- Freeradius-Users - lists.freeradius.org

Time and traffic limits
by Mobin Yazarlou 28 Aug '11

28 Aug '11

Hello, I have the following user in the database: mysql> SELECT * FROM radcheck; +----+----------+--------------------+----+---------+ | id | username | attribute | op | value | +----+----------+--------------------+----+---------+ | 1 | sqltest | Cleartext-Password | := | testpwd | | 2 | sqltest | Max-All-Session | := | 600 | +----+----------+--------------------+----+---------+ 2 rows in set (0.00 sec) Well, freeRADIUS should allow this user to connect and stay online for 10 minutes but I can't even connect. Here is the freeRADIUS debug log: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host xx.xx.72.127 port 33451, id=15, length=135 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "sqltest" MS-CHAP-Challenge = 0xd237c3a9ecf61e669d362193cfb6b33b MS-CHAP2-Response = 0x6600d5135b141fa0f0fb3671adef9107716a000000000000000061a6f1db763fb3554c35008e7dec3f57936ca9ca1d2375b7 NAS-IP-Address = 127.0.1.1 NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "600" for attribute name "Max-All-Session" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sqltest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 15 to xx.xx.72.127 port 33451 Waking up in 4.9 seconds. Cleaning up request 0 ID 15 with timestamp +25 Ready to process requests. rlm_sql: Failed to create the pair: Invalid octet stringrad_recv: Access-Request packet from host xx.xx.72.127 port 40062, id=16, length=135 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "sqltest" MS-CHAP-Challenge = 0x6214c3aad82e064f6e9118c3aa9751d2 MS-CHAP2-Response = 0x280073eab0bdcb6b149e34b5d5a3be5dd7dc0000000000000000c9652cb77bbd8cf74273f9aa924c7dbe8b6a53968ffb7c6a NAS-IP-Address = 127.0.1.1 NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "600" for attribute name "Max-All-Session" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sqltest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 16 to xx.xx.72.127 port 40062 Waking up in 4.9 seconds. Cleaning up request 1 ID 16 with timestamp +93 Ready to process requests. rad_recv: Access-Request packet from host xx.xx.72.127 port 40203, id=17, length=135 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "sqltest" MS-CHAP-Challenge = 0x470c8b8089c5b8a4a322d16b51ab1a91 MS-CHAP2-Response = 0x3300c3bac8e9819c7a7e962f3611fad2cda20000000000000000c8e0d842bdff8a8183104ac176bb16835ea6626028a146da NAS-IP-Address = 127.0.1.1 NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id rlm_sql: Failed to create the pair: Invalid octet string "600" for attribute name "Max-All-Session" rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 1 ++[sql] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sqltest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 17 to xx.xx.72.127 port 40203 Waking up in 4.9 seconds. Cleaning up request 2 ID 17 with timestamp +469 Ready to process requests. I was so happy that I could install freeRADIUS last week! I can't disconnect users using freeRADIUS cause there is no NAS in my network and if I can't get time and traffic limits to work I would have to code a script to do it myself maybe. I would be thankful if someone helps to work it out. PS: I have just noticed that radacct table is empty. I had the session logs in this table when pptpd and freeRADIUS servers where on the same machine but I can't see anything in this table now. Do I have to setup something on the pptpd server to have to session logs in freeRADIUS database?

1 0

authenticate realm no matter what username is
by Barry Murphy 27 Aug '11

27 Aug '11

Hey guys, We're an ISP providing ADSL services ourselves and on behalf of our wholesalers. I have a bunch of realms that are LOCAL and proxied which work with no issues. I'm trying to add realms of competitors to our radius so when customers are migrated from our competitors to our network they get authenticated and I drop them into a VRF displaying to them they need to change their login details. I've already got the VRF working, the forwarder page etc, I just can't seem to get users to authenticate with a wildcard *(a)dsl.competitor.co.nz I have tried the following varies in users file… DEFAULT User-Name =~ "~*\\.xnet\\.co\\.nz$" Auth-Type := Accept, Pool-Name := un-auth, Service-Type = Framed-User, Framed-Protocol = PPP, Cisco-Avpair += "ip:vrf-id=Suspended", Cisco-Avpair += "ip:ip-unnumbered=Loopback 1000", Cisco-Avpair += "ip:dns-servers=14.1.33.1 120.136.0.25" DEFAULT Realm == "ihug.co.nz", Auth-Type := Accept None work and all look for a username. So in the above scenarios I want anything(a)dsl.xnet.co.nz or whatever(a)ihug.co.nz to authenticate and be assigned an IP address from the pool and dropped into the vrf Suspended where I do my tricks based on their IP address to display a splash page advising the customer its time to modify their username & password on their router. I've found many examples based on MAC authentication but none that work unfortunately. Any help would be much appreciated Thanks Barry

2 2

sql and xlat in authorize section
by Sébastien Barbereau 26 Aug '11

26 Aug '11

Hi, I am trying to do mac authorization as per http://wiki.freeradius.org/Mac-Auth#Mac-Auth+authorisation+by+SSID+SQL In fact my attempt is much simpler as I just have a very simple table containing the mac address of system to accept. My conf looks like that: authorize { ... # newer authorized macs if("%{sql_local:SELECT COUNT(mac) FROM authorized_macs WHERE mac ='%{Calling-Station-ID}'}" > 0){ update control { Auth-Type := Accept } ok = return } ... } But when doing an authentication attemp I get the following in the debug logs : ... Thu Aug 25 16:52:56 2011 : Info: ++? if (ok) -> FALSE Thu Aug 25 16:52:56 2011 : Info: ++? if ("%{sql_local:SELECT COUNT(mac) FROM authorized_macs WHERE mac ='%{Calling-Station-ID}'}" > 0) Thu Aug 25 16:52:56 2011 : Info: WARNING: Unknown module "sql_local" in string expansion "%" Thu Aug 25 16:52:56 2011 : Info: ? Evaluating ("%{sql_local:SELECT COUNT(mac) FROM authorized_macs WHERE mac ='%{Calling-Station-ID}'}" > 0) -> FALSE Thu Aug 25 16:52:56 2011 : Info: ++? if ("%{sql_local:SELECT COUNT(mac) FROM authorized_macs WHERE mac ='%{Calling-Station-ID}'}" > 0) -> FALSE ... As far as I can understand the documentation this should be working ( http://wiki.freeradius.org/Rlm_sql#SQL+xlat) Any helpful hand which can bring some light to the darkness of my intellect? Cheers, seb.

2 4

A trick for configuring freerad to authenticate multiple NAS with dynamic IPs
by Grace M. 26 Aug '11

26 Aug '11

Guyz, I have FreeRADIUS Version 2.1.10 working with mysql to authenticate uses connected to a number of NAS(s). Now, I would like to authenticate NAS(s) which should connect to my freerad from other networks (outside my lan) which have dynamic IPs. Anyone with a trick on how to configure clients.conf for that? Regards Grace

3 5

Packet Fence web interface and freeradius users
by Marlon Bastida 26 Aug '11

26 Aug '11

Hi, I have 3 radius users working on freeradius. I will give one sample: On /etc/raddb/users test Cleartext-Password:="test" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "2" When I enter with this user credentials on Xp client 802.1X auth they give to the proper VLAN assigned. For example I have VLAN-ID = 2 - registration, 3 - isolation, 5 - guests, 10 - normal. So with the statement Tunnel-Private-Group-ID = VLAN-ID, I can't get succesfully put a user on the proper VLAN, in this case above entered on registration VLAN. If anyone has acknowledge with Packet Fence solution I would like some help to integrate these users with web interface of Packet Fence 2.1.0. So I can get on the Violation Tab (isolation VLAN) an user or Node Tab (guests VLAN). Tks in advance, Marlon

2 2

Authentication probation for VLAN
by joaocdc＠gmail.com 26 Aug '11

26 Aug '11

Hello, I am using freeradius to authenticate to multiple databases, some in other LDAP in SQL. I am doing authentication and wireless networks, where I have multiple SSIDs for wireless networks, and each one logs in a database. All these databases are in the same Radius server, which differentiate based authentication used by the users of the Realm, running as follows: authorize { ... if (Realm == "fpti") { ldap_fpti } if ( Realm == "pti") { ldap_pti } if ( Realm == "visitantes") { sql_visitantes } ... } This model is funcionaç, however have a problem (very serious), Radius does not know from which SSID the client is trying to authenticate, or whether it decides the basis solely of the Realm authentication of the client. I need to make the Radius check the VLAN that is associated with the request for user authentication. Check through the debug radius that an Access-Request packet has the following information: ... rad_recv: Access-Request packet from host 192.168.254.48 port 32769, id=204, length=184 User-Name = "joao@fpti" Calling-Station-Id = "68-a3-c4-85-c5-89" Called-Station-Id = "00-26-cb-94-65-60:FPTI" NAS-Port = 29 NAS-IP-Address = 192.168.254.48 NAS-Identifier = "WLC-PTI" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 * Tunnel-Private-Group-Id:0 = "5"* EAP-Message = 0x020500061500 State = 0xfd87ee8cfe82fb655b300470157cca59 Message-Authenticator = 0xb9a2c29a193593e8f1165dc71ab487c1 # Executing section authorize from file /etc/freeradius/sites-enabled/default ... Once the session authorization, I tried to check the VLAN required before releasing the basis for authorization, did it as follows: authorize { ... if (Tunnel-Private-Group-Id:0 == 5){ # Base de dados LDAP da FPTI if (Realm == "fpti") { ldap_fpti } } if (Tunnel-Private-Group-Id:0 == 30){ # Todos os Hbitantes do PTI atraves do numero do cracha if ( Realm == "pti") { ldap_pti } # Base de dados SQL de Visitantes if ( Realm == "visitantes") { sql_visitantes } } ... } But unfortunately this is not working (as shown in the log below): [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++? if (Tunnel-Private-Group-Id:0 == 5) ? Evaluating (Tunnel-Private-Group-Id:0 == 5) -> FALSE ++? if (Tunnel-Private-Group-Id:0 == 5) -> FALSE ++? if (Tunnel-Private-Group-Id:0 == 30) ? Evaluating (Tunnel-Private-Group-Id:0 == 30) -> FALSE ++? if (Tunnel-Private-Group-Id:0 == 30) -> FALSE ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: joao@fpti [mschap] Told to do MS-CHAPv2 for joao@fpti with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Login incorrect: [joao@fpti] (from client controladora-wlan-1 port 0 via TLS tunnel) Note that all conditional "IF" fails. Also said that if I try to use the Tunnel-Private-Group-Id without the ":0" at the end, appears in the logs that the attribute was not found, I mention this because in several instances I saw on the internet was used only "Tunnel- Private -Group-Id" (with :0 at the end) I ask, how can I make this check? Thank you for listening; -- João Paulo de Lima Barbosa

3 6

How to connect FreeRADIUS uding JAVA
by Rajkumar Balaji 26 Aug '11

26 Aug '11

Hi, If anyone knows how to connect FreeRADIUS using JAVA Please help me to solve this Thanks Regards Rajkumar

2 1

How to store group ID into radius and retrieve it back
by Rajkumar Balaji 26 Aug '11

26 Aug '11

Hi everyone, I am new to FreeRADIUS. I have a requirement to store and retrieve it back to java to Authorize the user Please help me to resolve this. Thanks

1 0

Radius user Packet Fence 2.1.0
by Marlon Bastida 26 Aug '11

26 Aug '11

Hi, I have 3 radius users working fine on freeradius. I will give one sample: On /etc/raddb/users test Cleartext-Password:="teste"

1 0

Re: problem with perl...
by Tyller D 25 Aug '11

25 Aug '11

> Hi > > Im trying to run freeradius, using rlm_perl, and centos 6. > > after installing ( yum install freeradius freeradius-mysql freeradius-perl > freeradius-utils ). when I and start free radius I fails with this error > > Can't load '/usr/local/lib64/perl5/auto/DBI/DBI.so' for module DBI: > /usr/local/lib64/perl5/auto/DBI/DBI.so: undefined symbol: PL_memory_wrap at > /usr/lib64/perl5/DynaLoader.pm line 200. > at /usr/local/lib64/perl5/DBI.pm line 268 > BEGIN failed--compilation aborted at /usr/local/lib64/perl5/DBI.pm line > 268. > Compilation failed in require at /etc/raddb/perl3.pl line 6. > BEGIN failed--compilation aborted at /etc/raddb/perl3.pl line 6. > > > here is the output of radius -X > > > [root@crystaltowers raddb]# radiusd -X > FreeRADIUS Version 2.1.9, for host x86_64-unknown-linux-gnu, built on Nov > 12 2010 at 09:55:25 > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /etc/raddb/radiusd.conf > including configuration file /etc/raddb/proxy.conf > including configuration file /etc/raddb/clients.conf > including configuration file /etc/raddb/sites-available/dynamic-clients > including files in directory /etc/raddb/modules/ > including configuration file /etc/raddb/modules/detail.log > including configuration file /etc/raddb/modules/realm > including configuration file /etc/raddb/modules/passwd > including configuration file /etc/raddb/modules/inner-eap > including configuration file /etc/raddb/modules/detail > including configuration file /etc/raddb/modules/acct_unique > including configuration file /etc/raddb/modules/attr_filter > including configuration file /etc/raddb/modules/expiration > including configuration file /etc/raddb/modules/detail.example.com > including configuration file /etc/raddb/modules/etc_group > including configuration file /etc/raddb/modules/otp > including configuration file /etc/raddb/modules/digest > including configuration file /etc/raddb/modules/smbpasswd > including configuration file /etc/raddb/modules/ippool > including configuration file /etc/raddb/modules/exec > including configuration file /etc/raddb/modules/wimax > including configuration file /etc/raddb/modules/smsotp > including configuration file /etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /etc/raddb/modules/mac2vlan > including configuration file /etc/raddb/modules/echo > including configuration file /etc/raddb/modules/attr_rewrite > including configuration file /etc/raddb/modules/policy > including configuration file /etc/raddb/modules/pam > including configuration file /etc/raddb/modules/mschap > including configuration file /etc/raddb/modules/radutmp > including configuration file /etc/raddb/modules/perl > including configuration file /etc/raddb/modules/files > including configuration file /etc/raddb/modules/ldap > including configuration file /etc/raddb/modules/counter > including configuration file /etc/raddb/modules/preprocess > including configuration file /etc/raddb/modules/checkval > including configuration file /etc/raddb/modules/always > including configuration file /etc/raddb/modules/ntlm_auth > including configuration file /etc/raddb/modules/linelog > including configuration file /etc/raddb/modules/pap > including configuration file /etc/raddb/modules/logintime > including configuration file /etc/raddb/modules/expr > including configuration file /etc/raddb/modules/chap > including configuration file /etc/raddb/modules/sql_log > including configuration file /etc/raddb/modules/cui > including configuration file /etc/raddb/modules/mac2ip > including configuration file /etc/raddb/modules/krb5 > including configuration file /etc/raddb/modules/sradutmp > including configuration file /etc/raddb/modules/unix > including configuration file /etc/raddb/eap.conf > including configuration file /etc/raddb/sql.conf > including configuration file /etc/raddb/sql/mysql/dialup.conf > including configuration file /etc/raddb/sql/mysql/counter.conf > including configuration file /etc/raddb/policy.conf > including files in directory /etc/raddb/sites-enabled/ > including configuration file /etc/raddb/sites-enabled/inner-tunnel > including configuration file /etc/raddb/sites-enabled/default > including configuration file /etc/raddb/sites-enabled/control-socket > main { > user = "radiusd" > group = "radiusd" > allow_core_dumps = no > } > including dictionary file /etc/raddb/dictionary > main { > prefix = "/usr" > localstatedir = "/var" > logdir = "/var/log/radius" > libdir = "/usr/lib/freeradius" > radacctdir = "/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1650065408 > pidfile = "/var/run/radiusd/radiusd.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = yes > auth_badpass = yes > auth_goodpass = yes > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > client dynamic { > ipaddr = 192.168.0.0 > netmask = 16 > require_message_authenticator = no > dynamic_clients = "dynamic_client_server" > lifetime = 86400 > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > Module: Linked to module rlm_expiration > Module: Instantiating expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server dynamic_client_server { > modules { > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_always > Module: Instantiating ok > always ok { > rcode = "ok" > simulcount = 0 > mpp = no > } > } # modules > } # server > server inner-tunnel { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 4096 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/etc/raddb/certs/server.pem" > certificate_file = "/etc/raddb/certs/server.pem" > CA_file = "/etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/etc/raddb/certs/dh" > random_file = "/etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_realm > Module: Instantiating suffix > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_files > Module: Instantiating files > files { > usersfile = "/etc/raddb/users" > acctusersfile = "/etc/raddb/acct_users" > preproxy_usersfile = "/etc/raddb/preproxy_users" > compat = "no" > } > Module: Checking session {...} for more modules to load > Module: Linked to module rlm_radutmp > Module: Instantiating radutmp > radutmp { > filename = "/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > Module: Linked to module rlm_attr_filter > Module: Instantiating attr_filter.access_reject > attr_filter attr_filter.access_reject { > attrsfile = "/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > } > } # modules > } # server > server { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_perl > Module: Instantiating perl > perl { > module = "/etc/raddb/perl3.pl" > func_authorize = "authorize" > func_authenticate = "authenticate" > func_accounting = "accounting" > func_preacct = "preacct" > func_checksimul = "checksimul" > func_detach = "detach" > func_xlat = "xlat" > func_pre_proxy = "pre_proxy" > func_post_proxy = "post_proxy" > func_post_auth = "post_auth" > func_recv_coa = "recv_coa" > func_send_coa = "send_coa" > } > Can't load '/usr/local/lib64/perl5/auto/DBI/DBI.so' for module DBI: > /usr/local/lib64/perl5/auto/DBI/DBI.so: undefined symbol: PL_memory_wrap at > /usr/lib64/perl5/DynaLoader.pm line 200. > at /usr/local/lib64/perl5/DBI.pm line 268 > BEGIN failed--compilation aborted at /usr/local/lib64/perl5/DBI.pm line > 268. > Compilation failed in require at /etc/raddb/perl3.pl line 6. > BEGIN failed--compilation aborted at /etc/raddb/perl3.pl line 6. > rlm_perl: perl_parse failed: /etc/raddb/perl3.pl not found or has syntax > errors. > /etc/raddb/modules/perl[7]: Instantiation failed for module "perl" > /etc/raddb/sites-enabled/default[247]: Failed to load module "perl". > /etc/raddb/sites-enabled/default[247]: Failed to parse "perl" entry. > > > What could cause this? I have perl-DBD and perl-DBI installed and running > the script manually works fine. > > >

3 4