- Freeradius-Users - lists.freeradius.org

wpa auth.xp stuck on login
by Collen Blijenberg 30 Aug '06

30 Aug '06

Good day to you all, I'm kinda stuck with authenticating a windows xp sp2 laptop to a wlan - ap that uses wpa. i followed the 802.1X port based auth howto from tldp.org but no luck. the idea is to use ms-chapv2,eap,tls,peap in the log file i can see the user auth. come by, but no errors or problems showed up. the other day, a friend tried is with his mac i-book, and he did get in!? but now my xp machine doesn't.. dunno where it goes wrong.. starting radiusd -XX gives alot of output, but no error's shown either. here is a small dump.. --------- rad_recv: Access-Request packet from host 10.0.0.20:3072, id=0, length=125 User-Name = "collen" NAS-IP-Address = 10.0.0.20 Called-Station-Id = "0016b69e59c3" Calling-Station-Id = "00166f980e78" NAS-Identifier = "0016b69e59c3" NAS-Port = 46 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000b01636f6c6c656e Message-Authenticator = 0xe97abfadc688db9d412503fc8a0e283f Wed Aug 30 15:53:02 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authorize for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 0 Wed Aug 30 15:53:02 2006 : Debug: radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830' Wed Aug 30 15:53:02 2006 : Debug: rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "auth_log" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP packet type response id 0 length 11 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Wed Aug 30 15:53:02 2006 : Debug: users: Matched entry collen at line 217 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "files" returns ok for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authorize (returns updated) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rad_check_password: Found Auth-Type EAP Wed Aug 30 15:53:02 2006 : Debug: auth: type "EAP" Wed Aug 30 15:53:02 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authenticate for request 0 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP Identity Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: processing type tls Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Initiate Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Start returned 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall[authenticate]: module "eap" returns handled for request 0 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 10.0.0.20 port 3072 Reply-Message = "Go and See your system administrator" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x514be7fc208b2ee1df2cc191b5282f3a Wed Aug 30 15:53:02 2006 : Debug: Finished request 0 Wed Aug 30 15:53:02 2006 : Debug: Going to the next request Wed Aug 30 15:53:02 2006 : Debug: --- Walking the entire request list --- Wed Aug 30 15:53:02 2006 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.20:3072, id=0, length=212 User-Name = "collen" NAS-IP-Address = 10.0.0.20 Called-Station-Id = "0016b69e59c3" Calling-Station-Id = "00166f980e78" NAS-Identifier = "0016b69e59c3" NAS-Port = 46 Framed-MTU = 1400 State = 0x514be7fc208b2ee1df2cc191b5282f3a NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201005019800000004616030100410100003d030144f67859f94017b05e178d502a2f37b42e86f6cb6d6d13bd90a07398bdb3115900001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x0fb306b26777d99c2b78ac78fcbbcf85 Wed Aug 30 15:53:02 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authorize for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling auth_log (rlm_detail) for request 1 Wed Aug 30 15:53:02 2006 : Debug: radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830' Wed Aug 30 15:53:02 2006 : Debug: rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/10.0.0.20/auth-detail-20060830 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from auth_log (rlm_detail) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "auth_log" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP packet type response id 1 length 80 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Wed Aug 30 15:53:02 2006 : Debug: users: Matched entry collen at line 217 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authorize]: module "files" returns ok for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authorize (returns updated) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rad_check_password: Found Auth-Type EAP Wed Aug 30 15:53:02 2006 : Debug: auth: type "EAP" Wed Aug 30 15:53:02 2006 : Debug: Processing the authenticate section of radiusd.conf Wed Aug 30 15:53:02 2006 : Debug: modcall: entering group authenticate for request 1 Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: Request found, released from the list Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: EAP/peap Wed Aug 30 15:53:02 2006 : Debug: rlm_eap: processing type peap Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_peap: Authenticate Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: processing TLS Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: Length Included Wed Aug 30 15:53:02 2006 : Debug: eaptls_verify returned 11 Wed Aug 30 15:53:02 2006 : Debug: (other): before/accept initialization Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: before/accept initialization Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 read client hello A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write server hello A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write certificate A Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 write server done A Wed Aug 30 15:53:02 2006 : Debug: TLS_accept: SSLv3 flush data Wed Aug 30 15:53:02 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Aug 30 15:53:02 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Aug 30 15:53:02 2006 : Debug: In SSL Handshake Phase Wed Aug 30 15:53:02 2006 : Debug: In SSL Accept mode Wed Aug 30 15:53:02 2006 : Debug: eaptls_process returned 13 Wed Aug 30 15:53:02 2006 : Debug: rlm_eap_peap: EAPTLS_HANDLED Wed Aug 30 15:53:02 2006 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall[authenticate]: module "eap" returns handled for request 1 Wed Aug 30 15:53:02 2006 : Debug: modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 10.0.0.20 port 3072 Reply-Message = "Go and See your system administrator" EAP-Message = 0x0102040a19c0000006f1160301004a02000046030144f5983e2a3f2787f349e2c803691e2bd1dcecb00c4cdf71d8130966b67808e0203c016a91c6fb93cb2a5b767bd564efb362ae8b997c45585ec2c3ff446bda25e800040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x98cb9ce82b22aff87c8ddd218edbc40a Wed Aug 30 15:53:02 2006 : Debug: Finished request 1 Wed Aug 30 15:53:02 2006 : Debug: Going to the next request Wed Aug 30 15:53:02 2006 : Debug: rl_next: returning NULL --------------- Cheers Collen..

1 0

Reply VSA-s in Access-Reject
by Yervand Petrosyan 30 Aug '06

30 Aug '06

Thank you for answers, Really, it would be reasonably to have this option configurable. Yervand On Wed 30 Aug 2006 12:13, Nicolas Baradakis wrote: > Yervand Petrosyan wrote: > > In 1.1.3 version Access-Reject doesn't return in reply > > VSA attributes but it is works well in 1.0.1. > > Something was changed? > > Yes, because it was considered as a bug. > See http://bugs.freeradius.org/show_bug.cgi?id=207 > > I also note Vendor-Specific attributes aren't allow in Access-Reject > packets per RFC 2865. (section 5.44) > See http://www.ietf.org/rfc/rfc2865.txt This is not the first time we have been asked this, and as it appears that some NASes used this behaviour, maybe we should make this rfc compliance a configurable option.. I have added a section to the FAQ: http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#VSA_in_Access-Reje… -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

no more anonymous@my.realm
by A.L.M.Buxey＠lboro.ac.uk 30 Aug '06

30 Aug '06

hi, got a small question for those used to xlate etc. I have a development/test setup here which is happily authenticating via EAP/TTLS and PEAP. however, what I am seeing is that Windows users using PEAP are having their real name logged and recorded, whereas the Mac TTLS and Windows TTLS folk are being recorded as anonymous(a)my.realm - ie the outer layer is being recorded as their username (the inner layer username is happily being used for the authorization stage so all is okay....but the NAS and authentication/accounting SQL are filled with the anonymous(a)my.realm now, the Windows PEAP users also have anonymous(a)my.realm as their outer ID but I believe its the 'Windows is a bit leaky with inner credentials' issue that is allowing their real ID to be caught and logged. whats the recommended way of fixing this? what have other people done to fix this? enabling features such as use_tunneled_reply and log_stripped_name havent helped... I am thinking that xlate is the way to go oh, and currently the RADPOSTAUTH table is showing the real ID and the anonymous ID which isnt helping the NAS which receives the anonymous part last. do I simply drop or discard the anonymous part when it gets to this proxy box? alan

1 0

Cannot compile and run on Mac OS X 10.4.7
by Michael Check 30 Aug '06

30 Aug '06

Hi all, We've tried to compile fr v1.1.2 on os x.4.7 with no luck. We've followed the instructions at doc/MACOSX (using --disable_shared - the mod for the makefile for rlm_sql is already done in this version) but get the following errors during make (this is the tail of the make): /usr/bin/ld: multiple definitions of symbol _CRYPTO_lock /usr/lib/libcrypto.dylib(cryptlib.o) definition of _CRYPTO_lock /usr/local/mysql/lib/libmysqlclient_r.a(libtaocrypt_la-misc.o) definition of _CRYPTO_lock in section (__TEXT,__text) collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Error 1 make[3]: *** [common] Error 2 make[2]: *** [all] Error 2 make[1]: *** [common] Error 2 make: *** [all] Error 2 And cannot proceed further. --- If you try and compile _without_ --disable_shared, the we get through make with this at the end: /usr/local/src/freeradius-1.1.2/libtool --mode=link gcc -o radwho radwho.lo util.lo log.lo conffile.lo -lresolv -lpthread ../lib/libradius.la gcc -o .libs/radwho radwho.o util.o log.o conffile.o -lresolv -lpthread -L../lib/.libs -lradius creating radwho Making all in raddb... make[2]: Nothing to be done for `all'. Making all in scripts... make[2]: Nothing to be done for `all'. Making all in doc... Making all in examples... /usr/bin/make -C examples all make[4]: Nothing to be done for `all'. Making all in rfc... /usr/bin/make -C rfc all make[4]: Nothing to be done for `all'. The make install has these ominous warning while linking all the libraries for each rlm: ---------------------------------------------------------------------- Making install in rlm_realm... if [ "xrlm_realm" != "x" ]; then \ /usr/local/src/freeradius-1.1.2/libtool --mode=install /usr/local/src/freeradius-1.1.2/install-sh -c -c \ rlm_realm.la /usr/local/lib/rlm_realm.la || exit $?; \ rm -f /usr/local/lib/rlm_realm-1.1.2.la; \ ln -s rlm_realm.la /usr/local/lib/rlm_realm-1.1.2.la || exit $?; \ fi libtool: install: warning: relinking `rlm_realm.la' (cd /usr/local/src/freeradius-1.1.2/src/modules/rlm_realm; /bin/sh /usr/local/src/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -module -export-dynamic -o rlm_realm.la -rpath /usr/local/lib rlm_realm.lo rlm_realm.c /usr/local/src/freeradius-1.1.2/src/lib/libradius.la -lresolv -lpthread) gcc -dynamiclib -flat_namespace -undefined suppress -o .libs/rlm_realm-1.1.2.so rlm_realm.lo /usr/local/lib/libradius.dylib -lresolv -lpthread -lc -install_name /usr/local/lib/rlm_realm-1.1.2.so /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm-1.1.2.soT /usr/local/lib/rlm_realm-1.1.2.so (cd /usr/local/lib && rm -f rlm_realm.so && ln -s rlm_realm-1.1.2.so rlm_realm.so) /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm.lai /usr/local/lib/rlm_realm.la /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_realm.a /usr/local/lib/rlm_realm.a ranlib /usr/local/lib/rlm_realm.a chmod 644 /usr/local/lib/rlm_realm.a ---------------------------------------------------------------------- Libraries have been installed in: /usr/local/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `DYLD_LIBRARY_PATH' environment variable during execution See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- AND FOR PERL: Making install in rlm_perl... /usr/local/src/freeradius-1.1.2/install-sh -c -m 755 example.pl /usr/local/etc/raddb if [ "xrlm_perl" != "x" ]; then \ /usr/local/src/freeradius-1.1.2/libtool --mode=install /usr/local/src/freeradius-1.1.2/install-sh -c -c \ rlm_perl.la /usr/local/lib/rlm_perl.la || exit $?; \ rm -f /usr/local/lib/rlm_perl-1.1.2.la; \ ln -s rlm_perl.la /usr/local/lib/rlm_perl-1.1.2.la || exit $?; \ fi libtool: install: warning: relinking `rlm_perl.la' (cd /usr/local/src/freeradius-1.1.2/src/modules/rlm_perl; /bin/sh /usr/local/src/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -module -export-dynamic -o rlm_perl.la -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /usr/local/src/freeradius-1.1.2/src/lib/libradius.la -L/usr/local/lib /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a -L/System/Library/Perl/5.8.6/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lc -lresolv -lpthread) *** Warning: This library needs some functionality provided by /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLoader.a. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. gcc -dynamiclib -flat_namespace -undefined suppress -o .libs/rlm_perl-1.1.2.so rlm_perl.lo /usr/local/lib/libradius.dylib -L/usr/local/lib -L/System/Library/Perl/5.8.6/darwin-thread-multi-2level/CORE -lperl -ldl -lm -lc -lresolv -lpthread -lc -install_name /usr/local/lib/rlm_perl-1.1.2.so /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl-1.1.2.soT /usr/local/lib/rlm_perl-1.1.2.so (cd /usr/local/lib && rm -f rlm_perl.so && ln -s rlm_perl-1.1.2.so rlm_perl.so) /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl.lai /usr/local/lib/rlm_perl.la /usr/local/src/freeradius-1.1.2/install-sh -c -c .libs/rlm_perl.a /usr/local/lib/rlm_perl.a ranlib /usr/local/lib/rlm_perl.a chmod 644 /usr/local/lib/rlm_perl.a AND RUNNING sudo radiusd -X, the following error results: read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd.conf[1565] Failed to link to module 'rlm_exec': dlopen(/usr/local/lib/rlm_exec-1.1.2.so, 9): Symbol not found: _debug_flag Referenced from: /usr/local/lib/rlm_exec-1.1.2.so Expected in: flat namespace AND QUITS IMMEDIATELY --- We tried googling around and we're happy to hear that freeradius will be a part of 10.5, but we'd like to get it running now... There really is no other docs we've found on getting it compiled (after difficulty like the above) and installed. Certainly nothing recent anyway. Is it true that it _should_ just work? :) Thanks in advance for any assistance, Michael Check

7 16

Checking Service-Type with checkval and mysql
by Guilhem MORE-CAUSSE 30 Aug '06

30 Aug '06

Hello I am currently trying to have my FreeRadius server check the "Service-Type" values, and reject Login attempts from a user that should be used for service-type Outbound only. My client equipment always send the "Service-Type" attribute in its requests. This attribute is defined into the check databases, but debug mode says: >>Debug: rlm_checkval: Could not find attribute named Service-Type in check pairs I really do not see what is wrong and why value checking is not done properly. It should find the attribute in the database, and reject the request. Can you help me out ? Below is my radcheck table, relevant parts of my radiusd.config and the debug output. mysql> select * from radcheck; +----+----------+--------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+--------------+----+----------+ | 3 | admin | Password | == | cisco | | 5 | admin | Service-Type | == | Outbound | +----+----------+--------------+----+----------+ checkval { item-name = Service-Type check-name = Service-Type data-type = string notfound-reject = yes } //... authorize { preprocess chap suffix eap #files sql checkval } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } eap } rad_recv: Access-Request packet from host 10.10.107.68:1645, id=6, length=86 NAS-IP-Address = 10.10.107.68 NAS-Port = 500 NAS-Port-Type = Virtual User-Name = "admin" Calling-Station-Id = "XXX.XXX.XXX.XXX" User-Password = "cisco" Service-Type = Login-User Wed Aug 30 11:30:13 2006 : Debug: Processing the authorize section of radiusd.conf Wed Aug 30 11:30:13 2006 : Debug: modcall: entering group authorize for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_realm: No '@' in User-Name = "admin", looking up realm NULL Wed Aug 30 11:30:13 2006 : Debug: rlm_realm: No such realm "NULL" Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling sql (rlm_sql) for request 1 Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'admin' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): sql_set_user escaped user --> 'admin' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'admin' ORDER BY id' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'admin' ORDER BY id' Wed Aug 30 11:30:13 2006 : Debug: radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' Wed Aug 30 11:30:13 2006 : Debug: rlm_sql (sql): Released sql socket id: 3 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from sql (rlm_sql) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "sql" returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: calling checkval (rlm_checkval) for request 1 Wed Aug 30 11:30:13 2006 : Debug: rlm_checkval: Item Name: Service-Type, Value: Login-User Wed Aug 30 11:30:13 2006 : Debug: rlm_checkval: Could not find attribute named Service-Type in check pairs Wed Aug 30 11:30:13 2006 : Debug: modsingle[authorize]: returned from checkval (rlm_checkval) for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall[authorize]: module "checkval" returns notfound for request 1 Wed Aug 30 11:30:13 2006 : Debug: modcall: group authorize returns ok for request 1 Wed Aug 30 11:30:13 2006 : Debug: auth: type Local Wed Aug 30 11:30:13 2006 : Debug: auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 6 to 10.10.107.68:1645 Cisco-AVPair += "ipsec:tunnel-password=admin123" Cisco-AVPair == "ipsec:addr-pool=admin" Cisco-AVPair == "ipsec:inacl=admin" Service-Type == Outbound-User Cisco-AVPair += "shell:priv-lvl=0" Cisco-AVPair += "ipsec:key-exchange=ike" Cisco-AVPair += "ipsec:key-exchange=preshared-key" Tunnel-Type:0 == ESP Wed Aug 30 11:30:13 2006 : Debug: Finished request 1 Wed Aug 30 11:30:13 2006 : Debug: Going to the next request Thanks for your help ! G.

1 0

Reply VSA-s in Access-Reject
by Yervand Petrosyan 30 Aug '06

30 Aug '06

Hello, In 1.1.3 version Access-Reject doesn't return in reply VSA attributes but it is works well in 1.0.1. Something was changed? Thanks in advance, Yervand __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

public key for source signature
by Jonathan Casiot 30 Aug '06

30 Aug '06

Hi I've downloaded the most recent source, freeradius-1.1.3.tar.gz, and I'd like to verify the file against the PGP signature but I can't find the public key anywhere. Can someone point me to it's location? Thanks -- Jonathan

2 1

LDAP authentication
by Lin Richardson 30 Aug '06

30 Aug '06

A general question that I have not seen in the forum. I want to authenticate against LDAP... BUT I don't want to use the LDAP password as the password in every case. In a remote connectivity solution I want to check the remotepassword attribute for authentication. Problem is (as I see it), that the real LDAP password is not passed in with the remote connectivity request, so the request seems to be failing. If I make the request with the LDAP password, it succeeds. So my question, and I know that there is a caveat about a cleartext password being required for LDAP authentication, is: Can I make a request to freeradius that gets passed to LDAP but only requires the password to be checked against an attribute of the username, NOT the real LDAP password. Any insight/experience or pointers to helpful doc sources would be appreciated. Regards, Lin Richardson

2 4

Error 403 Dialupadmin
by toink_lagi_enak 30 Aug '06

30 Aug '06

Dear users, i've already configured my pc with freeradius 1.1.2, and after i configured, there still error to load the web page of dialupadmin. I tried some advices : changed the permission of the directory of dialupadmin into 701, added the directory on httpd.conf change the value allowoverride allow, but still got Error 403 about permission denied. My Distro : Linux Trustix 2.2 Kernel : 2.4.32-1tr Sorry for my bad english -- Thanks, Thohir http://toinkers.blogspot.com/

1 0

RE: Building Freeradius RPM on Redhat ES 4.0
by Sandworm 30 Aug '06

30 Aug '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Wednesday, 30 August 2006 10:19 AM, Michael King wrote: > > > -----Original Message----- > > I saw this last week building 1.1.3 on RHEL 4.0 ES (Update 3) too. > > Was fixed > > by just applying the latest patches from Redhat. Appears to > > be due to a mismatch between various software levels. With > > the latest fixes, it is all OK. > > > > > Which patches? Just run Up2date and all should be well? > Should be. We have an internal yum repository that collects all the latest updates from Redhat. I just did a "yum -y update" and all was well. SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkT07JAACgkQmw4BJyaatJ1rmwCcD2A6uODCMCxsgc4E7HuQQrEQ6nkA oL3bMPfyWYoZiAAVwMKX7o1fDdNq =SQrq -----END PGP SIGNATURE-----

1 0