- Freeradius-Users - lists.freeradius.org

FreeRadius rejects Status-Server requests
by Galmiche Herve 13 Sep '08

13 Sep '08

Dear All, My Freeradius 2.0.5 on Opensuse 11.0 rejects all my messages 'Status-Server' requests. radiusd -X returns debuging message: WARNING: Ignoring Status-Server resquest due to security configuration. But I well have in my radiusd.conf a line security { ... status_server = yes ..} Can you precise me please where in the various .conf files I have to enable things to be able to check Freeradius state? Thx for help Hervé -- View this message in context: http://www.nabble.com/FreeRadius-rejects-Status-Server-requests-tp19464797p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Problem compiling freeradius-2.1.0 on Centos 5 x86_64
by Sergio Belkin 12 Sep '08

12 Sep '08

Hi, I have a freeradius 2.0.2 working fine with no problems on Centos 5 x86_64, I had no problem at compiling time. I want to test version 2.1.0 from freeradius. But it failed as follows: [snip] Making all in main... gmake[4]: Entering directory `/root/freeradius-server-2.1.0/src/main' /root/freeradius-server-2.1.0/libtool --mode=link gcc -o radmin radmin.lo gcc -o radmin .libs/radmin.o .libs/radmin.o: In function `main': /root/freeradius-server-2.1.0/src/main/radmin.c:117: undefined reference to `using_history' /root/freeradius-server-2.1.0/src/main/radmin.c:118: undefined reference to `rl_insert' /root/freeradius-server-2.1.0/src/main/radmin.c:118: undefined reference to `rl_bind_key' /root/freeradius-server-2.1.0/src/main/radmin.c:176: undefined reference to `readline' /root/freeradius-server-2.1.0/src/main/radmin.c:185: undefined reference to `add_history' collect2: ld returned 1 exit status gmake[4]: *** [radmin] Error 1 gmake[4]: Leaving directory `/root/freeradius-server-2.1.0/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-server-2.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-server-2.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-server-2.1.0' make: *** [all] Error 2 [snip] What's wrong? -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 4

2 questions about the python module
by Jester 12 Sep '08

12 Sep '08

I have one question and one problem with the python module. I'll toss out the problem question first, and the curiosity second. Problem: When I run freeradius in debugging mode (-X switch) it will not terminate with a ctrl-C, in fact, when I run it as a service, the init.d script fails to kill it as well, it has to be manually slaughtered using kill -9 <number> and only then can be restarted. I am curious if this is some aspect of trying to tie python into radius, or if I've done something terribly wrong ;) My curiosity is, as a workaround to other problems I had with the python modules, I finally just wrote python scripts and put them into the freeradius library, and I call them using the 'exec' module instead, and that works pretty good. Is there some benefit to running python as a module instead of using the exec module? As I said, adding in python makes the daemon hard to manage in an automated sort of way (I can bash script together a better kill, but I fear some underlying issue) so the exec solution has worked well for me, I just want to make sure im not hobbling my system in some terrible way doing this. Thanks for any comments! --Jester

2 1

FreeRadius2 + MySQL: NAS x Usergroup
by Carlos Eduardo Tavares Terra 12 Sep '08

12 Sep '08

Dear freeradius users, I have a special scenario. Today I have many freeradius servers, each one responsible for differente services. Now I want to group this freeradius servers into one master server, but I have users in many differente usergroups (one for each service). How can I associate an usergroup to a nas? Example: NAS (192.168.2.1) -> Usergroup (Dialup) NAS (192.168.2.2) -> Usergroup (Broadband) NAS (192.168.2.3) -> Usergroup (Hotspot) I saw how to do this using huntgroups, but I want to use a mysql database with all clients. There are another ways to implement this different services into one radius server, maybe the right way? If not, how can I associate the usergroups and nas using mysql? Thank you -- Carlos Eduardo Tavares Terra GNU/Linux #413291 [http://counter.li.org] Slackware Linux

4 6

Logging problem
by Norbert Wegener 12 Sep '08

12 Sep '08

Hello Alan, I want logging information, if a client shows up with an expired certificate. Therefor in authorize I have: ... eap if ( invalid ) { update reply { Tmp-String-5="INVALID Certificate" } } .... in post-auth : .. Post-Auth-Type REJECT { sql_log } and in modules/sql_log: Post-Auth = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate, nasname, nasipaddress,radiusip,machinetype,nasport,modulefailmes,csi) VALUES \ ('%{User-Name}', '%{User-Password}', \ '%{reply:Packet-Type}', '%S', '%{NAS-Identifier}','%{Client-IP-Address}','${RADIP}',\ '%{Port-Message}','%{NAS-Port-Id}','%{reply:Tmp-String-5}','%{Calling-Station-Id}');" When a client shows up with an expired certificate I would expect to see the message "INVALID Certificate". ..... Here is what I get with 2.1.0: [tls] >>> TLS 1.0 Alert [length 0002], fatal certificate_expired TLS Alert write:fatal:certificate expired TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server cisco Using Post-Auth-Type Reject +- entering group REJECT {...} [sql_log] Processing sql_log_postauth expand: %{User-Name} -> HOST/osd02red.ww901.mycompany.net expand: %{%{User-Name}:-DEFAULT} -> HOST/osd02red.ww901.mycompany.net [sql_log] sql_set_user escaped user --> 'HOST/osd02red.ww901.mycompany.net' expand: INSERT INTO radpostauth (username, pass, reply, authdate, nasname, nasipaddress,radiusip,machinetype,nasport,modulefailmes,csi) VALUES ('%{User-Name}', '%{User-Password}', '%{reply:Packet-Type}', '%S', '%{NAS-Identifier}','%{Client-IP-Address}','1.2.3.4', '%{Port-Message}','%{NAS-Port-Id}','%{reply:Tmp-String-5}','%{Calling-Station-Id}'); -> INSERT INTO radpostauth (username, pass, reply, authdate, nasname, nasipaddress,radiusip,machinetype,nasport,modulefailmes,csi) VALUES ('HOST/osd02red.ww901.mycompany.net', '', 'Access-Reject', '2008-09-12 09:58:09', '','123.246.185.169','1.2.3.4', '','','','00-00-00-00-00-02'); It seems, "if (invalid) " is not entered and I don't see why. Norbert Wegener

2 4

Failed to link EAP-Type/tls: rlm_eap_tls.so - Need Help
by niel m 12 Sep '08

12 Sep '08

Hello Sir/Madam, Good Evening I have a problem with my Radius server with LDAP Authentication support. Below are some logs; ==================================================================== // when i run "freeradius -X" for test run of freeradius rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1962] Unknown module "eap". radiusd.conf[1909] Failed to parse authenticate section. ==================================================================== // this is the acutal logs that i got during the execution of this command "/etc/init.d/freeradius start" in a separate terminal window Thu Sep 11 06:14:12 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Sep 11 06:14:12 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Sep 11 06:14:12 2008 : Error: rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory Thu Sep 11 06:14:12 2008 : Error: radiusd.conf[10]: eap: Module instantiation failed. Thu Sep 11 06:14:12 2008 : Error: radiusd.conf[1962] Unknown module "eap". Thu Sep 11 06:14:12 2008 : Error: radiusd.conf[1909] Failed to parse authenticate section. ==================================================================== I will highly appreciate any help that you can give. Thanks, Niel

3 3

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

TNT perfect!! thank colleagues for their help, and we want to try it in my next doubt! thanks!

1 0

Problems with the authentication TLS
by Martin Silvero 11 Sep '08

11 Sep '08

already achieved what !!!!!!!!!, restart the service, I started from scratch, cree certificates again. said the error was like your ..... was the password, which is in eap.conf Now I have a doubt .... AT THE howto tls two files that need to install the computer user is "root.der" and "cert-clt.p12" but in the folder cert/ have client's certificate but not the root.der ... Does the latest version which would file.der replacing root.der? thanks!!

2 1

logging unknown clients
by Greg Woods 11 Sep '08

11 Sep '08

Is there any way to get the freeradius 2.1 server to log requests coming from unknown clients? As far as I can tell, these are just silently discarded. I have read through all the comments on the log section in radiusd.conf but I don't see anything about this. Is there anywhere else where the logging capabilities are more fully documented that I just haven't been able to find? Thanks, --Greg

3 2

kick the frozen session
by Przemysław Backiel 11 Sep '08

11 Sep '08

hey, I have freeradius-1.1.0-6.amd64 connected with rp-pppoe-server and now I have one frozen session how Can I drop this session from Freeradius? I have of cors username of that frozen user :) -- Z powazaniem Przemyslaw Backiel

2 3