- Freeradius-Users - lists.freeradius.org

Trivial patch for rlm_acctlog in 2.0.5
by Kostas Zorbadelos 14 Aug '08

14 Aug '08

Hello to everyone. As we are preparing for migration to 2.X version in some of our production systems, I took a closer look at the sources and found the rlm_acctlog module that allows for the logging of various types of accounting messages in the radius logs. Moreover I saw that syslog support in 2.X is vastly improved over 1.X series. My minor request is, could you include the following patch in later releases (so as to not maintain it internally)? --- rlm_acctlog.c.orig 2007-11-12 00:11:51.000000000 +0200 +++ rlm_acctlog.c 2008-08-08 13:54:34.000000000 +0300 @@ -79,7 +79,7 @@ rlm_acctlog_t *inst; VALUE_PAIR *pair; - char logstr[MAX_STRING_LEN]; + char logstr[1024]; int acctstatustype = 0; The idea is to have a bigger buffer than 253 characters for logging. Some old syslog implementations can have a 1024 character limit I think, so I guess that would be enough :) Thanks and keep up the good work. Kostas Zorbadelos

2 2

Post-proxy Perl script availability
by Julien Leloup 14 Aug '08

14 Aug '08

Hello, I developped a little script in Perl working with FreeRadius v2.x, called in post-proxy section to implement QoS Radius attributes translation from "Class" attribute to Alcatel-Lucent QoS attribute "SLA Profile" and "SUB Profile". It's using a database to get a mapping between this attributes and replace them before sending the response to the client. My question is, do I have to make this script (and SQL schema I suppose) available in the FreeRadius CVS ? I'm not sure it's the kind of script usefull for a large panel of FreeRadius users, but if I have to make it available (maybe to respect GPLv2 or if someone is interested by this script) it's not a problem. Best regards, Julien Leloup Axione 132, boulevard Camélinat 92240 Malakoff, France

2 2

Re: Freeradius in an AD environment on opensuse server
by Roberto S. G. 14 Aug '08

14 Aug '08

>Can I set up freeradius to authenticate with ldaps and be secure? The >ldap would be Microsoft and is on my domain controller. I have >websites using the ldap process but OR do I have to do that samba >thing? It can be done more or less easily, depending on what type of authentication are u doing... If it's plain user/pwd, you can configure freeradius to use LDAP directly. That would be easier. The servers would be your AD servers (you can use all of them if you have more than one), uncomment and configure ldap parts on your FR conf. In order to use ldaps, you just have to enable it in your AD servers if it isn't (just make a netstat looking for por 636 on your AD; if needed, check your windows version on how to enable it), and if you wanna check AD certificates from freeradius when doing connections (it's a good idea), you'll have to import your AD's CA certificate to ./certs on yor FR configuration. It'd run smoothly. bye

1 0

invalid login attempts user lockout
by Sudarshan Soma 14 Aug '08

14 Aug '08

Hi All, Does anyone know of RadiusServer denying access for a particular user after a configurable number of invalid login attempts. I know this can be done on the client side with pam modules. But i thought since radius users are same across multple nodes connected to radiusserver, it would be an useful option to lockout at radius server level. Please let me know if anyone is aware of this scenario. Regards, Pavan.

3 6

Possible bug in shipped configuration file.
by Maurizio Cimaschi 14 Aug '08

14 Aug '08

Hi, I don't know if this has been reported/discussed before, but it happened to me last week. I was trying to setup a freeradius (2.0.5) to authenticate requests from my access point (using WPA Enterprise) aganist an LDAP server. It was working fine using the "radclient", but the requests from the AP were buonced claiming that no authentication metod was set. I checked the configuration file more than once, googled a lot but was unable to solve. After almost a day of trying, I noticed a line in the debug (radiusd -X) that said something about proxying. So I remembered to have seen a statement in the "inner-server" configuration: #update control { # Proxy-To-Realm := LOCAL #} In the configuration file installed by the installation procedure that part was uncommented; adding the comments was enough to make the server work. I'm not an expert in this application and I don't know why that part was uncommented, but, may I suggest to uncomment that part in the configuration file ? Thank you for your great work. Bye.

2 4

Re: Prefix/Suffix not working (FR 2.0.5, CentOS 5, System Auth)
by Steve Weaver 13 Aug '08

13 Aug '08

Alan DeKok writes: > > Steve Weaver wrote: > > The problem I'm having is that we have a lot of legacy users still > > logging in with "Pusername" for PPP connections. I've tried to set it > > up in both the users file and the hints file (separately) and get the > > same result. No matter what I do, it tries to authenticate (System > > auth type) the username "Pusername" instead of "username". > > Hmm... that functionality seems to have been lost somehow. > > I've commited a one-line fix. Please grab the latest version from > git.freeradius.org. It should now work. > That took care of it. Thanks! -SW -- Steven Weaver sweaver(a)inebraska.com IT Director (402) 434-8680 x101 Internet Nebraska http://www.inebraska.com/

1 0

Prefix/Suffix not working (FR 2.0.5, CentOS 5, System Auth)
by Steve Weaver 13 Aug '08

13 Aug '08

I'm having a strange problem I hope you can help me figure out. We're finally moving from an ancient Livingston RADIUS to FreeRADIUS. I compiled and installed version 2.0.5 on a freshly installed CentOS 5 box, read all the documentation I could find, installed our old users file and adapted it until it now (mostly) works correctly. System info: # radiusd -v radiusd: FreeRADIUS Version 2.0.5, for host i686-redhat-linux-gnu, built on Aug 5 2008 at 15:40:15 # uname -a Linux ****.*******.com 2.6.18-92.1.6.el5 #1 SMP Wed Jun 25 13:49:24 EDT 2008 i686 i686 i386 GNU/Linux The problem I'm having is that we have a lot of legacy users still logging in with "Pusername" for PPP connections. I've tried to set it up in both the users file and the hints file (separately) and get the same result. No matter what I do, it tries to authenticate (System auth type) the username "Pusername" instead of "username". If I add a user named "Pusername" everything works correctly. It hits the right default entry and authenticates fine, so it's just not stripping off the "P" when authenticating. I have also tried suffixes (".ppp") to test if it was just the prefix that wasn't working. Same problem. We're not using any realms, proxying, LDAP, SQL, etc at this time. Just a very simple single RADIUS server reading from a users file and authenticating against the system password file. I first tried to set it up in the users file. I commented out everything in the hints file. Here's what the DEFAULT entry looks like in the users file: DEFAULT Auth-Type := System, Prefix == "P" User-Service-Type = Framed-User, Session-Timeout = 36000, Idle-Timeout = 600, Port-Limit = 1, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Netmask = 255.255.255.255, Framed-Routing = None, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP I attempt to authenticate: # radtest Psweaver ******** localhost 0 testing123 Sending Access-Request of id 43 to 127.0.0.1 port 1645 User-Name = "Psweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1645, id=43, length=20 Things are working otherwise; without the "P" it works fine: # radtest sweaver ******** localhost 0 testing123 Sending Access-Request of id 223 to 127.0.0.1 port 1645 User-Name = "sweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1645, id=223, length=56 Session-Timeout = 36000 Idle-Timeout = 600 Port-Limit = 1 Service-Type = Login-User Login-IP-Host = ***.***.***.*** Login-Service = Rlogin With the "P", here's the output of radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 35915, id=175, length=6 0 User-Name = "Psweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20080812 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20080812 expand: %t -> Tue Aug 12 10:10:44 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Psweaver", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 3526 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type System auth: type "System" +- entering group authenticate ++[unix] returns notfound auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Psweaver attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 175 to 127.0.0.1 port 35915 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 175 with timestamp +1013 Ready to process requests. Note that it's matching line 3526, which is indeed the DEFAULT entry I listed above. If I move prefix information to the hints file, I end up with this in the hints file: DEFAULT Prefix == "P", Strip-User-Name = Yes Hint = "PPP" and this in the users file: DEFAULT Auth-Type := System, Hint == "PPP" User-Service-Type = Framed-User, Session-Timeout = 36000, Idle-Timeout = 600, Port-Limit = 1, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Netmask = 255.255.255.255, Framed-Routing = None, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP Test fails: # radtest Psweaver ******** localhost 0 testing123 Sending Access-Request of id 161 to 127.0.0.1 port 1645 User-Name = "Psweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1645, id=161, length=20 radiusd -X output: rad_recv: Access-Request packet from host 127.0.0.1 port 35924, id=161, length=60 User-Name = "Psweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize hints: Matched DEFAULT at 65 ++[preprocess] returns ok expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20080812 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20080812 expand: %t -> Tue Aug 12 10:44:04 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Psweaver", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 3526 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type System auth: type "System" +- entering group authenticate ++[unix] returns notfound auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Psweaver attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 161 to 127.0.0.1 port 35924 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 161 with timestamp +4 Ready to process requests. It hits line 65 in the hints file (my "P" entry), and line 3526 in the users file (my "PPP" entry.) When using the hints file, it even logs this to the detail file showing that it's been stripped: Tue Aug 12 10:44:04 2008 Packet-Type = Access-Request User-Name = "Psweaver" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Stripped-User-Name = "sweaver" Hint = "PPP" Either way, everything works if I add a Psweaver entry to the password file, and not if I don't. I'm out of ideas. Anyone have any I can borrow? :) TIA, SW -- Steven Weaver sweaver(a)inebraska.com IT Director (402) 434-8680 x101 Internet Nebraska http://www.inebraska.com/

3 3

Freeradius + OpenLDAP
by Ivan . 13 Aug '08

13 Aug '08

Hi Does any have any links to some decent "how tos" for integrating OpenLDAP into freeradius for user management? Thanks Ivan

3 3

Error compiling FreeRadius-2.0.5
by Ums 13 Aug '08

13 Aug '08

Hi I have Red Hat Linux release 8.0 and i am trying to install free radius 2.0.5 fresh getting the following errors while doing a make after the ./configure any inpur with be greatly appreciated rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin -fno-rtti -fno-exceptions "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/radius_snmp.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /freeradius-server-2.0.5/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -ldl -Wl,--rpath -Wl,/usr/local/lib .libs/threads.o: In function `setup_ssl_mutexes': /freeradius-server-2.0.5/src/main/threads.c:217: undefined reference to `OpenSSL_add_all_algorithms' /freeradius-server-2.0.5/src/main/threads.c:220: undefined reference to `CRYPTO_num_locks' /freeradius-server-2.0.5/src/main/threads.c:226: undefined reference to `CRYPTO_num_locks' /freeradius-server-2.0.5/src/main/threads.c:230: undefined reference to `CRYPTO_set_id_callback' /freeradius-server-2.0.5/src/main/threads.c:231: undefined reference to `CRYPTO_set_locking_callback' .libs/threads.o: In function `request_handler_thread': /freeradius-server-2.0.5/src/main/threads.c:497: undefined reference to `ERR_remove_state' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/freeradius-server-2.0.5/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/freeradius-server-2.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/freeradius-server-2.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/freeradius-server-2.0.5' make: *** [all] Error 2 Thanks much, Ums

2 1

oracle support
by Alexandre Chapellon 13 Aug '08

13 Aug '08

Hello, I can see that oracle can be used to store accounting data ippool and others stuff like this but nothing about authenticating request with users and password stored in oracle database..... how can i manage to do this?

1 1