- Freeradius-Users - lists.freeradius.org

Re : 2.0.0-pre : Failed to open socket.
by Eshun Benjamin 21 Jun '07

21 Jun '07

ERROR: Failed to open socket: check the port 1812 if it is being used. Or you can also run radius on the old school port 1645 for testing. ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Debashis Prusty <dprusty(a)systemsfusion.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 20 Juin 2007, 18h02mn 39s Objet : 2.0.0-pre : Failed to open socket. I am trying to rum Freeradius on Solaris with MySQL. Logs are pasted below. Its working fine for earlier versions of Freeradius. Do any one have the solution? Thanks in advance, Debashis ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ freeradius/sbin # ./radiusd -X Config: including file: /opt/sf/freeradius/etc/raddb/radiusd.conf Config: including file: /opt/sf/freeradius/etc/raddb/proxy.conf Config: including file: /opt/sf/freeradius/etc/raddb/clients.conf Config: including file: /opt/sf/freeradius/etc/raddb/snmp.conf Config: including file: /opt/sf/freeradius/etc/raddb/eap.conf Config: including file: /opt/sf/freeradius/etc/raddb/sql.conf Config: including file: /opt/sf/freeradius/etc/raddb/sql/mysql-dialup.conf FreeRADIUS Version 2.0.0-pre1, for host i386-pc-solaris2.10, built on Jun 19 2007 at 10:29:22 Starting - reading configuration files ... read_config_files: reading dictionary main { prefix = "/opt/sf/freeradius" localstatedir = "/opt/sf/freeradius/var" logdir = "/opt/sf/freeradius/var/log/radius" libdir = "/opt/sf/freeradius/lib" radacctdir = "/opt/sf/freeradius/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no log_stripped_names = no log_file = "/opt/sf/freeradius/var/log/radius/radius.log" log_auth = no log_auth_badpass = no log_auth_goodpass = no pidfile = "/opt/sf/freeradius/var/run/radiusd/radiusd.pid" checkrad = "/opt/sf/freeradius/sbin/checkrad" debug_level = 0 proxy_requests = yes log { syslog_facility = "daemon" } proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } home_server localhost { ipaddr = 127.0.0.1 IP address [127.0.0.1] port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } server_pool my_auth_failover { type = my_auth_failover home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { ldflag = fail_over } port = 1812 listen { type = "auth" ipaddr = * port = 0 ERROR: Failed to open socket: /opt/sf/freeradius/etc/raddb/radiusd.conf[195]: Error binding to port for 0.0.0.0 port 1812 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

6 6

RE: Freeradius-Users Digest, Vol 26, Issue 79
by Hugh Messenger 20 Jun '07

20 Jun '07

Alan DeKok wrote: > Hugh Messenger wrote: > > So far the only errors I'm seeing are these: > > > > ==29820== Thread 2: > > ==29820== Invalid write of size 1 > > ==29820== at 0x4819294: strNcpy (misc.c:187) > > ==29820== by 0x4CC43F3: sqlippool_postauth (rlm_sqlippool.c:527) > > That's... fairly broken. Oh dear. I think you just made that wind sucking tsk-tsk sound favored by auto mechanics. FYI, these errors only seem to happen on the first handful of logins. Then it seems to run error free. Not much help, but an observation none the less. > Barring severe code changes to rlm_sqlippool, I would suggest not > using it in 1.1.6. Sorry. No apologies necessary. Hey, I get what I pay for. :) > > Try 2.0.0-pre, at least the rlm_sqlippool module is fixed there. Okie Dokie. Is 2.0.0 ready for prime time, assuming the bits I need work? Given that my choice is to keep running 1.1.6 in debug mode from a terminal session, I'd take a slightly fragile v2. Load would be very light for a few months while we migrate to PPPOE. > Alan DeKok. -- hugh

1 0

Ldap Group Membership Requirements
by Cody Jarrett 20 Jun '07

20 Jun '07

I'm trying to require a user to be a member of the wireless group in ldap to be able to join the wireless. All users can currently join the wireless. I can't find very much documentation on the groupmembers* lines in the ldap section of radius.conf. Basically trying to figure out what I need to add to these lines: groupname_attribute, groupmembership_filter, and groupmembership_attribute. Also not sure if I need to add something to users file like: DEFAULT LDAP-Group == "wireless". Can anyone provide input on what I need to configure, Thanks. wireless group in ldap, you can see cjarrett is a member: dn: cn=wireless,ou=Groups,dc=itfreedom,dc=com objectClass: posixGroup cn: wireless gidNumber: 1011 memberUid: cjarrett

3 3

add new arributes in the proxy reply message
by Ashraf Al-Basti 20 Jun '07

20 Jun '07

Dear, i need to add attributes in the proxy reply message, how can i do that using attrib_rewrite?

2 1

1.1.6 name resolution
by Andrew Long 20 Jun '07

20 Jun '07

Is it permissable to use a hostname in clients.conf, as for a host using dyndns? Regards, Andrew Long

2 2

empty password / dhcpd
by Felipe Ceglia - PY1NB 20 Jun '07

20 Jun '07

Hi again... I am now trying to authenticate a DHCPd request from a mikrotik box. My freeradius server says that there is a problem with user's password. How can I tell him (PAP) that this should be ok? Something strange that I noticed is that the calling station id got changed from the original mac address value. Anyway, I just put this as a calling-station id attribute on radcheck. mysql> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:0B:CD:EC:63:50' ORDER BY id; +------+-------------------+--------------------+-------------------+----+ | id | UserName | Attribute | Value | op | +------+-------------------+--------------------+-------------------+----+ | 2047 | 00:0B:CD:EC:63:50 | Calling-Station-Id | 1:0:b:cd:ec:63:50 | := | | 2050 | 00:0B:CD:EC:63:50 | User-Password | | := | +------+-------------------+--------------------+-------------------+----+ 2 rows in set (0.00 sec) SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:0B:CD:EC:63:50' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; Empty set (0.00 sec) mysql> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:0B:CD:EC:63:50' ORDER BY id; +----+-------------------+-------------------+-----------------+----+ | id | UserName | Attribute | Value | op | +----+-------------------+-------------------+-----------------+----+ | 42 | 00:0B:CD:EC:63:50 | Framed-IP-Address | 192.168.254.101 | == | | 43 | 00:0B:CD:EC:63:50 | Framed-IP-Netmask | 255.255.255.0 | == | +----+-------------------+-------------------+-----------------+----+ 2 rows in set (0.00 sec) SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:0B:CD:EC:63:50' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; Empty set (0.00 sec) Ready to process requests. rad_recv: Access-Request packet from host 172.16.3.5:32768, id=71, length=113 NAS-Port-Type = Ethernet NAS-Port = 2205155400 Calling-Station-Id = "1:0:b:cd:ec:63:50" Called-Station-Id = "server1" User-Name = "00:0B:CD:EC:63:50" User-Password = "" NAS-Identifier = "MikroTik" NAS-IP-Address = 172.16.3.5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00:0B:CD:EC:63:50", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "00:0B:CD:EC:63:50" rlm_realm: Proxying request from user 00:0B:CD:EC:63:50 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 174 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '00:0B:CD:EC:63:50' rlm_sql (sql): sql_set_user escaped user --> '00:0B:CD:EC:63:50' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:0B:CD:EC:63:50' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:0B:CD:EC:63:50' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:0B:CD:EC:63:50' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:0B:CD:EC:63:50' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 ****************************************************************************** rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 modcall[authenticate]: module "pap" returns invalid for request 0 modcall: leaving group PAP (returns invalid) for request 0 ****************************************************************************** auth: Failed to validate the user. Login incorrect (rlm_pap: empty password supplied): [00:0B:CD:EC:63:50/] (from client mikrotik port 2205155400 cli 1:0:b:cd:ec:63:50) rad_lowerpair: Stripped-User-Name now '00:0b:cd:ec:63:50' rad_lowerpair: User-Password now '' rad_rmspace_pair: Stripped-User-Name now '00:0b:cd:ec:63:50' rad_rmspace_pair: User-Password now '' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 Thank you, Felipe

2 2

RE: PHP issues with PHP 4.3.9 and dialup_admin
by Josh Howlett 20 Jun '07

20 Jun '07

> On 6/16/07, Josh Howlett <J.Howlett(a)ukerna.ac.uk> wrote: > > Ethan, > > > > Have you got the freeradius-mysql RPM installed? > > I don't know if I remembered to post a followup or not, but, > "undefined constant" messages aside (which are caused by a > change to how PHP requires single quotes), my real problems > with dialup_admin not working at all (blank screens), was > caused by a missing rpm related to PHP and a > reported/documented "feature" that if you call a PHP function > that does not exist, you get no feedback in the way of error > messages - just total silence. You were probably missing php-mysql, as I was. PHP does normally return sensible error messages of the kind you mention, so I had the some confusion as you. I'm not sure if there is an new option in php5 to enable these, or if something has changed in dialup_admin to suppress them... josh.

1 0

RE: PHP issues with PHP 4.3.9 and dialup_admin
by Josh Howlett 20 Jun '07

20 Jun '07

Ethan, Have you got the freeradius-mysql RPM installed? josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Ethan Dicks > Sent: 20 March 2007 21:00 > To: freeradius-users(a)lists.freeradius.org > Subject: PHP issues with PHP 4.3.9 and dialup_admin > > I've been digging around all day and I've seen other people > describe the same symptoms I'm having, but the follow-ups > typical asy "Oh, I fixed it", but don't describe the fix. It > seems that something resembling my symptoms goes back to the > version of dialup_admin that shipped with freeRADIUS 1.0.1, > so I am not convinced what I'm seeing is _specifically_ a PHP > 4.3 problem, but given the changes with registers_global from > 4.1.0 to 4.2.0, I thought it would be prudent to mention that. > > My setup is... > CentOS 4.4.2 (RHEL 4 without the RedHat trademarks and graphics) > Apache 2.0.52 > PHP 4.3.9 > mysql 4.1.20 > freeRADIUS 1.1.5 > dialup_admin ? (CVS snapshot 20070320) > firefox 1.5.0.10 > > I have freeRADIUS installed and working with users stuffed > into a flat file, verified with 'radtest'. I can get the > main page of dialup_admin to come up, but I get blank screens > and lots of PHP errors logged when I try to invoke nearly any > button. My radius database has tables, but no rows, since I > was trying to set up dialup_admin to start inserting users > and groups. I have set PHP's registers_global to 'on' via > /etc/php.ini and verified that it's on with phpinfo(), and I > still get dozens of errors per mouse-click... > > Here's a typical example - the output is generated when > clicking on the 'new group' button: a long list of 'undefined > constant', 'undefined variable', and 'undefined index' > following the warning that there's no prefix on a function > call to say what its namespace is. > I'm putting the error dump at the bottom to keep it from > creating a huge gulf between sections of this query. > > I know it must look familar because I've found several > references to errors that look just like this in the mailing > list archives. What's lacking is the solution. > > Am I just missing a setup step somewhere? Am I running > servers and packages that are just too new and untested? > > Thanks, > > -ethan > > > [client 127.0.0.1] PHP Notice: import_request_variables(): > No prefix specified - possible security hazard in > /usr/local/dialup_admin/conf/config.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/conf/config.php3 on line 66, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/conf/config.php3 on line 73, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/conf/config.php3 on line 76, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_username_mappings_file - assumed > 'general_username_mappings_file' in > /usr/local/dialup_admin/conf/config.php3 on line 86, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_username_mappings_file - assumed > 'general_username_mappings_file' in > /usr/local/dialup_admin/conf/config.php3 on line 87, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/conf/config.php3 on line 106, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: show in > /usr/local/dialup_admin/htdocs/group_new.php3 on line 3, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_lib_type - assumed 'general_lib_type' in > /usr/local/dialup_admin/htdocs/group_new.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_user_edit_attrs_file - assumed 'general_user_edit_attrs_file' > in /usr/local/dialup_admin/lib/attrshow.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/attrshow.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > accounting - assumed 'accounting' in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > userdb - assumed 'userdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasdb - assumed 'nasdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasadmin - assumed 'nasadmin' in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 17, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_accounting_attrs_file - assumed > 'general_accounting_attrs_file' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 23, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_accounting_attrs_file - assumed > 'general_accounting_attrs_file' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 24, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/attrshow.php3 on line 24, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > accounting - assumed 'accounting' in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > userdb - assumed 'userdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasdb - assumed 'nasdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasadmin - assumed 'nasadmin' in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: acct_attrs in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: ua in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: fl in > /usr/local/dialup_admin/lib/attrshow.php3 on line 40, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 40, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: uf in > /usr/local/dialup_admin/lib/attrshow.php3 on line 36, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 36, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 44, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/defaults.php3 on line 18, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/sql/attrmap.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/sql/defaults.php3 on line 3, referer: > http://localhost/dialup/buttons.php3 > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

1.1.6 rpmbuild on centos 4.4
by Andrew Long 20 Jun '07

20 Jun '07

I know this is a little off topic, but would appreciate any help. Following instructions at http://radiuswiki.suntel.com.tr/Build I am getting... [root@dev SPECS]# rpmbuild -bb freeradius.spec error: Failed build dependencies: libtool-ltdl-devel is needed by freeradius-1.1.6-0.i386 On Cent 4.4 there is no libtool-ltdl or devel package. I don't quite understand this, as this machine is identical to another on which I built freeradius from source (not rpmbuild, though). I can find a libtool-ltdl for FC, but it puts me in a spiral of failed deps... Anyone have a clue? Regards, Andrew Long

3 3

mschapv2 and users file
by Matt Cobb 20 Jun '07

20 Jun '07

I have freeradius 1.1.4 setup as a proxy to an upstream radius server which works. I also want to put guests in a local users file and use MSCHAPV2 on them, but didn't get it to work. I was able to get PAP and CHAP working. Here is the MSCHAPV2 configuration I tried: users file: cobb User-Password=="secret" proxy.conf: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm guests { type = radius authhost = LOCAL:1812 accthost = LOCAL:1813 secret = whatever } realm testlab.com { type = radius authhost = 172.16.0.3:1812 accthost = 172.16.0.3:1813 secret = testing } realm DEFAULT { type = radius authhost = 172.16.0.3:1812 accthost = 172.16.0.3:1813 secret = testing } radius.conf: prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var/lib sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = /var/log/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 1812 listen { ipaddr = * port = 1645 type = auth } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no } ldap { server = "ldap.your.domain" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = yes } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } } instantiate { exec expr # daily } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { preprocess chap mschap suffix ntdomain eap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique suffix ntdomain # # Read the 'acct_users' file files } accounting { detail unix radutmp } session { radutmp } post-auth { } post-proxy { eap } I get this error about the mschap response being incorrect. A request form the same client that is proxied back to IAS with mschapv2 works. rlm_realm: Looking up realm "guests" for User-Name = "cobb@guests" rlm_realm: Found realm "guests" rlm_realm: Adding Stripped-User-Name = "cobb" rlm_realm: Proxying request from user cobb to realm guests rlm_realm: Adding Realm = "guests" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "ntdomain" returns noop for request 0 modcall: leaving group (returns noop) for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry cobb at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: Told to do MS-CHAPv2 for cobb@guests with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. I also tried changing the users file to have NT-Password == "0xB6FFB3200061D7B7928F0D932F095128" But then freeradius just said it couldn't create the NT-Password: rlm_mschap: No User-Password configured. Cannot create NT-Password, followed by the previous error. How do I configure MSCHAPv2 to a local users file?

7 11