- Freeradius-Users - lists.freeradius.org

RE: Problem with EAP/MD5 behind proxy
by Josh Howlett 07 Dec '06

07 Dec '06

You're stripping the realm at the proxy; add "nostrip" to the realm stanza defined in realms.conf for the server you're proxying to. Josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. > freeradius.org] On Behalf Of Hans Bornemann > Sent: 07 December 2006 10:57 > To: freeradius-users(a)lists.freeradius.org > Subject: Problem with EAP/MD5 behind proxy > > Hi, > > I run into this problem: > > Config: > > 802.1x client (Windows XP with 802.1x / md5 ) --> freeradius-proxy --> > freeradius-server > > Same prg-version on both server (1.1.0) > same radius.conf > same users file > > if i try to authenticate against the proxy without realm, > everything ist > o.k. > > if i try this with a realm the second radius-server shows this error: > > rlm_eap: Identity does not match User-Name, setting from EAP Identity > rlm_eap: Failed in handler > > > any ideas? > > Hans > > > -- > Hans Bornemann > Universitaet Dortmund - Hochschulrechenzentrum > Tel. ++49 231 755 2132 Fax. ++49 231 755 2731 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 5

Authentication registers on MySQL
by Felipe Neuwald 07 Dec '06

07 Dec '06

Hi Folks, I'm building a new freeradius server here, and I wanna make some implementations: 1. Log every authentication (sucessfull or not) to MySQL database; 2. but, log *only* the last 10 registers of authentication in database. The database connection is already working ok, and I'm retrieving the user information from radcheck table. Does anybody knows how to implement this? Thanks, Felipe Neuwald.

1 0

Error rlm_exec
by Serg Max 07 Dec '06

07 Dec '06

I can't start freeradius 1.1.3_1 on FreeBSD6 radius.log: Error: radiusd.conf[226] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid file format ??? Sergu

2 1

NAS Port always 0
by Tom Murphy 07 Dec '06

07 Dec '06

Hi, I'm using a linux box as the NAS. PPP connections come in and get fed to radiusclient which in turn contacts a FreeRADIUS 1.1.3 server. Some of the PPP connections are dynamic, most are static. I did set up ippool properly in FreeRADIUS, but it dishes out only 2 IP addresses. Doing some searching around, I discovered this is because the Nas-Port is always 0 (as evidenced by the radius log files). So it will only send those two addresses out because it "thinks" the same user is logging on each time? Is there a way to tell the pppd-radius plugin, or, radiusclient to use a different "NAS Port" when it sends the RADIUS authentication requests? The pppd-radius man page says I can use "map-to-ifname" or "map-to-ttyname" (I'm using PPP v2.4.4b1). However, looking at the source code for pppd-radius, in radius.c it appears the NAS Port is hardcoded as zero. Would it then, be up to radiusclient to send the NAS Port? It appears to only have facility for setting NAS Port from the tty, and that's not an option for me. Has anyone else had this similar problem? I need to get FreeRADIUS to actually dish out more than the same 2 IP addresses. Regards, Tom

3 4

Problem with EAP/MD5 behind proxy
by Hans Bornemann 07 Dec '06

07 Dec '06

Hi, I run into this problem: Config: 802.1x client (Windows XP with 802.1x / md5 ) --> freeradius-proxy --> freeradius-server Same prg-version on both server (1.1.0) same radius.conf same users file if i try to authenticate against the proxy without realm, everything ist o.k. if i try this with a realm the second radius-server shows this error: rlm_eap: Identity does not match User-Name, setting from EAP Identity rlm_eap: Failed in handler any ideas? Hans -- Hans Bornemann Universitaet Dortmund - Hochschulrechenzentrum Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

1 0

SQL connections and radius restart
by Guido 07 Dec '06

07 Dec '06

The exactly question is, how could I detect when freeradius loses connection with the SQL and how can I reconnect it automatically. I have been reading "configurable_failover" and "supervise-radiusd.txt", but didn't find a way to do this. Thanks Guido >Guido wrote: > Hi list, I'm using freeradius with Ms-SQL. Freeradius can open > connections as many as are configured in mssql (num_sql_socks = 3). It > is ok, but when SQL go down, or when connection with SQL go down > freeradius can't connect to SQL until freeradius is restarted. So, I > need a way to rstart freeradius when any problem with SQL happens. Send a HUP signal to the server. Alan DeKok.

2 1

FreeRadius 1.1.3 Memory Leak
by Abdul Qadir 07 Dec '06

07 Dec '06

Hi, I just configured radius 1.1.3 and found that there are some memory leaks in it. Here is the output of Valgrind ==30841== ERROR SUMMARY: 4365 errors from 82 contexts (suppressed: 44 from 2) ==30841== malloc/free: in use at exit: 1,354,452 bytes in 25,976 blocks. ==30841== malloc/free: 35,826 allocs, 9,850 frees, 3,185,516 bytes allocated. ==30841== For counts of detected errors, rerun with: -v ==30841== searching for pointers to 25,976 not-freed blocks. ==30841== checked 75,458,816 bytes. ==30841== ==30841== ==30841== 11 bytes in 1 blocks are possibly lost in loss record 12 of 93 ==30841== at 0x43BF53F: malloc (m_replacemalloc/vg_replace_malloc.c:149) ==30841== by 0x441F567: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x44200B1: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x4420CB7: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x4421881: lt_dlopenext (in /usr/lib/libltdl.so.3.1.0) ==30841== by 0x8052C5A: (within /usr/local/sbin/radiusd) ==30841== by 0x8052F66: find_module_instance (in /usr/local/sbin/radiusd) ==30841== by 0x8054564: (within /usr/local/sbin/radiusd) ==30841== by 0x805475B: compile_modsingle (in /usr/local/sbin/radiusd) ==30841== by 0x8053422: (within /usr/local/sbin/radiusd) ==30841== by 0x8053958: setup_modules (in /usr/local/sbin/radiusd) ==30841== by 0x805683D: main (in /usr/local/sbin/radiusd) ==30841== ==30841== ==30841== 97 bytes in 6 blocks are definitely lost in loss record 43 of 93 ==30841== at 0x43BF53F: malloc (m_replacemalloc/vg_replace_malloc.c:149) ==30841== by 0x441F567: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x44200B1: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x4420CB7: (within /usr/lib/libltdl.so.3.1.0) ==30841== by 0x4421881: lt_dlopenext (in /usr/lib/libltdl.so.3.1.0) ==30841== by 0x8052C5A: (within /usr/local/sbin/radiusd) ==30841== by 0x8052F66: find_module_instance (in /usr/local/sbin/radiusd) ==30841== by 0x8054564: (within /usr/local/sbin/radiusd) ==30841== by 0x805475B: compile_modsingle (in /usr/local/sbin/radiusd) ==30841== by 0x8053422: (within /usr/local/sbin/radiusd) ==30841== by 0x8053958: setup_modules (in /usr/local/sbin/radiusd) ==30841== by 0x805683D: main (in /usr/local/sbin/radiusd) ==30841== ==30841== ==30841== 476 bytes in 7 blocks are possibly lost in loss record 68 of 93 ==30841== at 0x43C0C58: calloc (m_replacemalloc/vg_replace_malloc.c:279) ==30841== by 0x8464EA: _dl_allocate_tls (in /lib/ld-2.3.3.so) ==30841== by 0xAB978D: pthread_create@@GLIBC_2.1 (in /lib/tls/libpthread-2.3.3.so) ==30841== by 0x8059A3E: (within /usr/local/sbin/radiusd) ==30841== by 0x8059D20: thread_pool_init (in /usr/local/sbin/radiusd) ==30841== by 0x8056A8B: main (in /usr/local/sbin/radiusd) ==30841== ==30841== LEAK SUMMARY: ==30841== definitely lost: 97 bytes in 6 blocks. ==30841== possibly lost: 487 bytes in 8 blocks. ==30841== still reachable: 1,353,868 bytes in 25,962 blocks. ==30841== suppressed: 0 bytes in 0 blocks. ==30841== Reachable blocks (those to which a pointer was found) are not shown. ==30841== To see them, rerun with: --show-reachable=yes Can any one help me how to fix this.? Best Regards, Abdul Qadir --------------------------------- Need a quick answer? Get one in minutes from people who know. Ask your question on Yahoo! Answers.

1 0

RSA SecurID + FreeRADIUS
by Jeremy M. Guthrie 06 Dec '06

06 Dec '06

I have a system with Suse 10.0 and FreeRADIUS V1.0.4. What I am trying to do is this: 1. ssh to Host-A running FreeRADIUS and PAM talks with pam_securid.so to authenticate to SecurID. This works like a champ. 2. Telnet/ssh into network equipment, said equipment RADIUS authenticates to the Host-A. I'd like to get FreeRADIUS to push the request to resolve the username/password combo via PAM towards pam_securid.so. So far, no go. Why would there be a /etc/pam.d/radiusd if it does not use it? Is the PAM reference in the radiusd.conf only used if Host-A was acting as a client? modules { pap { encryption_scheme = crypt } ... pam { pam_auth = radiusd } .. -- -------------------------------------------------- Jeremy M. Guthrie jeremy.guthrie(a)berbee.com Senior Network Engineer Phone: 608-298-1061 Berbee - A CDW Company Fax: 608-288-3007 5520 Research Park Drive NOC: 608-298-1102 Madison, WI 53711

1 0

FreeRADIUS 1.1.3 configuration issues on Solaris 9 with OpenSSL
by Bob Jones 06 Dec '06

06 Dec '06

Hey all, I apologize if this has been covered before, but I've searched the archives and haven't found anything to seemed to speak to this specific issue. I have a Solaris 9 system with Sun Studio 11. When running the configure script, I'm encoutering an issue I haven't been able to come up with a solution to as of yet, so I was hoping some of you might be able to help. There really seems to be 2 issues. First, we use a third party to provide many of our opensource tools (TheWrittenWord) and these apps and libraries are installed in /opt/TWWfsw instead of your typical /usr/local. So, I set some environment variables: CC=/opt/SUNWspro/bin/cc CXX=/opt/SUNWspro/bin/CC F77=/opt/SUNWspro/bin/f77 CFLAGS=-L/opt/TWWfsw/libgdbm182/lib -R/opt/TWWfsw/libgdbm182/lib And then run configure thusly: ./configure\ --without-rlm_ldap\ --without-rlm_krb5\ --without-rlm_sql\ --with-openssl-includes=/opt/TWWfsw/libopenssl097/include\ --with-openssl-libraries=/opt/TWWfsw/libopenssl097/lib Those are the correct paths to the openssl libraries and includes (the includes are in the openssl subdirectory of /opt/TWWfsw/libopenssl097/include. However, the configure script doesn't seem to locate them... I get the following pertinent openssl messages from configure: configure: WARNING: skipping test for openssl/ssl.h And later with the modules messages like: configure: WARNING: silently not building rlm_eap_tls. configure: WARNING: FAILURE: rlm_eap_tls requires: OpenSSL. configure: WARNING: silently not building rlm_eap_ttls. configure: WARNING: FAILURE: rlm_eap_ttls requires: OpenSSL. configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-includes openssl-includes openssl-includes openssl-includes openssl-includes. All normal considering it failed it's openssl check. But why did it fail the check when I used the --with-openssl-libraries flag to configure? Now, even more confusing is if I set the library locations in CFLAGS thusly: CFLAGS=-L/opt/TWWfsw/libopenssl097/lib -R/opt/TWWfsw/libopenssl097/lib -L/opt/TWWfsw/libgdbm182/lib -R/opt/TWWfsw/libgdm182/lib And run the configure exactly as above, things change. Now it finds the openssl pieces: checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking openssl/ssl.h usability... yes checking openssl/ssl.h presence... yes checking for openssl/ssl.h... yes checking openssl/crypto.h usability... yes checking openssl/crypto.h presence... yes checking for openssl/crypto.h... yes checking openssl/err.h usability... yes checking openssl/err.h presence... yes checking for openssl/err.h... yes checking openssl/engine.h usability... yes checking openssl/engine.h presence... yes checking for openssl/engine.h... yes checking for OpenSSL version >= 0.9.7... yes And the configure output for rlm_eap_tls and others that require OpenSSL are fine, *except* for rlm_otp which still looks like: configure: configuring in src/modules/rlm_otp configure: running /bin/bash './configure' --prefix=/usr/local '--without-rlm_ldap' '--without-rlm_krb5' '--without-rlm_sql' '--without-snmp' '--with-openssl-includes=/opt/TWWfsw/libopenssl097/include' '--with-openssl-libraries=/opt/TWWfsw/libopenssl097/lib' '--with-rlm-perl-includes-dir=/opt/TWWfsw/perl586/lib/5.8.6/sun4-solaris-thread-multi/CORE' 'CC=/opt/SUNWspro/bin/cc' 'CFLAGS=-L/opt/TWWfsw/libopenssl097/lib -R/opt/TWWfsw/libopenssl097/lib -L/opt/TWWfsw/libgdbm182/lib -R/opt/TWWfsw/libgdm182/lib' 'CXX=/opt/SUNWspro/bin/CC' 'F77=/opt/SUNWspro/bin/f77' 'LDFLAGS=' --enable-ltdl-install --cache-file=/dev/null --srcdir=. checking for gcc... /opt/SUNWspro/bin/cc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... no checking whether /opt/SUNWspro/bin/cc accepts -g... yes checking for /opt/SUNWspro/bin/cc option to accept ANSI C... none needed checking how to run the C preprocessor... /opt/SUNWspro/bin/cc -E checking for egrep... egrep checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... no checking for unistd.h... yes checking for inttypes.h... (cached) yes checking for SSL_new in -lssl... yes checking openssl/des.h usability... no checking openssl/des.h presence... no checking for openssl/des.h... no checking openssl/hmac.h usability... no checking openssl/hmac.h presence... no checking for openssl/hmac.h... no checking openssl/md4.h usability... no checking openssl/md4.h presence... no checking for openssl/md4.h... no checking openssl/md5.h usability... no checking openssl/md5.h presence... no checking for openssl/md5.h... no checking openssl/sha.h usability... no checking openssl/sha.h presence... no checking for openssl/sha.h... no configure: WARNING: silently not building rlm_otp. configure: WARNING: FAILURE: rlm_otp requires: openssl-includes openssl-includes openssl-includes openssl-includes openssl-includes. configure: creating ./config.status config.status: creating Makefile I've checked though and all those .h files are there with the same permissions as the others, so I would expect it to find the presence even if it didn't find them usable (which I wouldn't know why that would be true either). Any ideas? I'm at a real loss here. -- Thanks in advance, Bob Jones bob.jones(a)usg.edu

2 4

redefine radius attribute set
by pc286＠bk.ru 06 Dec '06

06 Dec '06

Hello, all! i want redefine DEFAULT set of Simultaneous-use DEFAULT NAS-Port-Type == Virtual, Simultaneous-Use := 1 Fall-Through = 1 that for all users, but for someone need "Simultaneous-Use := 2" if add "Simultaneous-Use := 2" to specific user entry, this not work. i found for gnu radius manual: = Additivity = Replace ^(*) dictionary file: ATTRIBUTE Service-Type 6 integer - [LR-RLR]=P ^(*) -- pc286 mailto:pc286@bk.ru

2 1