- Freeradius-Users - lists.freeradius.org

make freeradius-2.0 cvs Version
by Hans-Peter Fuchs 07 Nov '07

07 Nov '07

Hello all, I want to make freeradius-2-0-pre2 on a Redhat 3.2.3-47 with openssl-0.9.7a-33.23. make gives this error: /service/freeradius-cvs/radiusd/libtool --mode=compile gcc -g -O2 -I/service/freeradius-cvs/radiusd/src -DHOSTINFO= \"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.0.0-beta\" -DOPENSSL_NO_KRB5 -c threads.c gcc -g -O2 -I/service/freeradius-cvs/radiusd/src -DHOSTINFO= \"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.0.0-beta\" -DOPENSSL_NO_KRB5 -c threads.c -fPIC -DPIC -o .libs/threads.o In file included from /usr/include/openssl/evp.h:81, from threads.c:64: /usr/include/openssl/md4.h:105: conflicting types for `librad_MD4_CTX' /service/freeradius-cvs/radiusd/src/freeradius-devel/md4.h:75: previous declaration of `librad_MD4_CTX' gmake[4]: *** [threads.lo] Fehler 1 On an other system with fedora 4.1.1-30 and openssl-0.9.8b-8.3.fc6 the make runs fine without errors -- Grüße Hans-Peter Fuchs Hans-Peter Fuchs - RRZK Zimmer 20 Zentrum für angewandte Informatik - Universitätsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 1

an intermittant PAP auth problem
by A.L.M.Buxey＠lboro.ac.uk 07 Nov '07

07 Nov '07

hi, we use nagios to monitor our freeradius install. this is using the adv_radius_check plugin to check from the nagios servers a user on the freeradius server (in the users file), the following are the succinct details users file entry nagios-user Huntgroup-Name == "nagios", Cleartext-Password := "password", Autz-Type := nagios-check Reply-Message = "This server is active", Fall-Through = No huntgroup file nagios Client-IP-Address == 127.0.0.1 nagios Client-IP-Address == 10.1.1.2 nagios Client-IP-Address == 10.1.1.3 sites-enabled/default auth entry authorize { Autz-Type nagios-check { files ok = return } } okay. so the user authentication tests fine with radtest on the radius server....and it works fine from the 2 nagios boxes...almost always. occasionally we see the following error come through during the 5-minute interval tests....... Wed Nov 7 11:21:40 2007 : Auth: Login OK: [nagios-user] (from client 10.1.1.2 port 0) Wed Nov 7 11:26:40 2007 : Auth: Login incorrect: [nagios-user] (from client 10.1.1.2 port 0) Wed Nov 7 11:29:40 2007 : Auth: Login OK: [nagios-user] (from client 10.1.1.2 port 0) of course, when that 11:26:40 event occurred, nagios claims a problem with the RADIUS. now, the check method is the same, the password is the same, the IP is the same, in essence nothing changes at all between each 5-minute test (the last entry 11:29:40 is quicker than a 5 minute interval as nagios catches up with failed events within a following window) and this is just plain PAP check in users file. so why is it occasionally failing? has anyone else seen this sort of activity? alan

2 1

rlm_ldap: Attribute "User-Name" is required for authentication.
by Ryan Pugatch 07 Nov '07

07 Nov '07

Hello, While I resolved my previous issue with radiusd segfaulting, I'm now running in to a new issue. I'm attempting to have my Linksys WRT54GL (running DD-WRT v23 SP2) use WPA RADIUS against a FreeRADIUS server (FreeRADIUS Version 1.1.7, for host i686-pc-linux-gnu) and subsequently have the FreeRADIUS server use our existing LDAP directory (OpenLDAP v2.2.13-4). When a user tries to connect to the access point and the access point contacts the radius server, the following happens: Ready to process requests. rad_recv: Access-Request packet from host 192.168.42.23:2050, id=0, length=129 User-Name = "rpugatch" NAS-IP-Address = 192.168.42.23 Called-Station-Id = "0018f8c16a5a" Calling-Station-Id = "0017f2e7032a" NAS-Identifier = "0018f8c16a5a" NAS-Port = 14 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d017270756761746368 Message-Authenticator = 0xe1b0b05b118ebe49d6b79b7569de75b1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_ldap: - authorize rlm_ldap: Attribute "User-Name" is required for authentication. modcall[authorize]: module "ldap" returns invalid for request 0 modcall: leaving group authorize (returns invalid) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- This is most likely an issue with my configuration, however, I'm not sure what the issue is. I'd appreciate any help I can get. Thanks, Ryan

4 6

help for radius server in huge DS L service
by ann kok 07 Nov '07

07 Nov '07

Hi all I have question about radius servers for Huge D SL services 1/ how many clients the freeradius server can handle? ls there any limitation? 2/ how many radius servers in LNS servers? 3/ for Telco company, they provide hundred thousand DSL service. Do you know what their archecture in radius setting? ls it different radius servers per LNS? Thank you for your help __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

freeRADIUS with 2 Active-direcotory
by Hangjun He 07 Nov '07

07 Nov '07

Hi, I use freeRADIUS1.1.6 and samba3 to talk with Active-directory. It can work well. Followed by wiki: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO Now we want to set up 2 active-directory, One is primary, The other is backup. If primary AD down, freeRADIUS can switch to backup AD to do authenticate. Can freeRADIUS or samba support 2 ADs? And how to do? Any comment is appreciated. John --------------------------------- @yahoo.cn 新域名、无限量，快来抢注！

2 3

hi
by ANUJ 07 Nov '07

07 Nov '07

Anujgaur88(a)gmail.com

1 0

problem with EAP-TTLS logging passwords
by Riccardo Veraldi 07 Nov '07

07 Nov '07

Hello, I use EAP-TTLS with PAP in my radius proxy infrastructure. The problem is that with option log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes passwords are logged on the intermediate radius servers and also on the final hub radius server since I have a tree radius server infrastructure sparse into Italy. How to solve this problem ? I cannot use EAP-MD5 or MSCHAPv2 inside the TLS tunnel since users passwords are on an encrypted database (unix passwords or kerberos passwords). Anyone has a solution for this ? I would like to prevent the possibility of the password being logged on the intermediate radius servers. thanks Riccardo

2 1

how to do the dynamic VLAN rewrite according to the username or calling-station-id?
by schilling 07 Nov '07

07 Nov '07

We are trying to explore the 802.1x in university resnet. One thing we want to do is put the cisco switch port in a walled garden VLAN if the username or calling-station-id match a blocklist. If username/calling-station-id is not in the blocklist, they will just get to the static access VLAN configured on the cisco switch port. Is there any module available to do this already? Regards, Shiling

3 8

radiusd deadlock on recvfrom on port 1814
by Ryan Melendez 06 Nov '07

06 Nov '07

Hey, I've had FreeRADIUS Version 1.1.0 hang twice recently. The core dumps are very similar in that it appears that main is waiting on some stuff from port 1814. Honestly I don't know what 1814 is really for (proxy port?) but it seems as if fd_isset says so we should expect some data on that socket. Unless something _else_ had already received that data. I hadn't noticed this before I added radrelay and another radiusd process on the same box. Both radiusd processes are bound to different virtual interfaces and radrelay is duplicating acct packets from one to the other. It's not obvious why there would be a race condition on that socket, but my guess is something is going on there. It seems as though both radiusd processes are using the same descriptors for each of their three sockets. I've included some debug info from the core files. Is this a know bug or can it be fixed with a configuration change? Thanks, Ryan ---------------------------------------------------------------------- Process One: (gdb) print *(rad_listen_t *) mainconfig.listen $1 = {next = 0x458023e8, ipaddr = 486477016, type = RAD_LISTEN_AUTH, port = 1812, fd = 3} (gdb) print *(rad_listen_t *) mainconfig.listen->next $2 = {next = 0x4580eef8, ipaddr = 486477016, type = RAD_LISTEN_ACCT, port = 1813, fd = 4} (gdb) print *(rad_listen_t *) mainconfig.listen->next->next $3 = {next = 0x0, ipaddr = 486477016, type = RAD_LISTEN_PROXY, port = 1814, fd = 5} Process Two: gdb) print *(rad_listen_t *) mainconfig.listen $2 = {next = 0x8117fe0, ipaddr = 1459555544, type = RAD_LISTEN_AUTH, port = 1812, fd = 3} (gdb) print *(rad_listen_t *) mainconfig.listen->next $3 = {next = 0x8117ff8, ipaddr = 1459555544, type = RAD_LISTEN_ACCT, port = 1813, fd = 4} (gdb) print *(rad_listen_t *) mainconfig.listen->next->next $4 = {next = 0x0, ipaddr = 1459555544, type = RAD_LISTEN_PROXY, port = 1814, fd = 5} Process One: (gdb) info threads * 6 process 11191 0x0804d145 in main (argc=1166077688, argv=0xbfffd0c0) at radiusd.c:1323 5 process 19865 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 4 process 19864 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 3 process 19863 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 2 process 19862 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 1 process 19861 0x401c8d0b in sem_wait(a)GLIBC_2.0 () from /lib/tls/libpthread.so.0 (gdb) bt #0 0x401c99fe in recvfrom () from /lib/tls/libpthread.so.0 #1 0x4004e6d1 in rad_recv (fd=5) at radius.c:1044 #2 0x0804d145 in main (argc=1166077688, argv=0xbfffd0c0) at radiusd.c:1323 (gdb) print *(rad_listen_t *) listener $22 = {next = 0x0, ipaddr = 486477016, type = RAD_LISTEN_PROXY, port = 1814, fd = 5} (gdb) frame 1 #1 0x4004e6d1 in rad_recv (fd=5) at radius.c:1044 1044 radius.c: No such file or directory. in radius.c (gdb) info locals packet = (RADIUS_PACKET *) 0x4780dc38 saremote = {sin_family = 0, sin_port = 0, sin_addr = {s_addr = 0}, sin_zero = "\000\000\000\000\000\000\000"} totallen = 263 salen = 16 attr = (uint8_t *) 0x0 count = -1073758352 host_ipaddr = "\000\000\000\000��۾\005\b" seen_eap = 0 data = "stuff"... --

2 9

EAP failed to remember handler...
by A.L.M.Buxey＠lboro.ac.uk 06 Nov '07

06 Nov '07

hi, Tue Nov 6 10:39:41 2007 : Error: rlm_eap: Failed to remember handler! Tue Nov 6 10:39:41 2007 : Error: rlm_eap: Failed to remember handler! Tue Nov 6 10:39:41 2007 : Error: rlm_eap: Failed to remember handler! then radiusd dead radiusd: FreeRADIUS Version 2.0.0-pre2, for host i686-pc-linux-gnu, built on Sep 17 2007 at 12:02:09 will be updating this CVS version to beta code later - but is this a known bug issue that has recently been fixed or should I look into turning on the debugging? It would be very nice if debugging could be increased for just one clients activity..... alan

2 1