- Freeradius-Users - lists.freeradius.org

ERROR: Failed to open socket: cannot bind socket: Address already in use
by Martin Silvero 07 Aug '08

07 Aug '08

: ERROR: Failed to open socket: cannot bind socket: Address already in use hello! when ejecute radiusd -X -x : Wed Aug 6 16:53:31 2008 : Error: ERROR: Failed to open socket: cannot bind socket: Address already in use Wed Aug 6 16:53:31 2008 : Error: /usr/local/etc/raddb/radiusd.conf[236]: Error binding to port for 0.0.0.0 port 1812 what is? thanks!! -- -- Silvero Martin -- -- Silvero Martin

2 1

service-type passed in response
by Josh Yost 07 Aug '08

07 Aug '08

I am having a problem configuring management users for Cisco WLC. Here's my basic users file: DEFAULT Service-Type = NAS-Prompt-User, cisco-avpair += "shell:priv-lvl=2", Fall-Through = 1 test User-Password == "xxxx" Service-Type = Administrative-User, cisco-avpair += "shell:priv-lvl=15" The problem I am having is that when user "test" logs in, the access-accept packet passes the DEFAULT Service-Type Value (along with all other attributes in DEFAULT). I only want the default Service-Type value to be passed if I don't otherwise have one assigned in the individual users' entries. Any Assistance here would be much appreciated!

2 1

Where to put EAP-TLS-Require-Client-Cert = Yes ?
by Martin Silvero 06 Aug '08

06 Aug '08

for example mi have this problem: when I run radiusd-X -x strip me this mistake even if the PATH're ok. what is? > > > > > Tue Aug 5 11:00:31 2008 : Error: rlm_eap: SSL error error:06065064:digital > envelope routines:EVP_DecryptFinal_ex:bad decrypt > Tue Aug 5 11:00:31 2008 : Error: rlm_eap_tls: Error reading private key > file /usr/local/etc/raddb/certs/server.pem > Tue Aug 5 11:00:31 2008 : Error: rlm_eap: Failed to initialize type tls > Tue Aug 5 11:00:31 2008 : Error: /usr/local/etc/raddb/eap.conf[17]: > Instantiation failed for module "eap" > Tue Aug 5 11:00:31 2008 : Error: > /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module > "eap". > Tue Aug 5 11:00:31 2008 : Error: > /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing > authenticate section. > Tue Aug 5 11:00:31 2008 : Debug: } > Tue Aug 5 11:00:31 2008 : Debug: } > Tue Aug 5 11:00:31 2008 : Error: Errors initializing modules > > > > thanks!!!!! > > > > -- > >

1 0

RES: Installation problem
by Frederick William Borges Pohl 06 Aug '08

06 Aug '08

Thanks again, Alan. Radius is now running and working fine. I tested it using radtest "radtest fpohl <password> localhost 1812 <password>" and I got an OK result "rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=162, length=20" My question is now regarding users. The user fpohl is a regular Unix user I created with useradd but it does not belong to the same group as radiusd. It is configured as follow: fpohl:x:1000:110:Fred:/home/fpohl:/bin/bash radiusd:x:107:109:Radius daemon:/var/lib/radiusd:/bin/false ns1:~ # id fpohl uid=1000(fpohl) gid=110 groups=110,16(dialout),33(video) ns1:~ # id radiusd uid=107(radiusd) gid=109(radiusd) groups=109(radiusd) How can I configure freeradius to only accept connections from users that belong to the same groups as radiusd? What I really need is to not allow all unix users to be a radius client, only the ones that belong to a specific group. If my questions are too basic and there are documents on the web that can help new users like me, please show me the way. Frederick Pohl -----Mensagem original----- De: freeradius-users-bounces+frederick.pohl=oi.net.br(a)lists.freeradius.org [mailto:freeradius-users-bounces+frederick.pohl=oi.net.br@lists.freeradius.org] Em nome de A.L.M.Buxey(a)lboro.ac.uk Enviada em: terça-feira, 5 de agosto de 2008 13:48 Para: FreeRadius users mailing list Assunto: Re: RES: Installation problem Hi, > > After running /sbin/ldconfig -v , I was able to execute radiusd. > > The only weird thing is that the daemon is not showing when I type ps aux. > > Even after running /usr/sbin/radiusd, nothing happens. yep - at this point you run radiusd -X to see whats wrong alan Esta mensagem, incluindo seus anexos, pode conter informações privilegiadas e/ou de caráter confidencial, não podendo ser retransmitida sem autorização do remetente. Se você não é o destinatário ou pessoa autorizada a recebê-la, informamos que o seu uso, divulgação, cópia ou arquivamento são proibidos. Portanto, se você recebeu esta mensagem por engano, por favor, nos informe respondendo imediatamente a este e-mail e em seguida apague-a.

1 0

postauth sql logging
by Jeff Crowe 06 Aug '08

06 Aug '08

Hi all, I have just recently migrated from 1.1.7 to 2.0.5. In 1.1.7 I had the postauth sql logging turned on to log successful and failed auth attempts. I not able to find where I would add it in 2.0.5 to enable this feature. I see the sql statement in the dialup.conf config file but I am unsure on how to invoke the sql query. Any pointers would be great. Thanks, Jeff.

2 1

Problem with rlm_sql_oracle.so
by andreiv 06 Aug '08

06 Aug '08

I tried to insert accounting requests in oracle db, but the following error occurs when i try to start the radius server : rlm_sql_oracle.so: cannot open shared object file: No such file or directory Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_oracle" server = "localhost" port = "" login = "system" password = "manager" radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=orcl)))" read_groups = yes sqltrace = yes sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT into RADACCT (ID, CALLING_STATION_ID, DATE, TIME, ID_APEL, LOCATION) VALUES('', '%{Calling-Station-Id}', '%{Setup-Date}', '%{Setup-Time}', '%{Acct-Session-Id}', '%{Location}')" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Could not link driver rlm_sql_oracle: rlm_sql_oracle.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[341]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[313]: Errors parsing accounting section. } } Errors initializing modules Can anyone help ? -- View this message in context: http://www.nabble.com/Problem-with-rlm_sql_oracle.so-tp18851356p18851356.ht… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: Login incorrect (Home Server says so)... - But why?
by uni＠christiankraus.de 06 Aug '08

06 Aug '08

Hi >Is the "outside central server" configured to forward mydomain.com to >your server? >Check if you see his failed attempt on your own server at all. If it >isn't there, the request was rejected earlier in the proxy chain. It definitely is configured to proxy the request to my server. (We are not the first ones having this service, there are more than 100 I think that already have this. So I trust those peaple managing the "outside central server" when they say it it configured...) Regards, Christian

2 1

Login incorrect (Home Server says so)... - But why?
by uni＠christiankraus.de 06 Aug '08

06 Aug '08

Dear group, you obviously still know my old thread: http://lists.freeradius.org/mailman/htdig/freeradius-users/2008-July/msg000… I am using still freeradius 1.1.7 Well, the problem was not the foreign server which had the problems. It is kind of embarrassing to say: The reason was my access points. There was a setting, saying that each password should be transfered while being coded with md5. Although I don´t know why this had any influence on the clients with MSChapv2/PEAP or TTLS/PAP I removed the setting and voila it works. So now, foreigner from other wanted enterprises can use our WLAN using their login credentials. So, the other way should also work. Do you know eduroam? The service we use is similar to this Let´s look at my setup: WLAN-accesspoints with SSID1 for local users-------------------------------------------------------------------------->Windows 2003 with IAS and active directory same WLAN-accesspoints with SSID2 for foreign users---------------->myFreeRadiusServer------------->Windows 2003 with IAS and active directory outside central server<------------------------------------------------------------->myFreeRadiusServer------------->Windows 2003 with IAS and active directory outside central server<------------------------------------------------------------->someonesOtherRadiusServer1 outside central server<------------------------------------------------------------->someonesOtherRadiusServer2 ... So, my local users are able tu use SSID1 with 802.1X. They use PEAP with MSCHAPv2 to use the WLAN. No problem. It works. Also, if they accidently use SSID2, which is for foreigners, they can use it. They login with "username(a)mydomain.com". Everything which ends with "@mydomain.de" is proxied from "myFreeRadiusServer" to the "Windows 2003 with IAS and active directory". This is also working without any problems. Foreigners can use their credentials, e.g.: "username(a)someonesOtherdomain.com". This credentials are passed to "myFreeRadiusServer". Everything else, that doesn´t end "@mydomain.de" is passed to the "outside central server". There is a list which maps the other "@someonesOtherdomain.com" to the right "someonesOtherRadiusServers" So dozen of other servers. And from there the request is proxied to the corresponding "someonesOtherRadiusServer" which belongs to the right "@someonesOtherdomain.com" What is working: I can use the "username(a)someonesOtherdomain.com" from a foreign enterprise to login and use the WLAN. No problem here. But the other way round doesn´t work. I asked a collegue from one of those foreign enterprises to test the login with "username(a)mydomain.com" He gave me the following error message: Mon Aug 4 17:19:57 2008 : Auth: Login incorrect (Home Server says so): [username(a)mydomain.com] (from client CB-Access-Point-802.11 port 2 cli 00-1B-77-A4-7B-A2) I don´t know where the problem is. Perhaps you can give me a hint? Coming to my configuration files with changed IP addresses...: ----------------------------------------------------------------------------- clients.conf: client WLAN-IP-AP1 { secret = oft36fW! shortname = WLAN-AP1 nastype = other } ... client "outside central server"-IP { secret = ASECRETPASSWORD shortname = top-level-radius1 nastype = other } client "outside central backup server"-IP { secret = ASECRETPASSWORD shortname = top-level-radius1 nastype = other } ----------------------------------------------------------------------------- proxy.conf realm mydomain.com { type = radius authhost = IAS-IP:1812 accthost = IAS-IP:1813 secret = anotherpass #ldflag = round_robin1 nostrip } realm DEFAULT { type = radius authhost = outside central server:1812 accthost = outside central server:1813 secret = pass nostrip } realm DEFAULT { type = radius authhost = outside central backup server:1812 accthost = outside central backup server:1813 secret = pass nostrip } ----------------------------------------------------------------------------- users DEFAULT, Realm == mydomain.com, FreeRADIUS-Proxied-To == IAS-IP User-Name = `%{User-Name}`, Fall-Through = yes, Auth-Type := EAP DEFAULT, User-Name =~ "^[Aa][Nn][Oo][Nn][Yy][Mm][Oo][Uu][Ss]@.*$" Auth-Type := EAP DEFAULT, User-Name =~ "$@$" Auth-Type := EAP DEFAULT Realm == NULL Auth-Type := Reject ----------------------------------------------------------------------------- ----------------------------------------------------------------------------- eap.conf Although it is not doing anything as I learned eap { timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no md5 { } leap { } tls { private_key_password = pass private_key_file = /usr/src/freeradius/key.pem #${raddbdir}/certs/cert-srv.pem certificate_file = /usr/src/freeradius/freeradius-cert.pem CA_file = /usr/src/freeradius/chain.txt dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } mschapv2 { } } ----------------------------------------------------------------------------- radiusd.conf, where I hardly changed anything. I commentec many things out... prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = /var/log/radius/radius.log log_destination = files libdir = /usr/lib/freeradius pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = monthly # This query properly handles calls that span from the # previous reset period into the current period but # involves more work for the SQL server than those # below # The same notes above about the differences between mysql # versus postgres queries apply here. query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } instantiate { exec expr } authorize { preprocess attr_filter chap mschap suffix eap files pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

2 1

How to set accounting with inner-tunnel Virtual server
by Andy An 06 Aug '08

06 Aug '08

Hi Alan/Ivan: Thanks for your great work of helps/guides that makes us progress step by step. Now my question is how I can set accounting work within inner-tunnel as I need to use eap-ttls/pap to autho/authen users via wireless AP. In fact I read this message: " There are no accounting requests inside of EAP-TTLS or PEAP tunnels." but My project needs me to have an accounting records and should keep them for a while. I use freeradius2.0.5 with mysql as the accounting backend. Thanks. -- Andy An Junior Programmer Information Technology Services Emily Carr University of Art and Design Tel: 604-630-4556 Fax: 604-844-3801 SB Room 341

2 1

Radius server request from new server.
by User for Free Radius mail list 06 Aug '08

06 Aug '08

Hello, We are trying to figure out how to do an auth from one client but not from another. Let me explain: For our DSL clients we use a separate radius server and backup server. For everything else (dialup, news) we use "other" servers. Our problem comes in that we set all DSL clients on these "other" servers to Auth-Type := Reject for each DSL customer, unless they subscribe to discounted dialup service as well. The problem is if the DSL client wants to use the news servers, the "other" radius servers will not auth the client for news. Question?? How can we direct the authentication for a news server but not the dialup servers without using separate radius servers. Did that make any sense? Thanks, Ken

1 0