- Freeradius-Users - lists.freeradius.org

Problem compiling on OSX 10.5
by Paul Bartell 10 Mar '09

10 Mar '09

I have two problems: One is with compiling in mysql support. Despite using the following ./configure line ./configure --prefix=/usr/local/freeradius --with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include/ --with-mysql-lib-dir=/usr/local/mysql-5.1.30-osx10.5-x86/lib/ it still says checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for SQLConnect in -liodbc... yes checking for isql.h... yes configure: creating ./config.status config.status: creating Makefile === configuring in ./drivers/rlm_sql_mysql (/Users/admin/radiusd/src/modules/rlm_sql/./drivers/rlm_sql_mysql) configure: running /bin/sh ./configure '--prefix=/usr/local/freeradius' '--with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include/' '--with-mysql-lib-dir=/usr/local/mysql-5.1.30-osx10.5-x86/lib/' '--enable-ltdl-install=no' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... Im am using the version from cvs. Am I not fetching the mysql module or something (which doesnt seem likely as the latest stable gives the same error)? It appears that freeradius is trying to compile a universal binary. On a PPC machine I don't have this problem. The intel machine im installing on appears to have some ppc libraries missing. Is there any way to prevent this cross compiling or does anyone know a fast fix. Ive seen numerous posts on this issue with the same errors, and all of them seem unanswered. Im using the following to configure: ./configure --prefix=/usr/local/freeradius --with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include when running make I get build errors. I cant get to the machine at the moment, or else i would give the exact errors, but it has something to do with rlm_perl. -- Random quote of the week/month/whenever i get to updating it: "Opportunity knocked. My doorman threw him out." - Adrienne Gusoff "At school you don't get parole, good behavior only brings a longer sentence." - The History Boys

2 1

Conversion to Version 2
by Doug Hardie 10 Mar '09

10 Mar '09

I have been using FreeRadius 1.x for a number of years. It has worked just fine. All I am using it for is to authenticate and authorize dial-in users (its about as simple as you can get). The only unusual item is I have a couple of fairly complex modules for authorization and accounting. The question is should I bother to upgrade to 2.x. I don't have a need for any of the new features it provides. I don't even use most of the features in 1.x. My largest concern is the modules. I don't recall seeing anything here about what changes would be required for them other than I believe they have to be compiled with the server. Currently the modules are compiled separately and placed in /usr/local/lib and everything just works.

4 20

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 09 Mar '09

09 Mar '09

>Is your NAS sending them? If it is, there is a firewall stopping them. >Ivan Kalik >Kalik Informatika ISP Thanks Ivan for fast reply, So, I'm very newer with linux also freeradius. If you permit, how can I see if the NAS send the account package? I'm using a ZINWELL G220 Plus and TP LInk WA501G. At zinwell I received an Authentication Failed, but is passed. NONREPLAY or something else.. Tanks again. _________________________________________________________________ News, entertainment and everything you care about at Live.com. Get it now! http://www.live.com/getstarted.aspx

2 1

No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 09 Mar '09

09 Mar '09

Hi there, I get a little problem with Ubuntu 8.04 + freeradius + EAP/TLS/PEAP + mysql, 'couse I don't receive an Accounting package even response. In Ubuntu is installed freeradius, mysql and open ssl. Could someone help me with this? Thanks _________________________________________________________________ More than messages–check out the rest of the Windows Live™. http://www.microsoft.com/windows/windowslive/

2 1

What does 'radius -C' do? (2.1.3)
by Mike Diggins 09 Mar '09

09 Mar '09

According to the documentation, radiusd -C is supposed to "Check configuration and exit." I was assuming that would catch errors in the configuration that might prevent it from restarting. However, if I intentionally mangle the configuration to the point it won't start, the -C check still returns nothing. What am I missing? -Mike

3 9

Re: failed to receive Accounting Response
by "Николай Г. Петров" 09 Mar '09

09 Mar '09

Ok! Where can I find information about howto make freeradius undarstand a TACACS+ ?

2 1

Re: failed to receive Accounting Response
by "Николай Г. Петров" 09 Mar '09

09 Mar '09

No. in my company we use a freeradius, not a TACACS, and we want to get a control under some users which work on cisco console and for this we would be like take a 'log command'. If you know how we make do that and freeradius implemet this, please tell us or give a some howto, patch, url etc. Still we implement unsuccessful.

2 1

Can we do sql just once during eap-tls handshake
by Johan F2 09 Mar '09

09 Mar '09

We are using eap-tls for authetication assisted with a database for filling in some attributes. FreeRADIUS Version 2.1.3 with minimal configuration will do a sql lookup for each round. (Four selects: radcheck, radusergroup, radgroupcheck and radgroupreply). There are 6-9 rounds depending on certificate chain sizes. Obviously performance would be better with only one database lookup. Part of the (attempted) configuration: authorize { preprocess eap if (I have tried some conditions here) { sql if (notfound) { fail } } } authenticate { eap } Is there som nice condition that will result in only one lookup in the database? A thing that complicates thing is that TLS (that declares Success I beleive) is run during authenticate which is later the the attempted database lookup. The TLS outcome is pretty well known in the second last round: There are logs saying [tls] (other): SSL negotiation finished successfully SSL Connection Established but there is still one Access-Challange. So if this fact could be tested in the last round that test would be a nice candidate for doing the sql update. As an aside: Is there a way to really inspect the client certificate (preferrably the entire chain) and let it affect some logic (in perl as an example)? -- View this message in context: http://www.nabble.com/Can-we-do-sql-just-once-during-eap-tls-handshake-tp22… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 20

FreeRadius 1.1.7 & Solaris 10
by Roar Pettersen 09 Mar '09

09 Mar '09

Hi ! We have a odd problem on one of our FreeRadius servers : SunOS 5.10 Generic_138888-03 sun4u sparc Mon Mar 9 13:39:26 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 179 due to unfinished request 2603 Mon Mar 9 13:39:32 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 179 due to unfinished request 2603 Mon Mar 9 13:39:52 2009 : Error: WARNING: Unresponsive child (id 96) for request 2603 (in component authenticate module rlm_pam) Mon Mar 9 13:40:01 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 143 due to unfinished request 2604 Mon Mar 9 13:40:02 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 145 due to unfinished request 2606 Mon Mar 9 13:40:03 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 144 due to unfinished request 2605 Mon Mar 9 13:40:07 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 143 due to unfinished request 2604 Mon Mar 9 13:40:07 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 145 due to unfinished request 2606 Mon Mar 9 13:40:07 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 144 due to unfinished request 2605 Mon Mar 9 13:40:09 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 146 due to unfinished request 2607 Mon Mar 9 13:40:09 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 147 due to unfinished request 2608 Mon Mar 9 13:40:15 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 146 due to unfinished request 2607 Mon Mar 9 13:40:15 2009 : Error: Discarding duplicate request from client hostname:1814 - ID: 147 due to unfinished request 2608 Mon Mar 9 13:40:30 2009 : Error: WARNING: Unresponsive child (id 104) for request 2604 (in component authenticate module rlm_pam) Mon Mar 9 13:40:30 2009 : Error: WARNING: Unresponsive child (id 99) for request 2605 (in component authenticate module rlm_pam) Mon Mar 9 13:40:30 2009 : Error: WARNING: Unresponsive child (id 103) for request 2606 (in component authenticate module rlm_pam) Mon Mar 9 13:40:35 2009 : Error: WARNING: Unresponsive child (id 97) for request 2607 (in component authenticate module rlm_pam) Mon Mar 9 13:40:35 2009 : Error: WARNING: Unresponsive child (id 102) for request 2608 (in component authenticate module rlm_pam) When this problem occur, then no radius authentication. After a few seconds radius is working as it should. We are observing this problem ca 2 or 4 times each hour. -- Regards; Roar Pettersen Universitetet i Bergen - The University of Bergen

2 1

radiusd server does not respond to radtest from another host
by mbhorner＠aol.com 09 Mar '09

09 Mar '09

[>Thanks for the response. My original email was very lengthy, but at the bottom you can see a wireshark capture showing the packet arrival. (My understanding is wireshark is a pretty GUI based on tcpdump) > Yes, it arrived but can't get through the firewall. You say you are using default freeradius configuration, so you haven't done anything strange to listen section to cause this - it has to be tha firewall.] OK, I'll investigate the firewall this morning - I am new to openSUSE so I don't know where that is but hopefully google will point me in the right direction. FYI - I uninstalled both installations, removed all the files under /etc/raddb and reinstalled only editing "users and clients.conf" What I found is on the 10.10.10.11 machine which has a full 32 bit version of openSUSE 11.1 installed that radiusd did not respond from other host. It did respond to radtest from another terminal window on the same machine I then started Linux using a openSUSE 64 bit "live CD" on my 10.10.10.10 machine (because its hard drive has windows). In installed the basic packages needed to get freeradius running (C/C++ dev, gnu make etc) - I used an identical "users and client.conf file" with 24 bit mask for clients in 10.10.10.0 On the liveCD host the freeradius server works! - so perhaps it is a lack of firewall? Note: I alsotraied changing the NAS-ID as suggested in another thread - that did not seem to make any difference 10.10.10.11 did not work with either NAS ID while 10.10.10.10 worked with either Thanks for the tips - I will cross my fingers it is a firewall setting that is installed by default in openSUSE 11.1

2 2