- Freeradius-Users - lists.freeradius.org

RLM Perl cache problem?
by david.suarezdelis＠telefonica.es 20 Nov '06

20 Nov '06

Greetings, I have freeradius 1.3.0 running on GNU/Linux 3.1 using rlm_perl with ithreads without problem (and it works nicely, well done!). The authenticate() sub returns a "Framed-Ip-Address" and a "Framed-Ip-Netmask" through the %RAD_REPLY hash, and, sometimes (when the NAS is adecuate, and depending on user, group and so on), a "Class" attribute as well. I have observed that once I have returned a Class attribute, though, it keeps getting sent by FreeRadius even when my authenticate() sub is not assigning to it. The behavior is like if it was cached somewhere... If I restart FreeRadius, though, the attribute is not sent, until I send one, and then it starts being sent again, even if I modify the data so it's not sent (my own traces and the rlm_perl traces: "adding AV pair..." confirm that Class is not being assigned). I have tried to delete() the %RAD_REPLY hash keys when the function gets called, so I always start with a fresh one, but it's not working either. Before doing further testing, though, undefining the keys values, and so on, I'd like to ask if anyone is having this behavior, if it's the expected one, and how can I correct it (because connections are rejected by the NAS when Class is assigned when it shouldn't). Thanks for you help, david PS- aditionally, is there an updated rlm_perl manual specifying what section it loads is for, and how to use the shared memory to set up db pools and cached results for making things easier before each forking? thanks! ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

2 1

proxy RADIUS: is fallback actived??
by Santiago Balaguer García 20 Nov '06

20 Nov '06

2 1

Blank usernames
by Marat Rysbekov 20 Nov '06

20 Nov '06

Good day, everyone. I'm trying to setup FreeRadius 1.1.3 to assing IP-addresses based on what NAS the authorization request came from, no matter what username or password was supplied. Some of my configuration: <huntgroups> ... Alpha NAS-IP-Address == 192.168.10.1 Beta NAS-IP-Address == 192.168.20.1 ... <users> ... DEFAULT Auth-Type := Accept, Huntgroup-Name == "Alpha", Pool-Name := "PoolA" DEFAULT Auth-Type := Accept, Huntgroup-Name == "Beta", Pool-Name := "PoolB" ... I specify the IP-pools in <radiusd.conf>, and it works fine, except for one thing: I get no Access-Accept reply whenever the username is left blank (any non-empty username is accepted by the server). So, my question: is there a way to make FreeRadius use the DEFAULT entries when the username is not supplied at all? Thanks.

2 3

RE: freeradius on solaris 10 - next try
by Ramm-Ericson, Johannes 20 Nov '06

20 Nov '06

On Mon, 20 Nov 2006 14:56:00 +0100 (CET), Michael Messner wrote: > hey @all, > > the next try to get freeradius with ldap support on a solaris 10: > > I've installed openldap from > http://sunfreeware.com/indexintel10.html, so > I find the ldap libraries: > > /usr/local/lib/libldap-2.3.so.0 > /usr/local/lib/libldap-2.3.so.0.2.9 > /usr/local/lib/libldap.a > /usr/local/lib/libldap.la > /usr/local/lib/libldap.so > /usr/local/lib/libldap_r-2.3.so.0 > /usr/local/lib/libldap_r-2.3.so.0.2.9 > /usr/local/lib/libldap_r.a > /usr/local/lib/libldap_r.la > /usr/local/lib/libldap_r.so > > but there is no libldap_r which is searched for during configure! > > checking for pthread_create in -lpthread... yes > checking for ldap_init in -lldap_r... no > checking for ldap.h... yes > configure: WARNING: silently not building rlm_ldap. > configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. > > any ideas? > > ca mIke Try ./configure --with-rlm-ldap-lib-dir=/usr/local/lib (and include all your other configure options aswell of course...) /johannes

1 0

freeradius on solaris 10 - next try
by Michael Messner 20 Nov '06

20 Nov '06

hey @all, the next try to get freeradius with ldap support on a solaris 10: I've installed openldap from http://sunfreeware.com/indexintel10.html, so I find the ldap libraries: /usr/local/lib/libldap-2.3.so.0 /usr/local/lib/libldap-2.3.so.0.2.9 /usr/local/lib/libldap.a /usr/local/lib/libldap.la /usr/local/lib/libldap.so /usr/local/lib/libldap_r-2.3.so.0 /usr/local/lib/libldap_r-2.3.so.0.2.9 /usr/local/lib/libldap_r.a /usr/local/lib/libldap_r.la /usr/local/lib/libldap_r.so but there is no libldap_r which is searched for during configure! checking for pthread_create in -lpthread... yes checking for ldap_init in -lldap_r... no checking for ldap.h... yes configure: WARNING: silently not building rlm_ldap. configure: WARNING: FAILURE: rlm_ldap requires: libldap_r. any ideas? ca mIke

2 1

RE: configuration problem in Freeradius.
by John Longland 20 Nov '06

20 Nov '06

Also, what does your cleints.conf file look like. Is "johndoe" a user on your system? John -----Original Message----- From: freeradius-users-bounces+jlongland=grintek.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jlongland=grintek.com@lists.freeradius.org] On Behalf Of Hernan Antolini Sent: 20 November 2006 15:07 To: FreeRadius users mailing list Subject: Re: configuration problem in Freeradius. What's your "radiusd -X" say about it ?, you should start there. Hernan Antolini freeradius-users-bounces+antolini=ar.ibm.com(a)lists.freeradius.org wrote on 11/15/2006 08:02:26 AM: > > hi ! > i got howto of freeradius. I am configuring it on suse 10.1 n i have > performed all steps but getting error. I tried alot to troubleshoot it but > didnt get any success. So i am pasting me error here . Plz help me . > > myserver:~ # radtest johndoe hello localhost 1812 password > Sending Access-Request of id 151 to 127.0.0.1 port 1812 > > > User-Name = "johndoe" > User-Password = "hello" > NAS-IP-Address = 255.255.255.255 > > NAS-Port = 1812 > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=151, length=20 > myserver:~ # > > > ------------------------------------------------------------ > > myserver:~ # radiusd -X > Module: Instantiated radutmp (radutmp) > > > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > > rad_recv: Access-Request packet from host 127.0.0.1:1025, id=151, length=59 > User-Name = "johndoe" > > User-Password = "hello" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL > > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 157 > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type System > > auth: type "System" > > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > > modcall[authenticate]: module "unix" returns notfound for request 0 > > modcall: leaving group authenticate (returns notfound) for request 0 > > auth: Failed to validate the user. > rad_lowerpair: User-Name now 'johndoe' > > rad_lowerpair: User-Password now 'hello' > rad_rmspace_pair: User-Name now 'johndoe' > > rad_rmspace_pair: User-Password now 'hello' > > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 157 > modcall[authorize]: module "files" returns ok for request 0 > > modcall: leaving group authorize (returns ok) for request 0 > > rad_check_password: Found Auth-Type System > auth: type "System" > > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > > modcall[authenticate]: module "unix" returns notfound for request 0 > > modcall: leaving group authenticate (returns notfound) for request 0 > auth: Failed to validate the user. > > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > > --- Walking the entire request list --- > Waking up in 1 seconds... > > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > > Sending Access-Reject of id 151 to 127.0.0.1 port 1025 > Waking up in 4 seconds... > --- > Walking the entire request list --- > Cleaning up request 0 ID 151 with timestamp 455743f6 > Nothing to do. > Sleeping until we see a request. > -- > View this message in context: http://www.nabble.com/configuration- > problem-in-Freeradius.-tf2627693.html#a7355750 > Sent from the FreeRadius - User mailing list archive at Nabble.com. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

configuration problem in Freeradius.
by capricorn 20 Nov '06

20 Nov '06

hi ! i got howto of freeradius. I am configuring it on suse 10.1 n i have performed all steps but getting error. I tried alot to troubleshoot it but didnt get any success. So i am pasting me error here . Plz help me . myserver:~ # radtest johndoe hello localhost 1812 password Sending Access-Request of id 151 to 127.0.0.1 port 1812 User-Name = "johndoe" User-Password = "hello" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=151, length=20 myserver:~ # ------------------------------------------------------------ myserver:~ # radiusd -X Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1025, id=151, length=59 User-Name = "johndoe" User-Password = "hello" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. rad_lowerpair: User-Name now 'johndoe' rad_lowerpair: User-Password now 'hello' rad_rmspace_pair: User-Name now 'johndoe' rad_rmspace_pair: User-Password now 'hello' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "johndoe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 157 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 151 to 127.0.0.1 port 1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 151 with timestamp 455743f6 Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/configuration-problem-in-Freeradius.-tf2627693.html#a… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

RE: how to allow login only from specified access point?
by Ramm-Ericson, Johannes 20 Nov '06

20 Nov '06

On Sat, 18 Nov 2006 13:54:32 +0100, Norbert Grochal wrote: > I have freeradius serwer with PEAP auth. secrets of nasnames > and user passwords are in mysql. > > Is it possible to set freeradius to send Access-Accept only > where user try to connect to specified access point? I try to > check it by sql query modified by me. > > snip.... < > > My question is as I have written: > Is it possible to set freeradius to send Access-Accept only > where user try to connect to specified access point? > And how to do it ? :-). > > Norboro One place to configure that would be in : /path/to/freeradius/etc/raddb/users. /johannes

2 1

SQLIPPOOL Documentation
by Liborio Marrone 20 Nov '06

20 Nov '06

Hi all, where can I get documentation (howto or whatever) about configuration of ip pools using (my)sql and sqlippool ? Freeradius docs about that is very poor . Thanks in advance. Boris

1 0

Re: PEAPv2 Server
by david＠mitton.com 20 Nov '06

20 Nov '06

Microsoft implements something better known as PEAP v0 see: draft-kamath-pppext-peapv0-00.txt, “Microsoft’s PEAP v0 (Implemented in Windows XP SP1) July 2002, http://www.watersprings. org/pub/id/draft-kamath-pppext-peapv0-00.txt As far as I know, no-one implements PEAP v2, and it's not clear why you would build a server for it if you don't have a client? Dave. ----Original Message---- From: aland(a)deployingradius.com Date: Nov 15, 2006 14:49 To: "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius. org> Subj: Re: PEAPv2 Server "MURAT SEZGIN" <sezginmurat(a)hotmail.com> wrote: > I am trying to implement a PEAP version 2 > (draft-josefsson-pppext-eap-tls-eap-10.txt) client. I was using "Odyssey > Server Administration" server for PEAP v1 and EAP-TTLS. But the server does > not support PEAP v2. Is there any other server softwares which support PEAP > v2? Or is there any body who tried to test PEAP v2? Microsoft supports PEAPv2, I think. My suggestion is to implement PEAPv2 in a server first, and to test that implementation with the Microsoft clients. Once that works, you then have a server you can use to test your client implementation. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html

6 8