- Freeradius-Users - lists.freeradius.org

matching on nas entry/shortname
by liran tal 08 Jul '09

08 Jul '09

Hey, Matching an entry based on the NAS's IP Address value in the request is doable via DEFAULT NAS-IP-Address == "1.2.3.4" ... How about if I wouldn't want to count on that attribute and I'd rather just want to match based on the NAS entry itself (which is read from mysql) or the shortname assigned to the NAS in that mysql database. Regards, Liran.

2 1

Re: receives 1 request --> proxy 2 requests?
by Torsten Förster 08 Jul '09

08 Jul '09

ok, next try to explain the problem: if i start radtest everything looks fine: radtest 111111@test 111111@test localhost:1645 0 *secret* Sending Access-Request of id 176 to 127.0.0.1 port 1645 User-Name = \"111111@test\" User-Password = \"111111@test\" NAS-IP-Address = 172.x.x.x NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1645, id=176, length=20 if i look in freeradius-debug: rad_recv: Access-Request packet from host 127.0.0.1 port 58236, id=177, length=64 User-Name = \"111111@test\" User-Password = \"111111@test\" NAS-IP-Address = 172.x.x.x NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20090708 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20090708 expand: %t -> Wed Jul 8 13:07:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm \"test\" for User-Name = \"111111@test\" [suffix] Found realm \"test\" [suffix] Adding Realm = \"test\" [suffix] Proxying request from user 111111 to realm test [suffix] Preparing to proxy authentication request to realm \"test\" ++[suffix] returns updated [prefix] Request already proxied. Ignoring. ++[prefix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop ------------------until here ok------------------------- Sending Access-Request of id 207 to 172.y.y.y port 1812 User-Name = \"111111@test\" User-Password = \"111111@test\" NAS-IP-Address = 172.x.x.x NAS-Port = 0 Proxy-State = 0x313737 Proxying request 34 to home server 172.y.y.y port 1812 Sending Access-Request of id 207 to 172.y.y.y port 1812 User-Name = \"111111@test\" User-Password = \"111111@test\" NAS-IP-Address = 172.x.x.x NAS-Port = 0 Proxy-State = 0x313737 -----------------why a second identical request?-------------------- Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 172.y.y.y port 1812, id=207, length=25 Proxy-State = 0x313737 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [111111@test/111111@test] (from client localhost port 0) Sending Access-Accept of id 177 to 127.0.0.1 port 58236 Finished request 34. Going to the next request Waking up in 2.9 seconds. Cleaning up request 34 ID 177 with timestamp +4454 Ready to process requests. ------------------------------End------------------------------------- So, i get an access-accept. But freeradius generates a second request. #adBox3 {display:none;}

2 1

Unable to configure rlm_ldap on Solaris 10 - doesn't find libldap_r
by Steven Carr 08 Jul '09

08 Jul '09

Hi list, I have been trying to configure FreeRADIUS 2.1.6 on Solaris 10 (sparc) but I am having issues with the rlm_ldap module not being able to locate libldap_r. I have installed the OpenSSL and OpenLDAP packages + dependencies from Sunfreeware. When issuing the plain "./configure" it returns the following: > root@radius0:/usr/local/src/freeradius/freeradius-server-2.1.6/src/modules/rlm_ldap # ./configure > ... > checking for ldap_init in -lldap_r... no > checking for ldap.h... yes > configure: WARNING: silently not building rlm_ldap. > configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > configure: creating ./config.status > config.status: creating Makefile When manually specifying the directories it still comes back with the same error: > root@radius0:/usr/local/src/freeradius/freeradius-server-2.1.6/src/modules/rlm_ldap # ./configure \ >> --with-rlm-ldap-lib-dir=/usr/local/lib \ >> --with-rlm-ldap-include-dir=/usr/local/include > ... > checking for ldap_init in -lldap_r... no > checking for ldap.h... yes > configure: WARNING: silently not building rlm_ldap. > configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > configure: creating ./config.status > config.status: creating Makefile Contents of the directories: > root@radius0:/usr/local/src/freeradius/freeradius-server-2.1.6/src/modules/rlm_ldap # ls -la /usr/local/lib/libldap* > lrwxrwxrwx 1 root root 20 Jul 8 09:10 /usr/local/lib/libldap-2.4.so.2 -> libldap-2.4.so.2.4.2 > -rwxr-xr-x 1 bin bin 306312 May 30 02:46 /usr/local/lib/libldap-2.4.so.2.4.2 > -rw-r--r-- 1 bin bin 373348 May 30 02:46 /usr/local/lib/libldap.a > -rw-r--r-- 1 bin bin 1290 May 30 02:46 /usr/local/lib/libldap.la > lrwxrwxrwx 1 root root 20 Jul 8 09:10 /usr/local/lib/libldap.so -> libldap-2.4.so.2.4.2 > lrwxrwxrwx 1 root root 22 Jul 8 09:10 /usr/local/lib/libldap_r-2.4.so.2 -> libldap_r-2.4.so.2.4.2 > -rwxr-xr-x 1 bin bin 332016 May 30 02:46 /usr/local/lib/libldap_r-2.4.so.2.4.2 > -rw-r--r-- 1 bin bin 410146 May 30 02:46 /usr/local/lib/libldap_r.a > -rw-r--r-- 1 bin bin 1304 May 30 02:46 /usr/local/lib/libldap_r.la > lrwxrwxrwx 1 root root 22 Jul 8 09:10 /usr/local/lib/libldap_r.so -> libldap_r-2.4.so.2.4.2 > root@radius0:/usr/local/src/freeradius/freeradius-server-2.1.6/src/modules/rlm_ldap # ls -la /usr/local/include/ldap* > -rw-r--r-- 1 bin bin 63828 May 30 02:46 /usr/local/include/ldap.h > -rw-r--r-- 1 bin bin 9538 May 30 02:46 /usr/local/include/ldap_cdefs.h > -rw-r--r-- 1 bin bin 1890 May 30 02:46 /usr/local/include/ldap_features.h > -rw-r--r-- 1 bin bin 9523 May 30 02:46 /usr/local/include/ldap_schema.h > -rw-r--r-- 1 bin bin 3539 May 30 02:46 /usr/local/include/ldap_utf8.h Any ideas what is going wrong? Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953

3 4

Freeradius 2.1.6: LDAP connect
by Anja Ruckdaeschel 08 Jul '09

08 Jul '09

Hello there! Hope you can help. I´m running freeradius 2.1.6 on sles 11 and do LDAP-Authentificaiton on Radius. EAP/TTLS with cleartext-password against ldap works fine. PEAP/MSCHAP with universal password retrieval works fine. Ldap-Groups work fine. Load-Balancing with multiple ldap-servers also work fine. The only problem is: From time to time! the radius-debug fpr rlm_ldap says: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in c=de, with filter (&(objectClass=inetOrgPerson)(uid=abc12345)) rlm_ldap: object not found So, radius doesn´t know the dn and can´t go on. The difference between other ldap searches and the one with this error is, that there is no new connect to the ldap-server and no new bind. Also, this never happens with the first access-request. Besides: A trace on my ldap servers shows no communication in that case (looks like radius doesntt ask after all) ... and: same problem appears with freeradius 2.1.1. Any ideas...??? Thank you very much... Kind regards Anja

1 0

How to configure 2 wimax qos profiles for the user in users file
by gayathri reddy 08 Jul '09

08 Jul '09

HI All, I am trying to configure the two wimax qos profiles for the single user as one for uplink and another for downlink. If i configure the same attributes two times, in the Access-Accept message the first configured wimax attribute value only is sending but its not sending the same attribute again which has different value. is there any way to do this and make it work? Please help me on this..... Thanks in advance, Gayathri

2 1

freeradius active directory integration fails with "no such realm"
by Andrei-Florian Staicu 08 Jul '09

08 Jul '09

Hello all, I tried to configure freeradius 2.0.4 on debian 5.0.2 (after recompiling with openssl support, as instructed in the debian readme) for authenticating wireless connections with wpa2-enterprise, using active directory user/password (windows xp as clients, d-link dwl 2200ap as ap's). I followed the how-to from http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO , but somehow i seem to fail. I know i should post here the configurations and the output of freeradius -X , but they are very long and i don't know what i should select. One thing stands out though in the output of freeradius -X (only after changing the order of suffix and ntdomain in sites-available/default and radiusd.conf: ++[mschap] returns noop rlm_realm: Looking up realm "IPSO0" for User-Name = "IPSO0\andrei.staicu" rlm_realm: No such realm "IPSO0" ++[ntdomain] returns noop rlm_realm: No '@' in User-Name = "IPSO0\andrei.staicu", looking up realm NULL rlm_realm: No such realm "NULL" IPSO0 is the realm name for the domain ipso.biz (not the public site; this is internal and resolved as such by our dns) I've tried for about two weeks now, but i still have no ideea on how to define the realm IPSO0. ntlm_auth works on that server: ntlm_auth --request-nt-key --username andrei.staicu --domain IPSO0 password: NT_STATUS_OK: Success (0x0) (note on this: using ntlm_auth –-request-nt-key –-domain=<your domain> –-username= <your username> as in the howto doesen't seem to work, but ntlm_auth –-request-nt-key –-domain <your domain> –-username <your username> works) Could you give me some pointers on how to continue? I've ran out of options with this one. If all the configuration files and all the output of freeradius -X are required, i'll post them in a pastebin and link here. Thanks in advance

4 7

RE: Re: receives 1 request --> proxy 2 requests?
by Torsten Förster 08 Jul '09

08 Jul '09

> Can you do radtest from the home server? Or that shows wrong shared secret > too? the home server isnt a freeeradius server. its a ncp radius server I checked the secret again. they are the same! The error message is not my problem. The problem is: why sends freeradius 2 requests to the home server? One should be enough. #adBox3 {display:none;}

2 1

Incorrect MySQL schema?
by Jeanette Lee 07 Jul '09

07 Jul '09

Hi, I have just installed 2.1.6-2 on a Centos 5.3 machine with MySQL 6.0.11. When I run the schema.sql to create the radius database tables I get an error on the last table, radpostauth about a syntax error: # mysql -u root -p radius </etc/raddb/sql/mysql/schema.sql Enter password: ERROR 1064 (42000) at line 127: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(14) NOT NULL, PRIMARY KEY (id), KEY username (username(32)) )' at line 6 If I log in and check the database, all of the tables are created except radpostauth. I've googled and read FAQs and everything I could think of, but I can't seem to figure this out or find a post from someone who had the same problem. Can anyone suggest anything? Many thanks! -- Cheers, jeanette-

2 1

radius.log not working
by Michael Humphries 07 Jul '09

07 Jul '09

2 2

RE: Re: receives 1 request --> proxy 2 requests?
by Torsten Förster 07 Jul '09

07 Jul '09

> > i installed a new server with ubuntu 8.04 lts and > > freeradius 2.1.0 > > behind this radius are 2 other radius-server (failover) > > after configuration i always get an error-message after > > succesfull login of an user. > > > > Error: Received Accounting-Response packet from client > > x.x.xx port 1813 with invalid signature (err=2)! (Shared > > secret is incorrect.) Dropping packet without response. > > Fix the shared secret between proxy and home servers. the shared secrets are the same! to 100%. #adBox3 {display:none;}

2 1