- Freeradius-Users - lists.freeradius.org

Packets in Accounting ?
by Edvin Seferovic 30 Nov '07

30 Nov '07

Hello, what happened to the Acct-Input/Output-Packets in Accounting. MySQL schema doesn't have those fields anymore. Any special reason ? Regards, E:S

1 0

Expiration module?
by Evert 30 Nov '07

30 Nov '07

Hi all! I'm trying to implement expiration, as mentioned in the wiki at http://wiki.freeradius.org/Radiusd.conf But all this gives me is: Failed to link to module 'rlm_expiration': rlm_expiration.so: cannot open shared object file: No such file or directory Is the wiki outdated on this point? Regards, Evert

2 3

Problem compiling freeradius 1.1.7
by Patrice Oliver 29 Nov '07

29 Nov '07

Hello, I have a problem compiling freeradius 1.1.7 When I use the make command, just after ./configure, I get the following error message : *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/admin/freeradius/freeradius-1.1.7/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /home/admin/freeradius/freeradius-1.1.7/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.1.7.so -o .libs/rlm_perl-1.1.7.so What's wrong ? Regards. -- *Hospices Civils de Beaune* *Patrice OLIVER* /Chef de Projet Ville Hôpital/ /Responsable Réseau & Sécurité/ BP 104 21203 BEAUNE Cedex Tél. 03 80 24 44 09 Fax. 03 80 24 45 90 ------------------------------------------------------------------------ Ce message, y compris les pièces jointes, est établi à l'attention exclusive de son ou ses destinataires et est confidentiel. Toute utilisation non conforme à sa destination, toute diffusion ou publication, totale ou partielle, est interdite sauf autorisation expresse de l'expéditeur. Si vous n'êtes pas le destinataire de ce message, merci d'avertir l'expéditeur de l'erreur de distribution puis de le détruire. Tout message électronique est susceptible d'altération et son intégrité ne peut être assurée. L'expéditeur décline toute responsabilité dans l'hypothèse où il aurait été modifié ou falsifié.

5 6

freeradius 1.1.5/1.1.6 has a known bug on 64bit linux systems
by Dan Gahlinger 29 Nov '07

29 Nov '07

If you happen to be using 64bit linux and happen to have free radius 1.1.5 or 1.1.6 there is a known bug in the unix system authentication API. Basically, it doesn't work. But, relax, there is a fix. Please don't report this bug, it's known, and has a solution. the solution is to install version 1.1.7 which fixes this problem. the best way to get 1.1.7 is to use CVS the bug seems isolated to libradius-1.1.5.so library, but it is recommended to use the entire 1.1.7 not replace portions, because that can have unexpected results. Please do not report basic system authentication bugs with 1.1.5/1.1.6 this is known, and has a working solution instead, please install version 1.1.7 either by download or from CVS this was first reported and fixed on Suse Linux 10.3 64bit using kernel 2.6.22.12 _________________________________________________________________ Express yourself with free Messenger emoticons. Get them today! http://www.freemessengeremoticons.ca/?icid=EMENCA122

1 0

Re: rlm_passwd and EAP-MD5
by A.L.M.Buxey＠lboro.ac.uk 29 Nov '07

29 Nov '07

Hi, > Hm, does this mean that even now when I use rlm_passwd and tacacs passwd > file, I need to HUP radiusd whenever someone changes their password? dont HUP the server, restart the process. alan

1 0

Re: rlm_passwd and EAP-MD5
by Alan DeKok 29 Nov '07

29 Nov '07

Kolbjørn Barmen wrote: ... >>> since I want to change the password for each and every test, and do >>> not want to HUP radiusd all the time. >> I'm not sure that will work. > > Hm, isnt that the point of rlm_passwd? Reload without HUP? No. > 1.1.7 on NetBSD. Allthough NetBSD bring som patches, they seem to just be > for installation paths and pthread flags. So if it is supposed to work, > I'm curious as to why it doesnt for me. No idea. Try "branch_1_1" from CVS. That may be better. We'll likely release 1.1.8 soon. Alan DeKok.

1 0

Which RADIUS server can support RFC3576?
by Hangjun He 29 Nov '07

29 Nov '07

I know freeRADIUS can't suport RFC3576 (Dynamic Authorization Extensions to RADIUS). Do you know which one can support it? --------------------------------- 雅虎邮箱，终生伙伴！

2 1

vlan assignment
by inl2goal 28 Nov '07

28 Nov '07

I am having trouble configuring VLAN assignment for CISCO switches, this is the debug output from when the user authenticates, any ideas? thanks rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 13 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 13 modcall: leaving group authorize (returns updated) for request 13 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 13 modcall: leaving group authenticate (returns ok) for request 13 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 13 rlm_sql (sql): Processing sql_postauth radius_xlat: 'tortuga' rlm_sql (sql): sql_set_user escaped user --> 'tortuga' radius_xlat: 'INSERT into radpostauth (user, pass, reply, date) values ('tortuga', 'Chap-Password', 'Access-Accept', NOW())' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (user, pass, reply, date) values ('tortuga', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT into radpostauth (user, pass, reply, date) values ('tortuga', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 1 modcall[post-auth]: module "sql" returns ok for request 13 modcall: leaving group post-auth (returns ok) for request 13 Sending Access-Accept of id 17 to 10.19.100.196 port 1645 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "120" EAP-Message = 0x03030004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "tortuga" Finished request 13 the user gets the attribute from a SQL table mysql> select * from radgroupreply; +----+-----------+-------------------------+----+---------------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------------+----+---------------------+ | 1 | admin | Framed-Protocol | := | PPP | | 2 | admin | Service-Type | := | Framed-User | | 3 | admin | Framed-Compression | := | Van-Jacobsen-TCP-IP | | 10 | admin | Tunnel-Type | := | VLAN | | 11 | admin | Tunnel-Medium-Type | := | IEEE-802 | | 13 | admin | Tunnel-Private-Group-ID | := | 120 | +----+-----------+-------------------------+----+---------------------+ -- View this message in context: http://www.nabble.com/vlan-assignment-tf4884769.html#a13980961 Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Execute A Script After User Authenticate
by fvt3 28 Nov '07

28 Nov '07

Hi, I have Freeradius setup to authenticate user off mysql database. I was able to set Freeradius to execute a script base on what group a user is in. ex. usergroup table: username groupname Jdoe testprogram radgroupreply table: Groupname atrribute op value testprogram Exec-Program-Wait == /usr/local/etc/raddb/test.pl When user Jdoe authenticates, the script ran no problem. My problem is how do you pass the user-name and client host information to this script. Note: I was able to pass the user-name to the script when the following is placed in the users file. However this does not behave the way I want. DEFAULT Auth-Type= local Exec-Program-Wait = '/usr/local/etc/raddb/test.pl %{User-Name}', Any help would be appreciated.. ____________________________________________________________________________________ Get easy, one-click access to your favorites. Make Yahoo! your homepage. http://www.yahoo.com/r/hs

2 1

Re: rlm_passwd and EAP-MD5
by Alan DeKok 28 Nov '07

28 Nov '07

Kolbjørn Barmen wrote: > Can rlm_passwd be used together with EAP-MD5? Yes. Only if the password is in clear-text. > If I in the users file set "Password == blabla" for a user test-user > and then connects using radeapclient as described in the manual with > "EAP-MD5-Password = blabla" it works fine. However, I want to use an > external clear-text password instead of having the password in users, > since I want to change the password for each and every test, and do > not want to HUP radiusd all the time. I'm not sure that will work. > On the same server I use rlm_passwd already for authenticate certain > clients against a TACACS passwd file, and for those clients I have in > users file entires like this: > > DEFAULT Auth-Type := PAP, Client-IP-Address == "w.x.y.z" > > which (if I have grasped things right) enforces those to use PAP, In 1.1.7, you don't need that Auth-Type. > With the above I get in the log: > > Info: rlm_eap_md5: User-Password is required for EAP-MD5 authentication Ugh. It works in 1.1.7. Which version are you running? > As for "Why EAP-MD5?", I just need some EAP-method for which > I can easily generate requests with radeapclient. See also wpa_supplicant and eapol_test. I use it to test all of the EAP types... Alan DeKok.

1 0