- Freeradius-Users - lists.freeradius.org

Users cant connect Freeradius 2.0.2
by Gustavo Chavelas 02 Apr '08

02 Apr '08

Hi to all. Firstly, i have to install a new server and my freeradius 2.0.2 it's running now. Bur I have a new problem. With last version, my freeradius work fine, but with this new version, the users can't connect. I'm attaching the raddiusd -X Please help me.

2 1

build freeradius 2.0.3 on ubuntu(debian)
by Mikhail Novikov 02 Apr '08

02 Apr '08

Hello, After installation freeradius server 2.0.3 on Ubuntu 7.10 with: ./configure ./make ./make install I got this message: $ radiusd x radiusd: error while loading shared libraries: libfreeradius-radius-2.0.3.so: cannot open shared object file: No such file or directory How can I fix that? Thanks

2 2

Please advise : Freeradius 2.0.3 on FreeBSD 7.0 Crashing ... Signal 11 ...
by Vikash Badal 02 Apr '08

02 Apr '08

Greetings, Can someone please assist me with Freeradius 2.0.3 crashes on FreeBSD 7.0 . Below is the outputs from radiusd -X and backtraces from the core files Crash 1 ---------------------------- Wed Apr 2 15:22:44 2008 : Debug: Going to the next request Wed Apr 2 15:22:44 2008 : Debug: Waking up in 9.6 seconds. Wed Apr 2 15:22:54 2008 : Error: Rejecting request 258 due to lack of any response from home server xxx.xxx.xxx.xxx port 1646 Wed Apr 2 15:22:54 2008 : Debug: Finished request 258. Wed Apr 2 15:22:54 2008 : Debug: Cleaning up request 258 ID 26 with timestamp +2133 Segmentation fault (core dumped) GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/libfreeradius-radius-2.0.3.so...done. Loaded symbols for /usr/local/lib/libfreeradius-radius-2.0.3.so <SNIP> Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x0806416d in cleanup_delay (ctx=0x28571060) at event.c:477 477 DEBUG2("Cleaning up request %d ID %d with timestamp +%d", [New Thread 0x28401100 (LWP 100774)] (gdb) bt #0 0x0806416d in cleanup_delay (ctx=0x28571060) at event.c:477 #1 0x0806519c in wait_a_bit (ctx=0x28571060) at event.c:947 #2 0x08064ddc in post_proxy_fail_handler (request=0x28571060) at event.c:794 #3 0x08064e95 in no_response_to_proxied_request (ctx=0x28571060) at event.c:819 #4 0x280c8a9d in fr_event_run (el=0x2856e000, when=0xbfbfe838) at event.c:214 #5 0x280c9078 in fr_event_loop (el=0x2856e000) at event.c:381 #6 0x0806814d in radius_event_process () at event.c:2660 #7 0x0805d366 in main (argc=2, argv=0xbfbfe93c) at radiusd.c:394 (gdb) frame 7 #7 0x0805d366 in main (argc=2, argv=0xbfbfe93c) at radiusd.c:394 394 while ((rcode = radius_event_process()) == 0x80) { (gdb) q Crash 2 ------------------ Wed Apr 2 15:46:06 2008 : Debug: Going to the next request Wed Apr 2 15:46:06 2008 : Debug: Waking up in 1.8 seconds. Wed Apr 2 15:46:08 2008 : Error: Rejecting request 49 due to lack of any response from home server xxx.xxx.xxx.xxx port 1646 Wed Apr 2 15:46:08 2008 : Debug: Finished request 49. Wed Apr 2 15:46:08 2008 : Debug: Cleaning up request 49 ID 93 with timestamp +673 Segmentation fault (core dumped) GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. <SNIP> #0 0x0806416d in cleanup_delay (ctx=0x28571060) at event.c:477 477 DEBUG2("Cleaning up request %d ID %d with timestamp +%d", [New Thread 0x28401100 (LWP 100467)] (gdb) bt #0 0x0806416d in cleanup_delay (ctx=0x28571060) at event.c:477 #1 0x0806519c in wait_a_bit (ctx=0x28571060) at event.c:947 #2 0x08064ddc in post_proxy_fail_handler (request=0x28571060) at event.c:794 #3 0x08064e95 in no_response_to_proxied_request (ctx=0x28571060) at event.c:819 #4 0x280c8a9d in fr_event_run (el=0x2856e000, when=0xbfbfe838) at event.c:214 #5 0x280c9078 in fr_event_loop (el=0x2856e000) at event.c:381 #6 0x0806814d in radius_event_process () at event.c:2660 #7 0x0805d366 in main (argc=2, argv=0xbfbfe93c) at radiusd.c:394 (gdb) frame 7 #7 0x0805d366 in main (argc=2, argv=0xbfbfe93c) at radiusd.c:394 394 while ((rcode = radius_event_process()) == 0x80) { Please let me know if more information is required Thanks Vikash Please note: This email and its content are subject to the disclaimer as displayed at the following link http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. Should you not have Web access, send a mail to disclaimers(a)is.co.za and a copy will be emailed to you.

3 4

Unable to authenticate with rlm_perl
by johnson elangbam 02 Apr '08

02 Apr '08

hi, I am trying to used the rlm_perl for authentication, I've found reading all the perl modules, but wouldn't able to handle the username from the client. For the testing purpose I've put this simple script in the perl program if ($RAD_REQUEST{'User-Name'} eq "john") { $RAD_REPLY{'A message'} = " Accepting John"; return RLM_MODULE_OK; } else { $RAD_REPLY{'A message'} = "Rececting users"; return RLM_MODULE_REJECT; } unfortunately everytime i try to authenticate the user "john" regardless of the password, the server rejects all the time here is the piece of output after rejecting the users rad_recv: Access-Request packet from host 127.0.0.1 port 32866, id=177, length=56 User-Name = "john" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x9e63c98 asigned new request. Handled so far: 1 found interpetator at address 0x9e63c98 rlm_perl: Added pair User-Name = john rlm_perl: Added pair User-Password = password rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9e63c98 ++[perl] returns ok rlm_realm: No '@' in User-Name = "john", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop users: Matched entry DEFAULT at line 203 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type Perl auth: type "Perl" +- entering group Perl perl_pool: item 0xa08e5d8 asigned new request. Handled so far: 1 found interpetator at address 0xa08e5d8 1,bill,Cleartext-Password,bill,:= Use of uninitialized value in string eq at /usr/local/etc/raddb/example.pmline 126. rlm_perl: Added pair User-Name = john rlm_perl: Added pair User-Password = password rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Auth-Type = Perl perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xa08e5d8 ++[perl] returns reject auth: Failed to validate the user. Login incorrect: [john/password] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 177 to 127.0.0.1 port 32866 Waking up in 4.9 seconds. Cleaning up request 0 ID 177 with timestamp +10 Ready to process requests. Regards, Elangbam Johnson

2 1

Freeradius push attribute to wireless connection
by Guillaume Chartrand 02 Apr '08

02 Apr '08

Hi, I'm using Freeradius 2.0, I configurated it with an sql database and the principal job of the radius server is to authorize and authenticate my wireless user over my network. What I want to do is to give some attribute to the user when is connected. Like Session-Timeout, bandwith and some other stuff. Here some entry in my database usergroup 1,"guillaume","dynamic" 2,"jacques","dynamic" Radcheck 1,"guillaume","Cleartext-Password","xxxxxx",":=" 2,"jacques","Cleartext-Password","xxxxx",":=" Radreply 3,"guillaume","Session-Timeout","30",":=" It's an Mssql database Here the debug info with radiusd -X rlm_sql (sql): sql_set_user escaped user --> 'guillaume' rlm_sql (sql): Reserving sql socket id: 2 expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'guillaume' ORDER BY id query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'guillaume' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'guillaume' ORDER BY id query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'guillaume' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok I have access but my session didn't disconnect after 30 sec. So can I do that with wireless configuration? My goal is to give some < guest user > a limited time and an expiration date. Thanks ---------------------------- Guillaume Chartrand

3 3

vmps documentation?
by bmccorkle 02 Apr '08

02 Apr '08

Can someone point me to documentation on how to use vmps in freeradius 2? I've googled for documents but only find a few discussions on the topic (mostly from this forum). I get the part on adding the listen section in radiusd.conf so the server listens for vmps requests. However, I'm having trouble understanding the actual coding to do the comparison of the mac address in the request against the mac address list. Also, the one or two examples I have seen seem to use a mysql database to store the mac addresses. Can freeradius use a simple text file to store the mac addresses for comparison or do they need to be stored in a database? -- View this message in context: http://www.nabble.com/vmps-documentation--tp16315996p16315996.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 9

problems with old mysql version and PEAP/MSCHAPV2
by Hans Bornemann 02 Apr '08

02 Apr '08

Hi, for wpa2 integration in our wireless network i have installed freeradius 1.1.7 und mysql 5.0 under ubuntu and for PEAP/MSCHAPV2 every things working fine. mysql-db: 10| test | NT-Password | := | 7C53CFA5EA7D0F9B3B968AA0FB51A3F5 when i change the db connection to the database with the real userdata, which runs under solaris 10 and mysql Version 3.2.23 the debug shows: module "sql" returns notfound for request 0 when i use the mysql monitor, both DBs show the same results for the sql commands, which are listed in the debug. It is very unfortunate, but there is for me no easy way to switch to mysql version 5.0 Debug: rad_recv: Access-Request packet from host 123.123.123.123:32769, id=125, length=180 User-Name = "test" Calling-Station-Id = "00-19-D2-CF-E5-50" Called-Station-Id = "00-0B-85-9A-2D-30:ITMC-WPA2" NAS-Port = 29 NAS-IP-Address = 123.123.123.123 NAS-Identifier = "mh-wlc4" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3503" EAP-Message = 0x0212000d016d68616e626f726e Message-Authenticator = 0xcb4bf5a66469aaa4185dd17788f2498b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 18 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [test] modcall[authorize]: module "sql" returns notfound for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" ..... Kind Regards Hans -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

2 1

Free Radius ISP and windows domain logins
by Andrew D (Webzone) 02 Apr '08

02 Apr '08

Hi there, We are using freeradius 1.1.4 on fbsd5.5 for auth as an ISP. We occasionally have dialup users that auth with a windows domain login (without the domain set) It is connected to a mssql server. As I understand it, the following options are supposed to remove the windows domain bizo In SQL.conf we have. sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" in proxy.conf we have realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } in radiusd.conf proxy_requests = yes $INCLUDE ${confdir}/proxy.conf The client will have logged on successfully a couple of hours earlier, but then we see this in the logs. Wed Apr 2 14:32:54 2008 : Info: rlm_sql (sql): No matching entry in the database for request from user [donb] Wed Apr 2 14:32:54 2008 : Auth: Login incorrect: [donb/] (from client patton1 port 19 cli 0882648219) And they get knocked back. Is there anything I may have missed or misinterpreted? Thanks in Advance. Cheers cya Andrew -- Network Administrator / Manager Webzone Internet 1st Floor (Oakley Street Entrance) 167 Grote Street Adelaide SA, 5000 Phone 1300 303 932 Fax 08 8221 6204 Email andrewd(a)webzone.net.au manager(a)webzone.net.au

2 1

Ascend-Data-Filter with srcip from ippool
by Andreas Kalb (akalb) 02 Apr '08

02 Apr '08

Hello, I'm trying to use Ascend-data-filters together with IP-pool DEFAULT Pool-Name := test_pool Fall-Through = Yes DEFAULT User-Name := "test_...", Cleartext-Password := test Service-Type = Framed-User, Framed-Protocol = PPP, Session-Timeout = 65000, Idle-Timeout = 3600, Ascend-Maximum-Time = 64000, Ascend-Idle-Limit = 3600, Ascend-Data-Filter := "ip in forward srcip %{Framed-IP-Address}/32 dstip 1.1.1.2/32" The pool is working well, but the filter doesn't: Login OK: [test_001/test] (from client bb-10k port 808583209) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_ippool: Searching for an entry for nas/port: 172.16.1.7/808583209 rlm_ippool: Found a stale entry for ip/port: 172.16.100.135/808583209 rlm_ippool: num: 0 rlm_ippool: Searching for an entry for nas/port: 172.16.1.7/808583209 rlm_ippool: Allocating ip to nas/port: 172.16.1.7/808583209 rlm_ippool: num: 1 rlm_ippool: Allocated ip 172.16.103.107 to client on nas 172.16.1.7,port 808583209 modcall[post-auth]: module "test_pool" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 195 to 172.16.1.7 port 21646 Service-Type = Framed-User Framed-Protocol = PPP Session-Timeout = 65000 Idle-Timeout = 3600 Ascend-Maximum-Time = 64000 Ascend-Idle-Limit = 3600 Ascend-Data-Filter := "ip in forward dstip 1.1.1.2/32 0" Framed-IP-Address = 172.16.103.107 Framed-IP-Netmask = 255.255.255.0 Looks like IP is taken from pool after users-file got processed. I wouldn't know how to change that order or where to add the filter then. Pls let me know whether this should work in some way and how to configure it then? Kind Regards, Andreas

2 11

proxy.conf and virtual_server
by Marc Boisis-Delavaud 01 Apr '08

01 Apr '08

Hello, I have two virtual server which listen on the same IP. According to realm in proxy.conf, I wich to proxy on virtual1 or virtual2. Is it possible to write this in proxy.conf ? realm toto { "proxy to virtual_server" = virtual1 }

2 2