- Freeradius-Users - lists.freeradius.org

Problem cheking multivalued attributes in LDAP schemas.
by Erling Paulsen 05 Dec '06

05 Dec '06

I try to make a decision based on checking for a value in a certain attribute of a LDAP schema. The problem is that this is a multivalued attribute, and it seems somewhat undefined when I try to check against it! My exact problem is checking against a "eduPerson" schema for an affiliation on an attribute called "eduPersonAffiliation" (which is multivalued). I want to check if a certain user has the right affiliation=xxxx before assigning a dynamic Vlan. I fetch the attribute in Authorization as "LDAP-Affiliation" (mapped as a checkItem in ldap.attrmap). I've tried checking with the regular expression operator (i.e. for "staff" affiliation), but it seems to not give a match. Ex. check-statement from users file: LDAP-Affiliation :~ .*staff.* In the LDAP-backend the "eduPersonAffiliation" is shown as containing: eduPersonAffiliation: employee staff member Is this a common problem in checking against multivalued attributes, or is there a way around it? Any feedback would be appreciated! - Erling Paulsen

3 4

Problem authenticating with Checkpoint Integrity.
by Ian Walker 05 Dec '06

05 Dec '06

I'm attempting 802.1x authentication with Checkpoint Integrity. I have it working with peap no problems and usings mschapv2. However, when I attempt with Integrity, I have to choose "Zone Labs Cooperative Enforcement" within the Windows 802.1x authentication options. I've then chosen peap/mschapv2 here, but an additional setting is eap-type "44" of which I'm unable to change on the client. When the authentication attempt is tried with freeradius, this is what I see from the debug log. rad_recv: Access-Request packet from host 172.20.12.220:4066, id=145, length=232 Framed-MTU = 1480 NAS-IP-Address = 172.20.12.220 NAS-Identifier = "HP ProCurve Switch 5304XL" User-Name = "bartek" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "A1" Called-Station-Id = "00-11-85-57-88-00" Calling-Station-Id = "00-00-39-53-b0-aa" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "111" State = 0xa470cc42adabab0256dc2c8bc1eed1a2 EAP-Message = 0x02020006032c Message-Authenticator = 0x7aaa286e636cd7d6d2db5775789ea1ec Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry bartek at line 223 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group eap for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for bad type 44 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group eap (returns invalid) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.20.12.220:4066, id=145, length=232 Sending Access-Reject of id 145 to 172.20.12.220 port 4066 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 144 with timestamp 4562beee Cleaning up request 1 ID 145 with timestamp 4562beee Nothing to do. Sleeping until we see a request. The main bit of this being the EAP NAK and "NAK asked for bad type 44". I'm unsure of how I'm supposed to configure freeradius to use this type, as in the IANA numbers, type 44 is shown as: 44 ZoneLabs EAP (ZLXEAP) Any ideas on what I can do to get this working?

2 3

Problem starting freeradius 1.1.3
by Ian Walker 05 Dec '06

05 Dec '06

I used the "rpmbuild -ta" command to build an rpm of freeradius-1.1.3 and all went well with the build. I then installed the rpm, and I'm getting the following error message after running radiusd -X. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: symbol lookup error: radiusd: undefined symbol: udpfromto_init I'm not sure what to do to get around the problem of the undefined symbol udpfromto_init error. Has anyone any ideas on what I can do to get freeradius working? Regards Ian

2 2

rlm_sql, mysql configuration
by Andrew Long 05 Dec '06

05 Dec '06

Setting up 1.1.2 with mysql and mschap. Our existing 0.9 setup uses clients.conf file and the rest via the mysql tables. Now, in 1.2, I see there is a "nas" table that was not around before (at least on our system), but as far as I can see we still need to use clients.conf as nas has no field for allowed ip addresses of clients. Am I missing something? I see no mention of the nas table in the rlm_sql docs. Thanks in advance for all help. Andrew Long

2 1

Parse error for entry DEFAULT entry in users file when Auth-Type := SQL
by Gunther 05 Dec '06

05 Dec '06

I was trying to upgrade from version 1.1.0 to 1.1.3 but when starting FreeRadius I received the following error: "Error: /usr/local/etc/raddb/users[216]: Parse error (check) for entry DEFAULT: Unknown value SQL for attribute Auth-Type" I use FR with MySQL and the ./raddb/users file contains the default attributes. E.g. DEFAULT Simultaneous-Use := 1, Auth-Type := sql Idle-Timeout = 3600, Acct-Interim-Interval = 180 This worked fine until FR 1.1.1 and stopped working with 1.1.2. I found that one change in the ./src/lib/valuepair.c file caused this problem: At the end of the pairread function: (1265-1271) /* * If we didn't make a pair, return an error. */ if (!vp) { *eol = T_INVALID; return NULL; } It seems that the pairmake function does not return a valid pair when the pair is 'Auth-Type := SQL'. I am not sure if I use the users file in connection with my MySQL setup correctly, or if my users file entry is simply not correct? Is 'Auth-Type := SQL' in the users file still allowed? It doesn't work anymore since 1.1.2. In a posting from Oct 2001 I saw the following: > If you want to do SQL authentication, you should use 'Auth-Type := SQL' >in the 'users' file. > > If you want to authenticate agains /etc/passwd, THEN you use >'Auth-Type := System'. > > Alan DeKok.

2 2

Re: unable to compile with openssl libraries
by Peter Param 04 Dec '06

04 Dec '06

Hi again, Eventually, I was able to create the package and install it on my debian server. Now when I run it, I get the following output: rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Failed to link EAP-Type/tls: /usr/lib/freeradius/rlm_eap_tls.so: undefined symbol: cbtls_password radiusd.conf[1]: eap: Module instantiation failed. radiusd.conf[365] Unknown module "eap". radiusd.conf[350] Failed to parse authenticate section. The tls Section: tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random #fragment_size = 1024 #include_length = yes #check_crl = yes #check_cert_cn = %{User-Name} } cheers Peter >>> aland(a)deployingradius.com 12/04/06 4:08 PM >>> Peter Param wrote: > dpkg-checkbuilddeps: Unmet build dependencies: debhelper (>= 4.2.32) > dpatch (>= 2) autotools-dev libtool (>= 1.5) libltdl3-dev libpam0g-dev > libmysqlclient15-dev | libmysqlclient14-dev | libmysqlclient-dev > libgdbm-dev libldap2-dev libsasl2-dev libiodbc2-dev libkrb5-dev snmp > libsnmp9-dev | libsnmp5-dev | libsnmp4.2-dev libpq-dev | postgresql-dev > libssl-dev Have you tried installing those packages? It gives you a list of required and optional packages. I would suggest debhelper, dpatch, autotools-dev, libtool, libltld3-dev, and libssl-dev. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

RE: DEFAULT access-reject Reply-Message
by Garber, Neal 04 Dec '06

04 Dec '06

> In your code, $RAD_REQUEST{'Module-Failure-Message'} what that variable mean? It means look in the RAD_REQUEST hash for key named 'Module-Failure-Message'. RAD_REQUEST, RAD_CHECK and RAD_REPLY are hashes that rlm_perl creates that contain the request, check and reply attributes respectively. For single-value attributes, you can test the value by referring to the hash name and key name (as above). If the attribute has multiple values, then value for the requested key is an array. > Is there any doc on how to write scripts for radius? FR comes with example.pl which is a sample perl script that can be called by the rlm_perl module. You can also find documentation for rlm_perl at the wiki: http://wiki.freeradius.org/Rlm_perl (the doc. says RAD_CONFIG is a hash that is created, but I believe the code to support that was only recently added..)

2 1

Questions about proxy radius on multihomed host
by Kostas Zorbadelos 04 Dec '06

04 Dec '06

Hello to everyone. I have a question regarding freeradius proxying. My setup is freeradius 1.1.3 on Solaris 9. I have a very simple proxy configuration. The setup is a bit 'weird' in the sense that I have a freeradius server on the machine that acts as a proxy to another radius server running on the same machine (different IP). So the setup is described as Solaris 9 Host ---------------------------------------------- | IP1 IP2 | | Freeradius <---Proxy---> Other Radius | | | ---------------------------------------------- The Solaris host contains 2 IPs, freeradius is configured with the listen directive to accept authentication requests on IP1, while the other server is listening on IP2. In the other radius, I have configured as client the IP1 but I notice several failures. My question is: on a multihomed Solaris host when radius packets are proxied what is their source IP? Is it IP1 or it could also be IP2? I took a look at the sources where I see that in proxy.c a rad_send() is used to actually send the packet. rad_send() uses sendto() unless WITH_UDPFROMTO is defined in which case sendfromto() is used. In my case, WITH_UDPFROMTO is undefined. sendfromto() is defined in freeradius sources with comments that it works on Linux and FreeBSD 5.x. I have not seen any configuration option that sets the source address of outgoing packets, in case of multihomed hosts. There is only the following comment in radiusd.conf: # bind_address: Make the server listen on a particular IP address, and # send replies out from that address. This directive is most useful # for machines with multiple IP addresses on one interface. # # It can either contain "*", or an IP address, or a fully qualified # Internet domain name. The default is "*" # # As of 1.0, you can also use the "listen" directive. See below for # more information. # Can I assume that outgoing packets use as source address the one listed in the listen directive? Thanks in advance, Kostas -- Kostas Zorbadelos m@il contact: kzorba (at) otenet.gr Out there in the darkness, out there in the night out there in the starlight, one soul burns brighter than a thousand suns.

2 3

FreeRadius + Ldap + TLS/SSL
by Rafał Kamiński 04 Dec '06

04 Dec '06

Hello I install freeradius on Debian Sarge machine. I have my user in ldap and I use that directory to auth. them. It's works. But when I want to use TLS in connections between radius and ldap, I have that error in radius log. rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/freeradius/cert/ca.crt rlm_ldap: setting TLS CACert File to /etc/freeradius/cert/ rlm_ldap: setting TLS Require Cert to never rlm_ldap: setting TLS Cert File to /etc/freeradius/cert/radius.crt rlm_ldap: setting TLS Key File to /etc/freeradius/cert/radius.key rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 When i saw that error, i check ldap logs. My ldap is configure with SSL not a TLS. Now i have a problem with configure freeradius to work with SSL ldap not TLS ldap :( I have in radiusd.conf: server = "ldap" port = 636 #port = 389 ... filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" start_tls = no # tls_cacertfile = /path/to/cacert.pem tls_cacertfile = /etc/freeradius/cert/ca.crt # tls_cacertdir = /path/to/ca/dir/ tls_cacertdir = /etc/freeradius/cert/ tls_cacertdir = /etc/freeradius/cert/ # tls_certfile = /path/to/radius.crt tls_certfile = /etc/freeradius/cert/radius.crt # tls_keyfile = /path/to/radius.key tls_keyfile = /etc/freeradius/cert/radius.key #tls_mode = yes I read about SSL in freeradius and i thought that that conf. use SSL to connections with ldap, but i wrong ? Can somebody tell me how i can use SSL auth between ldap and freeradius ? BR. Kamyk

3 3

Error with rlm_perl
by Robert Masse 04 Dec '06

04 Dec '06

Hi, I have the following error when trying to use rlm_perl : Module: Loaded perl /usr/sbin/freeradius: symbol lookup error: /usr/local/lib/rlm_perl-1.1.2.so: undefined symbol: perl_alloc I use freeradius-1.1.2 Thanks for any help. Robert Masse

2 3