- Freeradius-Users - lists.freeradius.org

Freeradius + OpenLDAP
by Ivan . 13 Aug '08

13 Aug '08

Hi Does any have any links to some decent "how tos" for integrating OpenLDAP into freeradius for user management? Thanks Ivan

3 3

Error compiling FreeRadius-2.0.5
by Ums 13 Aug '08

13 Aug '08

Hi I have Red Hat Linux release 8.0 and i am trying to install free radius 2.0.5 fresh getting the following errors while doing a make after the ./configure any inpur with be greatly appreciated rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin -fno-rtti -fno-exceptions "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/radius_snmp.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /freeradius-server-2.0.5/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -ldl -Wl,--rpath -Wl,/usr/local/lib .libs/threads.o: In function `setup_ssl_mutexes': /freeradius-server-2.0.5/src/main/threads.c:217: undefined reference to `OpenSSL_add_all_algorithms' /freeradius-server-2.0.5/src/main/threads.c:220: undefined reference to `CRYPTO_num_locks' /freeradius-server-2.0.5/src/main/threads.c:226: undefined reference to `CRYPTO_num_locks' /freeradius-server-2.0.5/src/main/threads.c:230: undefined reference to `CRYPTO_set_id_callback' /freeradius-server-2.0.5/src/main/threads.c:231: undefined reference to `CRYPTO_set_locking_callback' .libs/threads.o: In function `request_handler_thread': /freeradius-server-2.0.5/src/main/threads.c:497: undefined reference to `ERR_remove_state' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/freeradius-server-2.0.5/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/freeradius-server-2.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/freeradius-server-2.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/freeradius-server-2.0.5' make: *** [all] Error 2 Thanks much, Ums

2 1

oracle support
by Alexandre Chapellon 13 Aug '08

13 Aug '08

Hello, I can see that oracle can be used to store accounting data ippool and others stuff like this but nothing about authenticating request with users and password stored in oracle database..... how can i manage to do this?

1 1

Cleartext Password not clear
by Stéven Le Bras 12 Aug '08

12 Aug '08

Hi there, I'm attempting to log in chillispot with freeradius but when I send the couple username / password with a cleartext password in user-password to freeradius through chillispot, radiusd respond : rad_recv: Access-Request packet from host 127.0.0.1 port 36710, id=47, length=263 ChilliSpot-Version = "1.0.12" User-Name = "testuser" User-Password = "\177\326=\343\017\021e\247B4ޣ\202<6\001" NAS-IP-Address = 10.1.0.1 Service-Type = Login-User Framed-IP-Address = 10.1.0.4 Calling-Station-Id = "00-13-CE-8C-0F-AF" Called-Station-Id = "00-09-6B-D8-9A-C6" NAS-Identifier = "nas01" Acct-Session-Id = "48a18af500000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Location-ID = "isocc=,cc=,ac=,network=SYS_TECH," WISPr-Location-Name = "HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3990/logoff" Message-Authenticator = 0x8bd17fcc4a6acc6cac5026615e4545b5 [...] auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject (the password is "plop") but i want that freeradius can read the password without transform it. Is it possible or do you think it could be chillispot that transform it ? Thank's -- Stéven

2 3

Multiple Attribute checks with sql module
by Alexander Koeppe 12 Aug '08

12 Aug '08

Hello List, I want to set up freeradius as a proxy for cisco management and dot1x. The attribute to check is NAS-Port-Type. If it's "Ethernet" it's a dot1x request and has to be proxied by one realm configured in proxy.conf. Else it has to be proxied to another realm also configured in proxy.conf for one-time-password authentication. Further if a specific NAS requests, the request should be accepted by the proxy itself. I got this already working with the users file looking like DEFAULT NAS-Port-Type==Ethernet,NAS-IP-Address==1.1.1.1,Auth-Type:=Accept DEFAULT NAS-Port-Type==Ethernet,Proxy-To-Realm:=Realm1 DEFAULT NAS-IP-Address==1.1.1.1,Auth-Type:=Accept DEFAULT Proxy-To-Realm:=Realm2 But I doesn't get this working using the sql module. My database structure looks like mysql> select * from radcheck; +----+----------+---------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-------+ | 2 | testuser | Password | == | test | | 4 | DEFAULT | NAS-Port-Type | =* | | +----+----------+---------------+----+-------+ 2 rows in set (0.00 sec) mysql> select * from usergroup; +----+----------+------------+ | id | UserName | GroupName | +----+----------+------------+ | 2 | DEFAULT | ProxyMgt | | 3 | DEFAULT | ProxyDOT1x | +----+----------+------------+ 1 row in set (0.00 sec) mysql> select * from radgroupcheck; +----+------------+----------------+----+----------+ | id | GroupName | Attribute | op | Value | +----+------------+----------------+----+----------+ | 4 | ProxyMgt | NAS-Port-Type | == | Virtual | | 5 | ProxyMgt | Proxy-To-Realm | := | Mgt | | 6 | ProxyDOT1x | NAS-Port-Type | == | Ethernet | | 7 | ProxyDOT1x | Proxy-To-Realm | := | PortSec | +----+------------+----------------+----+----------+ 4 rows in set (0.00 sec) mysql> select * from radgroupreply; Empty set (0.00 sec) With this sql configuration, the server proxy management requests but not dot1x requests. In debug it says "No matching entry in the database for request from user". Despite the acceptance of specific NAS requests. The reason I want to realize this configuration with the sql module is, that changes are possible without HUP the process. I've read the documentation which is available for the sql module but the examples described there are not that complex to help with my problem. Can anyone help me to realize the above mentioned configuration of the users file with the sql module? Thanks in advance Cheers Alex

1 0

What is the certificate that I installed on the notebook?
by Martin Silvero 12 Aug '08

12 Aug '08

/certs/ in the folder many licences, what is that I installed on the notebook and as set? thanks!!! -- -- Silvero Martin

1 0

Help needed for radrelay under 1.1.3
by Ryan 12 Aug '08

12 Aug '08

Hi All, Need some help on radrelay for 1.1.3 if possible. I have a radius setup whereby there are two radius, one for authorization/authentication and one for accounting. The one doing authorization/authentication will relay the accounting detail using radrelay to the other radius which will update to sql. Currently I'm having some problem with the relaying, it does not seems to be working as the detail file which is suppose to be cleared as entries are relayed is getting filled up. I noticed that the radrelay process is not forking the detail.work file at all. Have tried running radrelay in debug mode but was not able to find any error other than the following rad_verify: Received Accounting-Response packet from client xxx.xxx.xxx.xxx port 1813 with invalid signature (err=2)! (Shared secret is incorrect.) Both radius are running 1.1.3. The error is rather strange as I'm sure that the shared secret is correct. Best Regards, Ryan

2 1

Why do I need to force Auth-Type?
by sphaero 12 Aug '08

12 Aug '08

In a previous post "PAP what password encryption is used?" I managed to get authentication working with a msssql backend however I need to force Auth-Type := PAP. I read it's bad practice to force the Auth-Type so I was wondering what I could do to let freeradius figure the authentication itself. This is all done on freeradius 1.1.6 (OSS 10.3) I've setup an sql module: sql mssql { driver = "rlm_sql_unixodbc" # Connect info server = "test" login = "Radius_User" password = "blabla" radius_db = "V2" # niet gebruikt wel geset! acct_table1 = "radacct" acct_table2 = "radacct" authcheck_table = "user" authreply_table = "user" # niet gebruikt wel geset! groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "usergroup" # Remove stale session if checkrad does not see a double login deletestalesessions = yes # Print all SQL statements when in debug mode (-x) sqltrace = no sqltracefile = ${logdir}/sqltrace.sql # number of sql connections to make to server num_sql_socks = 5 sql_user_name = "%{Stripped-User-Name:-%{User-Name:-none}}" # Custom query die attributen klaar zet! authorize_check_query = "SELECT UserID,Usernaam,'SHA-Password' AS Attribute, Wachtwoord, ':=' AS Op FROM ${authcheck_table} WHERE Usernaam = '%{SQL-User-Name}' ORDER BY UserID" authorize_reply_query = "SELECT UserID,Usernaam from {authreply_table} WHERE Usernaam = '%{SQL-User-Name}' ORDER BY UserID" } You can see I'm using a custom SQL query to get the right attributes. I can only compare username and password in this database. I actually don't need any groupcheck's etc. I've setup its authorize entry: Autz-Type mssql { mssql } and finally in users file: DEFAULT Realm == mssql.nl", Autz-Type := mssql This setup doesn't work: modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "mssql.nl" for User-Name = "lsa(a)mssql.nl" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "lsa" rlm_realm: Proxying request from user lsa to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 Found Autz-Type mssql Processing the authorize section of radiusd.conf modcall: entering group mssql for request 1 radius_xlat: 'lsa' rlm_sql (mssql): sql_set_user escaped user --> 'lsa' radius_xlat: 'SELECT UserID,Usernaam,'SHA-Password' AS Attribute, Wachtwoord, ':=' AS Op FROM bas_user WHERE Usernaam = 'lsa' ORDER BY UserID' rlm_sql (mssql): Reserving sql socket id: 3 radius_xlat: '' radius_xlat: 'SELECT UserID,Usernaam from {authreply_table} WHERE Usernaam = 'lsa' ORDER BY UserID' rlm_sql_getvpdata: database query error radius_xlat: '' rlm_sql (mssql): Released sql socket id: 3 modcall[authorize]: module "mssql" returns ok for request 1 modcall: leaving group mssql (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 223 to 127.0.0.1 port 32770 Waking up in 4 seconds... rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=223, length=20 If I add Auth-Type in users file it works: DEFAULT Realm == mssql.nl", Autz-Type := mssql, Auth-Type := PAP Rg, Arnaud Loonstra -- View this message in context: http://www.nabble.com/Why-do-I-need-to-force-Auth-Type--tp18925418p18925418… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Re: Lost entries from reply with multiple instances of the same attribute
by Phil Mayers 12 Aug '08

12 Aug '08

Konstantin KABASSANOV wrote: >> Konstantin KABASSANOV wrote: >>> Some months ago I mentioned a problem observed while sending Access- >> Accept >>> with multiple Cisco-AVPair="ssid=..." entries. Even if fields are >> correctly >>> retrieved from the LDAP server, only the first occurrence of the >> attribute >>> is sent in the packet. Can you tell me if recent developments have >> solved >>> this issue? >> This issue has been solved for almost 4 years now. Read >> ldap.attrmap. >> > > Alan, I'd be very happy if it was true, but: > > Even if my radius server gets the following from the rlm_ldap: > > rlm_ldap: looking for reply items in directory... > rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = > "ssid=mywifi1" > rlm_ldap: LDAP attribute wireless as RADIUS attribute Cisco-AVPair = > "ssid=mywifi2" Read the comments in "ldap.attrmap". Specifically you're going to want: replyItem Cisco-AVPair wireless += i.e. you need to use the "operator" field

1 0

Accounting
by Jonathan Gazeley 12 Aug '08

12 Aug '08

We at Bristol have used FreeRADIUS with no problems for some time, but I would like to alter the way that accounting is performed, but I am unsure of how to do it. Currently all the accounting is sent to a MySQL database. The 'radacct' table tells me the start/stop of each session and the amount of traffic passed in that time. However the traffic figures are only updated when the user's session terminates. Is there a way to get up-to-date statistics that can be polled, say, on an hourly basis? What I'm getting at is that I want each user to have a daily/weekly/etc traffic quota so the radius server should repeatedly check to see if it has been exceeded. Appropriate action will be taken elsewhere is this is exceeded. Does anyone have any pointers? e.g. can the radius server be queried intermittently for traffic figures? Can the radacct table be updated hourly without forcing a disconnection? Cheers, Jonathan ---------------------------- Jonathan Gazeley Systems Support Specialist ResNet | Wireless & VPN Team Information Services University of Bristol ----------------------------

4 6