- Freeradius-Users - lists.freeradius.org

FreeRADIUS 2.1.7 and 2.1.8 fail to build
by Joey Officer 16 Mar '10

16 Mar '10

Trying to build FreeRADIUS from Gentoo's package system, or manually building it from the downloaded sources and I receive the following errors: building manually: gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /root/build/freeradius-server-2.1.8/src/lib/.libs/libfreeradius-radius.s o -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -lssl -lcrypto -ldl .libs/modules.o: In function `setup_modules': /root/build/freeradius-server-2.1.8/src/main/modules.c:1358: undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/root/build/freeradius-server-2.1.8/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/build/freeradius-server-2.1.8/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/build/freeradius-server-2.1.8/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/build/freeradius-server-2.1.8' make: *** [all] Error 2 I found the following thread: http://lists.cistron.nl/pipermail/freeradius-users/2009-September/msg001 49.html I see that when I try to build manually I am getting basically the same thing. I'm the first to admit I may be missing something in Alan's notes about updating the freeradius source code. What I believe he meant was to update ltmain.sh in the root of the extracted FreeRADIUS directory. I made the following change: from: #define lt_preloaded_symbols some_other_symbol to: #define lt__PROGRAM__LTX_preloaded_symbols t__PROGRAM__LTX_preloaded_symbols I run make clean, configure, and make again, and still receive the same error. So I'm probably missing something in this step. When I try to compile from within Gentoo's package management tools, I get the following: gentoo emerge: libtool: compile: i686-pc-linux-gnu-gcc -O2 -mtune=i686 -pipe -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2. 1.7/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.7\" -DOPENSSL_NO_KRB5 -c event.c -fPIC -DPIC -o .libs/event.o event.c: In function 'wait_a_bit': event.c:1163: warning: implicit declaration of function 'pthread_equal' event.c:1163: error: 'REQUEST' has no member named 'child_pid' event.c:1163: error: 'NO_SUCH_CHILD_PID' undeclared (first use in this function) event.c:1163: error: (Each undeclared identifier is reported only once event.c:1163: error: for each function it appears in.) event.c:1174: error: 'wait_for_child_to_die' undeclared (first use in this function) event.c: In function 'radius_event_init': event.c:3440: warning: unused variable 'attr' gmake[4]: *** [event.lo] Error 1 gmake[4]: Leaving directory `/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2.1 .7/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2.1 .7/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2.1 .7/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/var/tmp/portage/net-dialup/freeradius-2.1.7/work/freeradius-server-2.1 .7' make: *** [all] Error 2 Unfortunately, I wasn't able to find reference of this within the existing archives for FreeRADIUS. One thing to point out is that the Gentoo package is based off of 2.1.7 and when I attempt to build from source it is 2.1.8. Any help would be fantastic. If possible I'd prefer to get it working within the existing package system, using the build from source as a last resort. Thanks, joey

2 1

About FreeRADIUS-Stats-Client-IP-Address
by Sergio Belkin 16 Mar '10

16 Mar '10

Hi, When I issue the following command on the shell: echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-IP-Address = 10.128.255.80" | radclient localhost:18120 status MySecret It gets global statistic and *not only* those of Client. Is there a way to get *only* stats from Client? Thanks in advance! -- -- SB http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Accounting and Segmentation Fault
by matthew.stringer＠bt.com 16 Mar '10

16 Mar '10

Hi all, I am a bit of a FreeRadius newbie and am having some issues with the accounting, getting segmentation fault reported back. I have FreeRadius 2.1.8 running on CentOS 5.4, set up in a pretty basic configuration. It is authenticating to a MySQL database that contains records for 300,000 users, again very basic info in the database. I am using RadPerf version 1.1a to have a number of users authenticated and then asking for accounting requests, the number needs to be up to 200,000 but at the moment I am having issues with 1,000 users. Basically RadPerf goes off and starts the authentication and then comes back and reports 'Segmentation Fault (Core Dump)' and then stops everything. Anybody got any ideas that may help with this? Thanks in advance Matt Stringer

2 1

vrf-aware vpdn / l2tp termination / cisco-avpair
by Alexander 16 Mar '10

16 Mar '10

Hello all, I am using FreeRadius 2.1.8 with MySQL to authenticate BBA users. I get L2TP sessions from my ISP (=LAC) arriving in VRF l2tp_vrf which I want to terminate in a different VRF (e.g. inet_vrf). Basic authentication works as long as I do not intruduce cisco-avpair attributes. Which ones do I need? I tried "lcp:interface-config#1=ip vrf forwarding (inet_vrf)" and "ip:vrf-id:=inet_vrf" in my radgroupreply table - without success. From the "debug radius authentication" I see "AAA Unsupported Attr: interface" and "parse unknown cisco vsa "vrf-id:". Here are some parts of my Cisco config: aaa authentication login default local aaa authentication ppp default group radius aaa authorization exec default local aaa authorization network default group radius aaa accounting delay-start aaa accounting update newinfo aaa accounting exec default action-type start-stop group radius aaa accounting network default action-type start-stop broadcast group radius aaa accounting connection default action-type start-stop group radius aaa session-id common vpdn-group 1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname LAC vpn vrf l2tp_vrf source-ip xxx.xxx.xxx.xxx local name LNS l2tp tunnel password 0 xyz ip mtu adjust interface Virtual-Template1 mtu 1460 ip unnumbered Loopback0 no snmp trap link-status peer default ip address pool INET_ADDR_POOL no keepalive ppp mru match ppp authentication pap callin ppp ipcp mask 255.255.255.255 end What am I missing? Thanks in advance! Cheers, Alexander

1 1

convert mysql from ICRadius to Free
by Len Conrad 16 Mar '10

16 Mar '10

We can't find any info how to do this, but we can't be the first, either. Anybody got howtos or recipes for converting MySQL db? Len

2 1

eapol_test retransmits 10 times
by R C 15 Mar '10

15 Mar '10

Hi, My eapol_test retransmits 10 times even though i set the RADIUS_CLIENT_MAX_RETRIES to 0. How can i avoid it retransmitting 10 times? It retransmits 10 times every 150 seconds. ________________________________ /* Defaults for RADIUS retransmit values (exponential backoff) */ #define RADIUS_CLIENT_FIRST_WAIT 150 /* seconds */ #define RADIUS_CLIENT_MAX_WAIT 120 /* seconds */ #define RADIUS_CLIENT_MAX_RETRIES 0 /* maximum number of retransmit attempts * before entry is removed from retransmit * list */ #define RADIUS_CLIENT_MAX_ENTRIES 0 /* maximum number of entries in retransmit * list (oldest will be removed, if this * limit is exceeded) */ #define RADIUS_CLIENT_NUM_FAILOVER 4 /* try to change RADIUS server after this * many failed retry attempts */ ________________________________ thanks, rc

2 2

accounting on msql
by omega bk 15 Mar '10

15 Mar '10

hi, just want to manage accounting on mysql so i coyed the schema.sql in /etc/freeradius, did mysql -u root -p accounting < schema.sql and i got this. *ERROR 1064 (42000) at line 17: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '[radacct] ( [RadAcctId] [numeric](21, 0) IDENTITY (1, 1) NOT NULL , [AcctSessi' at line 1* i compare the schema.sql to one at http://wiki.freeradius.org/MS-SQL_DDL_script , nothing changed. somebody as a clue? thanks

2 1

Dynamically assign realm name when using DEFAULT realm
by Jer Peterson 15 Mar '10

15 Mar '10

I am using FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu I am trying to take the username of a format 'realm/username' and have FreeRADIUS take the 'realm' and pass it on in a sql query using %{Realm} and take the 'username' and pass it on with %{SQL-User-Name}. I have found I can do a DEFAULT realm, but the realm is passed on as DEFAULT instead of the name of the realm that was tried. Is there a better way to get the realm the user entered and pass it on in a SQL query? I have a SQL table with usernames and locations. When a user authenticates I want the username to match the username field only if the realm matches the location field in the database. Jer

1 0

ldap auto header MS-CHAPv2
by omega bk 15 Mar '10

15 Mar '10

hi, how can i handle encrypted users's ldap password ? pap reckognize my ssha1 from base64 encoding => because of the auto_header to yes but it looks like MS-CHAP does not kwow how to deal with... [ldap] Added User-Password = {SSHA}2FJYOM+C3mqL2g6wOhcLfjMY2XdoQ4bi in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Cleartext-Password == "{SSHA}2FJYOM+C3mqL2g6wOhcLfjMY2XdoQ4bi" [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing SSHA1-Password from base64 encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject thank u

3 4

Re: MS-CHAP2-Response is incorrect + invalid NT-Password
by omega bk 15 Mar '10

15 Mar '10

sorry for spamming, i just want to understand *OpenLDAP knows the clear text password:* [ldap] userPassword -> Cleartext-Password == "test " [ldap] userPassword -> NT-Password == 0x7465737420 *=> supposed to be the hash password* [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} *Is the inner tunnel part of the MSCHAPv2 is failing because it doesn't kwow the way of dealing with the password supplied ?* *Adding into ldap.attrmap the userPassword -> NT-Password is enough to produce a correct NT hash password? *[mschap] Invalid NT-Password * * [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE

3 8