AD backend As already stated, where is your radiusd -X ? alan

3 10

Re: run radius in debug mode with screen
by Коньков Евгений 08 Dec '11

08 Dec '11

Hi, Alan > > while using this verion > FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.1, built on Jan 6 2009 at 10:52:08 > I can run radius as > /usr/local/bin/screen -d -m /usr/bin/nice -n -20 /r/radiusd debug >> What is "/r/radiusd debug" ? radiusd - is rc script in freebsd. actually it is /usr/local/etc/rc.d/radiusd debug ... extra_commands="reload debug" radiusd_debug() { radiusd_flags="-X ${radiusd_flags}" run_rc_command start } # ps ax | grep radiusd 51082 1 S 14:17.69 /usr/local/sbin/radiusd -X > but with > FreeRADIUS Version 2.1.10, for host i386-portbld-freebsd9.0, built on Nov 28 2011 at 00:20:11 > > it exit without any messages. > > Can you help me please to resolve this problem? >> Use the documented command-line options. problem is that that 'radiusd -X' is detached from stdout so now it is impossible to run it in screen =( radiusd: FreeRADIUS Version 2.1.10 uname -a FreeBSD flux 9.0-CURRENT FreeBSD 9.0-CURRENT #4: Fri Jun 10 01:30:12 UTC 2011 :/usr/obj/usr/src/sys/PAE_KES i386 in this radiusd: FreeRADIUS Version 2.1.3 I can run radius in screen -- С уважением, Коньков mailto:kes-kes@yandex.ru

4 5

FreeRadius, Active Directory, LDAP Authorization
by suggestme 08 Dec '11

08 Dec '11

Hi, I have installed FreeRadius server 2.1.12, installed and configured Kerberos, Samba; configured ntlm_auth program for FreeRadius Authentication with Active Directory. Everything is successful and running smoothly till this stage. Now, I am in the phase of configuration of Authorization in FreeRadius. For Authorization process I want to use LDAP database which is already up and running in another server (not in the server where FreeRadius is installed). The authorization should be granted in such a way that some users should be allowed/restricted VPN, some should be allowed/restricted wifi, etc....... I am not sure whether this is the best way to do Authorization using LDAP or not because it is first time I am trying this in FreeRadius. After changing the configuration as mentioned below and running FreeRadius in debug mode, I get successful "Ready to process requests" but while supplying user credentials I get rad_recv: *Access-Reject *packet from host 127.0.0.1 port 1812, id=60, length=20. What I have done so far is: I uncommented the "LDAP" in authorize section of both files /usr/local/etc/raddb/sites-enabled/default and /usr/local/etc/raddb/sites-enabled/inner-tunnel. I have changed the configuration in /usr/local/etc/raddb/modules/ldap accordingly as: (Some parts are left blank for privacy) ldap { server = "*My ldap server name*" identity = "cn= ,dc= ,dc= " password = basedn = "dc= ,dc= " filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap edir_account_policy_check = no } In /usr/local/etc/raddb/users file: DEFAULT Auth-Type = ntlm_auth bob Cleartext-Password := "hello" I havn't done any change in Authenticate section of both /usr/local/etc/raddb/sites-enabled/default and /usr/local/etc/raddb/sites-enabled/inner-tunnel files related to LDAP. I have listed authenticate section of ntlm_auth by following deployingradius.com. But while following *"rlm_ldap"* doc I have seen that it is mentioned: LDAP and Active Directory ------------------------- *You can only use PAP, and then only if you list "ldap" in the "authenticate" section.* Does this mean I need to list ldap in authenticate section also. If I list it, what about ntlm_auth that is already enabled for authentication. I am confused with this. Should I need to install openldap & openssl also in the machine where freeradius is installed to make LDAP authorisation work properly? Please suggest me whether the configuration & process I am following related to LDAP is the good way to do or not. If not what is the best way to achieve it. Any documentation/site/thread suggestion regarding this would be greately appreciated. Thanks, -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRadius-Active-Directory-LDAP-Au… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 7

packet in freeradius
by Harish Mandowara 08 Dec '11

08 Dec '11

Hi all, After authentication by Freeradius each and every packet is going through server. Or after authentication access point or router will handle all this thing. -- Warm Regards Harish Mandowara -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Re: Getting NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) when using ntlm_auth
by Alan Buxey 07 Dec '11

07 Dec '11

The freeradius daemon reads ALL files in the modules directory. You have duplicates and eg .rpmnew . Remove those and things may just work nicely for you alan -- Message may be brief as it has been sent from my mobile

1 0