- Freeradius-Users - lists.freeradius.org

freeradius install on mac server help
by Raymond Norton 02 Mar '11

02 Mar '11

I am trying to install freeradius-2.1.0 on a mac server (10.5.8). Make runs fine, until it gets to the errors below. I am not a mac guy, so not sure where to look for the cause of the error. Making all in rlm_perl... /usr/bin/make -C rlm_perl all /Users/raymond/Downloads/freeradius-server-2.1.10/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DDARWIN -Wall -D_GNU_SOURCE -DNDEBUG -I/Users/raymond/Downloads/freeradius-server-2.1.10/src -I/Users/raymond/Downloads/freeradius-server-2.1.10/libltdl `perl -MExtUtils::Embed -e ccopts` -c rlm_perl.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DDARWIN -Wall -D_GNU_SOURCE -DNDEBUG -I/Users/raymond/Downloads/freeradius-server-2.1.10/src -I/Users/raymond/Downloads/freeradius-server-2.1.10/libltdl -arch ppc -arch i386 -g -pipe -fno-common -DPERL_DARWIN -no-cpp-precomp -fno-strict-aliasing -Wdeclaration-after-statement -I/usr/local/include -I/System/Library/Perl/5.8.8/darwin-thread-multi-2level/CORE -c rlm_perl.c -fno-common -DPIC -o .libs/rlm_perl.o rlm_perl.c: In function 'rlm_perl_make_key': rlm_perl.c:246: warning: passing argument 2 of 'pthread_key_create' from incompatible pointer type rlm_perl.c: In function 'rlm_perl_make_key': rlm_perl.c:246: warning: passing argument 2 of 'pthread_key_create' from incompatible pointer type rlm_perl.c: In function 'perl_xlat': rlm_perl.c:373: warning: format '%d' expects type 'int', but argument 3 has type 'size_t' rlm_perl.c:373: warning: format '%d' expects type 'int', but argument 5 has type 'size_t' rlm_perl.c: In function 'perl_xlat': rlm_perl.c:373: warning: format '%d' expects type 'int', but argument 3 has type 'size_t' rlm_perl.c:373: warning: format '%d' expects type 'int', but argument 5 has type 'size_t' rlm_perl.c: In function 'perl_instantiate': rlm_perl.c:410: warning: unused variable 'envp' rlm_perl.c: In function 'perl_instantiate': rlm_perl.c:410: warning: unused variable 'envp' rlm_perl.c: In function 'perl_store_vps': rlm_perl.c:541: warning: assignment discards qualifiers from pointer target type rlm_perl.c: In function 'perl_store_vps': rlm_perl.c:541: warning: assignment discards qualifiers from pointer target type gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DDARWIN -Wall -D_GNU_SOURCE -DNDEBUG -I/Users/raymond/Downloads/freeradius-server-2.1.10/src -I/Users/raymond/Downloads/freeradius-server-2.1.10/libltdl -arch ppc -arch i386 -g -pipe -fno-common -DPERL_DARWIN -no-cpp-precomp -fno-strict-aliasing -Wdeclaration-after-statement -I/usr/local/include -I/System/Library/Perl/5.8.8/darwin-thread-multi-2level/CORE -c rlm_perl.c -o rlm_perl.o >/dev/null 2>&1 /Users/raymond/Downloads/freeradius-server-2.1.10/libtool --mode=link gcc -release 2.1.10 \ -module -export-dynamic -o rlm_perl.la \ -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /Users/raymond/Downloads/freeradius-server-2.1.10/src/lib/libfreeradius-radius.la `perl -MExtUtils::Embed -e ldopts` -framework DirectoryService -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /System/Library/Perl/5.8.8/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a is not portable! gcc ${wl}-flat_namespace ${wl}-undefined ${wl}suppress -o .libs/rlm_perl-2.1.10.so -bundle .libs/rlm_perl.o /Users/raymond/Downloads/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.dylib -L/usr/local/lib /System/Library/Perl/5.8.8/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a -L/System/Library/Perl/5.8.8/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lutil -lc -lresolv -lpthread -arch ppc -arch i386 -framework DirectoryService ld warning: in /Users/raymond/Downloads/freeradius-server-2.1.10/src/lib/.libs/libfreeradius-radius.dylib, file is not of required architecture dsymutil .libs/rlm_perl-2.1.10.so || : (cd .libs && rm -f rlm_perl.so && ln -s rlm_perl-2.1.10.so rlm_perl.so) ar cru .libs/rlm_perl.a /System/Library/Perl/5.8.8/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a rlm_perl.o ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (18) cpusubtype (0) is not an object file (bad magic number) ar: internal ranlib command failed make[6]: *** [rlm_perl.la] Error 1 make[5]: *** [rlm_perl] Error 2 make[4]: *** [all] Error 2 make[3]: *** [modules] Error 2 make[2]: *** [all] Error 2 make[1]: *** [src] Error 2 make: *** [all] Error 2

2 1

Use Hint file to proxy
by Difan Zhao 02 Mar '11

02 Mar '11

Hi experts, Long time no talk! I have another dilemma. For some reasons I want to try to use the hints file to do Proxy (the normal way of configuring realm and proxy.conf file works). So the following is my config: =============== hints =================== DEFAULT User-Name =~ "^host\/.*\.gtcorp\.com$" Hint = "Marriott" =============== users =================== DEFAULT Hint == "Marriott", Proxy-To-Realm := "~\.gtcorp\.com$" =============== proxy.conf =================== .... realm "~\.gtcorp\.com$" { nostrip auth_pool = Marriott_Auth_Pool acct_pool = Marriott_Acct_Pool } ============== module/realm ================ realm Marriott { format = suffix delimiter = "/" } Then I commented out the "Marriott" realm in the "authorize" section in the default server so the settings in the "realm" file shouldn't do anything. ============= sites-available/default ============== authorize { ... # Marriott ... } In the radius -X log I do see the requests are sent to the proxy server but I also see the following abnormal logs. The complete log is also attached. [eap] No pre-existing handler found ... rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. So is it possible to use the hints file to do proxy or I'm totally out of my mind?? If it's possible where I could do wrong? Thanks a lot! [cid:image002.gif@01CBD8B8.490E09F0]Difan Zhao M.Eng | CCNA CCNP CCSP | Network Engineer T: 403-509-1010 ext 3048 | M: 403-689-7514 | F: 403.509.1011 difan.zhao(a)guest-tek.com<mailto:difan.zhao@guest-tek.com> | www.guest-tek.com<http://www.guest-tek.com> The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

1 0

global hash variable perl
by Vinh Nguyen 02 Mar '11

02 Mar '11

hi all, I was able to setup my freeradius to use perl and mysql. Things are working ok. I wanted to use a global hash variable to store information. This way all other requests can also access this hash variable. Is this doable? I know you can use mysql for this purpose, but i wanted to reduce the # of mysql hits. Thanks. -- Computer Science B.S. at Texas A&M C# .Net Developer Server Analyst.

4 9

IP Pool for Ethernet
by Groebl, Laurence (Laurence) 02 Mar '11

02 Mar '11

Hello, I aim at setting up an IPsec tunnel between an IPsec client and an IPsec Gateway using IKEv2 and EAP-TLS for authentication. I am using freeradius as RADIUS server, and the authentication is working well. Currently the Gateway is assigning an IP address from a specific pool to the IKEv2 client. However I'd like the RADIUS server to assign this IP address and send it within the Access-Accept in the Framed-IP-Address attribute (to avoid configuring the IPsec Gateway with the tunnel address). I saw that FreeRADIUS has several IP Pool modules which have the ability to assign dynamic IP address to RADIUS sessions types where the NAS has control over the the users IP, however not for Ethernet. Is there a way (e.g. using DHCP) to assign an IP address to the Ipsec client and send it the Access-Accept in the Framed-IP-Address attribute? Best regards, Laurence

3 5

Clarification / Confirmation needed re: FreeRadius against Active Directory
by Moe, John 02 Mar '11

02 Mar '11

I'm setting up an Ubuntu server (10.04LTS amd64) with FreeRadius (v2.1.8 from apt-get) to use as an authenticator against Active Directory for our HP ProCurve switches. I've gotten the server on to our Active Directory domain, and have begun the setup of the FreeRadius server. I've even managed to allow login to a test ProCurve switch using my AD username. Now, I've read a lot of configuration pages (for Ubuntu, Samba, Winbind, and FreeRadius, to name a few) in the last few days, and my head's spinning a bit, and I'd like to make sure I'm doing this right, and I've managed to grasp a few things... Should I be using ntlm_auth, or mschap as my Auth-Type for the ProCurve switches? Currently, I'm using: # HP ProCurve Switch DEFAULT Auth-Type = ntlm_auth, NAS-Port-Type == Virtual, Service-Type == NAS-Prompt-User Service-Type = 6 as my line in the "users" file, and it works, but I want to make sure it's a) doing what I think it's doing, and b) the right way to do it. >From some of my reading, it seemed to indicate that Auth-Type shouldn't need to be set, that FreeRadius should be able to figure it out, but if I leave it out, it appears to match the rest of the rule (NAS-Port-Type and Service-Type), but I get a message saying: Tue Mar 1 09:54:03 2011 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Mar 1 09:54:03 2011 : Info: Failed to authenticate the user. I've put a single "=" in for the Auth-Type, because the documentation seems to say that with "=", it'll only add that to the request if no other Auth-Type was previously set, so that seems to say that the ProCurve switch isn't requesting ntlm_auth. How is FreeRadius supposed to figure it out, then? Also, I'd like to match the rule (or are they called policies?) against an Active Directory group name, so that only members of a specific group can get access into the switch. I can't seem to find any way match for that; is it possible? Any help or pointers would be appreciated. Thanks. John H. Moe Network Support - Hatch IT HATCH Tel: +61 (7) 3166 7777 Direct: +61 (7) 3166 7684 Fax: +61 (7) 3368 3754 Mobile: +61 438 772 425 61 Petrie Terrace, Brisbane, Queensland Australia 4011 ***************************** NOTICE - This message from Hatch is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential or proprietary. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, arrive late or contain viruses. By communicating with us via e-mail, you accept such risks.� When addressed to our clients, any information, drawings, opinions or advice (collectively, "information") contained in this e-mail is subject to the terms and conditions expressed in the governing agreements.� Where no such agreement exists, the recipient shall neither rely upon nor disclose to others, such information without our written consent.� Unless otherwise agreed, we do not assume any liability with respect to the accuracy or completeness of the information set out in this e-mail.� If you have received this message in error, please notify us immediately by return e-mail and destroy and delete the message from your computer.

3 5

Free Radius Issues
by Chris Kilian 02 Mar '11

02 Mar '11

Hi Guys I am new to Freeradius and have got it working with Mysql , however run into an issue whereby I am seeing this for all requests rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [chrisk/password] (from client seccom port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> chrisk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Can anyone help or let me know what other info may be required Thanks

4 4

RE: Clarification / Confirmation needed re: Free Radius against Active Directory
by Sallee, Stephen (Jake) 02 Mar '11

02 Mar '11

Just a word of warning, manually setting Authtype = ANTHING is usually a bad idea. FR is really good about figuring out what to do all on its own, if you force an auth type it will very likely break something else. Jake Sallee Network Engineer University of Mary Hardin-Baylor Fone: 254-295-4658 Phax: 254-295-4221 > -----Original Message----- > From: freeradius-users-bounces+jake.sallee=umhb.edu(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jake.sallee=umhb.edu(a)lists.freeradius.org] On Behalf Of Moe, > John > Sent: Tuesday, March 01, 2011 3:26 PM > To: FreeRadius users mailing list > Subject: RE: Clarification / Confirmation needed re: FreeRadius against > ActiveDirectory > > > -----Original Message----- > > From: freeradius-users-bounces+jmoe=hatch.com.au(a)lists.freeradius.org > > [mailto:freeradius-users- > > bounces+jmoe=hatch.com.au(a)lists.freeradius.org] On Behalf Of Alan > > bounces+DeKok > > Sent: Tuesday, 1 March 2011 5:51 PM > > To: FreeRadius users mailing list > > Subject: Re: Clarification / Confirmation needed re: FreeRadius > > against ActiveDirectory > > > > Moe, John wrote: > > > Now, I've read a lot of configuration pages (for Ubuntu, Samba, > > Winbind, > > > and FreeRadius, to name a few) in the last few days, and my head's > > > spinning a bit, and I'd like to make sure I'm doing this right, and > > I've > > > managed to grasp a few things... > > > > The definitive guide is here: > > > > http://deployingradius.com/documents/configuration/active_directory.ht > > m > > l > > > > It's simple, clear, and contains just enough information to allow > > you to get it to work. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > Yeah, the information in that one is, as you said, simple and "just enough". > However, it doesn't address either of the two questions I asked. > > 1) Is setting "Auth-Type = ntlm_auth" the correct way for doing what I want, > or have I mis-configured something so that FreeRadius could work out that it > needs to use ntlm_auth on its own? > 2) How do I match a rule against AD Group membership? This one was > answered in a previous reply, and I think I can work out the implementation > details from there, I just need to do some work and testing. > > If anyone knows the answer to the first question, I'd appreciate it. > > John H. Moe > Network Support - Hatch IT > HATCH > Tel: +61 (7) 3166 7777 > Direct: +61 (7) 3166 7684 > Fax: +61 (7) 3368 3754 > Mobile: +61 438 772 425 > 61 Petrie Terrace, Brisbane, Queensland Australia 4011 > > ***************************** > NOTICE - This message from Hatch is intended only for the use of the > individual or entity to which it is addressed and may contain information > which is privileged, confidential or proprietary. > Internet communications cannot be guaranteed to be secure or error-free as > information could be intercepted, corrupted, lost, arrive late or contain > viruses. By communicating with us via e-mail, you accept such risks.? When > addressed to our clients, any information, drawings, opinions or advice > (collectively, "information") contained in this e-mail is subject to the terms > and conditions expressed in the governing agreements.? Where no such > agreement exists, the recipient shall neither rely upon nor disclose to others, > such information without our written consent.? Unless otherwise agreed, we > do not assume any liability with respect to the accuracy or completeness of > the information set out in this e-mail.? If you have received this message in > error, please notify us immediately by return e-mail and destroy and delete > the message from your computer.

2 1

Radsec support on FR?
by Panagiotis Georgopoulos 01 Mar '11

01 Mar '11

Hello there, Judging from the website and the archives in the mailing list, native support for Radsec is planned on FR. Is there anyone actively working on this? Is there any timescale for this to be streamed on the main codebase? Thanks a lot in advance, Panos

4 7

Open Directory Howto
by Raymond Norton 28 Feb '11

28 Feb '11

Is there a good howto on setting up freeradius to work with Open Directory? (Freeradius will be on stand alone box)

2 2

Radius - Ldap
by Kyle Jake Plimack 28 Feb '11

28 Feb '11

I've configured radius to use ldap for authorization and authentication. Authorization works fine, but will allow access to authorized users without a correct password. Why? ldap stores passwords using SSHA encryption. Is there any way to: a. provide radius with the key/salt so it can compare the passwords properly b. have radius bind as the user to check that the password is correct? c. option I haven't thought of yet? Kyle Plimack KYLE J PLIMACK / SYSTEMS ADMINISTRATOR 415.531-9827 www.saymedia.com www.facebook.com/saymedia www.twitter.com/saymediainc

2 1