- Freeradius-Users - lists.freeradius.org

Installation on debian with postgresql
by Michele Petrazzo - Unipex 30 Aug '10

30 Aug '10

Hi list, I'm trying to install freeradius 2.0.4 on debian lenny and, after some googling, I'm arrived at the freeradius wiki (wiki.freeradius.org/SQL_HOWTO) that create me some headache... Starting from say that I don't know if this can be wiki or debian problems (since, like all known, debian make modifies into all sources), I report here some consideration about that wiki page. Starting saying that on my default configuration, I haven't found the "authorise {}" section, but only the authorize ones, the other chapter " Populating SQL", refer a table that doesn't exist on the schema.sql. I'm speaking about usergroup. A part of ask someone if can modify that page, my question is if there is a guide to the parameters that I can set to the various sql tables present on the same page. (for example like that fro the operators) Thanks, Michele

3 4

symbol 'ber_pvt_opt_on' not found
by Fernando Calvelo Vazquez 30 Aug '10

30 Aug '10

Hi guys: I'm trying to activate ldap authentication part at config files. But when I uncomment next lines: Auth-Type LDAP { ldap } I get next error when service starts up Module: Checking authenticate {...} for more modules to load /opt/csw/etc/raddb/modules/ldap[29]: Failed to link to module 'rlm_ldap': ld.so.1: radiusd: fatal: relocation error: file /opt/csw/lib/rlm_ldap-2.1.6.so: symbol ber_pvt_opt_on: referenced symbol not found /opt/csw/etc/raddb/sites-enabled/default[284]: Failed to find module "ldap". /opt/csw/etc/raddb/sites-enabled/default[284]: Failed to parse "ldap" entry. I don't know what does it mean symbol demanded: 'ber_pvt_opt_on' Thanks a lot in advance for your reply. Best regards, Fernando.

1 0

Proxy not working properly with PAP
by John Campbell 30 Aug '10

30 Aug '10

We are using FreeRADIUS Version 0.9.3 (I know - it's old). We are authenticating users on a network of wireless access controllers and are trying to integrate a new type of access controller. This controller can only authenticate using PAP (I know - it's old and unsecure). We use MySQL for the user database. We have built a custom application to manage user passwords. If an authentication attempt is not successful (no user account, expired password, invalid password) then FreeRADIUS sends a proxy request to the customer application to deal with the situation. When we use PAP, FreeRADIUS is sending proxy requests to the custom application in the case of: User not in the MySQL database User is in the MySQL database but the password has expired The problem is that it is not (or at least does not appear to be) sending a proxy request in the case of: User is in the MySQL database, there is a non-expired password but the submitted password is incorrect. We have very detailed logging on the custom application starting with the reception of a message on the port - here is a sample: [10/08/29 16:26:54:567]C[PortThread ]Received message on UDP port 15000. However, in problem case we don't see anything - so it seems to me that FreeRADIUS is not proxying this authentication request to the custom application. I have searched radius.conf and proxy.conf for some setting that would manage this without luck. Also it is important to note that this problem does not occur when we are using MS-CHAPV2 which we do with other controllers we have integrated with - it seems to be associated with PAP. Also - in case you were wondering users can authenticate if they have a valid user name and password. Any suggestions would be appreciated. Regards, John

2 1

Dealing with Incomplete Sessions
by Gabriel Marais 29 Aug '10

29 Aug '10

Hi Guys I was wondering how everyone was dealing with incomplete sessions ? I have some incomplete sessions that are quite old (sometimes days) where it seems like the Stop Accounting packet sever reached my server (or for reason unknown to me). Is it wise to just run a script every x days to append a manual date/time to those sessions ? Thanks, Gabriel

2 1

aaa authentication login and dot1x with one server
by Sascha Frey 29 Aug '10

29 Aug '10

Hi all, I'm trying to set up freeradius to authenticate users logging in to our switches (Cisco IOS) and provide authentication for 802.1X. 1. SSH/Telnet access to our switches for admin users (aaa authentication login) - Every user who is able to login to the server running freeradius should be able to login to the switches (Linux server with libpam-ldapd (nslcd) and pam_access.so to limit access by netgroup) - Using PAM seems to be the right way (direct access to the LDAP database would allow all users and not only certain users with membership in the admin netgroup (pam_access with /etc/security/access.conf) 2. IEEE 802.1X with EAP-TTLS and dynamic VLAN assignment (aaa authentication dot1x) - Using the freeradius LDAP module (direct access to the LDAP database) - 802.1X users are in a separate subtree (ou=dot1x,dc=example,dc=com) How do I setup freeraius to use PAM for authenticating users? How do I combine both functions with different auth methods in one server? I found some howtos for #2, which doesn't seem to be the problem. I appreciate any help. Regards Sascha

1 0

Adding Multiple Cisco-AVPairs using rlm_perl
by James Nedila 29 Aug '10

29 Aug '10

I have a rlm_perl script where i'd like to return multiple Cisco-AVPair attributes in an Access-Accept response. Since rlm_perl is passed hashes for RAD_REQUEST, RAD_CHECK, and RAD_REPLY, is there a way to pass an array as the value for the Cisco-AVPair hash key? If not, is there another way to do this? Thanks, James

5 8

Simultaneous-Use
by Student University 28 Aug '10

28 Aug '10

Dears , i configured *Simultaneous*-*Use:=1 , i followed the document step by step but i noticed that radutmp not updated and when check this file using radwho i see an entries for previously logged users even i disconnect all users ,,, Best Regard , *

1 0

EAP-MSCHAPv2 and smbpasswd
by Jonathan Black 27 Aug '10

27 Aug '10

I've dug around in documentation looking to find out if EAP-MSCHAPv2 can use the smbpasswd file to authenticate wireless clients. Is it possible to have the smbpasswd file authenticate EAP-MSCHAPv2 requests? Thanks! Jonathan

2 1

usergroup problems with separate auth and accounting databases
by Trey Scarborough 27 Aug '10

27 Aug '10

I have to mysql configurations for one for my authentication request and one for the accounting data. When it make a groupcheck query it is always using the module for the accounting server is there anyway to make this function correctly and have it use the configuration for the authentication database. Any Ideas of why this is happening Here some output while doing a request sql1 is the authentication DB and sql2 is the accounting rad_recv: Access-Request packet from host 127.0.0.1 port 2701, id=94, length=61 User-Name = "user(a)domain.net" CHAP-Password = 0x00000000000000000000000 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "domain.net" for User-Name = "user(a)domain.net" [suffix] No such realm "vortexmail.com" ++[suffix] returns noop [sql1] expand: %{User-Name} -> user(a)domain.net [sql1] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql1): Reserving sql socket id: 4 [sql1] expand: SELECT .......................................... rlm_sql_mysql: query: SELECT ................................... [sql1] User found in radcheck table [sql1] expand: SELECT .......................................... rlm_sql_mysql: query: SELECT ................................... [sql1] expand: SELECT ........................................... rlm_sql_mysql: query: SELECT.................................... [sql1] expand: SELECT ........................................... rlm_sql_mysql: query: SELECT .................................. [sql1] sql_groupcmp [sql1] expand: %{User-Name} -> user(a)domain.net [sql1] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 4 rlm_sql (sql2): Released sql socket id: 4 [sql1] sql_groupcmp finished: User is NOT a member of group active Invalid operator for item Sql-Group: reverting to '==' rlm_sql (sql1): Released sql socket id: 4 ++[sql1] returns ok [files] sql_groupcmp [files] expand: %{User-Name} -> user(a)domain.net [files] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 3 rlm_sql (sql2): Released sql socket id: 3 [files] sql_groupcmp finished: User is NOT a member of group active [files] sql_groupcmp [files] expand: %{User-Name} -> user(a)domain.net [files] sql_set_user escaped user --> 'user(a)domain.net' rlm_sql (sql2): Reserving sql socket id: 2 rlm_sql (sql2): Released sql socket id: 2

2 8

How to debug rlm_perl in multithread?
by Eugen Konkov 27 Aug '10

27 Aug '10

HI, FreeRadius. when run radiusd -X it works fine. But when run in multithread (without -X) it core dump after ten or twelve queriest to radiusd. please help any. -- Eugen Konkov mailto:kes-kes@yandex.ru

4 3