- Freeradius-Users - lists.freeradius.org

winbindd_privileged error?
by freeradius＠corwyn.net 09 Jan '10

09 Jan '10

I had everything working fine, and now it's not. (I use the ldap module to auth) When I look through the logs, I'm getting a winbindd_privileged error. I've seen that before, where you apply: chgrp radiusd /var/cache/samba/winbindd_privileged chmod g+rw /var/cache/samba/winbindd_privileged but that doesn't seem to be resolving in this case. I believe I did run yum update today and it updated samba. winbind won't start. Jan 8 17:09:45 ns5 winbindd[2086]: initialize_winbindd_cache: clearing cache and re-creating with version number 1 Jan 8 17:09:45 ns5 winbindd[2086]: [2010/01/08 17:09:45, 0] lib/util_sock.c:create_pipe_sock(1280) Jan 8 17:09:45 ns5 winbindd[2086]: invalid permissions on socket directory /var/cache/samba/winbindd_privileged Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 3

two user authentication groups for one AS
by Eric 09 Jan '10

09 Jan '10

Yes you are right but I have some problems in config: I set a vpn server address in client.conf and in users as: DEFAULT Client-IP-Address == 192.168.20.13, Auth-Type := Vpn, Autz-Type := Vpn, in radiusd.conf: ldap ldap-Vpn{ server = "192.168.10.1" ..... profile_attribute = "vpnProfileDn" access_attr = "vpnAccess" .... } sqlcounter monthly-Vpn { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql-Vpn key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > %b " } Autz-Type Vpn{ ldap-Vpn monthly-Vpn } Auth-Type Vpn{ ldap-Vpn } Acct-Type Vpn { sql-Vpn } Now the users that come from this vpn server are the same but there are parameters in ldap server that are different in admins and other users. I want give to admins' session-timeout different amount than others, but counter gives remain of monthly-count to users as session-timeout. It is good for regular users but how and where I should give this parameter to admins as different amount?

1 0

Design question considering 802.1x + edirectory + Active Directory
by Ric2009 09 Jan '10

09 Jan '10

Hello, I would like to know if anyone could help me with the design of this implementation : Requirements : - 802.1x Authentication for wired and wireless clients ( Windows XP with Novell Client ) - Single sign on login to Novell eDirectory and Active Directory - Radius Authentication should run over FreeRadius or IAS but not both, if it's possible. - High Availability is required for Radius service - Virtualization of the Radius servers is recommended Questions : - I have been looking at multi-platform 802.1x clients like Juniper Networks Odyssey Access Client ( OAC ) for multiplaform 802.1x login. But I don't know if it's possible to do the same without it. - Is there any downloadable Freeradius + LDAP virtual machine for testing ?? Thanks a lot !!!!! Ric2009 -- View this message in context: http://old.nabble.com/Design-question-considering-802.1x-%2B-edirectory-%2B… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

ld.so.1: radiusd: fatal: relocation error: file /usr/local/lib/rlm_sql_mysql-2.1.7.so: symbol mysql_next_result: referenced symbol not found
by Nereida Bernal 09 Jan '10

09 Jan '10

Hi all! I am testing my FreeRADIUS configuration using the NTRadPing Test Utility, but as soon as I send the user/password to the server I get the the error "ld.so.1: radiusd: fatal: relocation error: file /usr/local/lib/rlm_sql_mysql-2.1.7.so: symbol mysql_next_result: referenced symbol not found" and process radiusd is killed. I am not familiar with FreeRADIUS (This is my first installation) Could you help me? SUN Netra 210 FreeRADIUS Version 2.1.7 SO Solaris 10 MySQL 5.0.88 (32 bits) Packages installed: - SMCdb db - SMCgcc gcc - SMClgcc346 libgcc - SMClibidl libidl - SMClibt libtool - SMCliconv libiconv - SMCmake make - SMCmysql mysql - SMColdap openldap - SMCossl openssl - SMCsasl sasl Here's what I got from the radiusd debug bash-3.00# rad_recv: Access-Request packet from host 147.1.4.228 port 4138, id=4, length=44 User-Name = "test" User-Password = "radius123" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id ld.so.1: radiusd: fatal: relocation error: file /usr/local/lib/rlm_sql_mysql-2.1.7.so: symbol mysql_next_result: referenced symbol not found [1]+ Killed radiusd -X This is how I executed the configure command: /opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7 bash-3.00# ./configure --with-mysql-lib-dir=/usr/local/mysql/lib --with-mysql-include-dir=/usr/local/mysql/include --with-openssl --with-openssl-includes=/usr/sfw/include/openssl --with-openssl-libraries=/usr/sfw/bin/openssl | grep WARNI config.status: WARNING: ./Make.inc.in seems to ignore the --datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: silently not building rlm_eap_peap. configure: WARNING: FAILURE: rlm_eap_peap requires: OpenSSL. configure: WARNING: silently not building rlm_eap_tls. configure: WARNING: FAILURE: rlm_eap_tls requires: OpenSSL. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_eap_ttls. configure: WARNING: FAILURE: rlm_eap_ttls requires: OpenSSL. configure: WARNING: neither krb5 'k5crypto' nor 'crypto' libraries are found! configure: WARNING: the comm_err library isn't found! configure: WARNING: silently not building rlm_krb5. configure: WARNING: FAILURE: rlm_krb5 requires: krb5.h. configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-libs openssl-includes openssl-includes openssl-includes openssl-includes openssl-includes. configure: WARNING: silently not building rlm_perl. configure: WARNING: FAILURE: rlm_perl requires: EXTERN.h perl.h libperl.so libperl.so. configure: WARNING: silently not building rlm_python. configure: WARNING: FAILURE: rlm_python requires: Python.h libpython2.3. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. Thanks! Nere

2 3

rlm_perl symbol lookup errors
by Alexander Clouter 08 Jan '10

08 Jan '10

Hi, Running 2.1.8 on Debian lenny and recently have been playing around with rlm_perl. Got the following when I include Net::LDAP or Data::Dumper in my perl module: ---- Net::LDAP ---- garibaldi:/home/ac56# freeradius -X [snipped] freeradius: symbol lookup error: /usr/lib/perl/5.10/auto/IO/IO.so: undefined symbol: Perl_Istack_sp_ptr ------------------- ---- Data::Dumper ---- Can't load '/usr/lib/perl/5.10/auto/Data/Dumper/Dumper.so' for module Data::Dumper: /usr/lib/perl/5.10/auto/Data/Dumper/Dumper.so: undefined symbol: Perl_sv_cmp at /usr/lib/perl/5.10/XSLoader.pm line 64. at /usr/lib/perl/5.10/Data/Dumper.pm line 36 Compilation failed in require at /usr/src/otp-perl/rfc2289.pm line 8. BEGIN failed--compilation aborted at /usr/src/otp-perl/rfc2289.pm line 8. rlm_perl: perl_parse failed: /usr/src/otp-perl/rfc2289.pm not found or has syntax errors. /etc/freeradius/LOCAL/gtc-trial.perl[7]: Instantiation failed for module "gtc-trial.perl" /etc/freeradius/sites-enabled/gtc-trial[46]: Failed to find module "gtc-trial.perl". /etc/freeradius/sites-enabled/gtc-trial[46]: Failed to parse "gtc-trial.perl" entry. ---------------------- I am guessing this is probably all due to the previously reported libtool 'fun' issues[1]? I'm only curious if what I am seeing is to be expected or have I borked something with my install? Is there is a more formal 'fix' than just to run freeradius with "LD_PRELOAD=/usr/lib/libperl.so.5.10" prepended to it? Happy New Year All. Cheers [1] http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg56983.… P.S. seems there is a missing </li> on the freeradius homepage so the recent news after the first item is left wedged over -- Alexander Clouter .sigmonster says: Your supervisor is thinking about you.

3 3

Ang: Re: Does FreeRadius support different replies for same user via check-attributes?
by Tobbe & Millan 08 Jan '10

08 Jan '10

Thanks! Can "unlang" be used directly when reply attribute is set? I do not want to have a if-statement for each user. It would cause problems if I have hundreds of users... My hopes was that in mySQL (which I'm using) I could have 2 check attributes (for Go1 and Go2) and then directly set the corresponding service in a value in the "radreply" table. Could unlang be used in a common way for all users? Best regards, Tobian ----Ursprungligt meddelande---- Från: jjj.hooper(a)bristol.ac.uk Datum: 2010-jan-08 15:46 Till: "FreeRadius users mailing list"<freeradius-users@lists. freeradius.org> Ärende: Re: Does FreeRadius support different replies for same user via check-attributes --On Friday, January 08, 2010 03:35:00 PM +0100 Tobbe & Millan <ejp252l(a)tninet.se> wrote: > Hi! > > I would like a specific request item to set which attribute to reply. > > For example... > IF; > A request comes with User-Name: "XXX", Password: "YYY" and Attribute > A = "Go1" > The Access-Accept should include Attribute Go="Service1" > BUT IF; > A request comes with User-Name: "XXX", Password: "YYY" and Attribute > A = "Go2" > The Access-Accept should include Attribute Go="Service2" > > Is this possible? It is. <http://freeradius.org/radiusd/man/unlang.html> -James -- James J J Hooper Network Specialist Information Services University of Bristol http://www.wireless.bristol.ac.uk http://www.jamesjj.net -- - List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html

2 1

Does FreeRadius support different replies for same user via check-attributes?
by Tobbe & Millan 08 Jan '10

08 Jan '10

Hi! I would like a specific request item to set which attribute to reply. For example... IF; A request comes with User-Name: "XXX", Password: "YYY" and Attribute A = "Go1" The Access-Accept should include Attribute Go="Service1" BUT IF; A request comes with User-Name: "XXX", Password: "YYY" and Attribute A = "Go2" The Access-Accept should include Attribute Go="Service2" Is this possible? Thanks in advance! Tobian

2 1

radiusd -X On First Boot
by Brian Carpio 08 Jan '10

08 Jan '10

I am running RHEL 5.3 and FreeRADIUS Version 2.1.8. When I install freeradius and attempt to start it for the first time using the /etc/init.d/radiusd start script it always fails (only right after freeradius is installed), once i run freeradius with -X (in debug mode) it creates all the keys and such then I can cntrl + c and start free radius from that point forward using the init script... my question is why do I have to do this? Is there anyway around this? Thanks, Brian Carpio

12 28

cisco_vsa_hack
by Joe Maimon 08 Jan '10

08 Jan '10

Does turning on the hack do anything to the attributes other than adding the value to matching defined attributes? From the code: if ((vp->attribute & 0xffff) == 1) { const char *p; DICT_ATTR *dattr; p = vp->vp_strvalue; gettoken(&p, newattr, sizeof(newattr)); if (((dattr = dict_attrbyname(newattr)) != NULL) && (dattr->type == PW_TYPE_STRING)) { VALUE_PAIR *newvp; /* * Make a new attribute. */ newvp = pairmake(newattr, ptr + 1, T_OP_EQ); if (newvp) { pairadd(&vp, newvp); } } } else { /* h322-foo-bar = "h323-foo-bar = baz" */ /* * We strip out the duplicity from the * value field, we use only the value on * the right side of the '=' character. */ strlcpy(newattr, ptr + 1, sizeof(newattr)); strlcpy((char *)vp->vp_strvalue, newattr, sizeof(vp->vp_strvalue)); vp->length = strlen((char *)vp->vp_strvalue); }

2 1

freeradius proxy with 802.1x termination
by jgammons＠gmail.com 07 Jan '10

07 Jan '10

I am attempting to configure freeradius to terminate an 802.1x EAP-TTLS authentication, but forward/proxy the user/pass to another radius server. I can get it to standard proxy, and I can get it to function as a standalone radius server with EAP-TTLS, but can't seem to find any good information on how to do this.... I assume someone has been there done that... any help would be greatly appreciated. Thanks, John

4 6