- Freeradius-Users - lists.freeradius.org

Re: Beating a dead horse, or freeradius 2.1.1 and active directory
by Ben Little 04 Dec '08

04 Dec '08

The how to lists the user account in bold indicating it should be modified to fit my environment. I created a user named rtest in active directory and am using that account for testing I do not think it will matter if I create a user called user to test with but I can. There is an entry in the users file that states (according to the how to this can be used for testing) rtest Auth-type := "ntlm_auth" (Btw this fails unless ntlm_auth is inside quotes which is not shown in the how to) Which doesn't work using radtest. As far as the "warning" where exactly in the how to does it say to disable local auth because I sure didn't see it. This is enabled in the default install apparently because I sure didn't enable it. I appreciate the reply... --- Sent from Blackberry handheld device ----- Original Message ----- From: freeradius-users-bounces+blittle=skylight.com(a)lists.freeradius.org <freeradius-users-bounces+blittle=skylight.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wed Dec 03 18:10:09 2008 Subject: RE: Beating a dead horse, or freeradius 2.1.1 and active directory >Rupert had mentioned in this thread that the switch is sending a PAP request and that it isn't being forwarded to the ntlm_auth module because of that, which makes sense I suppose. I am wondering though is there a way to configure the radius server to forward (or proxy) authentication requests to the KDC for authentication? I think what I'm doing is a little outside of the how-to that has been referenced. > .. > Module: Instantiating ntlm_auth > exec ntlm_auth { > wait = yes > program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=SKYLIGHT --username=%{mschap:User-Name} --password=%{User-Password}" > input_pairs = "request" > shell_escape = yes > } .. >rad_recv: Access-Request packet from host <switch> port 1645, id=46, length=84 > User-Name = "rtest" > User-Password = "<omitted>" > NAS-Port = 2 > NAS-Port-Id = "tty2" > NAS-Port-Type = Virtual > Calling-Station-Id = "<omitted>" > NAS-IP-Address = +- entering group authorize {...} .. >[files] users: Matched entry rtest at line 1 >++[files] returns ok .. >Found Auth-Type = Local >WARNING: Please update your configuration, and remove 'Auth-Type = Local' So, what happened to following the howto? Why is user entry for rtest setting Auth-Type Local and not ntlm_auth? There is nothing like that mentioned in the instructions. Debug is also printing a clear warning that that is wrong. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Issue with PAP/LDAP authentication after upgrade FR 2.0.5 to FR 2.1.1
by Thibault Le Meur 04 Dec '08

04 Dec '08

Hi Gurus, I've just (auto)updated my FR from 2.0.5 to 2.1.1 and some authentications stop working. For these specific authentications the ldap module is used to retrieve the password from LDAP (hashed with MD5 or CRYPT, ...), and then PAP is used to compare the passwords (auto_header is turned on in the pap module). Before 2.1.1 everything was working. After 2.1.1, I get Authentication Failures because passwords don't match. I've analysed the debug log and I wonder if the auto_header of the pap module is really working! Here is an abstract of the radius debug logs (usernames,passwords, and IP address have been obfuscated): rad_recv: Access-Request packet from host 10.1.1.1 port 54251, id=6, length=94 User-Name = "username" User-Password = "USERPASSWD" NAS-IP-Address = 10.1.1.1 NAS-Port = 6 Service-Type = Dialout-Framed-User Calling-Station-Id = "10.1.1.10" NAS-Identifier = "OpenVpn" NAS-Port-Type = Virtual server mycompany-vpn-perso-ovpn { +- entering group authorize {...} ++[preprocess] returns ok ... [files_mycompany_vpn_perso_ovpn] users: Matched entry DEFAULT at line 2 ... ++[files_mycompany_vpn_perso_ovpn] returns ok ++- entering policy redundant {...} [ldap1] performing user authorization for username [ldap1] expand: %{Stripped-User-Name} -> [ldap1] expand: %{User-Name} -> username [ldap1] expand: (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(MyCompany-AccountStatus=active)) -> (&(uid=username)(MyCompany-AccountStatus=active)) [ldap1] expand: dc=mycompany, dc=fr -> dc=mycompany, dc=fr .. rlm_ldap: extracted attribute Pool-Name from generic item Pool-Name:=Ovpn_Main_Pool [ldap1] Added User-Password = {MD5}/9sLgyXJRml0Lds4xd6rOg== in check items [ldap1] looking for check items in directory... rlm_ldap: mycompanyNTPassword -> NT-Password == 0xe0b531f2a8a5cb7ecd2b4951b1d79E1d [ldap1] looking for reply items in directory... [ldap1] user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap1] returns ok ++- policy redundant returns ok ... ==> Until this line everything is ok: the userPassword attribute is added to User-Password because I have the line "password_attribute = userPassword" uncommented in my ldap module setup. Note also that I have the password in NT-Hashed format as well, but I don't intend to use it in this particular authentication process. ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group PAP {...} [pap] login attempt with password "USERPASSWD" [pap] Using clear text password "{MD5}/9sLgyXJRml0Lds4xd6rOg==" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. } # server mycompany-vpn-perso-ovpn Using Post-Auth-Type Reject ==> I have no reference to the User-Password attribute in my setup (either in the user "file" or in the radiusprofile taken from the ldap directory. It seems like the ldap module adds the User-Password attribute and then the PAP module decides to change it to Cleartext-Password instead of processing the auto_header feature and setting the MD5-Password. What do you think ? Is there somewhere in my setup where I could have broken the normal FR processing ? Many thanks in advance, Thibault

3 5

Beating a dead horse, or freeradius 2.1.1 and active directory
by Ben Little 04 Dec '08

04 Dec '08

Hello internet pals, I'm attempting to configure freeradius to be used as a AAA mechanism for a bunch of cisco routers and switches, I have freeradius working correctly with local users however it appears that it is completely ignoring the mschap configuration that I've applied, I'm not sure why... when attempting to perform a radtest locally I get the following: lol@id10t$ radiusd -X FreeRADIUS Version 2.1.1, for host i386-redhat-linux-gnu, built on Nov 24 2008 at 10:30:21 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client MR_SWITCHEROONIE { require_message_authenticator = no secret = "SUPER_SEKRAT_KEYZ" nastype = "cisco" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host *.*.*.* port 1645, id=2, length=102 User-Name = "windoze_luser" User-Password = "super sekrat passwordz" NAS-Port = 1 NAS-Port-Id = "tty1" NAS-Port-Type = Virtual Calling-Station-Id = "*.*.*.*" NAS-IP-Address = *.*.*.* +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "windoze_luser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 210 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> windoze_luser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 2 to 192.168.0.200 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 2 with timestamp +9 Ready to process requests. It appears that the mschap is returning noop and not even attempting to authenticate the user, here's what I have done so far... no changes to radiusd.conf (I have read several times that if I touch this file I get smacked like a red headed step child) changes made to /modules/mschap mschap { #use_mppe = no #require_encryption = yes #require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" not really any changes to /sites-enabled/default I've tried adding ntlm_auth to the authenticate section but it doesn't seem to like that...here's the output from that. Module: Checking authenticate {...} for more modules to load /etc/raddb/sites-enabled/default[260]: Failed to find module "ntlm_auth". /etc/raddb/sites-enabled/default[227]: Errors parsing authenticate section. } Errors initializing modules I have read the "how to" on deployingradius.com however, this "how to" appears to be written for a much older version of freeradius since many of the attributes mentioned are no longer contained in radiusd.conf, I've also looked at the freeradius wiki without much luck. I think I have everything configured correctly EXCEPT for freeradius utilizing the module for ntlm_auth. Thanks for any help!

4 15

Logging eap protocols
by Richard Timsit 04 Dec '08

04 Dec '08

Hello, i am using a Freeradius 2.1.1. I need logging authentication method by User-Name. I am trying using linelog module for this... but i don't know how to retrieve the information. Does anyone has a clue ? Thanks. -- Richard Timsit <Richard.Timsit(a)epfl.ch> EPFL DIT-TI

4 5

Re: Time based billing
by Sebo PL 04 Dec '08

04 Dec '08

I think it could be done by some special DB function. You can write one in plpgsql, then you can exec it using the sql radius module. 2008/12/3 regs(a)kinetix.gr <regs(a)kinetix.gr> These situations are often in the VoIP billing world. If the rate changes > during a call there is little > you can do in a prepaid billing system (in a postpaid situation this is not > a problem). You have to choose > either to bill your customer with the rate that is valid at the beginning > of the call or at the end of it. Most of the > implemantations choose to bill the customer with the rate that is valid at > the end of the call. I know > this is somewhat inconsistent because if you calculate the remaining time > with a low rate and the rate changes > during the call then you might end up with a negative credit on your > prepaid customer's balance. There is little > you can do to about that. You just have to choose one of the options above > and notify your customers > about your decision. The thing is that all this - although scary at first > sight - is somewhat balanced in the end > (fair-wise) because the probabilities that your customer can make a call > during a low-to-high rate change are > equal with the probabilities that the call follows a high-to-low rate > change. So in the end nobody really loses or wins. > > You don't have to be a perl expert to use the rlm_perl module. But I can > tell you from my experience that it > gives you control of all different scenarios that may arise. Your back-end > could (usually a DB in these situations) > be as complex as you like (pricelists per customer, per time-slice, per > type, per u-name-it), and your code could > be as complex as you like (and as dynamic as you like) using a 3rd > generation language that gives the flexibility to > do whatever you want. > > > > Alan DeKok wrote: > > Saeed Akhtar wrote: > > > Yes I know that freeradius doesn't know whether we are charging $ 1 or > 2. But the purpose of asking question was that If a user has 3 hrs left > @ $1/hr and after an hour the rate changes to 0.5/hr then technically > freeradius should reply Session-Timeout = 5hrs as (1hr @ $1/hr + 4hrs @ > $0.5/hr). So may be we can create some condition to do so. > > > See the "expr" module. It has limited support for some math expressions. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 2

Looking for freelance help to create a custom freeradius module for a 2-factor authentication
by Joshua Lim 03 Dec '08

03 Dec '08

Note: Sorry, please ignore my other post with no subject. I'm a newbie, i'm looking for freelance help to create a custom freeradius module for a 2-factor authentication requirement. If you are keen, you can find more details over here - http://www.rentacoder.com/RentACoder/misc/BidRequests/ShowBidRequest.asp?ln… Thank you. Rgds, Joshua _________________________________________________________________ Easily publish your photos to your Spaces with Photo Gallery. http://get.live.com/photogallery/overview

1 0

(no subject)
by Joshua Lim 03 Dec '08

03 Dec '08

Hi, I'm a newbie, i'm looking for freelance help to create a custom freeradius module for a 2-factor authentication requirement. If you are keen, you can find more details over here - http://www.rentacoder.com/RentACoder/misc/BidRequests/ShowBidRequest.asp?ln… Thank you. Rgds, Joshua _________________________________________________________________ Join the Fantasy Football club and win cash prizes here! http://fantasyfootball.sg.msn.com

1 0

Make error
by Olavo 03 Dec '08

03 Dec '08

Hello all, I am trying again with this issue hoping that someone can take a look at it. I am trying to compile on a RedHat ES5, 64 bits. Any help will be very much appreciated. thanks Olavo Hi again, It didn't "make" . It has returned errors. .libs/radmin.o: In function `main': /usr/src/freeradius-server-2.1.1/src/main/radmin.c:489: undefined reference to `readline' /usr/src/freeradius-server-2.1.1/src/main/radmin.c:411: undefined reference to `using_history' /usr/src/freeradius-server-2.1.1/src/main/radmin.c:412: undefined reference to `rl_insert' /usr/src/freeradius-server-2.1.1/src/main/radmin.c:412: undefined reference to `rl_bind_key' /usr/src/freeradius-server-2.1.1/src/main/radmin.c:498: undefined reference to `add_history' collect2: ld returned 1 exit status gmake[4]: *** [radmin] Error 1 gmake[4]: Leaving directory `/usr/src/freeradius-server-2.1.1/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/src/freeradius-server-2.1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/src/freeradius-server-2.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/src/freeradius-server-2.1.1' make: *** [all] Error 2 Olavo > -----Original Message----- > From: > freeradius-users-bounces+jsantos5954=gmail.com(a)lists.freeradiu > s.org > [ <mailto:freeradius-users-bounces+jsantos5954=gmail.com@lists.f> mailto:freeradius-users-bounces+jsantos5954=gmail.com@lists.f > reeradius.org] On Behalf Of Alan DeKok > Sent: Wednesday, November 19, 2008 1:14 PM > To: FreeRadius users mailing list > Subject: Re: configure error > > > Olavo wrote: > > I downloaded version 2.1 from <http://freeradius.org/download.html> http://freeradius.org/download.html . > > When configuring ( ./configure) I got several errors on config.log. > > The only reason to look at that file is to debug the > "configure" scripts. The log is SUPPOSED to be full of > errors, because it's testing for platforms other than the one > you're using. > > Don't look at it. > > Perhaps you could explain if there are *other* errors. > Like maybe you're trying to do something... ? Right now, all > it looks like is you're trying to understand the contents of > "config.log", which is a complete waste of time. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > <http://www.freeradius.org/list/users.html> http://www.freeradius.org/list/users.html >

10 31

PAM to authenticate - ldap to authorize?
by Zahid Mehmood 03 Dec '08

03 Dec '08

Hi, I have freeradius 2.0.5 configured to use pam (using kerb) for user authentication. I am trying to find out if it is possible to limit access based on ldap groups. I've checked the list archive as well as the web and am not able to find a solution. I'd appreciate it very much if someone can provide some guidance/tips in this regard. Thanks. -- Zahid

2 1

Problem with CPU load
by Angel L. Mateo 03 Dec '08

03 Dec '08

Hello, We have a debian server (debian 4.0 etch) running freeradius 1.1.7. We have compile it from debian source package, but including eap_tls and eap_ttls support. Our user repository is an LDAP server (openldap 2.3.30) running in another host. This radius server is a Xen virtual machine with 512MB of RAM. The problem we have is that sometimes it loads the CPU too much. An uptime of the host reports loads over 100 points and a 99% of CPU utilization. These loads last least than a minute, but during this minute, you can't authorize anybody. Any idea of what could be happening? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

2 1