- Freeradius-Users - lists.freeradius.org

login to domain with EAP-TLS
by kemas 07 Mar '07

07 Mar '07

hi everyone, how to make XP make connection to the ap so it can logon to the samba pdc? it seems that xp make wireless connection after a user login to the box if using eap-tls. is there a way to solve this? I read about something using machine auth or machine certificate. thanks

1 0

IP based Proxy routing problem
by freeradius 06 Mar '07

06 Mar '07

Good Evening, I’m actually using the realm based proxy routing and trying to configure a NAS IP Address based proxy routing. *_Main Problem :_* 1/ I’ve moved the line “files” before the line “suffix” in the radiusd.conf file to force the radius server to check the files before the realm usage in the login. Did I do it right ? 2/ I’ve added a test line : TestUser Client-IP-Address == 192.168.1.128/28, Proxy-To-Realm := ServerA I’ve restarted the freeradius deamon for the server to take care of the changes. --> It _does not work_ as described in the debug output : modcall[authorize]: module "files" returns notfound for request 34 3/ I’ve changed the test line to : TestUser Client-IP-Address == 192.168.1.129, Proxy-To-Realm := ServerA I’ve restarted the freeradius deamon for the server to take care of the changes. --> It _does work_ as described in the debug output : users: Matched entry TestUser at line 19 modcall[authorize]: module "files" returns ok for request 4 Could you give to me a good advise to help me ? *_Other Question : _* Do I need the same configuration in the “users”, “acct_users” and “preproxy_users” files ? Sincerely, Philippe

1 0

radiusd is doing a fasttop
by Robert Ford 06 Mar '07

06 Mar '07

I can not get radiusd to start. Here is the output from the debug: radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 10.16.93.77 IP address [10.16.93.77] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib *** glibc detected *** radiusd: double free or corruption (fasttop): 0x09bf70d0 *** ======= Backtrace: ========= /lib/libc.so.6[0x3251e0] /lib/libc.so.6(__libc_free+0x77)[0x32572b] /usr/local/lib/libltdl.so.3[0x984a58] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xc3)[0x98552f] radiusd(find_module_instance+0x1bd)[0x49d001] radiusd(setup_modules+0x1c0)[0x49d7fc] radiusd(main+0x3b0)[0x4a0850] /lib/libc.so.6(__libc_start_main+0xdf)[0x2d6d7f] radiusd[0x495cad] ======= Memory map: ======== 00110000-00111000 r-xp 00110000 00:00 0 [vdso] 00111000-0012b000 r-xp 00000000 fd:00 1785864 /lib/ld-2.3.6.so 0012b000-0012c000 r-xp 00019000 fd:00 1785864 /lib/ld-2.3.6.so 0012c000-0012d000 rwxp 0001a000 fd:00 1785864 /lib/ld- 2.3.6.so 0012d000-00140000 r-xp 00000000 fd:00 49371 /usr/local/lib/libradius- 1.1.5.so 00140000-00141000 rwxp 00013000 fd:00 49371 /usr/local/lib/libradius- 1.1.5.so 00141000-00142000 rwxp 00141000 00:00 0 00142000-00144000 r-xp 00000000 fd:00 1785879 /lib/libcom_err.so.2.1 00144000-00145000 rwxp 00001000 fd:00 1785879 /lib/libcom_err.so.2.1 00145000-00157000 r-xp 00000000 fd:00 774534 /usr/lib/libz.so.1.2.2.2 00157000-00158000 rwxp 00011000 fd:00 774534 /usr/lib/libz.so.1.2.2.2 00158000-0015a000 r-xp 00000000 fd:00 774879 /usr/lib/libkrb5support.so.0.0 0015a000-0015b000 rwxp 00001000 fd:00 774879 /usr/lib/libkrb5support.so.0.0 0015b000-0015f000 r-xp 00000000 fd:00 1786215 /lib/libnss_dns-2.3.6.so 0015f000-00160000 r-xp 00003000 fd:00 1786215 /lib/libnss_dns- 2.3.6.so 00160000-00161000 rwxp 00004000 fd:00 1786215 /lib/libnss_dns-2.3.6.so 00161000-00163000 r-xp 00000000 fd:00 49436 /usr/local/lib/rlm_exec- 1.1.5.so 00163000-00164000 rwxp 00001000 fd:00 49436 /usr/local/lib/rlm_exec- 1.1.5.so 00165000-00176000 r-xp 00000000 fd:00 1785875 /lib/libnsl- 2.3.6.so 00176000-00177000 r-xp 00010000 fd:00 1785875 /lib/libnsl-2.3.6.so 00177000-00178000 rwxp 00011000 fd:00 1785875 /lib/libnsl-2.3.6.so 00178000-0017a000 rwxp 00178000 00:00 0 0017a000-00272000 r-xp 00000000 fd:00 1785880 /lib/libcrypto.so.0.9.7f 00272000-00284000 rwxp 000f8000 fd:00 1785880 /lib/libcrypto.so.0.9.7f 00284000-00287000 rwxp 00284000 00:00 0 0028a000-002bf000 r-xp 00000000 fd:00 1785881 /lib/libssl.so.0.9.7f 002bf000-002c2000 rwxp 00035000 fd:00 1785881 /lib/libssl.so.0.9.7f 002c2000-003e5000 r-xp 00000000 fd:00 1785865 /lib/libc- 2.3.6.so 003e5000-003e7000 r-xp 00122000 fd:00 1785865 /lib/libc-2.3.6.so 003e7000-003e9000 rwxp 00124000 fd:00 1785865 /lib/libc-2.3.6.so 003e9000-003eb000 rwxp 003e9000 00:00 0 003eb000-0045a000 r-xp 00000000 fd:00 774917 /usr/lib/libkrb5.so.3.2 0045a000-0045d000 rwxp 0006e000 fd:00 774917 /usr/lib/libkrb5.so.3.2 0045d000-00480000 r-xp 00000000 fd:00 774886 /usr/lib/libk5crypto.so.3.0 00480000-00481000 rwxp 00023000 fd:00 774886 /usr/lib/libk5crypto.so.3.0 00481000-0048a000 r-xp 00000000 fd:00 1785871 /lib/libgcc_s- 4.0.2-20051126.so.1 0048a000-0048b000 rwxp 00009000 fd:00 1785871 /lib/libgcc_s- 4.0.2-20051126.so.1 00491000-004ad000 r-xp 00000000 fd:00 81931 /usr/local/sbin/radiusd 004ad000-004ae000 rwxp 0001c000 fd:00 81931 /usr/local/sbin/radiusd 004ae000-004af000 rwxp 004ae000 00:00 0 00636000-0064d000 r-xp 00000000 fd:00 774919 /usr/lib/libgssapi_krb5.so.2.2 0064d000-0064e000 rwxp 00017000 fd:00 774919 /usr/lib/libgssapi_krb5.so.2.2 0079e000-007a7000 r-xp 00000000 fd:00 1786231 /lib/libnss_files-2.3.6.so 007a7000-007a8000 r-xp 00008000 fd:00 1786231 /lib/libnss_files- 2.3.6.so 007a8000-007a9000 rwxp 00009000 fd:00 1786231 /lib/libnss_files-2.3.6.so 0089c000-0089e000 r-xp 00000000 fd:00 1785868 /lib/libdl- 2.3.6.so 0089e000-0089f000 r-xp 00001000 fd:00 1785868 /lib/libdl-2.3.6.so 0089f000-008a0000 rwxp 00002000 fd:00 1785868 /lib/libdl-2.3.6.so 00982000-00987000 r-xp 00000000 fd:00 781058 /usr/local/lib/libltdl.so.3.1.4 00987000-00988000 rwxp 00004000 fd:00 781058 Aborted [root@sta8-lx freeradius-1.1.5]# [root@sta8-lx freeradius-1.1.5]# [root@sta8-lx freeradius-1.1.5]# cls -bash: cls: command not found [root@sta8-lx freeradius-1.1.5 ]# clear [root@sta8-lx freeradius-1.1.5]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 10.16.93.77 IP address [10.16.93.77] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib *** glibc detected *** radiusd: double free or corruption (fasttop): 0x098ff0d0 *** ======= Backtrace: ========= /lib/libc.so.6[0x6641e0] /lib/libc.so.6(__libc_free+0x77)[0x66472b] /usr/local/lib/libltdl.so.3[0x40aa58] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xc3)[0x40b52f] radiusd(find_module_instance+0x1bd)[0x5ef001] radiusd(setup_modules+0x1c0)[0x5ef7fc] radiusd(main+0x3b0)[0x5f2850] /lib/libc.so.6(__libc_start_main+0xdf)[0x615d7f] radiusd[0x5e7cad] ======= Memory map: ======== 00110000-00111000 r-xp 00110000 00:00 0 [vdso] 00111000-0012b000 r-xp 00000000 fd:00 1785864 /lib/ld-2.3.6.so 0012b000-0012c000 r-xp 00019000 fd:00 1785864 /lib/ld-2.3.6.so 0012c000-0012d000 rwxp 0001a000 fd:00 1785864 /lib/ld- 2.3.6.so 0012d000-00144000 r-xp 00000000 fd:00 774919 /usr/lib/libgssapi_krb5.so.2.2 00144000-00145000 rwxp 00017000 fd:00 774919 /usr/lib/libgssapi_krb5.so.2.2 00145000-001b4000 r-xp 00000000 fd:00 774917 /usr/lib/libkrb5.so.3.2 001b4000-001b7000 rwxp 0006e000 fd:00 774917 /usr/lib/libkrb5.so.3.2 001b7000-001b9000 r-xp 00000000 fd:00 1785879 /lib/libcom_err.so.2.1 001b9000-001ba000 rwxp 00001000 fd:00 1785879 /lib/libcom_err.so.2.1 001ba000-001cc000 r-xp 00000000 fd:00 774534 /usr/lib/libz.so.1.2.2.2 001cc000-001cd000 rwxp 00011000 fd:00 774534 /usr/lib/libz.so.1.2.2.2 001cd000-001cf000 r-xp 00000000 fd:00 774879 /usr/lib/libkrb5support.so.0.0 001cf000-001d0000 rwxp 00001000 fd:00 774879 /usr/lib/libkrb5support.so.0.0 001d0000-001d4000 r-xp 00000000 fd:00 1786215 /lib/libnss_dns-2.3.6.so 001d4000-001d5000 r-xp 00003000 fd:00 1786215 /lib/libnss_dns- 2.3.6.so 001d5000-001d6000 rwxp 00004000 fd:00 1786215 /lib/libnss_dns-2.3.6.so 001d6000-001df000 r-xp 00000000 fd:00 1786231 /lib/libnss_files- 2.3.6.so 001df000-001e0000 r-xp 00008000 fd:00 1786231 /lib/libnss_files-2.3.6.so 001e0000-001e1000 rwxp 00009000 fd:00 1786231 /lib/libnss_files-2.3.6.so 001e1000-001ea000 r-xp 00000000 fd:00 1785871 /lib/libgcc_s- 4.0.2-20051126.so.1 001ea000-001eb000 rwxp 00009000 fd:00 1785871 /lib/libgcc_s- 4.0.2-20051126.so.1 00230000-00243000 r-xp 00000000 fd:00 49371 /usr/local/lib/libradius- 1.1.5.so 00243000-00244000 rwxp 00013000 fd:00 49371 /usr/local/lib/libradius- 1.1.5.so 00244000-00245000 rwxp 00244000 00:00 0 0024c000-0024e000 r-xp 00000000 fd:00 1785868 /lib/libdl- 2.3.6.so 0024e000-0024f000 r-xp 00001000 fd:00 1785868 /lib/libdl-2.3.6.so 0024f000-00250000 rwxp 00002000 fd:00 1785868 /lib/libdl- 2.3.6.so 0033f000-00374000 r-xp 00000000 fd:00 1785881 /lib/libssl.so.0.9.7f 00374000-00377000 rwxp 00035000 fd:00 1785881 /lib/libssl.so.0.9.7f 00408000-0040d000 r-xp 00000000 fd:00 781058 /usr/local/lib/libltdl.so.3.1.4 0040d000-0040e000 rwxp 00004000 fd:00 781058 /usr/local/lib/libltdl.so.3.1.4 0048d000-0049c000 r-xp 00000000 fd:00 1785878 /lib/libresolv-2.3.6.so 0049c000-0049d000 r-xp 0000e000 fd:00 1785878 /lib/libresolv- 2.3.6.so 0049d000-0049e000 rwxp 0000f000 fd:00 1785878 /lib/libresolv-2.3.6.so 0049e000-004a0000 rwxp 0049e000 00:00 0 004d9000-004ea000 r-xp 00000000 fd:00 1785875 /lib/libnsl- 2.3.6.so 004ea000-004eb000 r-xp 00010000 fd:00 1785875 /lib/libnsl-2.3.6.so 004eb000-004ec000 rwxp 00011000 fd:00 1785875 /lib/libnsl- 2.3.6.so 004ec000-004ee000 rwxp 004ec000 00:00 0 005e3000-005ff000 r-xp 00000000 fd:00 81931 /usr/local/sbin/radiusd 005ff000-00600000 rwxp 0001c000 fd:00 81931 /usr/local/sbin/radiusd 00600000-00601000 rwxp 00600000 00:00 0 00601000-00724000 r-xp 00000000 fd:00 1785865 /lib/libc-2.3.6.so 00724000-00726000 r-xp 00122000 fd:00 1785865 /lib/libc-2.3.6.so 00726000-00728000 rwxp 00124000 fd:00 1785865 /lib/libc- 2.3.6.so 00728000-0072a000 rwxp 00728000 00:00 0 0080a000-0080c000 r-xp 00000000 fd:00 49436 /usr/local/lib/rlm_exec- 1.1.5.so 0080c000-0080d000 rwxp 00001000 fd:00 49436 /usr/local/lib/rlm_exec- 1.1.5.so 00936000-0093b000 r-xp 00000000 fd:00 1785889 /lib/libcrypt-2.3.6.so 0093b000-0093c000 r-xAborted Any Help would be greatly appreciated.

1 0

ldap passwords?
by Tim Tyler 06 Mar '07

06 Mar '07

Freeradius experts, I am trying to configure freeradius to use openldap as a backend for authentication, but I can't seem to get the passwords to authenticate. It seems to have no problem binding and finding the username (uid). I am using crypt passwords in the ldap userPassword field: userPassword:: e1NTSEF9aXBWQklEYnZYSU9RdWl2V0ZtdGR5MWxIWFFsZWVCMjQ= I am not using any radius attributes. I simply want to allow any uid to authenticate. I get these results: rad_recv: Access-Request packet from host 144.89.40.8:59881, id=60, length=59 User-Name = "tylertj" User-Password = "xxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rlm_ldap: - authorize rlm_ldap: performing user authorization for tylertj rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to ldap.beloit.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer rlm_ldap: starting TLS rlm_ldap: bind as / to ldap.beloit.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user tylertj authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rad_recv: Access-Request packet from host 144.89.40.8:59881, id=60, length=59 Sending Access-Reject of id 60 to 144.89.40.8:59881 What might I be doing wrong? I presume that the ldap server doesn't have to store the passwords in plain text, correct? I can store them in md5 or SHA1 hash if I want, correct? I did uncomment: authenticate { Auth-Type LDAP { ldap } Am I wrong to think this is now a password issue? Tim Tim Tyler Network Engineer - Beloit College tyler(a)beloit.edu

2 3

rlm_sqlcounter in precompiled binarys? Problem in compiling.
by Jan Lausch 06 Mar '07

06 Mar '07

Hi there, I am just trying to get freeradius up and running to authenticate a chillispot. Thus I will need the sqlcounter module. I found a small number of postings covering this issue and they all indicate I would have to compile freeradius manually as this module is still experimental. On the other hand, all these postings and howtos seem to be about two years old. So my question is: - Is sqlcounter still experimental or is it yet included in the standard binarys (debian repository)? Because I'm kind of having problems in compiling it myself and can't quite figure out what this errors are all about: > make [...] gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/root/freeradius-1.1.5/src/include -I/root/freeradius-1.1.5/src/modules/rlm_sql -c rlm_sqlippool.c -fPIC -DPIC -o .libs/rlm_sqlippool.o In file included from rlm_sqlippool.c:37: /root/freeradius-1.1.5/src/include/modpriv.h:7:18: ltdl.h: No such file or directory In file included from rlm_sqlippool.c:37: /root/freeradius-1.1.5/src/include/modpriv.h:16: error: syntax error before "lt_dlhandle" /root/freeradius-1.1.5/src/include/modpriv.h:16: warning: no semicolon at end of struct or union /root/freeradius-1.1.5/src/include/modpriv.h:17: warning: type defaults to `int' in declaration of `module_list_t' /root/freeradius-1.1.5/src/include/modpriv.h:17: warning: data definition has no type or storage class /root/freeradius-1.1.5/src/include/modpriv.h:27: error: syntax error before "module_list_t" /root/freeradius-1.1.5/src/include/modpriv.h:27: warning: no semicolon at end of struct or union /root/freeradius-1.1.5/src/include/modpriv.h:32: error: syntax error before '}' token /root/freeradius-1.1.5/src/include/modpriv.h:32: warning: type defaults to `int' in declaration of `module_instance_t' /root/freeradius-1.1.5/src/include/modpriv.h:32: warning: data definition has no type or storage class /root/freeradius-1.1.5/src/include/modpriv.h:34: error: syntax error before '*' token /root/freeradius-1.1.5/src/include/modpriv.h:34: warning: type defaults to `int' in declaration of `find_module_instance' /root/freeradius-1.1.5/src/include/modpriv.h:34: warning: data definition has no type or storage class In file included from rlm_sqlippool.c:39: /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:15:25: ltdl.h: No such file or directory In file included from rlm_sqlippool.c:39: /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:68: error: syntax error before "lt_dlhandle" /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:68: warning: no semicolon at end of struct or union /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:70: error: syntax error before '}' token /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:70: warning: type defaults to `int' in declaration of `SQL_INST' /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:70: warning: data definition has no type or storage class /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:73: error: syntax error before '*' token /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:74: error: syntax error before '*' token /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:75: error: syntax error before '*' token /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:76: error: syntax error before '*' token /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:77: error: syntax error before '*' token /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:80: error: syntax error before '*' token /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:84: error: syntax error before "SQL_INST" /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:85: error: syntax error before "SQL_INST" /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:86: error: syntax error before "SQL_INST" /root/freeradius-1.1.5/src/modules/rlm_sql/rlm_sql.h:87: error: syntax error before "SQL_INST" rlm_sqlippool.c:53: error: syntax error before "SQL_INST" rlm_sqlippool.c:53: warning: no semicolon at end of struct or union rlm_sqlippool.c:105: error: syntax error before '}' token rlm_sqlippool.c:105: warning: type defaults to `int' in declaration of `rlm_sqlippool_t' rlm_sqlippool.c:105: warning: data definition has no type or storage class rlm_sqlippool.c:128: error: syntax error before ')' token rlm_sqlippool.c:128: error: initializer element is not constant rlm_sqlippool.c:128: error: (near initialization for `module_config[0].offset') rlm_sqlippool.c:128: error: initializer element is not constant rlm_sqlippool.c:128: error: (near initialization for `module_config[0]') rlm_sqlippool.c:130: error: syntax error before ')' token rlm_sqlippool.c:130: error: initializer element is not constant rlm_sqlippool.c:130: error: (near initialization for `module_config[1].offset') rlm_sqlippool.c:130: error: initializer element is not constant rlm_sqlippool.c:130: error: (near initialization for `module_config[1]') rlm_sqlippool.c:132: error: syntax error before ')' token rlm_sqlippool.c:132: error: initializer element is not constant rlm_sqlippool.c:132: error: (near initialization for `module_config[2].offset') [going on like this for much more] make[6]: *** [rlm_sqlippool.lo] Error 1 make[6]: Leaving directory `/root/freeradius-1.1.5/src/modules/rlm_sqlippool' make[5]: *** [common] Error 2 make[5]: Leaving directory `/root/freeradius-1.1.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/freeradius-1.1.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/root/freeradius-1.1.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/freeradius-1.1.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/root/freeradius-1.1.5' make: *** [all] Error 2 Could someone help here, please? This is a sarge installation with mysql5. Thanks in advance, Jan

1 1

freeradius ldap connector
by jerrrry＠voila.fr 06 Mar '07

06 Mar '07

Hello, I use freeradius 1.0.1 LDAP connector to request a LDAP directory. I notice that Freeradius tries 6 times to find a user in my LDAP directory when this user doesn't existe. Is there a mean to make freeradius tries only one time ? Thanks Thomas

4 5

Re: freeradius ldap connector
by jerrrry＠voila.fr 06 Mar '07

06 Mar '07

you can see the debug. there are 7 searches for an uid that doesn't exist in the ldap directory: rlm_ldap: - authorize rlm_ldap: performing user authorization for X06dfdgdg radius_xlat: '(uid=X06dfdgdg)' radius_xlat: 'ou=PERSONNES,o=sg' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldaps://ldap-homo.sesme.group.scen, authentication 0 rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cat-caconcerto-sogepa ss.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as sgzoneid=guards,ou=eloit,ou=personnes,o=sg/ghkhkk to ldaps: //ldap-homo.sesame.group.socgen rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=PERSONNES,o=sg, with filter (uid=X06dfdgdg) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=PERSONNES,o=sg' radius_xlat: '(uid=X06dfdgdg)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=PERSONNES,o=sg, with filter (uid=X06dfdgdg) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=PERSONNES,o=sg' radius_xlat: '(uid=X06dfdgdg)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=PERSONNES,o=sg, with filter (uid=X06dfdgdg) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=PERSONNES,o=sg' radius_xlat: '(uid=X06dfdgdg)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=PERSONNES,o=sg, with filter (uid=X06dfdgdg) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 116 modcall[authorize]: module "files" returns ok for request 0 modcall: group group returns ok for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=PERSONNES,o=sg' radius_xlat: '(uid=X06dfdgdg)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=PERSONNES,o=sg, with filter (uid=X06dfdgdg) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=PERSONNES,o=sg' radius_xlat: '(uid=X06dfdgdg)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=PERSONNES,o=sg, with filter (uid=X06dfdgdg) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=PERSONNES,o=sg' radius_xlat: '(uid=X06dfdgdg)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=PERSONNES,o=sg, with filter (uid=X06dfdgdg) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 116 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [X06dfdgdg] (from client sdfsfds por t 1 cli 192.18.136.19) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 165 to 192.18.136.44:1812 Reply-Message = "forbidden." Waking up in 4 seconds... > Message du 06/03/07 à 11h58 > De : "Michael Mitchell" > A : "FreeRadius users mailing list" > Copie à : > Objet : Re: freeradius ldap connector > > jerrrry(a)voila.fr wrote: > > I notice that Freeradius tries 6 times to find a user in my LDAP > > directory when this user doesn't existe. > > > > err, really? During authorisation (where a search is performed by a priviledged user) or during authentication (where an attempt may be made to bind to LDAP as the customer)? > > What does the debug say? (run radiusd with the -X flag). > > > > Is there a mean to make freeradius tries only one time ? > > It only tries once for me, but I only do LDAP "authorisation". > > regards, > Mike > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

Authentication Process/Flowchart
by Walt Reynolds 06 Mar '07

06 Mar '07

I have searched, but did not find what I was looking for, so trying to do my own flowchart of the process. Below is a written up flow that I want to try and convert to a graphical one. Can I please get some feedback on if this is not only the way it really works, but also if it is accurate. If someone has something like this I would be very grateful if you would pass it along to me. Just remember plagiarisms is the greatest form of flattery (I would give you credit either way if you wanted) Thanks. ======================================== 1. Request comes in (example) User-Name = "Guest2(a)location.com" User-Password = "Password" NAS-IP-Address = 192.168.224.36 Service-Type = Login-User Framed-IP-Address = 198.168.225.72 Called-Station-Id = "00:07:E9:D1:8F:C2" Calling-Station-Id = "00:40:96:a7:00:14" NAS-Identifier = "box.lab" Acct-Session-Id = "00:07:E9:D1:8F:C2:117165661771" NAS-Port-Type = Wireless-802.11 2. Looks in the authorize section of radius.conf ## authorize actually means is this request authorized to authenticate ##(does it match rules) preprocess ##This looks a the following files to add/coorelate ##the request to rules defined in later modules. huntgroups ##Matches based on NAS hints ##Matches on user auth_log ##This defines where the log will be suffix ##Defined as deliminater for proxying realms ## Finds realm (if listed, if so will be used ##starting in preproxy_users eap ##Set to define and perform EAP authentication (if in ##request) files ## Looks at the following files: users ##Used to decide how to AuthZ and AuthN ##users. Check items, if matched will ##add reply info to NAS ##if no specific match, will match ##DEFAULT ##User could move to acct_users ##Same as users file but for accounting. !!!***!!!If there is no realm defined at this part, it will preproxy_users ##Matches like users, but reply items ##added to proxied request to new NAS pre_proxy_log ##Allows you to log the pre-proxied ##request 3. Sent proxy request to radius server listed in proxy.conf if it did find a realm match (based on suffix/px.... 4. Receives reply a. Looks at post_proxy post_proxy_log ##Logs post proxy info if enabled attr_filter ##Allows you to filter what the proxied ##server sends back to NAS 5. Sends Accept/Deny to NAS (with all attributes added or filtered) 6. Accounting ---- -- Walt Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 2

Re: Freeradius-Users Digest, Vol 23, Issue 13
by Arran Cudbard-Bell 06 Mar '07

06 Mar '07

> Dana 5/3/2007, "Tim Tyler" <tyler(a)beloit.edu> pi?e: > >> Freeradius experts, >> I am trying to configure freeradius to use openldap as a backend >> for authentication, but I can't seem to get the passwords to >> authenticate. It seems to have no problem binding and finding the >> username (uid). I am using crypt passwords in the ldap userPassword field: >> userPassword:: e1NTSEF9aXBWQklEYnZYSU9RdWl2V0ZtdGR5MWxIWFFsZWVCMjQ= >> >> I am not using any radius attributes. I simply want to allow any >> uid to authenticate. I get these results: >> >> rad_recv: Access-Request packet from host 144.89.40.8:59881, id=60, length=59 >> User-Name = "tylertj" >> User-Password = "xxxxxx" >> NAS-IP-Address = 255.255.255.255 >> NAS-Port = 1812 >> rlm_ldap: - authorize >> rlm_ldap: performing user authorization for tylertj >> rlm_ldap: ldap_get_conn: Checking Id: 0 >> rlm_ldap: ldap_get_conn: Got Id: 0 >> rlm_ldap: (re)connect to ldap.beloit.edu:389, authentication 0 >> rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer >> rlm_ldap: starting TLS >> rlm_ldap: bind as / to ldap.beloit.edu:389 >> rlm_ldap: waiting for bind result ... >> rlm_ldap: Bind was successful >> rlm_ldap: looking for check items in directory... >> rlm_ldap: looking for reply items in directory... >> rlm_ldap: user tylertj authorized to use remote access >> rlm_ldap: ldap_release_conn: Release Id: 0 >> rad_recv: Access-Request packet from host 144.89.40.8:59881, id=60, length=59 >> Sending Access-Reject of id 60 to 144.89.40.8:59881 >> >> >> What might I be doing wrong? I presume that the ldap server >> doesn't have to store the passwords in plain text, correct? I can >> store them in md5 or SHA1 hash if I want, correct? I did uncomment: >> >> authenticate { >> Auth-Type LDAP { >> ldap >> } >> >> Am I wrong to think this is now a password issue? >> Tim >> >> >> >> >> >> Tim Tyler >> Network Engineer - Beloit College >> tyler(a)beloit.edu >> You need to prefix your crypt password with {crypt}, else LDAP won't know which hashing scheme your using, and when you attempt a v3 bind it'll treat your crypted password as plaintext. Also, in order to use crypted password you'll need a authentication mechanism that supports reversible encryption, like PAP or GTC. -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Unversity of Sussex | Infrastructure Services ++441273873900/ext:3900

1 0

Some problem
by zhangxianshi 06 Mar '07

06 Mar '07

Dear All, I use a Linux system called Ubuntu. Yesterday I tried to complier the freeradius 1.1.4. When I begun to make, there is something wrong. This is the error log: Making all in rlm_passwd... make[6]: Entering directory `/home/stone/freeradius-1.1.4/src/modules/rlm_passwd' make[6]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules/rlm_passwd' Making all in rlm_perl... make[6]: Entering directory `/home/stone/freeradius-1.1.4/src/modules/rlm_perl' /home/stone/freeradius-1.1.4/libtool --mode=link gcc -release 1.1.4 \ -module -export-dynamic -o rlm_perl.la \ -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /home/stone/freeradius-1.1.4/src/lib/libradius.la \ `perl -MExtUtils::Embed -e ldopts` -lnsl -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/stone/freeradius-1.1.4/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /home/stone/freeradius-1.1.4/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.1.4.so -o .libs/rlm_perl-1.1.4.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/stone/freeradius-1.1.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/stone/freeradius-1.1.4/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/stone/freeradius-1.1.4' make: *** [all] Error 2 How can I slove it? Regards Zhang

4 4