- Freeradius-Users - lists.freeradius.org

Error binding to port for 0.0.0.0 port 1812
by Bruno Noronha 26 Mar '09

26 Mar '09

Dawgs, I received the following error when starting debug mode or issuing "freeradius reload" and catching the error in radius.log: Tue Mar 24 16:16:05 2009 : Error: Failed binding to socket: Address already in use Tue Mar 24 16:16:05 2009 : Error: /etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 I disabled IPv6 and verified if there is another service running on this port... RADIUS:~ # lsof -i:1812 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME radiusd 3568 root 5u IPv4 10046 0t0 UDP *:1812 RADIUS:~ # netstat -unpl Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 0.0.0.0:1812 0.0.0.0:* 3568/radiusd udp 0 0 0.0.0.0:1813 0.0.0.0:* 3568/radiusd udp 0 0 0.0.0.0:1814 0.0.0.0:* 3568/radiusd udp 0 0 0.0.0.0:43956 0.0.0.0:* 2564/avahi-daemon: udp 0 0 0.0.0.0:5353 0.0.0.0:* 2564/avahi-daemon: udp 0 0 0.0.0.0:111 0.0.0.0:* 2347/portmap udp 0 0 0.0.0.0:631 0.0.0.0:* 2663/cupsd According to the outputs above there is just one service running on this port... I don't know what else I can do. I saw all topics related to my problem but no one gave me a solution.

5 10

WPA + Freeradius + Chillispot
by Leonardo Mártyres 26 Mar '09

26 Mar '09

Does anyone use Chillispot to use WPA and FReeradius? Could tell me what I have to configure at dd-wrt? thanks _________________________________________________________________ Show them the way! Add maps and directions to your party invites. http://www.microsoft.com/windows/windowslive/products/events.aspx

2 1

Retrieve an user attribute from AD for vlan assignment in PEAP auth
by Frad 26 Mar '09

26 Mar '09

Hi everyone, I am configuring a freeradius server with authentication PEAP/Mschap with an Active Directory. The authentication works :) There is my question: I have on my AD an attribute for each user such as "vlanId = 12" and I would like to get this value to assign the user authenticated on this VLAN. Any idea ? Thanks, Frad -- View this message in context: http://www.nabble.com/Retrieve-an-user-attribute-from-AD-for-vlan-assignmen… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Problem with attribute transfer to an external script
by Dmitry Lyubimkov 26 Mar '09

26 Mar '09

Hello. We use FreeRADIUS as an intermediate server (proxy) between commercial billing system and radius clients (NAS, servers, etc). In this case it is a question about SIPProxy. The billing system sends some additional attributes. Here a example from FreeRADIUS log: rad_recv: Access-Reject packet from host 172.16.2.9 port 1812, id=99, length=70 Reply-Message = "Authorization failed." h323-return-code = "h323-return-code=-2" We receive this from billing system. And we should transmit to the RADIUS-client the same plus additional attribute, calculated from h323-return-code. Approximately so: Sending Access-Reject of id 164 to 172.16.2.6 port 42424 SIP-AVP := "AUTHCODE:3" Reply-Message = "Authorization failed." h323-return-code = "h323-return-code=-2" I have described the application in a radiusd.conf exec siph323code { wait = yes input_pairs = reply output_pairs = reply packet_type = Access-Reject program = "/usr/bin/python -u /usr/sbin/radscripts/siph323code.py %{h323-return-code} } Also add it in section post-proxy { .... siph323code .... The application is started, attribute SIP-AVP is added. But there is a problem. Value of {h323-return-code} attribute is not transferred to this application. FreeRADIUS declares: rlm_exec (siph323code): WARNING! Input pairs are empty. No attributes will be passed to the script expand: %{h323-return-code} -> I.e.it cannot substitute value of h323-return-code attribute. But if I write on this place any attribute from initial request, for example %{Cisco-AVPair} that its value is substituted. Questions: 1. How correctly to describe my application. What value of output_pairs and input_pairs fields I should use? 2. In what section I should start this application (post-proxy, pre-proxy, post-auth...)? 3. Why it is not substituted attribute % {h323-return-code}? Thanks. Dmitry

1 0

Get fail [MS-CHAP2-Response is incorrect] while proxy the mschapv2 between two Freeradius 2.1.4
by Jacky Chan 26 Mar '09

26 Mar '09

Hi all, I installed two freeradius, one for home server(x.x.x.239/24) and one for proxy purpose, the home server is working normally with LEAP with mschapv1, WPA2 and PEAP with mschapv2. For other purpose, I need to established one more freeradius and work as proxy radius server(x.x.x.238/24) to proxy all request to other home radius that including the existing home freeradius server mention above, but after test, PAP and LEAP are proxyed successfully but PEAP/WPA2 with mschapv2 always get fail, the following is the debug log from these two freeradius 2.1.4 Freeradius (home server) x.x.x.239 rad_recv: Access-Request packet from host x.x.x.238 port 1814, id=58, length=179 NAS-IP-Address = x.x.x.21 (NAS for testing) NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test33", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry test33 at line 204 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for test33 with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Login incorrect: [test33/<via Auth-Type = mschap>] (from client fd-1 port 0 cli 000000000000) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test33 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 58 to x.x.x.238 port 1814 Proxy-State = 0x3134 Waking up in 4.9 seconds. Cleaning up request 0 ID 58 with timestamp +13 Ready to process requests. Freeradius (proxy server) x.x.x.238 rad_recv: Access-Request packet from host x.x.x.21 port 32846, id=14, length=191 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33(a)aaa.com" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] Looking up realm "aaa.com" for User-Name = "test33(a)aaa.com" [suffix] Found realm "aaa.com" [suffix] Adding Stripped-User-Name = "test33" [suffix] Adding Realm = "aaa.com" [suffix] Proxying request from user test33 to realm aaa.com [suffix] Preparing to proxy authentication request to realm "aaa.com" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 58 to x.x.x.239 port 1812 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 Proxying request 10 to home server x.x.x.239 port 1812 Sending Access-Request of id 58 to x.x.x.239 port 1812 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 Going to the next request Waking up in 0.9 seconds. Waking up in 18.9 seconds. rad_recv: Access-Reject packet from host x.x.x.239 port 1812, id=58, length=24 Proxy-State = 0x3134 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Login incorrect (Home Server says so): [test33(a)aaa.com/<via Auth-Type = mschap>] (from client Controller-1 port 0 cli 000000000000) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test33(a)aaa.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 14 to x.x.x.21 port 32846 Finished request 10. Going to the next request Waking up in 4.9 seconds. Cleaning up request 10 ID 14 with timestamp +9947 Waking up in 17.2 seconds. Sending Status-Server of id 70 to 127.0.0.1 port 1812 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" You can see that the MS-CHAP-Challenge and the MS-CHAP2-Response are same within two server, but why home server said that the password is wrong? Can anyone help me to check whether there are something wrong in my configuration, thanks. The following is the EAP and the mschap module of these two server: mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no } eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } -- View this message in context: http://www.nabble.com/Get-fail--MS-CHAP2-Response-is-incorrect--while-proxy… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

same user on different service
by "Николай Г. Петров" 26 Mar '09

26 Mar '09

Hello! I have a question about same 'username' from different services. Task: 1) Troublefree login users with same username, from different places(therefore different attribute) at the same time: - cisco console login(radius for cisco); - ppp(radius for dialup). 2) In some way delineate radius log for cisco from ppp radius log. aaa must be done on single freeradius server(...we have a one aaa server). May be use a different group or realm? Please, I'd like to listen our recommendation or link that this explained. [freeradius version 1.1.3, latest I can't,only this!!!] Thanks!

2 1

API
by David N'DAKPAZE 26 Mar '09

26 Mar '09

Hello, I'd like to know how to create an API which will permit me to create or delete a user on freeradius. Thank you for your help

4 5

Cdv D has sent you a private message
by Cdv D 26 Mar '09

26 Mar '09

1 0

Cdv D has sent you a private message
by Cdv D 26 Mar '09

26 Mar '09

1 0

undefined reference to `lt_preloaded_symbols'
by Nick Jones 25 Mar '09

25 Mar '09

I am running Ubuntu 8.10 and trying to build the debian package for FreeRADIUS 2.1.4 as described on the FreeRADIUS web site. When I issue the command: fakeroot dpkg-buildpackage -b -uc The process starts but at some point along the way, I get this error message: libtool: link: gcc .libs/radiusdS.o -Wl,-Bsymbolic-functions -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /home/parsond/Desktop/freeradius-server-2.1.4/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -ldl -lssl -lcrypto -Wl,-rpath -Wl,/usr/lib/freeradius .libs/modules.o: In function `setup_modules': /home/parsond/Desktop/freeradius-server-2.1.4/src/main/modules.c:1039: undefined reference to `lt_preloaded_symbols' collect2: ld returned 1 exit status make[5]: *** [radiusd] Error 1 make[5]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src/main' make[4]: *** [common] Error 2 make[4]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src' make[3]: *** [all] Error 2 make[3]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4/src' make[2]: *** [common] Error 2 make[2]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4' make[1]: *** [all] Error 2 make[1]: Leaving directory `/home/parsond/Desktop/freeradius-server-2.1.4' make: *** [build-arch-stamp] Error 2 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 I have searched online for fixes to the 'undefined reference to lt_preloaded_symbols', I know it is related to the libtool I am using, but I don't know where to begin to get this resolved. I hope someone can help! I am have libtool 2.2.4 and libltdl7 2.2.4 installed, if this helps.

2 1