- Freeradius-Users - lists.freeradius.org

Re: EAP-TTLS outer identity & accounting
by Sam Schultz 21 Mar '07

21 Mar '07

On Tue, 20 Mar 2007 09:38:25 -0500 Alan DeKok <aland(a)deployingradius.com> wrote: >Sam Schultz wrote: >> >> I have set a DEFAULT entry that sets the User-Name attribute via >> ':=', but I still end up with two User-Name attributes >(anonymous >> identity & real identity). This is especially strange, since >> use_tunneled_reply & copy_request_to_tunnel are both enabled as >> well. > > Then it may be a bug. My tests look like they work, so I'm not >sure >what the difference is with your configuration. It worked for me right out of the box at one time, too. I have a feeling it was using either freeradius 1.1.3 or 1.0.3 (or whatever FC2 came pre-packaged with). I'll probably test my configuration against an earlier version later & see if I can establish it as a "bug". The version I've been trying to coerce into working is 1.1.4, which was compiled from source. > >> If I understand correctly, := should replace the anonymous >(first) >> User-Name value with the real (second) value permitting they are >in >> the same session. Upon looking back at the debug output, it >looks >> like >> the tunneled request is actually handled as if it were a >seperate >> request than the one containing it (request->eap module-(unpack)- > >>> new request). > > Yes. > >> This would explain why two User-Name attributes are showing up >in >> the >> final response. > > Not entirely. If you have use_tunneled_reply = yes, AND you're >doing: > >DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 > User-Name := `%{User-Name}` > > Then that name should be copied to the outer tunnel, AND the >outer >tunnel SHOULD NOT add the "anonymous" username in the reply, >because it >sees the User-Name copied from the tunnel. See >src/modules/rlm_eap/*.c I may do this as a last resort. In my experience, code dependent on openssl tends to be ugly & hard to follow/understand. > >> P.S. A link to a list of known-good access points, or personal >> recommendations on access points would also be appreciated. > > See the Wiki. If you have good experiences, add them to the >Wiki. > >> We will be replacing a few 3com APs soon because they don't >> play well with...well...ANYTHING. One (3com OfficeConnect) >> doesn't even have options for radius account, even though >> it advertises the feature right on the box. > > Return them as broken. I planned on it as soon as I get replacements. It doesn't look like 3com even has a bug reporting system of any kind. Well, at least not for customers who don't have a support contract with them, anyway. > > Cisco AP350's seems to be pretty solid. > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html -- Click for free info on adult education and start making $150k/ year http://tagline.hushmail.com/fc/CAaCXv1S62SI4Y7VFkw7r5uPb1smYR4R/

3 3

Re: Freeradius-Users Digest, Vol 23, Issue 90
by Arran Cudbard-Bell 21 Mar '07

21 Mar '07

As always, patches are welcome. :) Yes I'm already putting one together the sql module, honestly who hardcodes sql queries :P No i don't want to select * from nas.. gah Am I right in thinking that for radius to be able to proxy eap successfully, the request_list module would have to be updated to hold information as to which home radius server the session was being handled by. With the sessions id being the unique acct id (which could be recorded at the same time as the eap start message), and then direct future packets to that server for an arbitrary length of time, say as long as the nas's authentication timeout and/or until it detected a accept/reject packet for that authentication session. Or is there some hidden complexity ? -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

2 1

IP Address based proxy forward
by freeradius 21 Mar '07

21 Mar '07

Hello, I’ve added a test line in freeradius 1.1.1 "users" file : TestUser Client-IP-Address == 192.168.1.128/28, Proxy-To-Realm := ServerA proxy.conf contains the realm definition... I’ve restarted the freeradius deamon for the server to take care of the changes. --> when I send a request from a NAC with the IP address 192.168.1.129, it does not work as described in the debug output : modcall[authorize]: module "files" returns notfound for request 34 Does anymone has an idea why it does not work ? Philippe

3 6

PHP issues with PHP 4.3.9 and dialup_admin
by Ethan Dicks 20 Mar '07

20 Mar '07

I've been digging around all day and I've seen other people describe the same symptoms I'm having, but the follow-ups typical asy "Oh, I fixed it", but don't describe the fix. It seems that something resembling my symptoms goes back to the version of dialup_admin that shipped with freeRADIUS 1.0.1, so I am not convinced what I'm seeing is _specifically_ a PHP 4.3 problem, but given the changes with registers_global from 4.1.0 to 4.2.0, I thought it would be prudent to mention that. My setup is... CentOS 4.4.2 (RHEL 4 without the RedHat trademarks and graphics) Apache 2.0.52 PHP 4.3.9 mysql 4.1.20 freeRADIUS 1.1.5 dialup_admin ? (CVS snapshot 20070320) firefox 1.5.0.10 I have freeRADIUS installed and working with users stuffed into a flat file, verified with 'radtest'. I can get the main page of dialup_admin to come up, but I get blank screens and lots of PHP errors logged when I try to invoke nearly any button. My radius database has tables, but no rows, since I was trying to set up dialup_admin to start inserting users and groups. I have set PHP's registers_global to 'on' via /etc/php.ini and verified that it's on with phpinfo(), and I still get dozens of errors per mouse-click... Here's a typical example - the output is generated when clicking on the 'new group' button: a long list of 'undefined constant', 'undefined variable', and 'undefined index' following the warning that there's no prefix on a function call to say what its namespace is. I'm putting the error dump at the bottom to keep it from creating a huge gulf between sections of this query. I know it must look familar because I've found several references to errors that look just like this in the mailing list archives. What's lacking is the solution. Am I just missing a setup step somewhere? Am I running servers and packages that are just too new and untested? Thanks, -ethan [client 127.0.0.1] PHP Notice: import_request_variables(): No prefix specified - possible security hazard in /usr/local/dialup_admin/conf/config.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/dialup_admin/conf/config.php3 on line 66, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: login in /usr/local/dialup_admin/conf/config.php3 on line 73, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: login in /usr/local/dialup_admin/conf/config.php3 on line 76, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_username_mappings_file - assumed 'general_username_mappings_file' in /usr/local/dialup_admin/conf/config.php3 on line 86, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_username_mappings_file - assumed 'general_username_mappings_file' in /usr/local/dialup_admin/conf/config.php3 on line 87, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/dialup_admin/conf/config.php3 on line 100, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/dialup_admin/conf/config.php3 on line 100, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/dialup_admin/conf/config.php3 on line 100, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/dialup_admin/conf/config.php3 on line 100, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/dialup_admin/conf/config.php3 on line 100, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant name - assumed 'name' in /usr/local/dialup_admin/conf/config.php3 on line 100, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/dialup_admin/conf/config.php3 on line 106, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: show in /usr/local/dialup_admin/htdocs/group_new.php3 on line 3, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_lib_type - assumed 'general_lib_type' in /usr/local/dialup_admin/htdocs/group_new.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_user_edit_attrs_file - assumed 'general_user_edit_attrs_file' in /usr/local/dialup_admin/lib/attrshow.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: login in /usr/local/dialup_admin/lib/attrshow.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: http_user in /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant accounting - assumed 'accounting' in /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: mappings in /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: http_user in /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant userdb - assumed 'userdb' in /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: mappings in /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: http_user in /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant nasdb - assumed 'nasdb' in /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: mappings in /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: http_user in /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant nasadmin - assumed 'nasadmin' in /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: mappings in /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/dialup_admin/lib/attrshow.php3 on line 17, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_accounting_attrs_file - assumed 'general_accounting_attrs_file' in /usr/local/dialup_admin/lib/attrshow.php3 on line 23, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_accounting_attrs_file - assumed 'general_accounting_attrs_file' in /usr/local/dialup_admin/lib/attrshow.php3 on line 24, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: login in /usr/local/dialup_admin/lib/attrshow.php3 on line 24, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: http_user in /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant accounting - assumed 'accounting' in /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: mappings in /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: http_user in /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant userdb - assumed 'userdb' in /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: mappings in /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: http_user in /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant nasdb - assumed 'nasdb' in /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: mappings in /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: http_user in /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant nasadmin - assumed 'nasadmin' in /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: mappings in /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: acct_attrs in /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined index: ua in /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined index: num in /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined index: fl in /usr/local/dialup_admin/lib/attrshow.php3 on line 40, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined index: num in /usr/local/dialup_admin/lib/attrshow.php3 on line 40, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined index: uf in /usr/local/dialup_admin/lib/attrshow.php3 on line 36, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined index: num in /usr/local/dialup_admin/lib/attrshow.php3 on line 36, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/dialup_admin/lib/attrshow.php3 on line 44, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/dialup_admin/lib/defaults.php3 on line 18, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Use of undefined constant general_use_session - assumed 'general_use_session' in /usr/local/dialup_admin/lib/sql/attrmap.php3 on line 32, referer: http://localhost/dialup/buttons.php3 [client 127.0.0.1] PHP Notice: Undefined variable: login in /usr/local/dialup_admin/lib/sql/defaults.php3 on line 3, referer: http://localhost/dialup/buttons.php3

1 0

Re: Proxying Eap Requests in round robbin
by Arran Cudbard-Bell 20 Mar '07

20 Mar '07

> Message: 2 > Date: Tue, 20 Mar 2007 12:30:47 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Proxying Eap Requests in round robbin. > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <45FFC5E7.7010801(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Arran Cudbard-Bell wrote: > >> Whats happening if the first round of authentication will go to >> radius1.uscs.susx.ac.uk >> >> Second will go to radius2.uscs.susx.ac.uk, but the second doesn't know >> about the previous request and bails out with. > > Round robin && EAP don't work together very well. > >> So firstly is EAP proxying actually possible ? > > Yes. Many people are using it. Round-robin, on the other hand, isn't > currently possible. It would require additional code in the server. > > It's not hard, but it hasn't been done yet. > >> Secondly is there something really stupid i've missed ? > > Nope. > >> There are two ways I can see this working, either the proxy server >> directs all the authentication rounds for one session to one proxy >> server. Or the eap module on either backend instance figures out what >> the previous part of the conversation was. > > If it's proxying, the EAP module isn't being used. > >> Also I noticed this entry in eap.conf >> >> # A list is maintained to correlate EAP-Response >> # packets with EAP-Request packets. After a >> # configurable length of time, entries in the list >> # expire, and are deleted. >> # >> timer_expire = 60 >> >> Anyone know where this list actually exists ? >> If it's just in memory or an actual file ? > > It's in the EAP module. And it's only used when the server is doing > the EAP authentication. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > Damn, so theres no way to do load balancing with radius packets containing EAP attributes ? Completely different topic, but is it normal for freeRADIUS to authorize the user in each round of authentication ? Can it not cache the credentials from the LDAP / SQL database ? Or is it doing that already transparently? Thankyou very much for your quick response anyway, saved me hours of head scratching. Regards, Arran -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

2 1

pam_radius_auth
by Dan Delaney 20 Mar '07

20 Mar '07

Looking for some help on configuring pam_radius_auth with linux for pop3 and imap services. Anyone have any clues? I currently have my /etc/pam.d/pop3 and imap files showing: auth sufficient /lib/security/pam_radius_auth.so try_first_pass account sufficient /lib/security/pam_radius_auth.so try_first_pass When I authtest -s pop3 user1 password1 it will pass (this is a management account) However if I authtest -s pop3 user2 password2, it fails authentication saying the passwords did not match (when I know they did) Whats even stranger is that when I pass user2 with no password, it passes authentication... I am not using freeradius that I know of (the radius server is on a OpenVMS machine) and this linux box is just a client. Any help would be appreciated Thank you Dan Delaney

1 0

Error while starting radiusd on FreeBSD 6.1
by rickan 20 Mar '07

20 Mar '07

Dear all, I just did a fresh install of freeradius-1.1.5 on a FreeBSD 6.1-RELEASE. Installation was sucessful. Then I tried to start the radiusd with "radiusd -X" and got following error: radiusd in free(): error: chunk is already free ------------------------------------------------------------------------------------- # /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd in free(): error: chunk is already free Abort (core dumped) ---------------------------------------------------------------------------------------- And output of gdb on Core is as follows: ----------------------------------------------------------------------------------------- * 1 LWP 100079 0x282b9363 in kill () from /lib/libc.so.6 Thread 1 (LWP 100079): #0 0x282b9363 in kill () from /lib/libc.so.6 No symbol table info available. #1 0x280941e2 in raise () from /usr/lib/libpthread.so.2 No symbol table info available. #2 0x282b8014 in abort () from /lib/libc.so.6 No symbol table info available. #3 0x2825e4d3 in _UTF8_init () from /lib/libc.so.6 No symbol table info available. #4 0xbfbfee02 in ?? () No symbol table info available. #5 0x282bf4d7 in sys_nsig () from /lib/libc.so.6 No symbol table info available. #6 0x282bf3d7 in sys_nsig () from /lib/libc.so.6 No symbol table info available. #7 0x282bf434 in sys_nsig () from /lib/libc.so.6 No symbol table info available. #8 0x00000000 in ?? () No symbol table info available. #9 0x282c9508 in ?? () from /lib/libc.so.6 No symbol table info available. #10 0xbfbfd548 in ?? () No symbol table info available. #11 0x2825e501 in _UTF8_init () from /lib/libc.so.6 No symbol table info available. #12 0x282c9508 in ?? () from /lib/libc.so.6 No symbol table info available. #13 0x282dbf64 in _nsyyin () from /lib/libc.so.6 No symbol table info available. #14 0xbfbfd5f8 in ?? () No symbol table info available. #15 0x2825f261 in _UTF8_init () from /lib/libc.so.6 No symbol table info available. #16 0x00000017 in ?? () No symbol table info available. #17 0x08130300 in ?? () No symbol table info available. #18 0x280e56e4 in __JCR_LIST__ () from /usr/local/lib/libltdl.so.4 No symbol table info available. #19 0x280e03cb in rpl_argz_next (argz=0x282bf434 "chunk is already free\n", argz_len=135087152, entry=0x0) at ltdl.c:751 No locals. ---------------------------------------------------------------------------------------------------------------------------- What could be the cause of this error and how to resolve it? Many thanks in advance Ricakn

2 2

freeRadius 1.1.5 compile errors - please help
by MWoody 20 Mar '07

20 Mar '07

I am trying to build/compile freeRadius 1.1.5. My Cygwin environment is 1.5.24-2 from www.cygwin.com. freeRadius 1.1.5 from www.freeradius.org. I ran configure for freeRadius with following parameters: ./configure -without-snmp -disable-shared -enable-static -without-rlm_perl. Configure and make outputlogs are attached to this email. configure log http://www.nabble.com/file/7292/config.log config.log make log http://www.nabble.com/file/7293/make.log make.log -- View this message in context: http://www.nabble.com/freeRadius-1.1.5-compile-errors---please-help-tf34343… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Re: EAP-TTLS outer identity & accounting
by Sam Schultz 20 Mar '07

20 Mar '07

After alot of experimenting & researching, I still haven't found a solution to the TTL anonymous outer identity being used for accounting. I have set a DEFAULT entry that sets the User-Name attribute via ':=', but I still end up with two User-Name attributes (anonymous identity & real identity). This is especially strange, since use_tunneled_reply & copy_request_to_tunnel are both enabled as well. If I understand correctly, := should replace the anonymous (first) User-Name value with the real (second) value permitting they are in the same session. Upon looking back at the debug output, it looks like the tunneled request is actually handled as if it were a seperate request than the one containing it (request->eap module-(unpack)- >new request). This would explain why two User-Name attributes are showing up in the final response. Is there any way to discard the first (anonymous) entry via a module or other method without hacking FR code? Surely someone has this working. My setup is just basic TTLS-PAP auth'ing against LDAP. P.S. A link to a list of known-good access points, or personal recommendations on access points would also be appreciated. We will be replacing a few 3com APs soon because they don't play well with...well...ANYTHING. One (3com OfficeConnect) doesn't even have options for radius account, even though it advertises the feature right on the box. -- Click for free info on criminal justice degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S4xqOnm2zOGqjRJ3VXHodSBUi/

3 2

problem with rlm_sql or mysql-server ?
by Mathieu Lemaitre 20 Mar '07

20 Mar '07

Hi everybody, I have a problem with freeradius 1.0.2 and mysql 4.0.24, on a debian stable, used for about 1700 clients. I often have (about 10 times an hour) errors like these: Tue Mar 20 12:21:29 2007 : Auth: Login incorrect: [XXXX/YYYYY] (from client ZZZZ port 0) Tue Mar 20 12:21:40 2007 : Info: rlm_sql (sql): No matching entry in the database for request from user [XXXXX] Tue Mar 20 12:21:40 2007 : Auth: Login incorrect: [XXXXX/YYYYY] (from client ZZZZ port 0) Tue Mar 20 12:22:00 2007 : Info: rlm_sql (sql): No matching entry in the database for request from user [XXXXX] Tue Mar 20 12:22:00 2007 : Auth: Login incorrect: [XXXXX/YYYYY] (from client ZZZZ port 0) Tue Mar 20 12:22:21 2007 : Auth: Login OK: [XXXXX/YYYYY] (from client ZZZZ port 0) whereas, of course, the username exists, and the pass didn't change... is this a problem with the freeradius config, or is the mysqlserver too busy? thanks for your answers, Mathieu

2 1