- Freeradius-Users - lists.freeradius.org

GCC
by Casartello, Thomas 16 Oct '08

16 Oct '08

Are there any known issues with Free RADIUS and GCC 4.3.0+? I've never been able to get freeradius working quite right in Fedora 9 and I was wondering if it's because of the new GCC version. Thomas E. Casartello, Jr. Wireless Network Technician Linux Specialist Information Technology Westfield State College Westfield, MA 01086 (413) 572-8245

3 3

errors on starting deamon
by Noel Rwamatsika 16 Oct '08

16 Oct '08

hi there, i have the following error when i try to start the free radius daemon: roke-billing:/home/noel # rcfreeradius start Starting RADIUS daemon radiusd: Error: No log destination specified. startproc: exit status of parent of /usr/sbin/radiusd: 1 failed I have specified the log destination in the radius.conf file as /var/log/radius when i check the log, this is what i see Fri Oct 17 00:48:57 2008 : Error: rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory Fri Oct 17 00:48:57 2008 : Error: rlm_eap_tls: Error reading certificate file /etc/raddb/certs/server.pem Fri Oct 17 00:48:57 2008 : Error: rlm_eap: Failed to initialize type tls Fri Oct 17 00:48:57 2008 : Error: /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" Fri Oct 17 00:48:57 2008 : Error: /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". Fri Oct 17 00:48:57 2008 : Error: /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Fri Oct 17 00:48:57 2008 : Error: Errors initializing modules looking forward to your help regards, Noel

2 3

dynamic dns in radius?
by Karl Auer 16 Oct '08

16 Oct '08

Hi all. We have a very broken NAS - it basically only half-understands realms. If I log in with "john@ream", it will send "john@realm" off to the RADIUS server, which authenticates just fine, but the NAS will then try to register "johnrealm" via dynamic DNS. So this is not a RADIUS issue, it's an issue with how this NAS handles dynamic DNS updates. There is no way to make the NAS behave differently, though enhancement requests and bug reports have been lodged in hopes of better behaviour in a future release of the NAS OS. So I was wondering whether there is any practical way to get the RADIUS server to do the dynamic DNS instead. I found this from 2002: http://marc.info/?l=freeradius-users&m=106947389429225&w=2 And this thread from 2004: http://lists.cistron.nl/pipermail/freeradius-devel/2004-July/007357.html ... but I see no mention of a DDNS module in the current distribution, nor in the docs (though I admit I may well have missed it, there are a lot of docs). Is there such a module? Or has anyone already implemented DDNS from within FreeRADIUS, perhaps by writing an executable script such as suggested by Alan in 2002? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

2 5

LDAP integrations
by Martin MacLeod-Brown 16 Oct '08

16 Oct '08

Hi Everyone I have installed the latest version of Free Radius onto an Ubuntu server, and was hoping that someone can help me with the steps to get it to authenticate users against our LDAP server Are there any good HOW-TOs out there on the best way to do this? Im finding everything as bit confusing and could do with an outline of the steps to take, or files I need to edit. So far from googling Edit the LDAP section of radius.conf - done, I think! Edit the dictionary file? Edit users file? Any help appreciated Martin Martin Macleod-Brown | Infrastructure Engineer - Networks & Security Infrastructure Team London Business School | Regent's Park | London NW1 4SA | United Kingdom Switchboard +44 (0)20 7000 7000 | Direct line +44 (0)20 7000 7772 | Mobile +44 (0)796 690 7772 | Email mmacleod(a)london.edu <mailto:mmacleod@london.edu> www.london.edu <http://www.london.edu> | London experience. World impact. Please consider the environment before printing this email ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System on behalf of the London Business School community. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

4 3

I'm stuck; FreeRadius and Heimdal Kerberos
by Ronni Feldt 16 Oct '08

16 Oct '08

Hi, I am trying to get FreeRadius to work with Heimdal Kerberos. What I use: Ubuntu 8.04 FreeRadius 1.1.7-1build4 Heimdal-kdc 1.0.1-5ubuntu4 I have installed Heimdal Kerberos and get tickets. My next step is to get FreeRadius to work with Heimdal and then logging in to my HP-Switch using FreeRadius. I have done the following: # Heimdal Kerberos information REALM = ONE.COM HOST = rofe # In Heimdal Kerberos kadmin -l kadmin> add radius kadmin> ext_keytab --keytab=/etc/krb5.keytab radius kadmin> add rofe # Installing FreeRadius apt-get install freeradius freeradius-krb5 # Added the following in /etc/freeradius/radiusd.conf # In the authenticate section Auth-Type Kerberos { krb5 } # In the modules section krb5 { # keytab containing the key used by rlm_krb5 keytab = /etc/krb5.keytab # principal that is used by rlm_krb5 service_principal = radius/rofe.one.com } I have followed what documentation I could find; http://wiki.freeradius.org/Rlm_krb5 # Then I configured my HP-Switch: radius-server host 192.168.212.93 radius-server key <key> # As key I used the principal radius password - correct ? aaa authentication ssh login radius local aaa authentication ssh enable radius local aaa authentication telnet login radius local aaa authentication telnet enable radius local aaa authentication login privilege-mode # Then I tried to login using telnet telnet 192.168.212.4 # Gets prompted for username and password and uses principal rofe and my password but gets this error: Can't reach RADIUS server 192.168.212.93 I can ping 192.168.212.4 from the HP-Switch. I don't know what to do or where to look - I'm stuck! - Ronni

2 4

Re: freeradius 2.1.1 with ubuntu server 8.04
by piston 16 Oct '08

16 Oct '08

Hi All Update, i found this error message under freeradius-server-2.1.1/debian/patches/01-radiusd-to-freeradius.dpatch patching file Make.inc.in Hunk #1 succeeded at 48 with fuzz 1. patching file raddb/radiusd.conf.in Hunk #1 succeeded at 66 with fuzz 2 (offset 33 lines). Hunk #2 FAILED at 128. Hunk #3 FAILED at 154. 2 out of 3 hunks FAILED -- saving rejects to file raddb/radiusd.conf.in.rej Thanks ----- Original Message ---- From: piston <pistonic(a)yahoo.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, October 16, 2008 7:06:45 PM Subject: freeradius 2.1.1 with ubuntu server 8.04 Hi All I'm trying to building package, so how i got error during the process. I have no problem to build freeradius 2.1.0 package at this pc. Please assist. Below are the logs dpkg-buildpackage -b -uc dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set LDFLAGS to default value: -Wl,-Bsymbolic-functions dpkg-buildpackage: source package freeradius dpkg-buildpackage: source version 2.1.1-0 dpkg-buildpackage: source changed by Alan DeKok <aland(a)freeradius.org> dpkg-buildpackage: host architecture i386 debian/rules clean dpatch deapply-all 02-dialupadmin-help not applied to ./ . attempting to revert failed patch 01-radiusd-to-freeradius from ./: md5sums match, proceeding ... done (neither success nor failure guaranteed) rm -rf patch-stamp patch-stampT debian/patched dh_testdir dh_clean rm -f build-arch-stamp build-indep-stamp libltdl/stamp-h1 rm -f install-arch-stamp install-indep-stamp configure-stamp [ -f Make.inc ] && make distclean || true # The make clean forgets to remove this build directory [ -d src/modules/lib ] && rm -fr src/modules/lib || true # Put the original autotools files back in place [ -f config.sub.dist ] && rm config.sub && mv config.sub.dist config.sub || true [ -f config.guess.dist ] && rm config.guess && mv config.guess.dist config.guess || true debian/rules build test -d debian/patched || install -d debian/patched dpatch apply-all applying patch 01-radiusd-to-freeradius to ./ ... failed. make: *** [patch-stamp] Error 1 dpkg-buildpackage: failure: debian/rules build gave error exit status 2 Thank you. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Syslog?
by Phillip Heller 16 Oct '08

16 Oct '08

Hello, Running FreeRadius 2.0.5, with the following log related config: logdir = syslog log { log_destination = syslog syslog_facility = local7 stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } I've found lots of conflicting info among the wiki, documentation, and list suggesting different statements (log_destination=, destination=), and perhaps outside of log{}. I did look at the code, and it looks to me as if log_destination is the proper statement. Regardless of what I try (and I have tried both destination= and log_destination=, both inside and outside of log{}), the server does not show it as a parsed command when I fire up attached with debugging: [root@h36laa001:/etc/raddb]% radiusd -X -f FreeRADIUS Version 2.0.5, for host x86_64-redhat-linux-gnu, built on Aug 14 2008 at 23:20:24 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "syslog" libdir = "/usr/lib64" radacctdir = "syslog/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } } I'm sure I'm just missing something simple. Any ideas? --phil

4 5

turn off accounting for specific group
by Marinko Tarlac 15 Oct '08

15 Oct '08

Hi I want to ignore accounting inform. for some user groups and to insert them into database for another groups. What is the best way to do this ? Thanks

2 1

Number of Clients
by Bernhard Miklautz 15 Oct '08

15 Oct '08

Hi there, I'm graphing the stats of the configured clients we have. Currently I use something like <snip> echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 35, FreeRADIUS-Stats-Client-Number = 21" | radclient 127.0.0.1:18120 status veryverysecret </snip> to retrive them.That works out fine. What I now miss is a way to actually get a list of clients, either the number (Stats-Client-Number), or even better a list of ips. Is it somehow possible to also get the number of clients via the server status? Or is there another possibility, besides parsing the config file. Thanks in advance, Bernhard

3 7

EAP-TTLS with LDAP and KRB5?
by Jonathan D. Proulx 15 Oct '08

15 Oct '08

Hi all, using 1.1.7 (forgive me) I have EAP-TTLS working from the files module and I have krb5 athentication working with ldap authorization fro radtest, but when I try EAP-TTLS as an ldap user I fail to connect, and the sever never seems to try the krb5 module. Before I start pulling my hair out is even possible? http://lists.cistron.nl/pipermail/freeradius-users/2006-March/msg00055.html seems to suggest it is but my searches aren't turning up much specifics... Thanks, -Jon

2 2