- Freeradius-Users - lists.freeradius.org

Optimize LDAP searches
by Jorgen Rosink 08 Sep '06

08 Sep '06

We have multiple remote sites each with it's own NAS, each NAS search for users in multiple LDAP contexts. Each NAS (read: site) has one or more "primary" contexts, which I like to search first before looking in all others (roaming users). At this time search order is based on the order of LDAP module entries in the authorize {} section. Is there a way to configure the search order of multiple LDAP contexts based on NAS IP address ? I understand there is no way to do a single recursive query on a LDAP base like o=myorg, is there some reason, or should I submit a feature request ??? ;-)))

2 1

RE: How to restrict pppoe users on nas-port-id
by eugene＠snowball.co.za 07 Sep '06

07 Sep '06

Thank you Gef that pointed me in the right direction. What I still had to figure out was that the "check-item" variable is an extra row in the radcheck table and that the operator has to be "==". Kind regards, Eugene -----Original Message----- From: freeradius-users-bounces+eugene=snowball.co.za(a)lists.freeradius.org [mailto:freeradius-users-bounces+eugene=snowball.co.za@lists.freeradius. org] On Behalf Of Geoffrey Cauchi Sent: 06 September 2006 09:25 To: 'FreeRadius users mailing list' Subject: RE: How to restrict pppoe users on nas-port-id Use the check-item variable to restrict port id's Gef -----Original Message----- From: freeradius-users-bounces+agcauchi=winssystems.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+agcauchi=winssystems.com@lists.freeradi us.o rg] On Behalf Of eugene(a)snowball.co.za Sent: 05 September 2006 21:04 To: freeradius-users(a)lists.freeradius.org Subject: How to restrict pppoe users on nas-port-id I'm using FreeRADIUS Version 1.0.4 with Dialup_admin and mysql and I would like to know if anyone can direct me in the right place to find out how to restrict pppoe users from logging in from multiple NAS port IDs. I would like to restrict them to logging on to only a specific set of port IDs that comes from a database. Any help will be appreciated. -Eugenevdm - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

WPA with Chillispot in proxy mode, problem
by Giuseppina Venezia 07 Sep '06

07 Sep '06

Hi all, I'm trying to use FreeRADIUS with WPA and Chillispot in proxy mode. When I try to login, chillispot give me this error: radius.c: 1602: Received unknown radius packet 11! chilli.c: 3751: radius_proxy_ind() failed! This is the log of freeradius: ------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,dc=mydomain,dc=it" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "aPassword" ldap: basedn = "ou=myDepartment,dc=mydomain,dc=it" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "userPassword" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusGroupName mapped to RADIUS Ldap-Group rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id rlm_ldap: LDAP radiusMaxBandwidthDown mapped to RADIUS WISPr-Bandwidth-Max-Down rlm_ldap: LDAP radiusMaxBandwidthUp mapped to RADIUS WISPr-Bandwidth-Max-Up rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8139a00 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = yes rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded IPPOOL ippool: session-db = "/usr/local/etc/raddb/db.ippool" ippool: ip-index = "/usr/local/etc/raddb/db.ipindex" ippool: range-start = 192.168.182.129 IP address [192.168.182.129] ippool: range-stop = 192.168.182.254 IP address [192.168.182.254] ippool: netmask = 255.255.255.0 IP address [255.255.255.0] ippool: cache-size = 800 ippool: override = no ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1024, id=0, length=125 User-Name = "prof1" EAP-Message = 0x0202000a0170726f6631 Message-Authenticator = 0xdb9251a308d92279fddaedc7cd5553b2 Calling-Station-Id = "00-17-F2-44-11-C2" Called-Station-Id = "00-50-BF-E3-E8-2A" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "localhost" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "prof1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 154 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=myDepartment,dc=mydomain,dc=it' radius_xlat: '(uid=prof1)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=mydomain,dc=it/aPassword to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=myDepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmyDepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmyDepartment\2cdc\3dmydomain\2cdc\3dit)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=myDepartment,dc=mydomain,dc=it, with filter (&(cn=professor)(|(&(objectClass=GroupOfNames)(member=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmyDepartment\2cdc\3dmydomain\2cdc\3dit))(&(objectClass=GroupOfUniqueNames)(uniquemember=cn\3dMaurizio Costanzo\2cou\3dfaculty\2cou\3ddspsa\2cou\3dmyDepartment\2cdc\3dmydomain\2cdc\3dit)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Maurizio Costanzo,ou=faculty,ou=dspsa,ou=myDepartment,dc=mydomain,dc=it, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group professor rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 176 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for prof1 radius_xlat: '(uid=prof1)' radius_xlat: 'ou=myDepartment,dc=mydomain,dc=it' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=myDepartment,dc=mydomain,dc=it, with filter (uid=prof1) rlm_ldap: checking if remote access for prof1 is allowed by userPassword rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusGroupName as Ldap-Group, value professor & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-05-5D-25-12-5B & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-02-C7-8F-A0-16 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-0B-6B-4A-22-E8 & op=21 rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id, value 00-17-F2-44-11-C2 & op=21 rlm_ldap: Adding userPassword as User-Password, value a & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value 98 & op=11 rlm_ldap: user prof1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: 00-17-F2-44-11-C2 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-05-5D-25-12-5B rlm_checkval: Value Name: Calling-Station-Id, Value: 00-02-C7-8F-A0-16 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-0B-6B-4A-22-E8 rlm_checkval: Value Name: Calling-Station-Id, Value: 00-17-F2-44-11-C2 modcall[authorize]: module "checkval" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 127.0.0.1 port 1024 Service-Type == Framed-User Filter-Id = "98" EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x06c632db2f3bbd1c133568054f07c4a0 Finished request 0 ------------------ This is my eap.conf: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes check_crl = no } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 } mschapv2 { } } I've configured Access Point with WPA-Enterprise support. Let me know if you need some other informations. Thanks in advance Best Regards,Giusy

2 5

Question about Multiple-valued attributes
by Ali Majdzadeh 07 Sep '06

07 Sep '06

Hi Is it possible to catch Multiple-valued attributes through a C program? I can fetch, for example, User-Name attribute by calling USER_NAME = getenv (USER_NAME); but how should I fetch something like Cisco-AVPair? Best Regards Ali

2 2

XT Radius to Free Radius
by relists 07 Sep '06

07 Sep '06

Hi I am currently trying to migrate XT Radius to Freeradius and running into a few problems when trying to run an External Script. The external script in XT Radius checks the username and password against a postgres database and if username and password match it returns the details for that user e.g. IP address, Framed-Address etc etc. We are using the default xradiusd.conf file with the port number changed to 1645. We have changed the users file to the following: DEFAULT Auth-Type := External Exec-Program = "/etc/raddb/checkpassword.pl %u %{User-Password}" If we run the scipt manually it works as expected with IP address etc etc returned. These details are stored in our postgres database. We are using the Ntradping tool as suggested by the radius book. When we startup radius using radiusd -X we get the following errors. Does anyone have any ideas what we are doing wrong? Thanks in advance. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1:1926, id=4, length=68 User-Name = "user(a)adslgateway.co.uk" User-Password = "test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "adslgateway.co.uk" for User-Name = "user(a)adslgateway.co.uk" rlm_realm: No such realm "adslgateway.co.uk" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 4 radius_xlat: '/etc/raddb/checkpassword.pl user(a)adslgateway.co.uk test' modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 4 to 192.168.1.1:1926 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 4 with timestamp 44fe9d6f Nothing to do. Sleeping until we see a request.

4 7

exec-program-wait to send back AV pairs to freeradius
by Shankar Ganesh C 07 Sep '06

07 Sep '06

Hi All, I am trying to set values for more than one attributes in the exec-program-wait for accounting start packets. Below is the code i am trying in the exec-program-wait putenv("Calling-Station-ID=10") putenv("Called-Station-ID=50") Putenv("Acct-Session-ID="20") return 0; I have set the exec-wait=yes in the radiusd.conf I am not sure whether freeradius picks all this values and sets in the valuepairs of the radius_exec_program () I am trying to set the accounting response packets with this value pairs in the rad_accounting using pairmove but still my accounting response packets does not contain this attributes value pairs. Can some body help me to solve this problem ? Thanks and regards Shankar ganesh

2 1

Re: 1.1.3 on Solaris 10 (sparc)
by Lin Richardson 07 Sep '06

07 Sep '06

You should post this to thet userlist (I am cc'ing them on this reply). Perhaps someone there has seen the "false cru" error before... I'm no compiler guru, but google tells me that libtool may be to blame. I don't acutally show libtool installed on my box and don't know much about it. Regards, Lin On 9/5/06, Ahsan Rafiqul-CRA064 <rahsan(a)motorola.com> wrote: > > Hi Lin Richardson, > > I need your help. As I understand you succesfully installed freeRadius > 1.1.3 for Solaris 10. I tried to follow your direction as follows, and > installed all necessary pacjkage (openssl, and openldap...as you suggested). > However, I am getting error at make, as follow: > > # make > gmake[1]: Entering directory > `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3' > Making all in libltdl... > gmake[2]: Entering directory > `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3/libltdl' > /usr/sfw/bin//gmake all-am > gmake[3]: Entering directory > `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3/libltdl' > /bin/bash ./libtool --tag=CC --mode=link gcc -g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -no-undefined > -version-info 4:4:1 -o libltdl.la -rpath /usr/local/lib ltdl.lo -ldl > -lnsl -lresolv -lsocket -lposix4 -lpthread > rm -fr .libs/libltdl.so .libs/libltdl.so.3 .libs/libltdl.so.3.1.4 > gcc -shared -Wl,-h -Wl,libltdl.so.3 -o .libs/libltdl.so.3.1.4 > .libs/ltdl.o -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lc > (cd .libs && rm -f libltdl.so.3 && ln -s libltdl.so.3.1.4 libltdl.so.3) > (cd .libs && rm -f libltdl.so && ln -s libltdl.so.3.1.4 libltdl.so) > false cru .libs/libltdl.a ltdl.o > gmake[3]: *** [libltdl.la] Error 1 > gmake[3]: Leaving directory > `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3/libltdl' > gmake[2]: *** [all] Error 2 > gmake[2]: Leaving directory > `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3/libltdl' > gmake[1]: *** [common] Error 2 > gmake[1]: Leaving directory > `/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3' > make: *** [all] Error 2 > Here is the out put of my ./configure > > > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for egrep... egrep > checking for AIX... no > checking whether gcc needs -traditional... no > checking whether we are using SUNPro C... no > checking for ranlib... : > checking whether byte ordering is bigendian... yes > checking for gmake... yes > checking for gmake... /usr/sfw/bin//gmake > checking for lt_dlinit in -lltdl... no > checking build system type... sparc-sun-solaris2.10 > checking host system type... sparc-sun-solaris2.10 > checking for a sed that does not truncate output... /usr/bin/sed > checking for ld used by gcc... /usr/ccs/bin/ld > checking if the linker (/usr/ccs/bin/ld) is GNU ld... no > checking for /usr/ccs/bin/ld option to reload object files... -r > checking for BSD-compatible nm... /usr/ccs/bin/nm -p > checking whether ln -s works... yes > checking how to recognise dependent libraries... pass_all > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking dlfcn.h usability... yes > checking dlfcn.h presence... yes > checking for dlfcn.h... yes > checking for g++... g++ > checking whether we are using the GNU C++ compiler... yes > checking whether g++ accepts -g... yes > checking how to run the C++ preprocessor... g++ -E > checking for g77... no > checking for f77... no > checking for xlf... no > checking for frt... no > checking for pgf77... no > checking for fort77... no > checking for fl32... no > checking for af77... no > checking for f90... no > checking for xlf90... no > checking for pgf90... no > checking for epcf90... no > checking for f95... no > checking for fort... no > checking for xlf95... no > checking for ifc... no > checking for efc... no > checking for pgf95... no > checking for lf95... no > checking for gfortran... no > checking whether we are using the GNU Fortran 77 compiler... no > checking whether accepts -g... no > checking the maximum length of command line arguments... 262144 > checking command to parse /usr/ccs/bin/nm -p output from gcc object... ok > checking for objdir... .libs > checking for ar... false > checking for ranlib... (cached) : > checking for strip... : > checking if gcc supports -fno-rtti -fno-exceptions... no > checking for gcc option to produce PIC... -fPIC > checking if gcc PIC flag -fPIC works... yes > checking if gcc static flag -static works... no > checking if gcc supports -c -o file.o... yes > checking whether the gcc linker (/usr/ccs/bin/ld) supports shared > libraries... yes > checking whether -lc should be explicitly linked in... yes > checking dynamic linker characteristics... solaris2.10 ld.so > checking how to hardcode library paths into programs... immediate > checking whether stripping libraries is possible... no > checking for shl_load... no > checking for shl_load in -ldld... no > checking for dlopen... yes > checking whether a program can dlopen itself... yes > checking whether a statically linked program can dlopen itself... yes > checking if libtool supports shared libraries... yes > checking whether to build shared libraries... yes > checking whether to build static libraries... yes > configure: creating libtool > appending configuration tag "CXX" to libtool > checking for ld used by g++... /usr/ccs/bin/ld > checking if the linker (/usr/ccs/bin/ld) is GNU ld... no > checking whether the g++ linker (/usr/ccs/bin/ld) supports shared > libraries... yes > checking for g++ option to produce PIC... -fPIC > checking if g++ PIC flag -fPIC works... yes > checking if g++ static flag -static works... no > checking if g++ supports -c -o file.o... yes > checking whether the g++ linker (/usr/ccs/bin/ld) supports shared > libraries... yes > checking dynamic linker characteristics... solaris2.10 ld.so > checking how to hardcode library paths into programs... immediate > appending configuration tag "F77" to libtool > checking docdir... ${datadir}/doc/freeradius > checking logdir... ${localstatedir}/log/radius > checking radacctdir... ${logdir}/radacct > checking raddbdir... ${sysconfdir}/raddb > checking for perl... /usr/bin/perl > checking for snmpget... /usr/sfw/bin//snmpget > checking for snmpwalk... /usr/sfw/bin//snmpwalk > checking for rusers... /usr/bin/rusers > checking for working aclocal... missing > checking for working autoconf... missing > checking for working autoheader... missing > checking for locate... no > checking for dirname... /usr/bin/dirname > checking for grep... /usr/bin/grep > checking pthread.h usability... yes > checking pthread.h presence... yes > checking for pthread.h... yes > checking for pthread_create in -lpthread... yes > checking for library containing sem_init... -lposix4 > checking for getsockname in -lsocket... yes > checking for inet_aton in -lresolv... yes > checking for inet_ntoa in -lnsl... yes > checking for DH_new in -lcrypto... yes > checking for SSL_new in -lssl... yes > checking for dirent.h that defines DIR... yes > checking for library containing opendir... none required > checking for ANSI C header files... (cached) yes > checking whether time.h and sys/time.h may both be included... yes > checking for sys/wait.h that is POSIX.1 compatible... yes > checking for unistd.h... (cached) yes > checking crypt.h usability... yes > checking crypt.h presence... yes > checking for crypt.h... yes > checking errno.h usability... yes > checking errno.h presence... yes > checking for errno.h... yes > checking resource.h usability... no > checking resource.h presence... no > checking for resource.h... no > checking getopt.h usability... yes > checking getopt.h presence... yes > checking for getopt.h... yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > checking utmp.h usability... yes > checking utmp.h presence... yes > checking for utmp.h... yes > checking utmpx.h usability... yes > checking utmpx.h presence... yes > checking for utmpx.h... yes > checking signal.h usability... yes > checking signal.h presence... yes > checking for signal.h... yes > checking sys/select.h usability... yes > checking sys/select.h presence... yes > checking for sys/select.h... yes > checking syslog.h usability... yes > checking syslog.h presence... yes > checking for syslog.h... yes > checking for inttypes.h... (cached) yes > checking for stdint.h... (cached) yes > checking stdio.h usability... yes > checking stdio.h presence... yes > checking for stdio.h... yes > checking netdb.h usability... yes > checking netdb.h presence... yes > checking for netdb.h... yes > checking semaphore.h usability... yes > checking semaphore.h presence... yes > checking for semaphore.h... yes > checking arpa/inet.h usability... yes > checking arpa/inet.h presence... yes > checking netinet/in.h usability... yes > checking netinet/in.h presence... yes > checking for netinet/in.h... yes > checking for sys/types.h... (cached) yes > checking sys/socket.h usability... yes > checking sys/socket.h presence... yes > checking for sys/socket.h... yes > checking sys/time.h usability... yes > checking sys/time.h presence... yes > checking for sys/time.h... yes > checking for sys/wait.h... (cached) yes > checking sys/security.h usability... no > checking sys/security.h presence... no > checking for sys/security.h... no > checking fcntl.h usability... yes > checking fcntl.h presence... yes > checking for fcntl.h... yes > checking sys/fcntl.h usability... yes > checking sys/fcntl.h presence... yes > checking for sys/fcntl.h... yes > checking for sys/stat.h... (cached) yes > checking sys/prctl.h usability... no > checking sys/prctl.h presence... no > checking for sys/prctl.h... no > checking prot.h usability... no > checking prot.h presence... no > checking for prot.h... no > checking sia.h usability... no > checking sia.h presence... no > checking for sia.h... no > checking siad.h usability... no > checking siad.h presence... no > checking for siad.h... no > checking regex.h usability... yes > checking regex.h presence... yes > checking for regex.h... yes > checking openssl/ssl.h usability... yes > checking openssl/ssl.h presence... yes > checking for openssl/ssl.h... yes > checking openssl/crypto.h usability... yes > checking openssl/crypto.h presence... yes > checking for openssl/crypto.h... yes > checking openssl/err.h usability... yes > checking openssl/err.h presence... yes > checking for openssl/err.h... yes > checking openssl/engine.h usability... yes > checking for openssl/engine.h... yes > checking for OpenSSL version >= 0.9.7... yes > checking for off_t... yes > checking for pid_t... yes > checking for size_t... yes > checking for uid_t in sys/types.h... yes > checking for socklen_t... yes > checking for uint8_t... yes > checking for uint16_t... yes > checking for uint32_t... yes > checking for getopt_long... yes > checking for lockf... yes > checking for strsignal... yes > checking for sigaction... yes > checking for sigprocmask... yes > checking for pthread_sigmask... yes > checking for snprintf... yes > checking for vsnprintf... yes > checking for setsid... yes > checking for strncasecmp... yes > checking for strcasecmp... yes > checking for localtime_r... yes > checking for ctime_r... yes > checking for gmtime_r... yes > checking for strsep... no > checking for inet_aton... yes > checking for inet_pton... yes > checking for inet_ntop... yes > checking for gethostname... yes > checking for setlinebuf... yes > checking for setvbuf... yes > checking for getusershell... yes > checking for initgroups... yes > checking for closefrom... yes > checking whether crypt must be declared... no > checking whether strncasecmp must be declared... no > checking whether strcasecmp must be declared... no > checking whether inet_aton must be declared... no > checking whether gethostname must be declared... no > checking whether setlinebuf must be declared... no > checking whether getusershell must be declared... no > checking whether endusershell must be declared... no > checking return type of signal handlers... void > checking for ut_xtime in struct utmpx... yes > checking for ipi_addr in struct in_pktinfo... no > checking type of OS... SunOS > checking for developer gcc flags... no. > checking for crypt in -lcrypt... yes > checking for setkey in -lcipher... no > checking for asn1.h,snmp.h,snmp_impl.h... no > checking gethostbyaddr_r() syntax... SYSV-style > checking gethostbyname_r() syntax... SYSV-style > checking ctime_r() syntax... POSIX-style > top_builddir=/export/home/dev/rafi_dir/free_radius_1.1.3/freeradius-1.1.3 > configure: creating ./config.status > config.status: creating ./Make.inc > config.status: creating ./src/include/build-radpaths-h > config.status: creating ./src/main/Makefile > config.status: creating ./src/main/checkrad.pl > config.status: creating ./src/main/radlast > config.status: creating ./src/main/radtest > config.status: creating ./scripts/rc.radiusd > config.status: creating ./scripts/radwatch > config.status: creating ./scripts/check-radiusd-config > config.status: creating ./scripts/radiusd.cron.daily > config.status: creating ./scripts/radiusd.cron.monthly > config.status: creating ./scripts/cryptpasswd > config.status: creating ./raddb/dictionary > config.status: creating ./raddb/radiusd.conf > config.status: creating src/include/autoconf.h > config.status: src/include/autoconf.h is unchanged > configure: configuring in libltdl > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for a BSD-compatible install... ./install-sh -c > checking whether build environment is sane... yes > checking for gawk... no > checking for mawk... no > checking for nawk... nawk > checking whether make sets $(MAKE)... yes > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ISO C89... none needed > checking for style of include used by make... none > checking dependency style of gcc... none > checking for an ANSI C-conforming const... yes > checking for inline... inline > checking build system type... sparc-sun-solaris2.10 > checking host system type... sparc-sun-solaris2.10 > checking for a sed that does not truncate output... /usr/bin/sed > checking for grep that handles long lines and -e... /usr/sfw/bin//ggrep > checking for egrep... /usr/sfw/bin//ggrep -E > checking for ld used by gcc... /usr/ccs/bin/ld > checking if the linker (/usr/ccs/bin/ld) is GNU ld... no > checking for /usr/ccs/bin/ld option to reload object files... -r > checking for BSD-compatible nm... /usr/ccs/bin/nm -p > checking whether ln -s works... yes > checking how to recognise dependent libraries... pass_all > checking how to run the C preprocessor... gcc -E > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking dlfcn.h usability... yes > checking dlfcn.h presence... yes > checking for dlfcn.h... yes > checking for g++... g++ > checking whether we are using the GNU C++ compiler... yes > checking whether g++ accepts -g... yes > checking dependency style of g++... none > checking how to run the C++ preprocessor... g++ -E > checking for g77... no > checking for f77... no > checking for xlf... no > checking for frt... no > checking for pgf77... no > checking for cf77... no > checking for fort77... no > checking for fl32... no > checking for af77... no > checking for f90... no > checking for xlf90... no > checking for pgf90... no > checking for pghpf... no > checking for epcf90... no > checking for gfortran... no > checking for g95... no > checking for f95... no > checking for fort... no > checking for xlf95... no > checking for ifort... no > checking for ifc... no > checking for efc... no > checking for pgf95... no > checking for lf95... no > checking for ftn... no > checking whether we are using the GNU Fortran 77 compiler... no > checking whether accepts -g... no > checking the maximum length of command line arguments... 262144 > checking command to parse /usr/ccs/bin/nm -p output from gcc object... ok > checking for objdir... .libs > checking for ar... no > checking for ranlib... no > checking for strip... no > checking if gcc supports -fno-rtti -fno-exceptions... no > checking for gcc option to produce PIC... -fPIC > checking if gcc PIC flag -fPIC works... yes > checking if gcc static flag -static works... no > checking if gcc supports -c -o file.o... yes > checking whether the gcc linker (/usr/ccs/bin/ld) supports shared > libraries... yes > checking whether -lc should be explicitly linked in... yes > checking dynamic linker characteristics... solaris2.10 ld.so > checking how to hardcode library paths into programs... immediate > checking whether stripping libraries is possible... no > checking if libtool supports shared libraries... yes > checking whether to build shared libraries... yes > checking whether to build static libraries... yes > configure: creating libtool > appending configuration tag "CXX" to libtool > checking for ld used by g++... /usr/ccs/bin/ld > checking if the linker (/usr/ccs/bin/ld) is GNU ld... no > checking whether the g++ linker (/usr/ccs/bin/ld) supports shared > libraries... yes > checking for g++ option to produce PIC... -fPIC > checking if g++ PIC flag -fPIC works... yes > checking if g++ static flag -static works... no > checking if g++ supports -c -o file.o... yes > checking whether the g++ linker (/usr/ccs/bin/ld) supports shared > libraries... yes > checking dynamic linker characteristics... solaris2.10 ld.so > checking how to hardcode library paths into programs... immediate > appending configuration tag "F77" to libtool > checking for dirent.h that defines DIR... yes > checking for library containing opendir... none required > checking which extension is used for loadable modules... .so > checking which variable specifies run-time library path... LD_LIBRARY_PATH > checking for the default library search path... /lib /usr/lib > checking for objdir... .libs > checking whether libtool supports -dlopen/-dlpreopen... yes > checking for shl_load... no > checking for shl_load in -ldld... no > checking for dlopen in -ldl... yes > checking for dlerror... yes > checking for _ prefix in compiled symbols... no > checking whether deplibs are loaded by dlopen... yes > checking argz.h usability... no > checking argz.h presence... no > checking for argz.h... no > checking for error_t... no > checking for argz_append... no > checking for argz_create_sep... no > checking for argz_insert... no > checking for argz_next... no > checking for argz_stringify... no > checking assert.h usability... yes > checking assert.h presence... yes > checking for assert.h... yes > checking ctype.h usability... yes > checking ctype.h presence... yes > checking for ctype.h... yes > checking errno.h usability... yes > checking errno.h presence... yes > checking for errno.h... yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > checking for memory.h... (cached) yes > checking for stdlib.h... (cached) yes > checking stdio.h usability... yes > checking stdio.h presence... yes > checking for stdio.h... yes > checking for unistd.h... (cached) yes > checking dl.h usability... no > checking dl.h presence... no > checking for dl.h... no > checking sys/dl.h usability... yes > checking sys/dl.h presence... yes > checking for sys/dl.h... yes > checking dld.h usability... no > checking dld.h presence... no > checking for dld.h... no > checking mach-o/dyld.h usability... no > checking mach-o/dyld.h presence... no > checking for mach-o/dyld.h... no > checking for string.h... (cached) yes > checking for strchr... yes > checking for strrchr... yes > checking for memcpy... yes > checking for memmove... yes > checking for strcmp... yes > checking for closedir... yes > checking for opendir... yes > checking for readdir... yes > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > config.status: executing depfiles commands > configure: configuring in src/modules/rlm_attr_rewrite > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in src/modules/rlm_counter > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for gdbm.h... no > checking for gdbm_open in -lgdbm... no > checking for gdbm_fdesc... no > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in src/modules/rlm_dbm > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for ndbm.h... yes > checking for dbm in default lib... yes > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in src/modules/rlm_eap > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in ./types/rlm_eap_tls > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for OpenSSL support... yes > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in ./types/rlm_eap_sim > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in ./types/rlm_eap_ttls > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for OpenSSL support... yes > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in ./types/rlm_eap_mschapv2 > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for egrep... egrep > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in ./types/rlm_eap_md5 > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for egrep... egrep > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking malloc.h usability... yes > checking malloc.h presence... yes > checking for malloc.h... yes > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in ./types/rlm_eap_peap > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for OpenSSL support... yes > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in src/modules/rlm_ippool > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... n > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for gdbm.h... no > checking for gdbm_open in -lgdbm... no > checking for gdbm_fdesc... no > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in src/modules/rlm_krb5 > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for krb5.h... no > checking for krb5_encrypt_data in -lk5crypto... no > checking for DH_new in -lcrypto... yes > checking for set_com_err_hook in -lcom_err... no > checking for krb5_init_context in -lkrb5... no > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in src/modules/rlm_ldap > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking for pthread_create in -lpthread... yes > checking for ldap_init in -lldap_r... no > checking for ldap.h... yes > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in src/modules/rlm_otp > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for egrep... egrep > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking for inttypes.h... (cached) yes > checking for SSL_new in -lssl... yes > checking openssl/des.h usability... yes > checking openssl/des.h presence... yes > checking for openssl/des.h... yes > checking openssl/hmac.h usability... yes > checking openssl/hmac.h presence... yes > checking for openssl/hmac.h... yes > checking openssl/md4.h usability... yes > checking openssl/md4.h presence... yes > checking for openssl/md4.h... yes > checking openssl/md5.h usability... yes > checking openssl/md5.h presence... yes > checking for openssl/md5.h... yes > checking openssl/sha.h usability... yes > checking openssl/sha.h presence... yes > checking for openssl/sha.h... yes > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in src/modules/rlm_pam > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for dlopen in -ldl... yes > checking for pam_start in -lpam... yes > checking for egrep... egrep > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking security/pam_appl.h usability... yes > checking security/pam_appl.h presence... yes > checking for security/pam_appl.h... yes > checking pam/pam_appl.h usability... no > checking pam/pam_appl.h presence... no > checking for pam/pam_appl.h... no > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in src/modules/rlm_perl > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking how to run the C preprocessor... gcc -E > checking for perl... yes > checking for EXTERN.h... no > checking for perl.h... no > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in src/modules/rlm_radutmp > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for egrep... egrep > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking sys/mman.h usability... yes > checking sys/mman.h presence... yes > checking for sys/mman.h... yes > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in src/modules/rlm_sql > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > config.status: creating ./Makefile > config.status: creating ./drivers/Makefile > configure: configuring in ./drivers/rlm_sql_iodbc > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for isql.h... no > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in ./drivers/rlm_sql_mysql > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking for mysql_config... yes > checking for pthread_create in -lpthread... yes > checking for mysql_init in -lmysqlclient_r (using mysql_config)... yes > checking for mysql.h (using mysql_config)... no > checking for mysql/mysql.h... yes > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in ./drivers/rlm_sql_postgresql > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking for libpq-fe.h... no > checking for PQconnectdb in -lpq... no > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in ./drivers/rlm_sql_oracle > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for oci.h... no > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in ./drivers/rlm_sql_unixodbc > configure: running /bin/bash './configure' --prefix=/usr/local > '--prefix=/usr/local' '--enable-ltdl-instal > l' '--cache-file=/dev/null' '--srcdir=.' 'CFLAGS=-g -O2 -D_REENTRANT > -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GN > U_SOURCE -DNDEBUG' --cache-file=/dev/null --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for sql.h... no > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in src/modules/rlm_sqlcounter > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > configure: creating ./config.status > config.status: creating Makefile > configure: configuring in src/modules/rlm_unix > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > checking for gcc... gcc > checking for C compiler default output file name... a.out > checking whether the C compiler works... yes > checking whether we are cross compiling... no > checking for suffix of executables... > checking for suffix of object files... o > checking whether we are using the GNU C compiler... yes > checking whether gcc accepts -g... yes > checking for gcc option to accept ANSI C... none needed > checking how to run the C preprocessor... gcc -E > checking for system password file... /etc/passwd > checking for system shadow password file... /etc/shadow > checking for crypt... yes > checking for egrep... egrep > checking for ANSI C header files... yes > checking for sys/types.h... yes > checking for sys/stat.h... yes > checking for stdlib.h... yes > checking for string.h... yes > checking for memory.h... yes > checking for strings.h... yes > checking for inttypes.h... yes > checking for stdint.h... yes > checking for unistd.h... yes > checking crypt.h usability... yes > checking crypt.h presence... yes > checking for crypt.h... yes > checking shadow.h usability... yes > checking shadow.h presence... yes > checking for shadow.h... yes > checking for getspnam... yes > checking for getusershell... yes > checking for getspnam in -lshadow... no > checking for fgetpwent... yes > checking for fgetspent... yes > checking for fgetgrent... yes > configure: creating ./config.status > config.status: creating Makefile > config.status: creating config.h > config.status: config.h is unchanged > configure: configuring in src/modules/rlm_checkval > configure: running /bin/bash './configure' --prefix=/usr/local > --enable-ltdl-install --cache-file=/dev/nul > l --srcdir=. > configure: creating ./config.status > config.status: creating Makefile > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > "rafi.notes" 939 lines, 40686 characters > > *Rafi Ahsan* > *_______________________________* > *Motorola Wireless Broadband Engineering (WiMAX)* > *1455 W. Shure Dr. (IL 75/ Rm 341)* > *Arlington Heights, IL 60004* > *Desk : 847-435-2449* > >

12 22

Re: windowsXP+LDAP+freeradius
by Muthu 07 Sep '06

07 Sep '06

Hai, Thanks for your reply. I was trying to use PAM authentication with freeradius for Win XP client (PEAP). I was getting error in the tls section. I posted to freeradius userlist. I got the reply as below. Is this right?. If not, Can I use LDAP+PEAP+freeradius. ============================================================================================================= You cannot use PAM to answer PEAP/MS-CHAP requests. You must either have the plaintext password for the user, the NT or LM hashes for their password, or access to an NT domain controller and use the "ntlm_auth" helper in the mschap module. ============================================================================================================= > > I have Link sys wireless router, windows XP clients, freeradius > > and LDAP server (Linux). I want to make the user authentication for the > > windows XP clients against freeradius to connect to Link sys router. I > > have all the users in LDAP. The LDAP server is set as user database for > > freeradius sever. Is this possible?. If possible, can you please give me > > the idea how to do this. Perfectly fine. Take a look at the ldap { } section in radiusd.conf (it's pretty much self explanatory), and enable ldap in authorize { } and authenticate { }. For wireless, you'll also need at least a server certificate, a script for generating one is in the scripts/ subdirectory of freeradius. Use that certificate for the eap.conf configuration, where you will have to enable at least the tls { } part, and either peap or ttls, depending on what supplicant you use on the Win XP side. The built-in supplicant (not recommended, but working) is using peap. Greetings, Stefan Winter Thanks & Regards, Muthu.

3 2

Re: multiiple values in an attribute
by Ali Majdzadeh 07 Sep '06

07 Sep '06

Hi Fonci Thanks for your attention. I consulted the freeradius documentation about the problem. They have mentioned that the AV pairs which contain multiple values are maintained using arrays. These arrays are available in, for example, shell scripts: example: %{Cisco-AVPair[0]} references the value of the *first* Cisco-AVPair attribute (if it exists) in the request packet. You can pass these values as command line arguments to your program. But my problem was about fetching these types of AV pairs using getenv() in C. Example: char *Cisco-AVPair; if (getenv ("Cisco-AVPair")) { Cisco-AVPair = getenv ("Cisco-AVPair"); } Hope this information can help. Best Regards Ali On 9/7/06, Fonci <fonci(a)freemail.hu> wrote: > > Hi Ali! > I've seen your mail in the freeradius mailing list. I think > we have the same problem. Let me write here mine: > So I get accounting requests from a client, which contains > an attribute whit these TLV parameters: > Type : PC_Header > Length: 76 bytes > The Problem: > Value : 003ab54687bcc3029a.... (152 hexadecimal numbers) > parts : message ID. | Event type | .... > > The message ID is a random number. But I need to know the > event type. But all of this are together in one attribute. I > want to separate these. > How can I catch this value, and separate them? You mentioned > a C program or something. Can you give me an advice, how to > try, or where to find information? > Thank you, and > Regards: > F. > > _____________________________________________________________________ > Kamatmentes vásárlás 45 napig! Különleges mindennapok az [origo] klikkbank > hitelkártyával. > http://www.klikkbank.hu/lakossagi/termekek/hitelkartya/index.html > >

1 1

WPA/RADIUS Problems
by Loukas Kalenderidis 07 Sep '06

07 Sep '06

Hi list, I'm a FreeRADIUS noob, and I've been charged with getting some WiFi APs authenticating against an existing FreeRADIUS server being used for dialup users. I've configured FreeRADIUS as best I can figure from what I've found on the web, but I'm having no success with getting WPA to work. I'm using a D-Link 2100AP access point, and a Mac OS X 10.4 client. From what I can gather it seems that I might have misconfigured FreeRADIUS, based on the error message below. I've configured a test user as follows: pants Auth-Type := Accept Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-Id = 1 The last 3 lines I found in a tutorial on the web, but I'm not sure if they are necessary or not (and commenting them out makes no difference). When I run radtest everything looks OK: $ radtest pants "" localhost 1 XXXXXX Sending Access-Request of id 141 to 127.0.0.1:1812 User-Name = "pants" User-Password = "" NAS-IP-Address = newdeewhy NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=141, length=35 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" When I try to connect from my Mac OS X client I get the following error: And the following appears in the radius.log: Fri Sep 1 15:50:59 2006 : Auth: Login OK: [pants] (from client testap port 1 cli 00-0D-93-86-48-8E) Fri Sep 1 15:51:02 2006 : Error: Authentication reply packet code 2 sent to a non-proxy reply port from client testap:1025 - ID 0 : IGNORED Watching the traffic shows the Access-Accept packet being sent back to the AP, but confusingly the AP sends an Access-Accept back to the RADIUS server! (10.0.0.100 is the AP, 10.0.0.101 is the RADIUS server): # tcpdump -nXi eth1 -s 65535 host 10.0.0.100 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes 16:08:43.990613 IP 10.0.0.100.1027 > 10.0.0.101.1812: RADIUS, Access Request (1), id: 0x00 length: 193 0x0000: 4500 00dd 0008 0000 4011 6540 0a00 0064 E.......@.e@...d 0x0010: 0a00 0065 0403 0714 00c9 0613 0100 00c1 ...e............ 0x0020: 3daa 0458 77d9 5edd 5149 6230 7717 7c71 =..Xw.^.QIb0w.|q 0x0030: 5012 091d 4b11 cb44 3587 c0cd d27e c929 P...K..D5....~.) 0x0040: 2bbd 0606 0000 0002 0108 7061 6e74 7300 +.........pants. 0x0050: 0c06 0000 05d0 1e1b 3030 2d31 312d 3935 ........ 00-11-95 0x0060: 2d44 422d 3337 2d30 423a 5465 7374 5750 - DB-37-0B:TestWP 0x0070: 411f 1330 302d 3044 2d39 332d 3836 2d34 A.. 00-0D-93-86-4 0x0080: 382d 3845 2015 442d 4c69 6e6b 2041 6363 8-8E..D- Link.Acc 0x0090: 6573 7320 506f 696e 743d 0600 0000 134d ess.Point=.....M 0x00a0: 1843 4f4e 4e45 4354 2035 344d 6270 7320 .CONNECT. 54Mbps. 0x00b0: 3830 322e 3131 674f 0c02 0000 0a01 7061 802.11gO......pa 0x00c0: 6e74 7304 060a 0000 6405 0600 0000 0157 nts.....d......W 0x00d0: 0e53 5441 2070 6f72 7420 2320 31 .STA.port.#.1 16:08:43.992271 IP 10.0.0.101.1812 > 10.0.0.100.1027: RADIUS, Access Accept (2), id: 0x00 length: 35 0x0000: 4500 003f 0015 4000 4011 25d1 0a00 0065 E..?..@.@. %....e 0x0010: 0a00 0064 0714 0403 002b fc7c 0200 0023 ...d..... +.|...# 0x0020: a6d5 7da7 33d8 c5a1 b0d4 f206 098f 1394 ..}. 3........... 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:08:46.987506 IP 10.0.0.100.1027 > 10.0.0.101.1812: RADIUS, Access Accept (2), id: 0x00 length: 35 0x0000: 4500 003f 0009 0000 4011 65dd 0a00 0064 E..?....@.e....d 0x0010: 0a00 0065 0403 0714 002b 1ab7 0200 0023 ...e..... +.....# 0x0020: 3daa 0458 77d9 5edd 5149 6230 7717 7c71 =..Xw.^.QIb0w.|q 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:08:48.382840 IP 10.0.0.100.1027 > 10.0.0.101.1812: RADIUS, Access Request (1), id: 0x01 length: 193 0x0000: 4500 00dd 000a 0000 4011 653e 0a00 0064 E.......@.e>...d 0x0010: 0a00 0065 0403 0714 00c9 bedd 0101 00c1 ...e............ 0x0020: 0489 1566 53aa 5f00 1842 47e4 38e0 661d ...fS._..BG.8.f. 0x0030: 5012 46a9 7407 9185 bbc4 4d10 7445 1df2 P.F.t.....M.tE.. 0x0040: 301d 0606 0000 0002 0108 7061 6e74 7300 0.........pants. 0x0050: 0c06 0000 05d0 1e1b 3030 2d31 312d 3935 ........ 00-11-95 0x0060: 2d44 422d 3337 2d30 423a 5465 7374 5750 - DB-37-0B:TestWP 0x0070: 411f 1330 302d 3044 2d39 332d 3836 2d34 A.. 00-0D-93-86-4 0x0080: 382d 3845 2015 442d 4c69 6e6b 2041 6363 8-8E..D- Link.Acc 0x0090: 6573 7320 506f 696e 743d 0600 0000 134d ess.Point=.....M 0x00a0: 1843 4f4e 4e45 4354 2035 344d 6270 7320 .CONNECT. 54Mbps. 0x00b0: 3830 322e 3131 674f 0c02 0100 0a01 7061 802.11gO......pa 0x00c0: 6e74 7304 060a 0000 6405 0600 0000 0157 nts.....d......W 0x00d0: 0e53 5441 2070 6f72 7420 2320 31 .STA.port.#.1 16:08:48.384472 IP 10.0.0.101.1812 > 10.0.0.100.1027: RADIUS, Access Accept (2), id: 0x01 length: 35 0x0000: 4500 003f 0016 4000 4011 25d0 0a00 0065 E..?..@.@. %....e 0x0010: 0a00 0064 0714 0403 002b e581 0201 0023 ...d..... +.....# 0x0020: fcf6 b690 11e0 81d6 d8ca 90b4 c0f3 833e ...............> 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:08:51.370904 IP 10.0.0.100.1027 > 10.0.0.101.1812: RADIUS, Access Accept (2), id: 0x01 length: 35 0x0000: 4500 003f 000b 0000 4011 65db 0a00 0064 E..?....@.e....d 0x0010: 0a00 0065 0403 0714 002b 0eb4 0201 0023 ...e..... +.....# 0x0020: 0489 1566 53aa 5f00 1842 47e4 38e0 661d ...fS._..BG.8.f. 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:09:02.626769 IP 10.0.0.100.1028 > 10.0.0.101.1812: RADIUS, Access Request (1), id: 0x00 length: 193 0x0000: 4500 00dd 000c 0000 4011 653c 0a00 0064 E.......@.e<...d 0x0010: 0a00 0065 0404 0714 00c9 03eb 0100 00c1 ...e............ 0x0020: 32b4 2a4d 2ac5 2831 0ba6 120d 3064 6cf9 2.*M*. (1....0dl. 0x0030: 5012 f943 27f4 f8c4 d74c b014 6c59 69e2 P..C'....L..lYi. 0x0040: bc6d 0606 0000 0002 0108 7061 6e74 7300 .m........pants. 0x0050: 0c06 0000 05d0 1e1b 3030 2d31 312d 3935 ........ 00-11-95 0x0060: 2d44 422d 3337 2d30 423a 5465 7374 5750 - DB-37-0B:TestWP 0x0070: 411f 1330 302d 3044 2d39 332d 3836 2d34 A.. 00-0D-93-86-4 0x0080: 382d 3845 2015 442d 4c69 6e6b 2041 6363 8-8E..D- Link.Acc 0x0090: 6573 7320 506f 696e 743d 0600 0000 134d ess.Point=.....M 0x00a0: 1843 4f4e 4e45 4354 2035 344d 6270 7320 .CONNECT. 54Mbps. 0x00b0: 3830 322e 3131 674f 0c02 0000 0a01 7061 802.11gO......pa 0x00c0: 6e74 7304 060a 0000 6405 0600 0000 0157 nts.....d......W 0x00d0: 0e53 5441 2070 6f72 7420 2320 31 .STA.port.#.1 16:09:02.628391 IP 10.0.0.101.1812 > 10.0.0.100.1028: RADIUS, Access Accept (2), id: 0x00 length: 35 0x0000: 4500 003f 0017 4000 4011 25cf 0a00 0065 E..?..@.@. %....e 0x0010: 0a00 0064 0714 0404 002b 310c 0200 0023 ...d..... +1....# 0x0020: 0f90 831a 311e 14e3 2b1e ce7b 7b42 5bdd ....1...+.. {{B[. 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:09:05.620998 IP 10.0.0.100.1028 > 10.0.0.101.1812: RADIUS, Access Accept (2), id: 0x00 length: 35 0x0000: 4500 003f 000d 0000 4011 65d9 0a00 0064 E..?....@.e....d 0x0010: 0a00 0065 0404 0714 002b 6f69 0200 0023 ...e..... +oi...# 0x0020: 32b4 2a4d 2ac5 2831 0ba6 120d 3064 6cf9 2.*M*. (1....0dl. 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:09:06.912295 IP 10.0.0.100.1028 > 10.0.0.101.1812: RADIUS, Access Request (1), id: 0x01 length: 193 0x0000: 4500 00dd 000e 0000 4011 653a 0a00 0064 E.......@.e:...d 0x0010: 0a00 0065 0404 0714 00c9 efec 0101 00c1 ...e............ 0x0020: 25b0 0c0b 4bde 0758 193b 59e7 19fb 7f5e %...K..X.;Y....^ 0x0030: 5012 8626 e5d6 1f1e 6d3f ca86 5fd6 5f64 P..&....m?.._._d 0x0040: 9e83 0606 0000 0002 0108 7061 6e74 7300 ..........pants. 0x0050: 0c06 0000 05d0 1e1b 3030 2d31 312d 3935 ........ 00-11-95 0x0060: 2d44 422d 3337 2d30 423a 5465 7374 5750 - DB-37-0B:TestWP 0x0070: 411f 1330 302d 3044 2d39 332d 3836 2d34 A.. 00-0D-93-86-4 0x0080: 382d 3845 2015 442d 4c69 6e6b 2041 6363 8-8E..D- Link.Acc 0x0090: 6573 7320 506f 696e 743d 0600 0000 134d ess.Point=.....M 0x00a0: 1843 4f4e 4e45 4354 2035 344d 6270 7320 .CONNECT. 54Mbps. 0x00b0: 3830 322e 3131 674f 0c02 0100 0a01 7061 802.11gO......pa 0x00c0: 6e74 7304 060a 0000 6405 0600 0000 0157 nts.....d......W 0x00d0: 0e53 5441 2070 6f72 7420 2320 31 .STA.port.#.1 16:09:06.913952 IP 10.0.0.101.1812 > 10.0.0.100.1028: RADIUS, Access Accept (2), id: 0x01 length: 35 0x0000: 4500 003f 0018 4000 4011 25ce 0a00 0065 E..?..@.@. %....e 0x0010: 0a00 0064 0714 0404 002b 43c4 0201 0023 ...d..... +C....# 0x0020: b02e 5ba5 c0a4 59b4 ee06 063d 6d18 0f23 .. [...Y....=m..# 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 16:09:07.627117 arp who-has 10.0.0.100 tell 10.0.0.101 0x0000: 0001 0800 0604 0001 0080 c8cf df7e 0a00 .............~.. 0x0010: 0065 0000 0000 0000 0a00 0064 .e.........d 16:09:07.627526 arp reply 10.0.0.100 is-at 00:11:95:db:37:0b 0x0000: 0001 0800 0604 0002 0011 95db 370b 0a00 ............7... 0x0010: 0064 0080 c8cf df7e 0a00 0065 0000 0000 .d.....~...e.... 0x0020: 0000 0000 0000 0000 0000 0000 0000 .............. 16:09:09.904367 IP 10.0.0.100.1028 > 10.0.0.101.1812: RADIUS, Access Accept (2), id: 0x01 length: 35 0x0000: 4500 003f 000f 0000 4011 65d7 0a00 0064 E..?....@.e....d 0x0010: 0a00 0065 0404 0714 002b 4903 0201 0023 ...e..... +I....# 0x0020: 25b0 0c0b 4bde 0758 193b 59e7 19fb 7f5e %...K..X.;Y....^ 0x0030: 4006 0000 000d 4106 0000 0006 5103 31 @.....A.....Q.1 Anybody know what is going on here? What have I misconfigured? Thanks, Loukas

7 15