- Freeradius-Users - lists.freeradius.org

rlm_perl / libtool / libltdl problem
by Garber, Neal 24 Aug '09

24 Aug '09

I've had FR 2.1.6 running on a FreeBSD 7.2 test server for some time now. When I applied the rlm_mschap / rlm_eap_mschap patch I worked on over the weekend (which is working great btw - I will upload it shortly), I now get the following error on FR startup: Can't load '/usr/local/lib/perl5/5.8.8/mach/auto/Data/Dumper/Dumper.so' for module Data::Dumper: /usr/local/lib/perl5/5.8.8/mach/auto/Data/Dumper/Dumper.so: Undefined symbol "Perl_sv_cmp" at /usr/local/lib/perl5/5.8.8/mach/XSLoader.pm line 70. at /usr/local/lib/perl5/5.8.8/mach/Data/Dumper.pm line 36 My friend google tells me that others have had this problem in the past (esp. on Debian) and the workaround is to use LD_PRELOAD=path_to_libperl.so /usr/local/sbin/radiusd This does, in fact, work; but, isn't very satisfying as a permanent solution. I believe that libtool and libltdl were updated during the install of the patch and this is the source of the problem. I'm now running FreeBSD 7.2 with libltdl-2.2.6a & libtool-2.2.6a (they were at 2.2.5 before). Is anyone aware of any compatibility issues with libtool/libltdl 2.2.6a and FreeRADIUS? Anyone have a more permanent solution that avoids the LD_PRELOAD ugliness? I've tried rebuilding FR from the port with no subsequent patches and received the same result (FR wouldn't start without the LD_PRELOAD). I also tried using the portdowngrade port to downgrade libtool & libltdl back to 2.2.5 which didn't seem to have this problem. However, it only displayed 2.2.6a (i.e., I couldn't downgrade). rlm_perl seems to be pointing to the proper libperl.so as shown below: ldd output on rlm_perl.so shows: /usr/local/lib/freeradius-2.1.6/rlm_perl.so: libfreeradius-radius-2.1.6.so => /usr/local/lib/freeradius-2.1.6/libfreeradius-radius-2.1.6.so (0x2816c000) libperl.so => /usr/local/lib/perl5/5.8.8/mach/CORE/libperl.so (0x28187000) libm.so.4 => /lib/libm.so.4 (0x28294000) libcrypt.so.3 => /lib/libcrypt.so.3 (0x282aa000) libutil.so.5 => /lib/libutil.so.5 (0x282c2000) libtool output for rlm_perl: libtool: install: warning: relinking `rlm_perl.la' libtool: install: (cd /usr/ports/net/freeradius2/work/freeradius-server-2.1.6/src/modules/rlm_perl; /bin/sh /usr/local/bin/libtool --mode=relink cc -release 2.1.6 -module -export-dynamic -L/usr/local/lib -pthread -o rlm_perl.la -rpath /usr/local/lib/freeradius-2.1.6 rlm_perl.lo rlm_perl.c /usr/ports/net/freeradius2/work/freeradius-server-2.1.6/src/lib/libfreeradius-radius.la -Wl,-R/usr/local/lib/perl5/5.8.8/mach/CORE -pthread -Wl,-E -L/usr/local/lib /usr/local/lib/perl5/5.8.8/mach/auto/DynaLoader/DynaLoader.a -L/usr/local/lib/perl5/5.8.8/mach/CORE -lperl -lm -lcrypt -lutil ) *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/local/lib/perl5/5.8.8/mach/auto/DynaLoader/DynaLoader.a is not portable! libtool: relink: cc -shared .libs/rlm_perl.o -Wl,-rpath -Wl,/usr/local/lib/freeradius-2.1.6 -L/usr/local/lib -L/usr/local/lib/freeradius-2.1.6 -lfreeradius-radius -pthread /usr/local/lib/perl5/5.8.8/mach/auto/DynaLoader/DynaLoader.a -L/usr/local/lib/perl5/5.8.8/mach/CORE -lperl -lm -lcrypt -lutil -pthread -Wl,-R/usr/local/lib/perl5/5.8.8/mach/CORE -pthread -Wl,-E -pthread -pthread -pthread -pthread -Wl,-soname -Wl,rlm_perl-2.1.6.so -o .libs/rlm_perl-2.1.6.so libtool: install: /usr/ports/net/freeradius2/work/freeradius-server-2.1.6/install-sh -c -c .libs/rlm_perl-2.1.6.soT /usr/local/lib/freeradius-2.1.6/rlm_perl-2.1.6.so libtool: install: (cd /usr/local/lib/freeradius-2.1.6 && { ln -s -f rlm_perl-2.1.6.so rlm_perl.so || { rm -f rlm_perl.so && ln -s rlm_perl-2.1.6.so rlm_perl.so; }; }) libtool: install: /usr/ports/net/freeradius2/work/freeradius-server-2.1.6/install-sh -c -c .libs/rlm_perl.lai /usr/local/lib/freeradius-2.1.6/rlm_perl.la libtool: install: /usr/ports/net/freeradius2/work/freeradius-server-2.1.6/install-sh -c -c .libs/rlm_perl.a /usr/local/lib/freeradius-2.1.6/rlm_perl.a libtool: install: chmod 644 /usr/local/lib/freeradius-2.1.6/rlm_perl.a libtool: install: ranlib /usr/local/lib/freeradius-2.1.6/rlm_perl.a Thanks, in advance, for any help you can provide..

3 5

Freeradius help to update /etc/hosts?
by Dave 24 Aug '09

24 Aug '09

Ive been using freeradius for years to authenticate pppoe users for my WISP., Customers get dynamic IP addresses from an IP pool. Im going to be implementing a new monitoring system, and I need to use hostnames to check on customer status. Anyone have ideas how freeradius can update a DNS server such as BIND or other linux DNS server? Is it possible?

2 1

Freeradius updating /etc/hosts?
by Dave 24 Aug '09

24 Aug '09

Ive been using freeradius for years to authenticate pppoe users for my WISP., Customers get dynamic IP addresses from an IP pool. Im going to be implementing a new monitoring system, and I need to use hostnames to check on customer status. Anyone have ideas how freeradius can update /etc/hosts so a dns server such as dnsmasq can serve the hostnames of customers as their IP changes?

1 0

Invitation to connect on LinkedIn
by Durai C 23 Aug '09

23 Aug '09

1 0

IPv6 and packet sending
by Alan Buxey 23 Aug '09

23 Aug '09

hi, in my proxy.conf I have a FQDN for a proxy destination. that FQDN has a AAAA record (and all other operations to it from the server us IPv6 for transit). however, FreeRADIUS doesnt want to talk to that remote proxy via IPv6 anyone else successfully SENDING proxied packets from FreeRADIUS using IPv6? have you had to change/bork something to make it use IPv6 for the transit instead of IPv4? the FQDN also has an A record...but the RFC states that if theres a AAAA for the target then it should be used in preference to the A record..... alan

2 3

Bandwidth & Hardware Requirement Question
by Deepak 23 Aug '09

23 Aug '09

Hi all, I have done basic setup of freeradius and tested in my old PC (PIII). Now I want to do the real thing but I need some estimation regarding this. Can somebody share their knowledge on this? What is the bandwidth requirement for dedicated radius service based on numbers of user or hotspots. Yes I know more the better and more users mean more bandwidth but is there a rough formula for this? X users = Y bandwidth (roughly) Besides what kind of hardware (can I use desktop computers for this purpose), minimum memory? Can I use the radius and mysql in same server or run separate in same LAN? (recommendation) Also I need a rough estimate on how many users can be handled by one server with certain hardware+memory ideally. Some expert advice is greatly appreciated Thanks -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

4 5

MSChap via ntlm_auth problem
by Anton Brinyov 22 Aug '09

22 Aug '09

Hi! I tried to use aythentication via Active Directory domain. FreeRadius 2.1.6 return error: [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for BAS with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=BAS [mschap] mschap2: bb [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=256c4a167da6dfb6 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=d57ebadb8c21cc5b95dfc9022b621678897e529734e979ba Exec-Program output: Exec-Program: Abnormal child exit: Invalid argument [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. If I call ntlm_auth from shell I get right answer. It was tested with samba-3.0.35 and samba 3.3.4. My radiusd.conf, modules/mschap and dump of radiusd output in attachments. Thanks, Anton.

4 18

Accounting Exec-Program
by David Rodríguez Fernández 22 Aug '09

22 Aug '09

Hi list. This is my first message to the list. I have read a lot before send this message. I have freeradius version 2.1.6 and want to for every accounting packet exec a script. I have configured the ${confdir}/modules/files file with: acctusersfile = ${confdir}/acct_users and my acct_users file have: DEFAULT Acct-Status-Type == Start Exec-Program = "/etc/rad216-gprs/raddb/user_login.pl" DEFAULT Acct-Status-Type == Stop Exec-Program = "/etc/rad216-gprs/raddb/user_login.pl" The accounting is working, the radius server stores the accounting data in files, but don't execute my script. This script was working with a previous version of freeradius. I'm missing some configuration parameter, but I don't know what. Can you help? Thanks in advance.

2 1

Re: Values from LDAP
by John Smith 21 Aug '09

21 Aug '09

>>>Map the attributes in ldap.attrmap. >> >> Thanks for the prompt reply. I have put something in there: >> replyItem My-Email mail >> >> and I've tried things like %{My-Email} ... but that didn't work. > >If you have defined My-Email in freeradius then it will be %{reply:My-Email}. In my dictionary, I have: ATTRIBUTE My-Email 3010 string I can now do Reply-Message += "%{reply:My-Email}" in a post-auth section and it works. However if I change (in ldap.attrmap) mail to dn, the Reply-Message contains "". Should it be possible to read the dn in this same way? >> Can you suggest a suitable way to use this? > >replyItem Reply-Message mail > >You can add += at the end if you might be sending more messages. If I do: replyItem Reply-Message mail Then it works, however if I put the += after it, it doesn't appear. In this specific case, this is the first place Reply-Message is given a value, so appending isn't necessary, however in future cases(when not using Reply-Message) it might be useful to be able to do this. Cheers, -John -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

Re: Values from LDAP
by John Smith 21 Aug '09

21 Aug '09

>> To being with I'd like to put 'mail' or 'ou' into the Reply-Message >> attribute - does anyone have any suggestions? (This is the first time I'm >> using LDAP, so please go easy if I've missed something obvious). > >Map the attributes in ldap.attrmap. Thanks for the prompt reply. I have put something in there: replyItem My-Email mail and I've tried things like %{My-Email} ... but that didn't work. I've looked through the docs at http://wiki.freeradius.org/Rlm_ldap but that didn't help. Can you suggest a suitable way to use this? Cheers, -John -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1