- Freeradius-Users - lists.freeradius.org

Re: Freeradius 2
by Usuário do Sistema 19 Mar '11

19 Mar '11

Hello everyone, I've Installed by yum freeradius2-2.1.7-7.el5 but I'm can't found the ldap dirctory under /etc/raddb/.. I have creta it or install more any package ?? thank! 2011/3/5 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) (Phil Mayers) > 2. Re: Freeraidus 2 (Gary Gatten) > 3. Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) (James J J Hooper) > 4. RE: mschap with ntlm_auth and Active Directory (McNutt, Justin M.) > 5. Re: MS-CHAP-V2 with no retry (Alan DeKok) > 6. Re: Hopefully quick question: conditional processing sneaking > in and setting Auth-Type (Alan DeKok) > 7. Re: Freeraidus 2 (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 05 Mar 2011 00:45:43 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4D7187B7.5000402(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 03/05/2011 12:21 AM, Gary Gatten wrote: > > I kinda like your caching idea, but not sure of any security > > implications. > > It's not a workable idea. MSCHAP responses are specific to the 8-byte > random challenge, which is different every time. You can't cache them. > > > > > I have (2) FR servers (each pointing to different DC) and my NAS's > > are configured to use both. But, iirc if AD is down on the backend > > FR still replies (with something) so the NAS never rolls over to the > > other FR server. > > Yes, this is a bad idea. > > Just configure samba to autodiscover the AD controllers. Winbind will > cache connections and open new ones when the old ones go away. > > > > > So, I thought about some script that would use ntlm_auth every...n > > seconds, if it fails kill FR process (or use FR policy to act dead). > > When it starts working again, restart FR. This should make the NAS > > roll to the next FR server. > > That might work, but it seems like a sledgehammer to crack a nut. > > > > > What about OpenLDAP on the FR server that's "refreshed" / sync'd to > > the winblows/AD? I've never tried this but assume it's doable. > > It's not possible. AD controllers will only sync to other AD controllers. > > At some point in the future, Samba 4 might be able to slave the LDAP > database of an AD controller, but it's purely theoretical at the moment > I think. > > > ------------------------------ > > Message: 2 > Date: Fri, 4 Mar 2011 18:54:44 -0600 > From: Gary Gatten <Ggatten(a)waddell.com> > Subject: Re: Freeraidus 2 > To: "'freeradius-users(a)lists.freeradius.org'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > < > 27487_1299286485_4D7189D5_27487_3768_1_D9B37353831173459FDAA836D3B43499BD354A55(a)WADPMBXV0.waddell.com > > > > Content-Type: text/plain; charset="utf-8" > > Try ../sites_enabled/default; or if *eap requests it would be inner-tunnel, > - I think... > > From: Paulo Maia [mailto:phc.maia@gmail.com] > Sent: Friday, March 04, 2011 06:43 PM > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeraidus 2 > > Compilou o instalou via yum ? Geralmente fica em $RADIUSDIR/modules/ldap > > Abs, > > > 2011/3/4 Usu?rio do Sistema <maiconlp(a)ig.com.br<mailto:maiconlp@ig.com.br > >> > Hello everyone, I'm Maicon from Brazil. > > I'm in a project with Freeradius. I want to deployment authentication with > certificate from my wireless users EAP-TLS but I'm finding some difficult. > there is a good how to for version 2 ?? I've started with version 1.x but > decided to change for version 2 and I'm not finding where I set the LDAP > conection. at the older version it was inside radiusd.conf. anybody help me > ?? > > > thank! > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in > 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > >

5 6

Freeradius 2 + MySQL + MD5 hash don't work
by joaocdc＠gmail.com 18 Mar '11

18 Mar '11

Hello, Someone already has implemented two freeradius with mysql I'm using version 2.1.10 of freeradius on a debian 6 If I try a plaintext based authentication, everything works. But if I try to do an authentication with an MD5 password, I get the message seguite: *[pap] ERROR: You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!* Below is my debug and table structures of authentication. Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.25.3.0 port 1814, id=40, length=143 User-Name = "usql2@visitantes" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000015017573716c32407669736974616e746573 Message-Authenticator = 0x026cbd100d0b63cacb106f91006b21f2 Proxy-State = 0x30 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "visitantes" for User-Name = "usql2@visitantes" [suffix] Found realm "visitantes" [suffix] Adding Stripped-User-Name = "usql2" [suffix] Adding Realm = "visitantes" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 0 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++? if (Realm == "visitantes" ) ? Evaluating (Realm == "visitantes" ) -> TRUE ++? if (Realm == "visitantes" ) -> TRUE ++- entering if (Realm == "visitantes" ) {...} [sql_visitantes] expand: %{Stripped-User-Name} -> usql2 [sql_visitantes] sql_set_user escaped user --> 'usql2' rlm_sql (sql_visitantes): Reserving sql socket id: 4 [sql_visitantes] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'usql2' ORDER BY id [sql_visitantes] User found in radcheck table [sql_visitantes] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'usql2' ORDER BY id [sql_visitantes] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'usql2' ORDER BY priority [sql_visitantes] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'visitantes' ORDER BY id [sql_visitantes] User found in group visitantes [sql_visitantes] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'visitantes' ORDER BY id rlm_sql (sql_visitantes): Released sql socket id: 4 +++[sql_visitantes] returns ok ++- if (Realm == "visitantes" ) returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing MD5-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} *[pap] ERROR: You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!* ++[pap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} ++? if (Realm == "visitantes" ) ? Evaluating (Realm == "visitantes" ) -> TRUE ++? if (Realm == "visitantes" ) -> TRUE ++- entering if (Realm == "visitantes" ) {...} [sql_visitantes] expand: %{Stripped-User-Name} -> usql2 [sql_visitantes] sql_set_user escaped user --> 'usql2' [sql_visitantes] expand: %{User-Password} -> [sql_visitantes] ... expanding second conditional [sql_visitantes] expand: %{Chap-Password} -> [sql_visitantes] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'usql2@visitantes', '', 'Access-Reject', '2011-03-17 16:54:17') rlm_sql (sql_visitantes) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'usql2@visitantes', '', 'Access-Reject', '2011-03-17 16:54:17') rlm_sql (sql_visitantes): Reserving sql socket id: 3 rlm_sql (sql_visitantes): Released sql socket id: 3 +++[sql_visitantes] returns ok ++- if (Realm == "visitantes" ) returns ok [attr_filter.access_reject] expand: %{User-Name} -> usql2@visitantes attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 40 to 172.25.3.0 port 1814 Proxy-State = 0x30 Waking up in 4.9 seconds. Cleaning up request 0 ID 40 with timestamp +12 Ready to process requests. mysql> select * from radcheck; +----+----------+--------------------+----+----------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------------------------------+ | 1 | usql1 | Cleartext-Password | := | usql1 | | 2 | usql2 | MD5-Password | := | 18f3e5d08056778649949b6872a0d4ff | +----+----------+--------------------+----+----------------------------------+ 2 rows in set (0.00 sec) mysql> select * from radgroupcheck; +----+------------+-----------+----+-------+ | id | groupname | attribute | op | value | +----+------------+-----------+----+-------+ | 1 | visitantes | Auth-Type | := | PAP | +----+------------+-----------+----+-------+ 1 row in set (0.00 sec) mysql> select * from radusergroup;; +----------+------------+----------+ | username | groupname | priority | +----------+------------+----------+ | usql1 | visitantes | 1 | | usql2 | visitantes | 1 | +----------+------------+----------+ 2 rows in set (0.00 sec) -- João Paulo de Lima Barbosa

3 5

(Fwd) (Fwd) Re: Seg Fault - radius 3.0 Debug
by Breuer Nicolas 18 Mar '11

18 Mar '11

The debug mode said anything - No errors. My variable is in the SQLIPPOOL.conf file and called with "%{Huntgroup-Name}" No values were returned. With 2.1.11 - Same directory, dic files, etc , i have a value. ------- Forwarded message follows ------- Breuer Nicolas wrote: > but.. Maybe variables have changed but since 3.0 version the variable > %{Huntgroup-Name} > is no more recognized. It should work. The git "master" branch hasn't changed any of that functionality. And (as always) what does debug mode say? Alan DeKok. ------- Forwarded message follows ------- From: Breuer Nicolas <Nicolas.Breuer(a)Belcenter.biz> To: freeradius-users(a)lists.freeradius.org Subject: (Fwd) Re: Seg Fault - radius 3.0 Debug Date sent: Fri, 18 Mar 2011 12:45:23 +0100 Hello, I finally solved my issue. It was a problem of linking mysql libs. I'm sorry . Apologies to all but.. Maybe variables have changed but since 3.0 version the variable %{Huntgroup-Name} is no more recognized. tested on version 2.1.11 - Works perfectly Any ideas ? Thanks ------- Forwarded message follows ------- Date sent: Thu, 17 Mar 2011 21:20:20 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: "Nicolas.Breuer(a)Belcenter.biz" <Nicolas.Breuer(a)Belcenter.biz>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Seg Fault - radius 3.0 Debug Hi, > Here is my debug file with gbd on the seg fault > [Thread debugging using libthread_db enabled] > [New Thread 0x7ffff600b700 (LWP 23433)] > [Thread 0x7ffff600b700 (LWP 23433) exited] > Program received signal SIGSEGV, Segmentation fault. > 0x00007ffff6032890 in mysql_field_count () from > /usr/lib64/mysql/libmysqlclient_r.so.16 > Missing separate debuginfos, use: debuginfo-install > glibc-2.13-1.x86_64 ^^^^^^^^^^^^^^^^^^^^ suggest you follow the information given to get more debugging info out alan ------- End of forwarded message ------- ------- End of forwarded message -------

2 1

Cisco and Enterasys not active access to Authenticated User
by Fabricio Oliveira 18 Mar '11

18 Mar '11

Hello everyone, I have a scenario that is configured to access active Linux, Cisco and Enterasys for when using Cisco VPN can not authenticate in assets. Only works when it is turned off *Filter-ID == "Enterasys: version = 1: mgmt = rw "*. Is there any way to configure and access the assets? Follow the example set : *FreeRADIUS Version 2.0.4* example_user Auth-Type := LDAP Service-Type = Shell-User, Cisco-AVPair = "shell:priv-lvl=15", Cisco-AVPair = "shell:cmd*", Filter-ID == "Enterasys:version=1:mgmt=rw" -- Thanks, Fabricio Oliveira

2 1

(Fwd) Re: Seg Fault - radius 3.0 Debug
by Breuer Nicolas 18 Mar '11

18 Mar '11

Hello, I finally solved my issue. It was a problem of linking mysql libs. I'm sorry . Apologies to all but.. Maybe variables have changed but since 3.0 version the variable %{Huntgroup-Name} is no more recognized. tested on version 2.1.11 - Works perfectly Any ideas ? Thanks ------- Forwarded message follows ------- Date sent: Thu, 17 Mar 2011 21:20:20 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: "Nicolas.Breuer(a)Belcenter.biz" <Nicolas.Breuer(a)Belcenter.biz>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Seg Fault - radius 3.0 Debug Hi, > Here is my debug file with gbd on the seg fault > [Thread debugging using libthread_db enabled] > [New Thread 0x7ffff600b700 (LWP 23433)] > [Thread 0x7ffff600b700 (LWP 23433) exited] > Program received signal SIGSEGV, Segmentation fault. > 0x00007ffff6032890 in mysql_field_count () from > /usr/lib64/mysql/libmysqlclient_r.so.16 > Missing separate debuginfos, use: debuginfo-install > glibc-2.13-1.x86_64 ^^^^^^^^^^^^^^^^^^^^ suggest you follow the information given to get more debugging info out alan ------- End of forwarded message -------

2 1

Freeradius + PEAP/EAP-MSCHAPv2 + AD 2008
by Geoffrey Chavepeyer 18 Mar '11

18 Mar '11

Hey everyone ! I'm trying to configure a FreeRadius server that authenticates with MSCHAPv2 with an Active Directory 2008. It's my fisrt radius install so go easy with me, I'm a noob :) I've followed the following howto : http://deployingradius.com/documents/configuration/active_directory.html and everything goes fine with the radtest, wbinfo, ntlm_auth and my user is correctly authentified. I'm no trying to connect a Windows 7 supplicant using that radius server. (That client is configured to use "Microsoft : Protected EAP (PEAP)", "validate server certificate" is unchecked and the authentication is on "secured password (EAP-MSCHAPv2)". The problem seems to be that my client stops answering after 4-5 Access-Challenge. I saw the remarks about the xpextensions of the certificats and make sure that the included makefile correctly uses the xpextensions wich it seems to be doing. The full debug is here : http://pastebin.com/B86AgN1N It's seems that mschap correctly authentifies the user : Fri Mar 18 09:51:31 2011 : Info: +- entering group authenticate {...} Fri Mar 18 09:51:31 2011 : Info: [eap] Request found, released from the list Fri Mar 18 09:51:31 2011 : Info: [eap] EAP/mschapv2 Fri Mar 18 09:51:31 2011 : Info: [eap] processing type mschapv2 Fri Mar 18 09:51:31 2011 : Info: [mschapv2] +- entering group MS-CHAP {...} Fri Mar 18 09:51:31 2011 : Info: [mschap] Told to do MS-CHAPv2 for gchavepeyer with NT-Password Fri Mar 18 09:51:31 2011 : Info: [mschap] No NT-Domain was found in the User-Name. Fri Mar 18 09:51:31 2011 : Info: [mschap] expand: --domain=%{mschap:NT-Domain:-EUROPE} -> --domain=EUROPE Fri Mar 18 09:51:31 2011 : Info: [mschap] expand: --username=%{mschap:User-Name} -> --username=gchavepeyer Fri Mar 18 09:51:31 2011 : Info: [mschap] mschap2: 5c Fri Mar 18 09:51:31 2011 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=82d538878ea2db35 Fri Mar 18 09:51:31 2011 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=555bd723d3058e951670b77a443550a83f4eab5af5124f1f Fri Mar 18 09:51:31 2011 : Debug: Exec-Program output: NT_KEY: 99DC7FD7D0C603D05D96779E61DF89AF Fri Mar 18 09:51:31 2011 : Debug: Exec-Program-Wait: plaintext: NT_KEY: 99DC7FD7D0C603D05D96779E61DF89AF Fri Mar 18 09:51:31 2011 : Debug: Exec-Program: returned: 0 Fri Mar 18 09:51:31 2011 : Info: [mschap] adding MS-CHAPv2 MPPE keys Fri Mar 18 09:51:31 2011 : Info: ++[mschap] returns ok Fri Mar 18 09:51:31 2011 : Debug: MSCHAP Success Fri Mar 18 09:51:31 2011 : Info: ++[eap] returns handled } # server inner-tunnel Fri Mar 18 09:51:31 2011 : Info: [peap] Got tunneled reply code 11 EAP-Message = 0x011400331a0313002e533d46443545363236453946453838393330423230313643394537314632313231464433373038344446 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cafd11f3dbbcb7c3aaaafe5efc8d331 Fri Mar 18 09:51:31 2011 : Info: [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x011400331a0313002e533d46443545363236453946453838393330423230313643394537314632313231464433373038344446 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cafd11f3dbbcb7c3aaaafe5efc8d331 Fri Mar 18 09:51:31 2011 : Info: [peap] Got tunneled Access-Challenge Fri Mar 18 09:51:31 2011 : Info: ++[eap] returns handled Sending Access-Challenge of id 29 to 10.32.25.204 port 32768 EAP-Message = 0x0114005b19001703010050efa71e4179b8bba7065b53e5c07cc774ffa8494adc0cd61c810e10ea5af21f52ac755a7f7a908b1c6898ac8039096320bf270f4ff208b22559eb7111f6c2e4412eaad47c33a4e151d5ad626af368c991 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x11c1c21a16d5dba84c633101b1a44bc3 Fri Mar 18 09:51:31 2011 : Info: Finished request 7. Fri Mar 18 09:51:31 2011 : Debug: Going to the next request Fri Mar 18 09:51:31 2011 : Debug: Waking up in 4.8 seconds. Fri Mar 18 09:51:36 2011 : Info: Cleaning up request 0 ID 22 with timestamp +27 Fri Mar 18 09:51:36 2011 : Info: Cleaning up request 1 ID 23 with timestamp +27 Fri Mar 18 09:51:36 2011 : Info: Cleaning up request 2 ID 24 with timestamp +27 Fri Mar 18 09:51:36 2011 : Info: Cleaning up request 3 ID 25 with timestamp +27 Fri Mar 18 09:51:36 2011 : Info: Cleaning up request 4 ID 26 with timestamp +27 Fri Mar 18 09:51:36 2011 : Debug: Waking up in 0.1 seconds. Fri Mar 18 09:51:36 2011 : Info: Cleaning up request 5 ID 27 with timestamp +27 Fri Mar 18 09:51:36 2011 : Info: Cleaning up request 6 ID 28 with timestamp +27 Fri Mar 18 09:51:36 2011 : Info: Cleaning up request 7 ID 29 with timestamp +27 Fri Mar 18 09:51:36 2011 : Debug: Ready to process requests. The server send an Access-Challenge (instead of a Access-Accept ?) again but the client never answers back and the client gets a "unable to connect to xxxx...." Can someone please help me with this ? (All my configuration is visible in the first debug lines but if needed i can post the content of any file.) Thanks a lot !!! Geoffrey.

2 1

Seg Fault - radius 3.0 Debug
by Breuer Nicolas 17 Mar '11

17 Mar '11

Dear all, Here is my debug file with gbd on the seg fault [Thread debugging using libthread_db enabled] [New Thread 0x7ffff600b700 (LWP 23433)] [Thread 0x7ffff600b700 (LWP 23433) exited] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff6032890 in mysql_field_count () from /usr/lib64/mysql/libmysqlclient_r.so.16 Missing separate debuginfos, use: debuginfo-install glibc-2.13-1.x86_64 keyutils-libs-1.2- 6.fc12.x86_64 krb5-libs-1.8.2-7.fc14.x86_64 libcom_err-1.41.12-6.fc14.x86_64 libgcc-4.5.1- 4.fc14.x86_64 libselinux-2.0.96-6.fc14.1.x86_64 mysql-libs-5.1.55-1.fc14.x86_64 nss- softokn-freebl-3.12.9-2.fc14.x86_64 openssl-1.0.0d-1.fc14.x86_64 zlib-1.2.5-2.fc14.x86_64

2 1

Re : Seg Fault - radius 3.0 Debug
by Breuer Nicolas 17 Mar '11

17 Mar '11

More messages ------- Forwarded message follows ------- From: root <root(a)mail-mx-out.belcenter.com> Date sent: Thu, 17 Mar 2011 18:43:14 +0100 To: nicolas.breuer(a)belcenter.be Program received signal SIGSEGV, Segmentation fault. 0x00007ffff6032890 in mysql_field_count () from /usr/lib64/mysql/libmysqlclient_r.so.16 Missing separate debuginfos, use: debuginfo-install glibc-2.13-1.x86_64 keyutils-libs-1.2- 6.fc12.x86_64 krb5-libs-1.8.2-7.fc14.x86_64 libcom_err-1.41.12-6.fc14.x86_64 libgcc-4.5.1- 4.fc14.x86_64 libselinux-2.0.96-6.fc14.1.x86_64 mysql-libs-5.1.55-1.fc14.x86_64 nss- softokn-freebl-3.12.9-2.fc14.x86_64 openssl-1.0.0d-1.fc14.x86_64 zlib-1.2.5-2.fc14.x86_64 * 1 Thread 0x7ffff7bba720 (LWP 23430) 0x00007ffff6032890 in mysql_field_count () from /usr/lib64/mysql/libmysqlclient_r.so.16 Thread 1 (Thread 0x7ffff7bba720 (LWP 23430)): #0 0x00007ffff6032890 in mysql_field_count () from /usr/lib64/mysql/libmysqlclient_r.so.16 No symbol table info available. #1 0x00007ffff6391dee in sql_num_fields (sqlsocket=<value optimized out>, config=<value optimized out>) at sql_mysql.c:239 num = 0 mysql_sock = 0x8986b0 #2 0x00007ffff639233d in sql_select_query (sqlsocket=0x898640, config=0x847480, querystr=<value optimized out>) at sql_mysql.c:275 ret = 0 #3 0x00007ffff6598c67 in rlm_sql_select_query (sqlsocket=0x898640, inst=0x847410, query=0x7fffffffaf40 "SELECT ip_address FROM radippool WHERE pool_name = 'BC*' AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE") at sql.c:566 ret = <value optimized out> #4 0x00007ffff4ff1c3b in sqlippool_query1 (out=0x7fffffffd180 "\001", fmt=<value optimized out>, sqlsocket=0x898640, data=0x8c59f0, request=0x8d5b20, param_len=0, param=0x0, outlen=-2) at rlm_sqlippool.c:359 expansion = "SELECT ip_address FROM radippool WHERE pool_name = '%{reply:Pool-Suffix}*%{Huntgroup-Name}' AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE\000\000.\341\377\377\377\177\000\000\000\000\000\000\377\177", '\000' <repeats 34 times>, " ", '\000' <repeats 15 times>... query = "SELECT ip_address FROM radippool WHERE pool_name = 'BC*' AND expiry_time < NOW() ORDER BY rand(), pool_name, expiry_time LIMIT 1 FOR UPDATE\000\377\177\000\000\220\322\377\377\377\177\000\000(\256C", '\000' <repeats 13 times>, "[xA\000\000\000\000\000[LIVE-SYSTEM-01] \texpand: COMMIT -"... rlen = <value optimized out> retval = 0 #5 0x00007ffff4ff1f6c in sqlippool_postauth (instance=0x8c59f0, request=0x8d5b20) at rlm_sqlippool.c:596 data = 0x8c59f0 allocation = "\001\000\000\000\000\000\000\000\237\314\336\367\377\177\000\000 [\215\000\000\000\000\000\350\003", '\000' <repeats 14 times>, "O\317\336\367\377\177\000\000\000\004\000\000\000\000\000\000H[\215\000\000\000\000 \000 [\215\000\000\000\000\000\001", '\000' <repeats 15 times>"\305, #B\000\000\000\000\000 \000\000\000\060\000\000\000\340\322\377\377\377\177\000\000\000\322\377\377\377\177 \000\000\026\371:\367\377\177\000\000\060\000\000\000\060\000\000\000\020\323\377\37 7\377\177\000\000 \322\377\377\377\177\000\000\000\000\000\000\000\000\000\000]pC\000\000\000\000\000\ 260X\214\000\000\000\000\000\200\033y\000\000\000\000\000H[\215\000\000\000\000\000\ 002\000\000\000\000\000\000\000\300\204C\000\000\000\000\000\310t\335\367\377\177\00 0\000\000\000\000\000\377\177\000\000\000\000\000\000\000\000\000\000 [\215\000\000\000\000\000\340\060y\000\000\000\000\000Saf\000\000" allocation_len = <value optimized out> ip_allocation = <value optimized out> vp = <value optimized out> sqlsocket = 0x898640 ipaddr = {af = 6709588, ipaddr = {ip4addr = {s_addr = 0}, ip6addr = {__in6_u = { __u6_addr8 = "\000\000\000\000\265=a\234\061\000\000\000@Y\215", __u6_addr16 = {0, 0, 15797, 40033, 49, 0, 22848, 141}, __u6_addr32 = {0, 2623618485, 49, 9263424}}}}, scope = 0} logstr = "@E{\367\377\177\000\000/\346:\367\377\177\000\000\000\000\000\000\000\000\000\000\0 22\004\000\000\000\000\000\000Pv\215\000\000\000\000\000\025\000\000\000\000\000\00 0\000\005", '\000' <repeats 15 times>, "\020\321\377\377\377\177\000\000p\001", '\000' <repeats 30 times>, "\025\000\000\000\065\000\000\000[\000\000\000n\000\000\000w\000\000\000|\000\000\000 \321\377\377\377\177\000\000\017\321\377\377\377\177\000\000\377\377\377\377\000\000 \000\000\062\316\335\367\377\177\000\000\000\000\000\000\000\000\000\000\342\v\336\3 67\377\177\000\000\360\070 \000\000\000\000\000\300qÜ1\000\000\000@\001\000\000\000\000\000\000\001\000\000\0 00\000\000\000\000\270\274w\000\000\000\000\000@\322\377\377\377\177\000\000PCy\0 00\000\000\000\000\375\237\247\234\061\000\000\000\350\003\000\000\000\000\000\000\2 70\274w\000\000" sqlusername = "BCa10733@BELCENTER\000\367\377\177\000\000\230\066@\000\000\000\000\000ؐ\244 \234\061\000\000\000\227%C\000\000\000\000\000\000\000\000\000\001\000\000\000\001\ 000\000\000\377\177\000\000\225%C\000\000\000\000\000\000\000\000\000\n\000\000\000 P\321\377\377\377\177\000\000p\321\377\377\377\177\000\000\220\024y", '\000' <repeats 13 times>, "l\312\071X\000\000\000\000\242\226`\234\061", '\000' <repeats 1ֹ times>, "\005", '\000' <repeats 15 times>, "\001\000\000\000\377\177\000\000\220\024y\000\000\000\000\000\005\000\000\000\377\1 77\000\000\000\000\000\000\000\000\000\000\310t\335\367\377\177", '\000' <repeats 18 times>"\350, \027y\000\000\000\000\000\360\320\377\377\377\177\000\000\001\000\000\000\000\000\00 0\000\020\321\377\377ל377\177\000\000\265=a\234\001" #6 0x000000000041afd9 in call_modsingle (component=7, c=0x8c4a40, request=<value optimized out>) at modcall.c:297 myresult = <value optimized out> #7 modcall (component=7, c=0x8c4a40, request=<value optimized out>) at modcall.c:670 myresult = <value optimized out> stack = {pointer = 2, priority = {0 <repeats 32 times>}, result = {0 <repeats 32 times>}, children = { <value optimized out> <repeats 32 times>}, start = {<value optimized out> <repeats 32 times>}} parent = 0x8c5840 child = 0x8c6500 if_taken = 0 was_if = 1 #8 0x0000000000419d45 in indexed_modcall (comp=7, idx=0, request=0x8d5b20) at modules.c:759 rcode = <value optimized out> list = <value optimized out> server = <value optimized out> #9 0x0000000000408495 in rad_postauth (request=0x8d5b20) at auth.c:422 result = <value optimized out> postauth_type = <value optimized out> vp = 0x0 #10 0x0000000000408afb in rad_authenticate (request=0x8d5b20) at auth.c:812 namepair = 0x8d7500 check_item = 0x0 auth_item = 0x8d5e90 module_msg = <value optimized out> tmp = <value optimized out> result = 0 password = 0x436e91 "" autz_retry = <value optimized out> autz_type = <value optimized out> #11 0x0000000000429813 in radius_handle_request (request=0x8d5b20, fun=0x4084e0 <rad_authenticate>) at event.c:4243 No locals. #12 0x0000000000420a55 in thread_pool_addrequest (request=0x8d5b20, fun=0x4084e0 <rad_authenticate>) at threads.c:900 No locals. #13 0x000000000042746d in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0x8d5580) at event.c:3957 listener = 0x8d5580 fun = 0x4084e0 <rad_authenticate> request = 0x8d5b20 #14 0x00007ffff7df0fdf in fr_event_loop (el=0x8c7a80) at event.c:413 ef = <value optimized out> i = <value optimized out> rcode = 1 maxfd = 26 when = {tv_sec = 0, tv_usec = 0} wake = <value optimized out> read_fds = {fds_bits = {33554432, 0 <repeats 15 times>}} master_fds = {fds_bits = {109051904, 0 <repeats 15 times>}} #15 0x000000000041d434 in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:408 rcode = <value optimized out> argval = <value optimized out> spawn_flag = 0 dont_fork = 1 flag = 0 act = {__sigaction_handler = {sa_handler = 0x41cef0 <sig_fatal>, ------- End of forwarded message ------- Breuer Nicolas Network Supervisor Sales Executive BELCENTER sprl/bvba Avenue Henri Consciencelaan, 94 Bruxelles 1140 Brussel T. : +32 (0)2 403 04 60 F. : +32 (0)2 403 04 63 M. :+32 (0)486 50 27 87 E. : Nicolas.Breuer(a)Belcenter.biz W. : http://www.BelCenter.be | http://www.BelCenter.net

2 1

Sending attribute with sub-attributes
by Kristoffer Milligan 17 Mar '11

17 Mar '11

Hello list, I have compiled and am now running FR v3.0 and it seems to be working fine. I have reached the situation where I need to send attributes that contain sub TLVs for automatic configuration of WiMAX basestations. With great help from list user Ben Wiechman I have a dictionary that has been fit to match (as best possible) the specification provided by the equipment vendor. For automatic configuration of the basestation, one of the attributes required is for example: Attribute R3-IF-Descriptor Sub-TLV R3-IF-Name R3-IF-ID PDFID These are all exposed in the dictionary .. but running a MySQL based freeradius configuration, how do I return this type of packet when a user requests access? Sincerely, Kristoffer Milligan

3 19

Re: freeradius failover-through proxy or other way?
by Martin Lambev 17 Mar '11

17 Mar '11

On 03/16/2011 07:00 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: SQL Counter Escape String ! (Alan DeKok) > 2. Re: SQL Counter Escape String ! (Suman Dash) > 3. Re: freeradius failover-through proxy or other way? (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 16 Mar 2011 11:39:54 +0100 > From: Alan DeKok<aland(a)deployingradius.com> > Subject: Re: SQL Counter Escape String ! > To: suman(a)clydontech.com, FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID:<4D80937A.5010808(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Suman Dash wrote: >> Hi Alan, >> >> Did you managed to look into the issue ? > No. > >> or maybe any hints on how to use DATETIME in Expiration instead of String ? > Honestly, in 2.1.10, you can just write SELECT statements directly in > "unlang". > > update reply { > Session-Timeout := "%{sql: SELECT ...}" > } > > Couple that with a few other things, and you should be able to replace > the sqlcounter module entirely. > > i.e. I don't use that module, and I know little or nothing about it. > I have little time to do anything with it. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Wed, 16 Mar 2011 16:13:49 +0530 > From: Suman Dash<suman(a)clydontech.com> > Subject: Re: SQL Counter Escape String ! > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID:<4D809465.2050204(a)clydontech.com> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > Much thanks Alan, > > That was some really good advice on how to make the thing work. > > So now i have to write unlang statement in preprocess so that it > directly gives the Session-Timeout . Please correct me if i am wrong. > > Thanks Again > On 3/16/2011 4:09 PM, Alan DeKok wrote: >> Suman Dash wrote: >>> Hi Alan, >>> >>> Did you managed to look into the issue ? >> No. >> >>> or maybe any hints on how to use DATETIME in Expiration instead of String ? >> Honestly, in 2.1.10, you can just write SELECT statements directly in >> "unlang". >> >> update reply { >> Session-Timeout := "%{sql: SELECT ...}" >> } >> >> Couple that with a few other things, and you should be able to replace >> the sqlcounter module entirely. >> >> i.e. I don't use that module, and I know little or nothing about it. >> I have little time to do anything with it. >> >> Alan DeKok. >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus signature database 5924 (20110303) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> >> >> >

1 0