- Freeradius-Users - lists.freeradius.org

I Can't compile freeradius2.1.3 with RHEL4
by 张̍ 11 Feb '09

11 Feb '09

I have installed "everything" software packages on RHEL4 update 7,but still can not make freeradius 2.1.3 on it.below is the error message: ... ... Making all in main...gmake[4]: Entering directory `/root/freeradius-server-2.1.3/src/main'/root/freeradius-server-2.1.3/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/root/freeradius-server-2.1.3/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.3\" -DOPENSSL_NO_KRB5 -c listen.c gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/root/freeradius-server-2.1.3/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.3\" -DOPENSSL_NO_KRB5 -c listen.c -fPIC -DPIC -o .libs/listen.olisten.c:99:1: directives may not be used inside a macro argumentlisten.c:98:54: unterminated argument list invoking macro "rad_assert"listen.c: In function `client_listener_find':listen.c:100: `rad_assert' undeclared (first use in this function)listen.c:100: (Each undeclared identifier is reported only oncelisten.c:100: for each function it appears in.)listen.c:111: syntax error before ')' token! listen.c:141: warning: passing arg 1 of pointer to function discards qualifiers from pointer target typelisten.c:220: warning: assignment discards qualifiers from pointer target typeIn file included from listen.c:1024:command.c: In function `command_show_client_config':command.c:805: warning: passing arg 2 of `cf_section2file' discards qualifiers from pointer target typegmake[4]: *** [listen.lo] Error 1gmake[4]: Leaving directory `/root/freeradius-server-2.1.3/src/main'gmake[3]: *** [common] Error 2gmake[3]: Leaving directory `/root/freeradius-server-2.1.3/src'gmake[2]: *** [all] Error 2gmake[2]: Leaving directory `/root/freeradius-server-2.1.3/src'gmake[1]: *** [common] Error 2gmake[1]: Leaving directory `/root/freeradius-server-2.1.3'make: *** [all] Error 2 _________________________________________________________________ 讲述中国特色文化，体验不同的节日习俗，快来微软春节搜索！ http://chunjie.live.com/?form=PANER01

2 1

Radgroupcheck and regexp
by ecard 11 Feb '09

11 Feb '09

I use freeradius 2.1.3 with oracle DB. Regexp works wrong in radgroupcheck table. What did I do wrong? Usergrop table ------------------------------------------------------------------ 65658 testgroup testgroup1 15 65659 testgroup testgroup2 20 ------------------------------------------------------------------ Radgroupcheck table ------------------------------------------------------------------ 321 testgroup1 NAS-IP-Address !~ ^10.10 341 testgroup2 NAS-IP-Address =~ ^10.10 ------------------------------------------------------------------ Radgroupreply table ------------------------------------------------------------------ 682 testgroup1 Fall-Through = Yes 661 testgroup1 Cisco-AVPair += ip:addr-pool=test1 681 testgroup2 Fall-Through = Yes 662 testgroup2 Cisco-AVPair += ip:addr-pool=test2 ------------------------------------------------------------------ Sending Access-Request of id 250 to 127.0.0.1 port 1812 User-Name = "testgroup" User-Password = "test" NAS-IP-Address = 10.10.1.1 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=250, length=46 Cisco-AVPair = "ip:addr-pool=test2" Sending Access-Request of id 203 to 127.0.0.1 port 1812 User-Name = "testgroup" User-Password = "test" NAS-IP-Address = 10.11.1.1 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=203, length=46 Cisco-AVPair = "ip:addr-pool=test2" Debug from last request: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 6526, id=133, length=55 User-Name = "testgroup" User-Password = "test" NAS-IP-Address = 10.11.1.1 +- entering group authorize {...} [preprocess] expand: %{NAS-IP-Address} -> 10.11.1.1 ++[preprocess] returns ok [auth_log] expand: /usr/local/var/log/radius/radacct/detail/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/detail/127.0.0.1/detail-20090205 [auth_log] /usr/local/var/log/radius/radacct/detail/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/detail/127.0.0.1/detail-20090205 [auth_log] expand: %t -> Thu Feb 5 16:39:28 2009 ++[auth_log] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "testgroup", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "testgroup" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok [sqlauth] expand: %{User-Name} -> testgroup [sqlauth] sql_set_user escaped user --> 'testgroup' rlm_sql (sqlauth): Reserving sql socket id: 7 [sqlauth] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testgroup' ORDER BY id SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testgroup' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sqlauth] User found in radcheck table [sqlauth] expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testgroup' ORDER BY id SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testgroup' ORDER BY id [sqlauth] expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' OR CLID='%{Calling-Station-Id}' order by priority -> SELECT GroupName FROM usergroup WHERE UserName='testgroup' OR CLID='' order by priority SELECT GroupName FROM usergroup WHERE UserName='testgroup' OR CLID='' order by priority [sqlauth] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'testgroup1' ORDER BY id SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'testgroup1' ORDER BY id ################################################### [sqlauth] expand: %{NAS-IP-Address} -> 10.11.1.1 ################################################### [sqlauth] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'testgroup2' ORDER BY id SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'testgroup2' ORDER BY id ################################################### [sqlauth] expand: %{NAS-IP-Address} -> 10.11.1.1 [sqlauth] User found in group testgroup2 ################################################### [sqlauth] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'testgroup2' ORDER BY id SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'testgroup2' ORDER BY id rlm_sql (sqlauth): Released sql socket id: 7 ++[sqlauth] returns ok [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Local !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. Login OK: [testgroup] (from client local port 0) +- entering group post-auth {...} [reply_log] expand: /usr/local/var/log/radius/radacct/detail/%{Client-IP-Address}/detail-%Y%m%d -> /usr/local/var/log/radius/radacct/detail/127.0.0.1/detail-20090205 [reply_log] /usr/local/var/log/radius/radacct/detail/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/detail/127.0.0.1/detail-20090205 [reply_log] expand: %t -> Thu Feb 5 16:39:28 2009 ++[reply_log] returns ok Sending Access-Accept of id 133 to 127.0.0.1 port 6526 Cisco-AVPair += "ip:addr-pool=test2" Finished request 7. Going to the next request Waking up in 4.9 seconds. Cleaning up request 7 ID 133 with timestamp +695 Ready to process requests.

2 3

Problem with remove the realm from User-Name Attribute
by huang allen 11 Feb '09

11 Feb '09

Hi, I am trying to remove the realm from User-Name when FreeRADIUS receive the access request. If it have realm in User-Name, the FR will proxy it to other RADIUS server. and i wish the FR will remove the realm from User-Name when it receive any access request from NAS-IP-Address=192.168.1.1 , if using unlang, how to do it thanks, Allen

1 0

Session-timeout problem
by Mitul Modi 11 Feb '09

11 Feb '09

hi, I am using EAP-TTLS authentication in radius. and i want to use Session-Timeout. but i am not getting where i have to set session time out. if some one can help. thanks, mitul modi

1 0

Re: using IP address of vpn users in radius server
by Eric 11 Feb '09

11 Feb '09

yes.but how can I specify Calling-Station-Ids based on valid and invalid ips? I want that radius checks that if Calling-Station-Id is valid radius sends ippool 1 for vpn server and if Calling-Station-Id is invalid sends ippool2. Where this compare is set in radius server? > > Message: 2 > Date: Sat, 07 Feb 2009 16:12:10 +0100 > From: <tnt(a)kalik.net> > Subject: Re: using IP address of vpn users in radius server > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <5yFqtWPV.1234019530.4835870.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >I have a radius server that uses ldap server for authentication and > >authorization. The client of radius server is a vpn server. > >now they are working. I want to have two groups of vpn users in vpn server > >base on their IP addresses. > >Could radius server check IP address of users > > Yes. IP address should be in Calling-Station-Id attribute in the request. > > Ivan Kalik > Kalik Informatika ISP > > > >

1 1

Re: FreeRadius support of EAP-AKA
by ljwbsbfan 11 Feb '09

11 Feb '09

I could not find that patch, it seems the only way is to download it from "bugs.freeradius.org". Could you please tell me when will that website be recovered from the crash? Thanks, Kevin

1 0

RE:outer identity anonymous is being rejected (solved)
by Godfrey Peart 10 Feb '09

10 Feb '09

Apologies, I didn't read all the MAN pages, found the answer I needed >My FR 2.1 is set to authenticate users via PEAP + EAP-TTLS, this works fine but some users are being rejected >So it's being rejected. How do I get the inner identity which contains a valid username to be processed instead of the outer identity. >I've seen some posts about using* Autz-type INNER* options but have merely succeded in breaking my test system when tryng it out. > >At present this is my users file: > > > > > > >#If you are not in either group, no access is allowed >#FreeRADIUS 2.1 > > >#These are the groups we are checking for Lunar Building staff >DEFAULT Ldap-Group == "lunar-staff" > Aruba-User-Role = "employee" > >DEFAULT Ldap-Group == "lunar-member" > Aruba-User-Role = "member" > >DEFAULT SQL-Group == "Guests" > Aruba-User-Role = "guest" > >DEFAULT Ldap-group != "lunar-staff", Auth-Type := Reject >DEFAULT Ldap-group != "lunar-member", Auth-Type := Reject >#End

1 0

Re: Installation Problem
by Marcelo Freitas 10 Feb '09

10 Feb '09

Nice, Thanks Will I'll try it ... I had to stay with 2.1.1, because I didn't have time ... Thanks for sharing ... ----- Original Message ----- From: "Will D. Spann" >;willdspann(a)yahoo.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

MSSQL, bugs and a "patch"
by Sebastian Heil 10 Feb '09

10 Feb '09

Hello everybody, i try to work with a mssql-database. The connection to the database works fine, but there are some things missing and wrong in the schema and the dialup.conf. I added the following part to the schema.sql to make sure, that there is a radpostauth-table in the mssql-database: ----------------- CREATE TABLE radpostauth ( [id] [int] IDENTITY (1, 1) NOT NULL, [UserName] [varchar] (64) NOT NULL, [pass] [varchar] (64) NOT NULL, [reply] [varchar] (32) NOT NULL, [authdate] [datetime] NOT NULL, ) on [PRIMARY] GO ALTER TABLE [radpostauth] WITH NOCHECK ADD CONSTRAINT [DF_radpostauth_UserName] DEFAULT ('') FOR [UserName], CONSTRAINT [DF_radpostauth_pass] DEFAULT ('') FOR [pass], CONSTRAINT [DF_radpostauth_reply] DEFAULT ('') FOR [reply], CONSTRAINT [DF_radpostauth_authdate] DEFAULT ('1900-01-01 00:00:00') FOR [authdate], CONSTRAINT [PK_radpostauth] PRIMARY KEY NONCLUSTERED ( [id] ) ON [PRIMARY]; GO ------------------------- Maybe someone can verify this, if it is correct and maybe it is even worth to be supplied as a patch to the current version of the server. In the next days, i will try to correct some other issues about the mssql-configuration and i will try to convert the missing dialup.conf from mysql to mssql. -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger01

1 1

Dialup_admin "New user" page is empty
by Michael Schwartzkopff 10 Feb '09

10 Feb '09

Hi, I am trying to get dialup_admin running. I have ldap directory and FR+LDAP works. I have the webserver running, see the start page and "Check Server" works. When I click "New User" I see a blank page. Nothing in the /var/log/apache2 files. Any help or hints? Thanks. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Addresse: Bretonischer Ring 7; 85630 Grasbrunn; Germany Tel: +49 - 89 - 45 69 11 0 Fax: +49 - 89 - 45 69 11 21 mob: +49 - 174 - 343 28 75 mail: misch(a)multinet.de web: www.multinet.de Sitz der Gesellschaft: 85630 Grasbrunn Registergericht: Amtsgericht München HRB 114375 Geschäftsführer: Günter Jurgeneit, Hubert Martens --- PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

1 1