- Freeradius-Users - lists.freeradius.org

Configuration Question
by Rupert Finnigan 26 Sep '08

26 Sep '08

Hi, This isn't a question about a problem, rather a "best practise" sort of thing... I've currently got a FreeRadius installation servicing a number of Cisco units providing WPAv2 Auth against MS AD. This works great. I need to expand my setup a bit, and am looking for guidance/advise as to how best to configure the server to get what I want. I can slip my users into two sets - a "head office" set, and a "regional" set. The Head Office guys will need to be able to gain access anywhere, but the regional guys will only need to get access to either one, or a couple of networks in regional locations. E.g., Regional User 1 can access the network in Region 1 only, but Regional User 2 can access the network in Regions 1 & 2... The Head Office guys are all authenticated by AD, and I'm planning on having the Regional Guys stored in a Postgresql Database, probably with a matrix arrangement to store the information relating to the regions they're allowed access to. Additionally, it would be good to be able to have two difference root CA's - largely for political reasons. So far, I'm thinking two domains each with a virtual server, an initial proxy to hand requests to the two virtual servers based on domain, and then a bit of perl moduling to determine which Regions each Regional guy is allowed access to. I'd be very grateful for advise/experience to streamline this a bit, or tell me I'm an idiot and there's a much simpler way! Many Thanks, Rupert

1 0

Re: ..::Errors initializing modules::..
by Ing. Alfonso Reyes 25 Sep '08

25 Sep '08

Message: 3 Date: Thu, 25 Sep 2008 21:02:49 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: ..::Errors initializing modules::.. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20080925200249.GA28065(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Thanks for your help Alan, but the radius server was built with the > --with-mysql variable with no luck. >err, it builds by default with MySQL - no need for that configure flag. Thanks for the advice >once again, I will ask you, read the output when you run the ./configure - dump it to a file if you cannot scrollback through the whole log. SEE what >configure says when it tries checking for or doing MySQL stuff. Here's the output: === configuring in ./drivers/rlm_sql_mysql (/home/Conesh/Download/freeradius-server-2.1.0/src/modules/rlm_sql/./drivers /rlm_sql_mysql) configure: running /bin/sh ./configure '--prefix=/usr/local' '--enable-ltdl-install=no' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for mysql_config... yes checking for pthread_create in -lpthread... yes checking for mysql_init in -lmysqlclient_r (using mysql_config)... yes checking for mysql.h (using mysql_config --cflags)... yes configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged the flags you give configure mean nothing if your system doesnt have the relevant includes, libraries etc. But I can see warnings: configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. configure: WARNING: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. >more bluntly - what OS are you using? if redhat, fedora or Centos, do you have mysql-devel RPM installed? >if debian/ubuntu etc, do you have libmysqlclient package installed? >etc It is fedora core 9 and it has the mysql-devel rpm installed. Any ideas? Alfonso. P.S I will attach the result in case I miss something.

1 0

The client does not connect _*_*_*_
by Martin Silvero 25 Sep '08

25 Sep '08

in fact this IP (10.0.42.250) is another network which is connected to the notebook, which I have done now is to disconnect from the network and try to connect to the radius of the outcome this time is that in the radius server does not There is movement and the tool NTRadPing I get: "no response from server (time out), new attemp" - "could not receive a response from the server" the IP i add to raddb/clients.conf is the access point client = 10.0.31.40 the IP 10.0.42.250 as other networks but i disconect thanks!

3 2

Re: ..::Errors initializing modules::..
by Ing. Alfonso Reyes 25 Sep '08

25 Sep '08

Message: 3 Date: Thu, 25 Sep 2008 19:56:36 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: ..::Errors initializing modules::.. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20080925185636.GA27888(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > But I can't see that on the radiusd -X output, I've double checked > everything with no luck. Even if I'm trying the radtest with a user > that is on mysql the radius send a reject packet. > I can see on the output that the password doesn't match but I tried > with a new one getting the same message, I think that it is not > reading mysql because it is not initializing the module right?. >you built the server yourself? check the output from the ./configure stage - it probably didnt build the SQL stuff because eg you didnt have the >required MySQL development libraries installed at the time >alan Thanks for your help Alan, but the radius server was built with the --with-mysql variable with no luck. Any other idea? Regards.

3 2

Re: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line
by sth 25 Sep '08

25 Sep '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Venkat, Sorry for the response lag; I just noticed your post when searching for the same issue before realizing the problem. Was your server.key really created with the password "whatever"? (Check your .../raddb/certs/server.cnf file for the "input_password" and "output_password" settings. The "private_key_password" setting in your eap.conf file needs to match the password on the server.key (and, therefore, the "PRIVATE KEY" portion of server.pem). Otherwise, radiusd can't decrypt the key it needs to build TLS transactions. Cheers, - -sth sam hooker|http://www.noiseplant.com|i am between the internet -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkjb8iMACgkQX8KByLv3aQ1zrgCgh8pVFVLywED6HdME310fnbSZ cSkAmwWaRSa+fSOz9leiunhkMiKNXU7m =x4eL -----END PGP SIGNATURE-----

1 0

Re: ..::Errors initializing modules::..
by Ing. Alfonso Reyes 25 Sep '08

25 Sep '08

Hi Alan and list, First of all I want to apologize for that mistake, now everything is working if I use the text file. The thing is that I'm trying to use mysql and according to the web page (http://wiki.freeradius.org/SQL_HOWTO) I should see the sql module loading: Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 But I can't see that on the radiusd -X output, I've double checked everything with no luck. Even if I'm trying the radtest with a user that is on mysql the radius send a reject packet. I can see on the output that the password doesn't match but I tried with a new one getting the same message, I think that it is not reading mysql because it is not initializing the module right?. Any ideas? This is the first time I use freeradius as you can see, thanks for your time and help. Regards, Alfonso. Message: 2 Date: Wed, 24 Sep 2008 08:32:00 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: ..::Errors initializing modules::.. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48D9DEE0.10609(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ing. Alfonso Reyes wrote: > I'm having some issues with the configuration of the radius server, I'm > getting the following: Error Initializing Modules. > > The thing is that my radius server has no issues with the configuration > (eap.conf), and the instalation was succesful with mysql. I don't know what you mean by that. > Attached configuration files and error. Please don't post the configuration files. They don't help. > eap.txt correspond to the conf file found on the /etc/raddb/eap.conf > Eap2.txt correspond to the conf file found on the > /usr/local/etc/raddb/eap.conf > > Any ideas? Stop trying to use two different installations at the same time. READ the debug output: rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading certificate file /usr/local/etc/raddb/certs/cert-srv.pem What is unclear about that message? Alan DeKok. ------------------------------

2 1

The client does not connect _*_*_*_
by Martin Silvero 25 Sep '08

25 Sep '08

The firewall is disabled, and probe with the tool NTRadPing and the result in the radius is as follows: Thu Sep 25 12:49:16 2008 : Debug: Ignoring request to authentication address * port 1812 from unknown client 10.0.42.250 port 1083 Thu Sep 25 12:49:16 2008 : Debug: Ready to process requests. Thu Sep 25 12:49:20 2008 : Debug: Ignoring request to authentication address * port 1812 from unknown client 10.0.42.250 port 1083 Thu Sep 25 12:49:20 2008 : Debug: Ready to process requests. Thu Sep 25 12:49:23 2008 : Debug: Ignoring request to authentication address * port 1812 from unknown client 10.0.42.250 port 1083 Thu Sep 25 12:49:23 2008 : Debug: Ready to process requests. Thu Sep 25 12:49:27 2008 : Debug: Ignoring request to authentication address * port 1812 from unknown client 10.0.42.250 port 1083 Thu Sep 25 12:49:27 2008 : Debug: Ready to process requests. Thu Sep 25 12:49:30 2008 : Debug: Ignoring request to authentication address * port 1812 from unknown client 10.0.42.250 port 1083 Thu Sep 25 12:49:30 2008 : Debug: Ready to process requests. Thu Sep 25 12:49:34 2008 : Debug: Ignoring request to authentication address * port 1812 from unknown client 10.0.42.250 port 1083 Thu Sep 25 12:49:34 2008 : Debug: Ready to process requests.

2 1

The client does not connect _*_*_*_
by Martin Silvero 25 Sep '08

25 Sep '08

Good morning! I am with a new problem, I feel like I'm close. My problem now is that set in a notebook the connection to authenticate with tls but not connecting, I am not showing any error, just does not connect, you run into the radius with "-x" and is waiting for requests. Why is this wrong? Do you ever step on someone?

2 1

Backtrace found in debug: FreeRadius 2.0.5 version
by Syed Anwarul Hasan 25 Sep '08

25 Sep '08

Dear Alan,Ivan and all, I have updated my FreeRadius version 2.0.5 Installed on SLES 10 SP2 through CVS. Now when I authenticate with a User i didn' get a BackTrace. But when I try to Authenticate against Openldap I see this Trace with Memory Map after Server returns back the result. Do I need to Install latest version of FreeRadius to be compatible with the CVS update for my current version. Regards, SYED sending Access-Reject of id 187 to 192.168.1.131 port 1047 *** glibc detected *** radiusd: double free or corruption (!prev): 0x0817dd80 *** ======= Backtrace: ========= /lib/libc.so.6[0xb7ddf961] /lib/libc.so.6(__libc_free+0x84)[0xb7de1404] /usr/local/lib/libfreeradius-radius-2.0.5.so(pairbasicfree+0x3a)[0xb7f36d6a] /usr/local/lib/libfreeradius-radius-2.0.5.so(pairfree+0x2c)[0xb7f3707c] radiusd[0x8061b73] radiusd(radius_handle_request+0x5b)[0x806249b] radiusd(thread_pool_addrequest+0x3c)[0x805bbec] radiusd[0x8060232] /usr/local/lib/libfreeradius-radius-2.0.5.so (fr_event_loop+0x236)[0xb7f3a8c6] radiusd(radius_event_process+0x30)[0x8060b70] radiusd(main+0x5dc)[0x805acac] /lib/libc.so.6(__libc_start_main+0xdc)[0xb7d918ac] radiusd[0x804d221] ======= Memory map: ======== 08048000-08076000 r-xp 00000000 08:06 259362 /usr/local/sbin/radiusd 08076000-08078000 rw-p 0002e000 08:06 259362 /usr/local/sbin/radiusd 08078000-0818b000 rw-p 08078000 00:00 0 [heap] b7800000-b7821000 rw-p b7800000 00:00 0 b7821000-b7900000 ---p b7821000 00:00 0 b79b9000-b79c3000 r-xp 00000000 08:03 340094 /lib/libgcc_s.so.1 b79c3000-b79c4000 rw-p 00009000 08:03 340094 /lib/libgcc_s.so.1 b79dd000-b7a12000 r--s 00000000 08:05 77489 /var/run/nscd/passwd b7a12000-b7a47000 r--s 00000000 08:05 77526 /var/run/nscd/dbbLcLLP (deleted) b7a47000-b7a49000 r-xp 00000000 08:06 893319 /usr/lib/libkrb5support.so.0.0 b7a49000-b7a4a000 rw-p 00002000 08:06 893319 /usr/lib/libkrb5support.so.0.0 b7a4a000-b7a6c000 r-xp 00000000 08:06 893307 /usr/lib/libk5crypto.so.3.0 b7a6c000-b7a6d000 rw-p 00022000 08:06 893307 /usr/lib/libk5crypto.so.3.0 b7a6d000-b7a83000 r-xp 00000000 08:06 893303 /usr/lib/libgssapi_krb5.so.2.2 b7a83000-b7a84000 rw-p 00015000 08:06 893303 /usr/lib/libgssapi_krb5.so.2.2 b7a84000-b7aec000 r-xp 00000000 08:06 893317 /usr/lib/libkrb5.so.3.2 b7aec000-b7aee000 rw-p 00068000 08:06 893317 /usr/lib/libkrb5.so.3.2 b7aee000-b7b24000 r-xp 00000000 08:06 893641 /usr/lib/libldap-2.3.so.0.2.20 b7b24000-b7b25000 rw-p 00036000 08:06 893641 /usr/lib/libldap-2.3.so.0.2.20 b7b25000-b7b38000 r-xp 00000000 08:03 340335 /lib/libnss_ldap.so.2 b7b38000-b7b39000 rw-p 00012000 08:03 340335 /lib/libnss_ldap.so.2 b7b39000-b7b44000 rw-p b7b39000 00:00 0 b7b5d000-b7c6d000 r-xp 00000000 08:06 893546 /usr/lib/libcrypto.so.0.9.8 b7c6d000-b7c81000 rw-p 0010f000 08:06 893546 /usr/lib/libcrypto.so.0.9.8 b7c81000-b7c85000 rw-p b7c81000 00:00 0 b7c85000-b7cbe000 r-xp 00000000 08:06 893547 /usr/lib/libssl.so.0.9.8 b7cbe000-b7cc2000 rw-p 00038000 08:06 893547 /usr/lib/libssl.so.0.9.8 b7cc2000-b7cd7000 r-xp 00000000 08:06 893294 /usr/lib/libsasl2.so.2.0.21 b7cd7000-b7cd8000 rw-p 00014000 08:06 893294 /usr/lib/libsasl2.so.2.0.21 b7cd8000-b7ce4000 r-xp 00000000 08:06 893639 /usr/lib/liblber-2.3.so.0.2.20 b7ce4000-b7ce5000 rw-p 0000b000 08:06 893639 /usr/lib/liblber-2.3.so.0.2.20 b7ce5000-b7d1f000 r-xp 00000000 08:06 893643 /usr/lib/libldap_r-2.3.so.0.2.20 b7d1f000-b7d21000 rw-p 00039000 08:06 893643 /usr/lib/libldap_r-2.3.so.0.2.20 b7d21000-b7d26000 rw-p b7d21000 00:00 0 b7d28000-b7d2a000 r-xp 00000000 08:03 340122 /lib/libcom_err.so.2.1 b7d2a000-b7d2b000 rw-p 00001000 08:03 340122 /lib/libcom_err.so.2.1 b7d2b000-b7d33000 r-xp 00000000 08:03 340069 /lib/libnss_files-2.4.so b7d33000-b7d35000 rw-p 00007000 08:03 340069 /lib/libnss_files-2.4.so b7d35000-b7d38000 r-xp 00000000 08:06 259212 /usr/local/lib/ rlm_detail-2.0.5.so b7d38000-b7d39000 rw-p 00002000 08:06 259212 /usr/local/lib/ rlm_detail-2.0.5.so b7d39000-b7d3b000 r-xp 00000000 08:06 259165 /usr/local/lib/ rlm_acct_unique-2.0.5.so b7d3b000-b7d3c000 rw-p 00001000 08:06 259165 /usr/local/lib/ rlm_acct_unique-2.0.5.so b7d3c000-b7d3e000 r-xp 00000000 08:06 259317 /usr/local/lib/ rlm_preprocess-2.0.5.so b7d3e000-b7d3f000 rw-p 00001000 08:06 259317 /usr/local/lib/ rlm_preprocess-2.0.5.so b7d3f000-b7d4b000 r-xp 00000000 08:06 1036627 /usr/lib/freeradius/ rlm_ldap-2.0.5.so b7d4b000-b7d4c000 rw-p 0000b000 08:06 1036627 /usr/lib/freeradius/rlm_ldap-2.0. Aborted

3 6

Jradius con file!
by Jelena Žagar 25 Sep '08

25 Sep '08

I add the allow_codechange in jradius module in radiusd.conf file as you can see: # configure the rlm_jradius module jradius { name = "example" # The "Requester" name (a single # JRadius server can have # multiple "applications") primary = "localhost" # Uses default port 1814 secondary = "localhost" # Fail-over server tertiary = "localhost" # Fail-over server on port 8002 timeout = 1 # Connect Timeout onfail = NOOP # What to do if no JRadius # Server is found. Options are: # FAIL (default), OK, REJECT, NOOP keepalive = yes # Keep connections to JRadius pooled connections = 8 # Number of pooled JRadius connections allow_codechange = yes } But, when I started FreeRAdius on the console output, you can see that the allow_codechange is not read at all: Module: Library search path is ../lib Module: Loaded jradius jradius: name = "example" jradius: primary = "localhost" jradius: secondary = "localhost" jradius: tertiary = "localhost" jradius: timeout = 1 jradius: onfail = "NOOP" jradius: keepalive = yes jradius: connections = 8 It seems that these parameters are not read at all because if I delete them all, I get the same output. >From where these parameters are read from? Sincerely, Žagar Jelena

2 3