- Freeradius-Users - lists.freeradius.org

Re: Problems compiling Freeradius 2.0.4 on Fedora 8 [Updated to 2.0.5]
by Piero Giobbi 11 Jun '08

11 Jun '08

Ups, sorry, here's with the line above: /usr/bin/gmake -w -C libeap gmake[7]: Entering directory `/root/freeradius-server-2.0.5/src/ modules/rlm_eap/libeap' gmake[7]: Nothing to be done for `all'. gmake[7]: Leaving directory `/root/freeradius-server-2.0.5/src/modules/ rlm_eap/libeap' /root/freeradius-server-2.0.5/libtool --mode=link gcc -o radeapclient radeapclient.lo libeap/libfreeradius-eap.la -lnsl - lresolv -lpthread -lcrypto -lssl -lcrypto gcc -o .libs/radeapclient .libs/radeapclient.o libeap/.libs/ libfreeradius-eap.so /root/freeradius-server-2.0.5/src/lib/.libs/ libfreeradius-radius.so -lnsl -lresolv -lpthread -lssl -lcrypto -Wl,-- rpath -Wl,/usr/local/lib libeap/.libs/libfreeradius-eap.so: undefined reference to `BIO_test_flags' libeap/.libs/libfreeradius-eap.so: undefined reference to `EVP_MD_size' collect2: ld returned 1 exit status gmake[6]: *** [radeapclient] Error 1 gmake[6]: Leaving directory `/root/freeradius-server-2.0.5/src/modules/ rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/freeradius-server-2.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-server-2.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-server-2.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-server-2.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-server-2.0.5' make: *** [all] Error 2 > Sorry Alan, i forgot to include "the" problem when i try to build > freeradius 2.0.5 on Fedora 8. Below is from make: > > /collect2: ld returned 1 exit status/ > /gmake[6]: *** [radeapclient] Error 1/ And you've deleted the actual error message. Alan DeKok.

2 1

Re: MySQL connection over SSL possible?
by Anders Holm 11 Jun '08

11 Jun '08

Indeed, stunnel is one way to go, another might be SSH tunnels, or as another poster mentioned IPSec tunnels. Yes, data integrity and security of the data is vital, along the whole path from backend storage to end device, so this is just one piece of that puzzle ... What I'll do short term is to look at ways to create a secure tunnel, and if time permitting see if I can manage to create a patch that someone that has better coding skills then me would then need to sanitize.. :) I can see a few new options coming out from such a patch ssl = yes <options to point to various SSL certificate files> I haven't checked, but from memory I'm not even sure it's possible to specify a port number for the database, need to check that too .. Questions, questions, and so little time .. :) //anders ----- Original Message ----- From: "A L M Buxey" <A.L.M.Buxey(a)lboro.ac.uk> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, June 9, 2008 6:19:30 PM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: MySQL connection over SSL possible? Hi, > No. Driver is sql_mysql.c file in > src/modules/rlm_sql/drivers/rlm_sql_mysql/ folder of your distribution. > You will need to edit the source file and recompile to have freeradius > mysql client ask for a SSL connection. hmm, i could see a future with sql.conf containing ssl = yes and each SQL driver, if supported, using SSL method to connect. would probably also need certs etc in the config for this to happen. for another option, without editing code, use eg stunnel to connect to the remote SQL server and then tell FreeRADIUS to use the local end port of the stunnel session. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Setting Post-Proxy-Type ??
by Mustapha Bouikhif 11 Jun '08

11 Jun '08

Hi All, I am having problemes getting Post-Proxy-Type to work in FreeRadius (FR); I did tests with FR v2.0.3 and FR v2.0.5 after update without success; Here is what i want to do: Use attr_rewrite to write some attributes (those for setting VLAN) in proxy replies received from the home server. So I had defined 3 sections for attr_rewrite in radiusd.conf: modules { ....... attr_rewrite addtunneltype { attribute = Tunnel-Type searchin = proxy_reply searchfor = "[+ ]" replacewith = "VLAN" new_attribute = yes } attr_rewrite addtunnelmediumtype { attribute = Tunnel-Medium-Type searchin = proxy_reply searchfor = "[+ ]" replacewith = "IEEE-802" new_attribute = yes } attr_rewrite addvlaninvitedr4 { attribute = Tunnel-Private-Group-ID searchin = proxy_reply searchfor = "[+ ]" replacewith = "VISITEUR" new_attribute = yes ......... } post-proxy { post_proxy_log attr_filter.post-proxy Post-Proxy-Type post.proxy.dr4 { addtunneltype addtunnelmediumtype addvlaninvitedr4 } The huntgroup file looks like: Nomade_Eduroam NAS-IP-Address == 193.51.XXX.YYY Nomade_Eduroam NAS-IP-Address == 130.79.XXX.ZZZ Nomade_Eduroam NAS-IP-Address == 195.220.XXX.TTT The uses file looks like: DEFAULT Huntgroup-Name == "Nomade_Eduroam", Realm == "DEFAULT", Post-Proxy-Type := post.proxy.dr4 In proxy.conf file, I have set: post_proxy_authorize = yes When I started radiusd (in debug mode), it tells me : Parse error (check) for entry DEFAULT: Unknown value for post.proxy.dr4 for attribute Post-Proxy-Type I don't know what i am doing wrong ? Any help is appreciated Thanks -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

2 2

Re: Problems compiling Freeradius 2.0.4 on Fedora 8 [Updated to 2.0.5]
by Piero Giobbi 11 Jun '08

11 Jun '08

Hi again. Sorry Alan, i forgot to include "the" problem when i try to build freeradius 2.0.5 on Fedora 8. Below is from make: collect2: ld returned 1 exit status gmake[6]: *** [radeapclient] Error 1 gmake[6]: Leaving directory `/root/freeradius-server-2.0.5/src/modules/ rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/freeradius-server-2.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-server-2.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-server-2.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-server-2.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-server-2.0.5' make: *** [all] Error 2 OpenSSL> version OpenSSL 0.9.8g 19 Oct 2007 OpenSSL> Linux 2.6.25.4-10.fc8 #1 SMP Thu May 22 23:34:09 EDT 2008 i686 i686 i386 GNU/Linux Below is warnings from the configure. thx. p 10 jun 2008 kl. 16.08 skrev freeradius-users-request(a)lists.freeradius.org : > Hi, > >> Update on FR 2.0.5 with Fedora 8 (from configure): >> >> [root@ns freeradius-server-2.0.5]# ./configure | grep -i warning >> config.status: WARNING: ./Make.inc.in seems to ignore the -- >> datarootdir >> setting >> config.status: WARNING: ./src/include/build-radpaths-h.in seems to >> ignore >> the --datarootdir setting >> chmod: cannot access `check-radiusd-config': No such file or >> directory >> configure: WARNING: silently not building rlm_eap_ikev2. >> configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 >> EAPIKEv2/connector.h. >> configure: WARNING: the TNCS library isn't found! >> configure: WARNING: silently not building rlm_eap_tnc. >> configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. >> configure: WARNING: silently not building rlm_sql_iodbc. >> configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. >> configure: WARNING: silently not building rlm_sql_postgresql. >> configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h >> libpq. >> configure: WARNING: oracle headers not found. Use >> --with-oracle-home-dir=<path>. >> configure: WARNING: silently not building rlm_sql_oracle. >> configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. >> configure: WARNING: silently not building rlm_sql_unixodbc. >> configure: WARNING: FAILURE: rlm_sql_unixodbc requires: sql.h. >> >> .. If it makes more sense... > > so, you dont have the required includes etc for building IKEv2, TNC, > IODBC, > postgresql or Oracle support into the server. > > do you use any of these? if not, then whats the problem? > > alan

3 2

Radius on server X; VPN on server Y; Samba on server Z
by Sascha Kiefer 10 Jun '08

10 Jun '08

Hi, I have the following: * Radius on server X * VPN on server Y * Samba on server Z Each server is located on a different continent. :-) Ok, user "foo" now connects to the VPN server and gets authorized by radius. Fine. Now, i want him to allow to connect to the samba server. Ideally without entering any user+password combination (is that safe enough?); i thought about, restricting samba connections only from ip-addresses of the VPN server. But he only is allowed to access his private space under samba. He is not alloed to access the space of another user "bar". Any hints on that issue? Thank you. Sascha

4 3

RADIUS APIs
by pallavi dharmadhikari 10 Jun '08

10 Jun '08

Hi all, I am writing a radius application to send authentication requests to the Freeradius server using different authentication methods. For that I would like to know about different APIs which will be used in the RADIUS application. Can somebody tell me more information about that? Thank you pal

2 2

EAP-TLS with different CA per user?
by Frank Sweetser 10 Jun '08

10 Jun '08

I have a configuration which I need, but haven't been able to figure out how to make freeradius do it. I have two users, A and B, both authenticating over wireless using EAP-TLS. User A has a certificate which has been signed by CA X, and B has one signed by CA Y. What I need is to tell freeradius that certificates presented by user A should only be checked against CA X, and similarly B only by Y. Putting both X and Y in the same CA list won't work in this case due to what appears to be a limitation in OpenSSL. I've been over all the existing docs I can find, and I haven't been able any way to do this. Anyone have any suggestion what I might try? -- Frank Sweetser fs at wpi.edu | For every problem, there is a solution that WPI Senior Network Engineer | is simple, elegant, and wrong. - HL Mencken GPG fingerprint = 6174 1257 129E 0D21 D8D4 E8A3 8E39 29E3 E2E8 8CEC

7 13

PEAP and TTLS simultaneously?
by Tim Tyler 10 Jun '08

10 Jun '08

Freeradius experts, I am running Freeradius 1.1.3 on a Centos 5 system. My desire is to support PEAP mschapv2 clients against our ldap server's LM and NT passwords. We also want to support some other clients with a TTLS - PAP against the posix passwords in our same ldap server. I can get each configuration solution to work independently, but I can't get them to work when I try to combine them into one configuration. 1. Is it possible to support both PEAP-mschapv2 and TTLS-PAP using the same ldap server with each user having both password hashes supported? 2. If so, can someone suggest how I would combine the two configurations properly? 3. Would this be easier to accomplish if we were using a 2.x version of Freeradius? My only problem is that Centos and Redhat seem to take forever in supporting the most recent open source applications so I would have to find another RPM update source. I have included both configurations that work independently and the output of a TTLS -PAP attempt that fails when both configurations are combined into one configuration. Here is my general TTLS config: #TTLS-pap method modules { ldap ldap_2x { server = {cut out} identity = password = basedn = filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /etc/openldap/cacerts/cacert.cer dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess chap mschap suffix eap staff ldap_2x } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type ldap_2x { ldap_2x } eap } Here is my PEAP config: #PEAP mschapv2 method ldap ldap_1x{ server = {cut out} identity = password = basedn = filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_cacertfile = /etc/openldap/cacerts/cacert.cer dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 authtype = ldap timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess chap mschap suffix ldap_1x eap files } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } Here is the output of a command line TTLS attempt from the server: # /usr/sbin/radiusd -X -y Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded LDAP ldap: server = "testldap.beloit.edu" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=beloit,dc=edu" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/etc/openldap/cacerts/cacert.cer" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "tac2tmaw" ldap: basedn = "dc=beloit,dc=edu" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = yes ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_2x-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_2x-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_2x rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x85d71f8 Module: Instantiated ldap (ldap_2x) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "2okacaip" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) ldap: server = "testldap.beloit.edu" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=beloit,dc=edu" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/etc/openldap/cacerts/cacert.cer" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "tac2tmaw" ldap: basedn = "dc=beloit,dc=edu" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Creating new attribute ldap_1x-Ldap-Group rlm_ldap: Registering ldap_groupcmp for ldap_1x-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap_1x rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x85ea9a8 Module: Instantiated ldap (ldap_1x) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 144.89.40.88:33050, id=31, length=57 User-Name = "tyler" User-Password = "chair" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tyler", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for tyler radius_xlat: '(uid=tyler)' radius_xlat: 'dc=beloit,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to testldap.beloit.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: starting TLS rlm_ldap: bind as cn=Manager,dc=beloit,dc=edu/tac2tmaw to testldap.beloit.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=beloit,dc=edu, with filter (uid=tyler) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value E02C0DC6138F12F76F424596E04E10E2 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value 0A5283563091373BAAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user tyler authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_1x" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for tyler radius_xlat: '(uid=tyler)' radius_xlat: 'dc=beloit,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to testldap.beloit.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: starting TLS rlm_ldap: bind as cn=Manager,dc=beloit,dc=edu/tac2tmaw to testldap.beloit.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=beloit,dc=edu, with filter (uid=tyler) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value E02C0DC6138F12F76F424596E04E10E2 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value 0A5283563091373BAAD3B435B51404EE & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap_2x" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 31 to 144.89.40.88 port 33050 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 31 with timestamp 484e906c Nothing to do. Sleeping until we see a request. Tim Tyler Network Engineer - Beloit College tyler(a)beloit.edu

2 1

Re: Problems compiling Freeradius 2.0.4 on Fedora 8 [Updated to 2.0.5]
by Piero Giobbi 10 Jun '08

10 Jun '08

Hi. Update on FR 2.0.5 with Fedora 8 (from configure): [root@ns freeradius-server-2.0.5]# ./configure | grep -i warning config.status: WARNING: ./Make.inc.in seems to ignore the -- datarootdir setting config.status: WARNING: ./src/include/build-radpaths-h.in seems to ignore the --datarootdir setting chmod: cannot access `check-radiusd-config': No such file or directory configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-home- dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: sql.h. .. If it makes more sense... p 7 jun 2008 kl. 12.00 skrev freeradius-users- request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > Today's Topics: > > 1. Re: Problems compiling Freeradius 2.0.4 on Fedora 8. > (A.L.M.Buxey(a)lboro.ac.uk) > 2. Re: logging of tls logons (Vladimir Vassiliev) > > Från: A.L.M.Buxey(a)lboro.ac.uk > Datum: lö 7 jun 2008 09.40.22 GMT+02:00 > Till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > Ämne: Re: Problems compiling Freeradius 2.0.4 on Fedora 8. > Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > > hi, > > what version of OpenSSL do you have? > > alan > > > > > Från: Vladimir Vassiliev <vova(a)edu.yar.ru> > Datum: lö 7 jun 2008 09.54.16 GMT+02:00 > Till: freeradius-users(a)lists.freeradius.org > Ämne: Re: logging of tls logons > Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > >> So, how can I get in logs exactly common names? > > As I understand, only way to do it is > > check_cert_cn = %{User-Name} > > in eap.conf? > > -- > Vladimir Vassiliev <vova(a)edu.yar.ru> > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Dictionary : Ericsson-AB Packet Core Networks
by rsg 10 Jun '08

10 Jun '08

Hi, Does anyone know of the RADIUS dictionary for Ericsson-AB PCN (Enterprise ID 10923) ? The currently available dictionary is for Ericsson -AB generic (VID 193) only. Many thanks in advance. sg.

1 0