- Freeradius-Users - lists.freeradius.org

rlm_ldap: ldap_search() failed: Operations error - advice please
by Jacob Jarick 19 Apr '07

19 Apr '07

Freeradius 1.1.3 installed via YUM on Fedora (not suse :P) radiusd.conf: http://pastebin.ca/447690 radiusd -X -A output: http://pastebin.ca/447693 domain: tfxschool.internal ADS: tfxschoolfs01.tfxschool.internal Hi again people, I have been pouring through the oreillys LDAP book (quite informative so far to btw). I got the example of using freeradius against the linux passwd file working fine. I tried their Freeradius and OpenLDAP (now I know ADS isnt OpenLDAP btw) and it fails with the following message: rlm_ldap: ldap_search() failed: Operations error Oriellys one reccomended for OpenLDAP (errors, possibly due to incorrect syntax ?): filter = "(&(objectclass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" Default filter (Fails with same search error): filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" Im wondering if it is perhaps my basedn ?, Im still getting used to the idea of them, the user jacob (me) resides in the ou people FYI. basedn = "ou=people,dc=tfxschool,dc=internal" Thats all my info atm, Im currently compiling a 1.1.6 rpm (after Alan resolving my silly little mistake) and will test then report back as I feel its more likely a config error than a bug :) If some1 else has a working radius setup that auths againts AD using LDAP would they mind sending me the ldap { } section, would be very handy to compare my config to a working one. Thanks all, keep up the good work.

2 2

Re: PAM Radius Authentication
by daniel 19 Apr '07

19 Apr '07

Ok, I have gotten pam_radius_auth.so to work and it is working well, however, is there any way to get it to create a UID when it receives an auth accept? At the moment I have to run adduser every time I want a user to be able to log in, this would be ok if the users were fairly static, I could run a script every night to add new users to the system, unfortunately I have a lot of users and they need to be available immediately. Thanks for all your help so far. -Daniel Davis

3 4

SNMP with 1.1.6 and Net-SNMP 5.3
by Stefan Winter 19 Apr '07

19 Apr '07

Hi, trying for the first time to get SNMP working, and I have come to a point where I'm really startled why stuff doesn't work. I've configured FreeRADIUS 1.1.6 with SNMP, and it's printing out that it is starting up the SMUX connection. Then the snmpd refuses the SMUX connection. This would usually mean I screwed up the shared secret, but I'm very sure I haven't. I even verified with tcpdump that FR sends the correct secret on the loopback "wire". So the problem would appear to be that Net-SNMP is confused wrt the secret. But I configured it with the line smuxpeer .1.3.6.1.4.1.3317.1.3.1 verysecret (also without the leading dot, in my desperation, didn't help). The password *is* verysecret on the FR side. Debug output says: ... Module: Instantiated detail (nas_reply_log) main: smux_password = "verysecret" main: snmp_write_access = no SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register message send failed: Broken pipe Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. The broken pipe is because Net-SNMP closes the connection, it's log says: [smux_accept] accepted fd 9 from 127.0.0.1:4580 refused smux peer: oid SNMPv2-SMI::enterprises.3317.1.3.1, descr radiusd and tcpdump reveals that the reason for refusing is authenticationFailure. Anyone else running a similar config? It's the version of Net-SNMP that came as RPM on SUSE 10.1. FR compiled freshly. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 4

1.1.6 rpm build errors
by Jacob Jarick 19 Apr '07

19 Apr '07

Notes: * The wiki glosses over a little and gives u an incorrect dir * the spec file expects 1.1.5 tar.gz # cd /usr/src # tar zxvf /root/Desktop/freeradius-1.1.6.tar.gz # cp /root/Desktop/freeradius-1.1.6.tar.gz /usr/src/redhat/SOURCES/freeradius-1.1.5.tar.gz # cp freeradius-1.1.6/suse/freeradius.spec /usr/src/redhat/SPECS/ # rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec ^ that gets me to this point here: [root@localhost src]# rpmbuild -ba /usr/src/redhat/SPECS/freeradius.spec sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found sh: apxs2-prefork: command not found error: Failed build dependencies: apache2-devel is needed by freeradius-1.1.5-0.generic.i386 db-devel is needed by freeradius-1.1.5-0.generic.i386 gettext-devel is needed by freeradius-1.1.5-0.generic.i386 mysql-devel is needed by freeradius-1.1.5-0.generic.i386 net-snmp-devel is needed by freeradius-1.1.5-0.generic.i386 openldap2-devel is needed by freeradius-1.1.5-0.generic.i386 postgresql-devel is needed by freeradius-1.1.5-0.generic.i386 unixODBC-devel is needed by freeradius-1.1.5-0.generic.i386 now checking yum and smart --gui I do not see apache2-devel for starters. So for the mean time I am back to compiling as rpm's are causing the issues they are famous for. If some1 has some tips on resolving dependancies I will be intrested. But I do not see what it needs apache2 headers anyway.

2 2

Howto compile 1.1.6 on Fedora 6
by Jacob Jarick 19 Apr '07

19 Apr '07

Thanks to the people who helped me figure this out (big thanks to Alan), this works perfectly on a fresh Fedora system. Download, compile and install openssl download freeradius 1.1.6 unpack in usr/src cd freeradius-1.1.6 ./configure --prefix=/usr --with-openssl-includes=/usr/local/ssl/include --with-openssl-libraries=/usr/local/ssl/lib/ --disable-libtool-lock --with-system-libtool --sysconfdir=/etc (^all one line) make make install That should also put everything where the rpm normally does (yuck) so should u upgrade later you wont have lib conflicts. All the best.

5 9

active directory host authentication
by Joe Vieira 18 Apr '07

18 Apr '07

Hi, Using freeradius 1.1.5 samba 3.0.24...i have an interesting problem, and was curious what methods other people would take to solve it. I am setting up radius for our new wpa2 wireless network, which means that windows machine auth should work so that people can LOGIN to their laptops. i have it working (with a slight hack). when a windows xp machine sends its machine auth to radius it sends host/machinename.activedirectorydomain.domain.domain. so freeradius takes the activedirectorydomain part of that and assumes that the domain's actual name (what you use for authentication) in our case....blame the windows people, that is NOT the case. example computer.ad.clarku.edu is the dns name...however that computer is actually joined to the CLARKU domain..so the authentication needs to be against the CLARKU domain as the AD domain doesn't exist. does that make sense? any ideas? the hack i have in place is a hardcoded domain of CLARKU in the NTLM_AUTH check(this can't stay as we have multiple domains). thanks in advance for any insight. Joe

2 5

Technical support
by Jacob Jarick 18 Apr '07

18 Apr '07

Hello, Im looking for a company that can provide professional level of technical support. If any one here can reccomend one I would appreciate it. I am after technical support, due to lack of good documentation on the freeradius project. Most the stuff I need done has only incomplete docs.

2 5

Radius 2.0.0-pre Making all in main compilation error
by tzieleniewski 18 Apr '07

18 Apr '07

Hi, I have just downloaded the CVS trunk sources. When I compile them I get the following errors: Please point me what do I miss. Making all in main... make[4]: Entering the directory `/home/radius/src/radiusd/src/main' /home/radius/src/radiusd/libtool --mode=link gcc -export-dynamic -dlopen self \ -pie -o radiusd acct.lo auth.lo client.lo conffile.lo crypt.lo exec.lo files.lo listen.lo log.lo mainconfig.lo modules.lo modcall.lo radiusd.lo radius_snmp.lo session.lo smux.lo threads.lo util.lo valuepair.lo version.lo xlat.lo event.lo realms.lo \ ../lib/libradius.la -lnsl -lresolv -lpthread -lsnmp \ -lcrypt -lltdl -lcrypto -lssl -lcrypto rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -pie -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/radius_snmp.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o -Wl,--export-dynamic ../lib/.libs/libradius.so -lnsl -lresolv -lpthread /usr/lib/libsnmp.so -lcrypt /usr/lib/libltdl.so -ldl -lssl -lcrypto -Wl,--rpath -Wl,/home/radius/freeradius/lib collect2: ld returned 1 exit status make[4]: *** [radiusd] Błąd 1 make[4]: Leaving the directory `/home/radius/src/radiusd/src/main' make[3]: *** [common] Błąd 2 make[3]: Leaving the directory `/home/radius/src/radiusd/src' make[2]: *** [all] Błąd 2 make[2]: Leaving the directory `/home/radius/src/radiusd/src' make[1]: *** [common] Błąd 2 make[1]: Leaving the directory `/home/radius/src/radiusd' make: *** [all] Błąd 2 Thanks in advance Cheers Tomasz

2 1

How to force the group processing?
by tzieleniewski 18 Apr '07

18 Apr '07

Hi, How can I force the group processing after the positive authentication with the radcheck table. I want to achieve the following: after I authenticate the user I would like to add a reply attribute if the user belongs to the particular group. Thank you in advance. Tomasz

2 1

FR + openldap + WPA, auth fails
by matthew zeier 18 Apr '07

18 Apr '07

With nearly the same config files as I had working on 1.0.1, I'm having problems with 1.1.6 authenticating WPA users. Probably something to do with this: rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for mzeier(a)mozilla.com with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: leaving group MS-CHAP (returns reject) for request 7 eap.conf - http://pastebin.mozilla.org/10218 radiusd.conf - http://pastebin.mozilla.org/10223 If there are other relevant files, let me know. Box is more or less a stock RHEL4. -- matthew zeier | Network Engineer | Mozilla Corp. | (650)903-0800 x219

2 6