- Freeradius-Users - lists.freeradius.org

outer identity anonymous is being rejected
by Godfrey Peart 11 Feb '09

11 Feb '09

My FR 2.1 is set to authenticate users via PEAP + EAP-TTLS, this works fine but some users are being rejected because their wireless client allows the setting of an outer identity: anonymous or something else, which is not a valid username. So it's being rejected. How do I get the inner identity which contains a valid username to be processed instead of the outer identity. I've seen some posts about using* Autz-type INNER* options but have merely succeded in breaking my test system when tryng it out. At present this is my users file: #If you are not in either group, no access is allowed #FreeRADIUS 2.1 #These are the groups we are checking for Lunar Building staff DEFAULT Ldap-Group == "lunar-staff" Aruba-User-Role = "employee" DEFAULT Ldap-Group == "lunar-member" Aruba-User-Role = "member" DEFAULT SQL-Group == "Guests" Aruba-User-Role = "guest" DEFAULT Ldap-group != "lunar-staff", Auth-Type := Reject DEFAULT Ldap-group != "lunar-member", Auth-Type := Reject #End

2 1

Error binding port to ipv6 address
by D'AVELLA STEFANO 11 Feb '09

11 Feb '09

Hello, I am new to Freeradius. I am running Freeradius 2.1.0 on Ubuntu 8.10, built from source. I have already read all the documentation I could find in the config files and in the wiki. The machine has two network interfaces, eth0 and eth1, the first configured with ipv4 and the second with ipv6. I am interested on using freeradius with ipv6 support so I would like to test it using it only on eth1 interface. The point of my testbed will be to define a new attribute and transfer it to the client when it is authorized. But before doing it I am finding some problems in opening the ip6 socket in the server. In fact I configured users and clients.conf to allow my ip6 client to connect to the server, and then in the radiusd.conf file I commented the ip4 listening option and uncommented the ip6 one. (I also commented the accounting listening part because I am not interested in it). The problem is that when I run the server it exits saying (last lines): Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipv6addr = :: IPv6 address [::] port = 0 /etc/freeradius/radiusd.conf[236]: Error binding to port for :: port 1812 I checked if the ip6 interface is properly configured, and it seems so (i can ping other ip6 nodes, and also writing another little c program to bind an ip6 socket works fine) Changing port doesn't solve the issue. Commenting or uncommenting the "interface" line in radiusd.conf doesn't change anything. Trying different types of ip6 addresses (::1, or manually assigned ones) doesn't work either. Obviously with ip4 I don't have any kind of problem. I can't understand if it a freeradius configuration problem or a system configuration one. Thank you for you help! Regards, -- Stefano D'Avella

4 11

I Can't compile freeradius2.1.3 with RHEL4
by 张̍ 11 Feb '09

11 Feb '09

I have installed "everything" software packages on RHEL4 update 7,but still can not make freeradius 2.1.3 on it.below is the error message: ... ... Making all in main...gmake[4]: Entering directory `/root/freeradius-server-2.1.3/src/main'/root/freeradius-server-2.1.3/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/root/freeradius-server-2.1.3/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.3\" -DOPENSSL_NO_KRB5 -c listen.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/root/freeradius-server-2.1.3/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.3\" -DOPENSSL_NO_KRB5 -c listen.c -fPIC -DPIC -o .libs/listen.olisten.c:99:1: directives may not be used inside a macro argumentlisten.c:98:54: unterminated argument list invoking macro "rad_assert"listen.c: In function `client_listener_find':listen.c:100: `rad_assert' undeclared (first use in this function)listen.c:100: (Each undeclared identifier is reported only oncelisten.c:100: for each function it appears in.)listen.c:111: syntax error before ')' token! listen.c:141: warning: passing arg 1 of pointer to function discards qualifiers from pointer target typelisten.c:220: warning: assignment discards qualifiers from pointer target typeIn file included from listen.c:1024:command.c: In function `command_show_client_config':command.c:805: warning: passing arg 2 of `cf_section2file' discards qualifiers from pointer target typegmake[4]: *** [listen.lo] Error 1gmake[4]: Leaving directory `/root/freeradius-server-2.1.3/src/main'gmake[3]: *** [common] Error 2gmake[3]: Leaving directory `/root/freeradius-server-2.1.3/src'gmake[2]: *** [all] Error 2gmake[2]: Leaving directory `/root/freeradius-server-2.1.3/src'gmake[1]: *** [common] Error 2gmake[1]: Leaving directory `/root/freeradius-server-2.1.3'make: *** [all] Error 2 _________________________________________________________________ 讲述中国特色文化，体验不同的节日习俗，快来微软春节搜索！ http://chunjie.live.com/?form=PANER01

2 1

Radgroupcheck and regexp
by ecard 11 Feb '09

11 Feb '09

I use freeradius 2.1.3 with oracle DB. Regexp works wrong in radgroupcheck table. What did I do wrong? Usergrop table ------------------------------------------------------------------ 65658 testgroup testgroup1 15 65659 testgroup testgroup2 20 ------------------------------------------------------------------ Radgroupcheck table ------------------------------------------------------------------ 321 testgroup1 NAS-IP-Address !~ ^10.10 341 testgroup2 NAS-IP-Address =~ ^10.10 ------------------------------------------------------------------ Radgroupreply table ------------------------------------------------------------------ 682 testgroup1 Fall-Through = Yes 661 testgroup1 Cisco-AVPair += ip:addr-pool=test1 681 testgroup2 Fall-Through = Yes 662 testgroup2 Cisco-AVPair += ip:addr-pool=test2 ------------------------------------------------------------------ Sending Access-Request of id 250 to 127.0.0.1 port 1812 User-Name = "testgroup" User-Password = "test" NAS-IP-Address = 10.10.1.1 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=250, length=46 Cisco-AVPair = "ip:addr-pool=test2" Sending Access-Request of id 203 to 127.0.0.1 port 1812 User-Name = "testgroup" User-Password = "test" NAS-IP-Address = 10.11.1.1 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=203, length=46 Cisco-AVPair = "ip:addr-pool=test2" Debug from last request: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 6526, id=133, length=55 User-Name = "testgroup" User-Password = "test" NAS-IP-Address = 10.11.1.1 +- entering group authorize {...} [preprocess] expand: %{NAS-IP-Address} -> 10.11.1.1 ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/detail/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/detail/127.0.0.1/detail-20090205 [auth_log] /usr/local/var/log/radius/radacct/detail/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/detail/127.0.0.1/detail-20090205 [auth_log] expand: %t -> Thu Feb 5 16:39:28 2009 ++[auth_log] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "testgroup", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "testgroup" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [sqlauth] expand: %{User-Name} -> testgroup [sqlauth] sql_set_user escaped user --> 'testgroup' rlm_sql (sqlauth): Reserving sql socket id: 7 [sqlauth] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testgroup' ORDER BY id SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testgroup' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sqlauth] User found in radcheck table [sqlauth] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testgroup' ORDER BY id SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testgroup' ORDER BY id [sqlauth] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' OR CLID='%{Calling-Station-Id}' order by priority -> SELECT GroupName FROM usergroup WHERE UserName='testgroup' OR CLID='' order by priority SELECT GroupName FROM usergroup WHERE UserName='testgroup' OR CLID='' order by priority [sqlauth] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'testgroup1' ORDER BY id SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'testgroup1' ORDER BY id ################################################### [sqlauth] expand: %{NAS-IP-Address} -> 10.11.1.1 ################################################### [sqlauth] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'testgroup2' ORDER BY id SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'testgroup2' ORDER BY id ################################################### [sqlauth] expand: %{NAS-IP-Address} -> 10.11.1.1 [sqlauth] User found in group testgroup2 ################################################### [sqlauth] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'testgroup2' ORDER BY id SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'testgroup2' ORDER BY id rlm_sql (sqlauth): Released sql socket id: 7 ++[sqlauth] returns ok [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Local !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. Login OK: [testgroup] (from client local port 0) +- entering group post-auth {...} [reply_log] expand: /usr/local/var/log/radius/radacct/detail/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/detail/127.0.0.1/detail-20090205 [reply_log] /usr/local/var/log/radius/radacct/detail/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/detail/127.0.0.1/detail-20090205 [reply_log] expand: %t -> Thu Feb 5 16:39:28 2009 ++[reply_log] returns ok Sending Access-Accept of id 133 to 127.0.0.1 port 6526 Cisco-AVPair += "ip:addr-pool=test2" Finished request 7. Going to the next request Waking up in 4.9 seconds. Cleaning up request 7 ID 133 with timestamp +695 Ready to process requests.

2 3

Problem with remove the realm from User-Name Attribute
by huang allen 11 Feb '09

11 Feb '09

Hi, I am trying to remove the realm from User-Name when FreeRADIUS receive the access request. If it have realm in User-Name, the FR will proxy it to other RADIUS server. and i wish the FR will remove the realm from User-Name when it receive any access request from NAS-IP-Address=192.168.1.1 , if using unlang, how to do it thanks, Allen

1 0

Session-timeout problem
by Mitul Modi 11 Feb '09

11 Feb '09

hi, I am using EAP-TTLS authentication in radius. and i want to use Session-Timeout. but i am not getting where i have to set session time out. if some one can help. thanks, mitul modi

1 0

Re: using IP address of vpn users in radius server
by Eric 11 Feb '09

11 Feb '09

yes.but how can I specify Calling-Station-Ids based on valid and invalid ips? I want that radius checks that if Calling-Station-Id is valid radius sends ippool 1 for vpn server and if Calling-Station-Id is invalid sends ippool2. Where this compare is set in radius server? > > Message: 2 > Date: Sat, 07 Feb 2009 16:12:10 +0100 > From: <tnt(a)kalik.net> > Subject: Re: using IP address of vpn users in radius server > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <5yFqtWPV.1234019530.4835870.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >I have a radius server that uses ldap server for authentication and > >authorization. The client of radius server is a vpn server. > >now they are working. I want to have two groups of vpn users in vpn server > >base on their IP addresses. > >Could radius server check IP address of users > > Yes. IP address should be in Calling-Station-Id attribute in the request. > > Ivan Kalik > Kalik Informatika ISP > > > >

1 1

Re: FreeRadius support of EAP-AKA
by ljwbsbfan 11 Feb '09

11 Feb '09

I could not find that patch, it seems the only way is to download it from "bugs.freeradius.org". Could you please tell me when will that website be recovered from the crash? Thanks, Kevin

1 0

RE:outer identity anonymous is being rejected (solved)
by Godfrey Peart 10 Feb '09

10 Feb '09

Apologies, I didn't read all the MAN pages, found the answer I needed >My FR 2.1 is set to authenticate users via PEAP + EAP-TTLS, this works fine but some users are being rejected >So it's being rejected. How do I get the inner identity which contains a valid username to be processed instead of the outer identity. >I've seen some posts about using* Autz-type INNER* options but have merely succeded in breaking my test system when tryng it out. > >At present this is my users file: > > > > > > >#If you are not in either group, no access is allowed >#FreeRADIUS 2.1 > > >#These are the groups we are checking for Lunar Building staff >DEFAULT Ldap-Group == "lunar-staff" > Aruba-User-Role = "employee" > >DEFAULT Ldap-Group == "lunar-member" > Aruba-User-Role = "member" > >DEFAULT SQL-Group == "Guests" > Aruba-User-Role = "guest" > >DEFAULT Ldap-group != "lunar-staff", Auth-Type := Reject >DEFAULT Ldap-group != "lunar-member", Auth-Type := Reject >#End

1 0

Re: Installation Problem
by Marcelo Freitas 10 Feb '09

10 Feb '09

Nice, Thanks Will I'll try it ... I had to stay with 2.1.1, because I didn't have time ... Thanks for sharing ... ----- Original Message ----- From: "Will D. Spann" >;willdspann(a)yahoo.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0