- Freeradius-Users - lists.freeradius.org

how to rewrite and replicate accounting?
by Justin Church 21 Aug '06

21 Aug '06

I want to take all accounting packets received and either rewrite received attributes or append new attributes using a custom dictionary and then replicate the rewritten packets to multiple radius servers. Freeradius documentation seems to indicate this should be doable, but I can't seem to find any specific examples. Looks like I need some combination of the rlm_attr_rewrite, rlm_preprocess, and rlm_proxy modules? Is this correct? Thanks in advance. -jc

1 0

Re: rlm_proxy problems
by Geoff Silver 21 Aug '06

21 Aug '06

I'll give it a shot. I'm trying to build 1.1.2 with that patch, but I'm having issues when compiling rlm_eap and rlm_eap_tls: gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/root/syssec/reverb/src/include -I../.. -I../../libeap -I/root/syssec/reverb/libltdl -DOPENSSL_NO_KRB5 -c rlm_eap_tls.c -fPIC -DPIC -o .libs/rlm_eap_tls.lo In file included from rlm_eap_tls.h:26, from rlm_eap_tls.c:30: eap_tls.h:163: syntax error before "uint8_t" eap_tls.h:163: warning: no semicolon at end of struct or union eap_tls.h:164: warning: type defaults to `int' in declaration of `data' eap_tls.h:164: warning: data definition has no type or storage class eap_tls.h:165: syntax error before '}' token eap_tls.h:165: warning: type defaults to `int' in declaration of `eaptls_packet_t' eap_tls.h:165: warning: data definition has no type or storage class eap_tls.h:168: syntax error before "uint8_t" eap_tls.h:168: warning: no semicolon at end of struct or union eap_tls.h:169: warning: type defaults to `int' in declaration of `id' eap_tls.h:169: warning: data definition has no type or storage class eap_tls.h:170: syntax error before "length" eap_tls.h:170: warning: type defaults to `int' in declaration of `length' eap_tls.h:170: warning: data definition has no type or storage class eap_tls.h:171: syntax error before "flags" eap_tls.h:171: warning: type defaults to `int' in declaration of `flags' eap_tls.h:171: warning: data definition has no type or storage class eap_tls.h:172: syntax error before '*' token eap_tls.h:172: warning: type defaults to `int' in declaration of `data' eap_tls.h:172: conflicting types for `data' eap_tls.h:164: previous declaration of `data' eap_tls.h:172: warning: redundant redeclaration of `data' in same scope eap_tls.h:164: warning: previous declaration of `data' eap_tls.h:172: warning: data definition has no type or storage class eap_tls.h:173: syntax error before "dlen" eap_tls.h:173: warning: type defaults to `int' in declaration of `dlen' eap_tls.h:173: warning: data definition has no type or storage class eap_tls.h:176: warning: type defaults to `int' in declaration of `EAPTLS_PACKET' eap_tls.h:176: warning: data definition has no type or storage class eap_tls.h:209: syntax error before "SSL_CTX" eap_tls.h:209: warning: no semicolon at end of struct or union eap_tls.h:210: warning: type defaults to `int' in declaration of `eap_tls_t' eap_tls.h:210: warning: data definition has no type or storage class eap_tls.h:214: syntax error before '*' token eap_tls.h:214: warning: type defaults to `int' in declaration of `eaptls_alloc' eap_tls.h:214: warning: data definition has no type or storage class eap_tls.h:215: syntax error before '*' token eap_tls.h:215: warning: function declaration isn't a prototype eap_tls.h:216: syntax error before '*' token eap_tls.h:216: warning: function declaration isn't a prototype eap_tls.h:217: syntax error before '*' token eap_tls.h:217: warning: function declaration isn't a prototype eap_tls.h:221: warning: type defaults to `int' in declaration of `SSL' eap_tls.h:221: syntax error before '*' token eap_tls.h:221: warning: function declaration isn't a prototype eap_tls.h:222: syntax error before "X509_STORE_CTX" eap_tls.h:222: warning: function declaration isn't a prototype eap_tls.h:224: syntax error before "size_t" eap_tls.h:224: warning: function declaration isn't a prototype eap_tls.h:225: syntax error before '*' token eap_tls.h:225: syntax error before '*' token eap_tls.h:225: warning: type defaults to `int' in declaration of `cbtls_rsa' eap_tls.h:225: warning: function declaration isn't a prototype eap_tls.h:225: warning: data definition has no type or storage class eap_tls.h:228: syntax error before '*' token eap_tls.h:228: syntax error before '*' token eap_tls.h:228: warning: type defaults to `int' in declaration of `eaptls_new_session' eap_tls.h:228: warning: function declaration isn't a prototype eap_tls.h:228: warning: data definition has no type or storage class eap_tls.h:229: syntax error before '*' token eap_tls.h:229: warning: function declaration isn't a prototype eap_tls.h:230: syntax error before '*' token eap_tls.h:230: warning: function declaration isn't a prototype eap_tls.h:231: syntax error before '*' token eap_tls.h:231: warning: function declaration isn't a prototype eap_tls.h:235: syntax error before '*' token eap_tls.h:235: warning: function declaration isn't a prototype eap_tls.h:236: syntax error before '*' token eap_tls.h:236: warning: function declaration isn't a prototype eap_tls.h:239: syntax error before '*' token eap_tls.h:239: warning: function declaration isn't a prototype eap_tls.h:240: syntax error before '*' token eap_tls.h:240: warning: function declaration isn't a prototype eap_tls.h:241: syntax error before '*' token eap_tls.h:242: warning: function declaration isn't a prototype eap_tls.h:243: syntax error before '*' token eap_tls.h:244: warning: function declaration isn't a prototype In file included from /root/syssec/reverb/src/include/libradius.h:59, from /root/syssec/reverb/src/include/radiusd.h:10, from rlm_eap_tls.h:28, from rlm_eap_tls.c:30: /root/syssec/reverb/src/include/sha1.h:22: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here In file included from /root/syssec/reverb/src/include/radiusd.h:10, from rlm_eap_tls.h:28, from rlm_eap_tls.c:30: /root/syssec/reverb/src/include/libradius.h:187: warning: declaration of `flags' shadows a global declaration eap_tls.h:171: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:249: warning: declaration of `id' shadows a global declaration eap_tls.h:169: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:367: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:378: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:394: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here /root/syssec/reverb/src/include/libradius.h:397: warning: declaration of `data' shadows a global declaration eap_tls.h:172: warning: shadowed declaration is here In file included from rlm_eap_tls.c:30: rlm_eap_tls.h:32: redefinition of `struct eap_tls_conf' rlm_eap_tls.h:57: redefinition of `EAP_TLS_CONF' eap_tls.h:203: `EAP_TLS_CONF' previously declared here rlm_eap_tls.h:62: syntax error before "SSL_CTX" rlm_eap_tls.h:62: warning: no semicolon at end of struct or union rlm_eap_tls.h:63: warning: type defaults to `int' in declaration of `eap_tls_t' rlm_eap_tls.h:63: warning: redundant redeclaration of `eap_tls_t' in same scope eap_tls.h:210: warning: previous declaration of `eap_tls_t' rlm_eap_tls.h:63: warning: data definition has no type or storage class rlm_eap_tls.c:79: syntax error before '*' token rlm_eap_tls.c:80: warning: function declaration isn't a prototype rlm_eap_tls.c: In function `load_dh_params': rlm_eap_tls.c:81: `DH' undeclared (first use in this function) rlm_eap_tls.c:81: (Each undeclared identifier is reported only once rlm_eap_tls.c:81: for each function it appears in.) rlm_eap_tls.c:81: `dh' undeclared (first use in this function) rlm_eap_tls.c:82: `BIO' undeclared (first use in this function) rlm_eap_tls.c:82: `bio' undeclared (first use in this function) rlm_eap_tls.c:84: warning: implicit declaration of function `BIO_new_file' rlm_eap_tls.c:84: `file' undeclared (first use in this function) rlm_eap_tls.c:89: warning: implicit declaration of function `PEM_read_bio_DHparams' rlm_eap_tls.c:90: warning: implicit declaration of function `BIO_free' rlm_eap_tls.c:91: warning: implicit declaration of function `SSL_CTX_set_tmp_dh' rlm_eap_tls.c:91: `ctx' undeclared (first use in this function) rlm_eap_tls.c:93: warning: implicit declaration of function `DH_free' rlm_eap_tls.c:97: warning: redundant redeclaration of `DH_free' in same scope rlm_eap_tls.c:93: warning: previous declaration of `DH_free' rlm_eap_tls.c: At top level: rlm_eap_tls.c:104: syntax error before '*' token rlm_eap_tls.c:105: warning: function declaration isn't a prototype rlm_eap_tls.c: In function `generate_eph_rsa_key': rlm_eap_tls.c:106: `RSA' undeclared (first use in this function) rlm_eap_tls.c:106: `rsa' undeclared (first use in this function) rlm_eap_tls.c:108: warning: implicit declaration of function `RSA_generate_key' rlm_eap_tls.c:108: `RSA_F4' undeclared (first use in this function) rlm_eap_tls.c:110: warning: implicit declaration of function `SSL_CTX_set_tmp_rsa' rlm_eap_tls.c:110: `ctx' undeclared (first use in this function) rlm_eap_tls.c:115: warning: implicit declaration of function `RSA_free' rlm_eap_tls.c: At top level: rlm_eap_tls.c:145: syntax error before "X509_STORE_CTX" rlm_eap_tls.c:146: warning: function declaration isn't a prototype rlm_eap_tls.c:146: warning: static declaration for `cbtls_verify' follows non-static rlm_eap_tls.c: In function `cbtls_verify': rlm_eap_tls.c:151: `EAP_HANDLER' undeclared (first use in this function) rlm_eap_tls.c:151: `handler' undeclared (first use in this function) rlm_eap_tls.c:152: `X509' undeclared (first use in this function) rlm_eap_tls.c:152: `client_cert' undeclared (first use in this function) rlm_eap_tls.c:153: `SSL' undeclared (first use in this function) rlm_eap_tls.c:153: `ssl' undeclared (first use in this function) rlm_eap_tls.c:156: `ok' undeclared (first use in this function) rlm_eap_tls.c:158: warning: implicit declaration of function `X509_STORE_CTX_get_current_cert' rlm_eap_tls.c:158: `ctx' undeclared (first use in this function) rlm_eap_tls.c:159: warning: implicit declaration of function `X509_STORE_CTX_get_error' rlm_eap_tls.c:160: warning: implicit declaration of function `X509_STORE_CTX_get_error_depth' rlm_eap_tls.c:164: warning: implicit declaration of function `X509_verify_cert_error_string' rlm_eap_tls.c:164: warning: format argument is not a pointer (arg 4) rlm_eap_tls.c:172: warning: implicit declaration of function `X509_STORE_CTX_get_ex_data' rlm_eap_tls.c:172: warning: implicit declaration of function `SSL_get_ex_data_X509_STORE_CTX_idx' rlm_eap_tls.c:173: syntax error before ')' token rlm_eap_tls.c:174: warning: implicit declaration of function `SSL_get_ex_data' rlm_eap_tls.c:180: warning: implicit declaration of function `X509_NAME_oneline' rlm_eap_tls.c:180: warning: implicit declaration of function `X509_get_subject_name' rlm_eap_tls.c:182: warning: implicit declaration of function `X509_get_issuer_name' rlm_eap_tls.c:191: warning: implicit declaration of function `X509_NAME_get_text_by_NID' rlm_eap_tls.c:192: `NID_commonName' undeclared (first use in this function) rlm_eap_tls.c:197: `X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT' undeclared (first use in this function) rlm_eap_tls.c:200: `X509_V_ERR_CERT_NOT_YET_VALID' undeclared (first use in this function) rlm_eap_tls.c:201: `X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD' undeclared (first use in this function) rlm_eap_tls.c:207: `X509_V_ERR_CERT_HAS_EXPIRED' undeclared (first use in this function) rlm_eap_tls.c:208: `X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD' undeclared (first use in this function) rlm_eap_tls.c: At top level: rlm_eap_tls.c:274: syntax error before '*' token rlm_eap_tls.c:275: warning: return type defaults to `int' rlm_eap_tls.c:275: warning: no previous prototype for `init_tls_ctx' rlm_eap_tls.c: In function `init_tls_ctx': rlm_eap_tls.c:276: `SSL_METHOD' undeclared (first use in this function) rlm_eap_tls.c:276: `meth' undeclared (first use in this function) rlm_eap_tls.c:277: `SSL_CTX' undeclared (first use in this function) rlm_eap_tls.c:277: `ctx' undeclared (first use in this function) rlm_eap_tls.c:278: `X509_STORE' undeclared (first use in this function) rlm_eap_tls.c:278: `certstore' undeclared (first use in this function) rlm_eap_tls.c:279: `SSL_VERIFY_NONE' undeclared (first use in this function) rlm_eap_tls.c:287: warning: implicit declaration of function `SSL_library_init' rlm_eap_tls.c:288: warning: implicit declaration of function `SSL_load_error_strings' rlm_eap_tls.c:290: warning: implicit declaration of function `TLSv1_method' rlm_eap_tls.c:291: warning: implicit declaration of function `SSL_CTX_new' rlm_eap_tls.c:297: `SSL_FILETYPE_PEM' undeclared (first use in this function) rlm_eap_tls.c:299: `SSL_FILETYPE_ASN1' undeclared (first use in this function) rlm_eap_tls.c:306: warning: implicit declaration of function `SSL_CTX_set_default_passwd_cb_userdata' rlm_eap_tls.c:307: warning: implicit declaration of function `SSL_CTX_set_default_passwd_cb' rlm_eap_tls.c:321: warning: implicit declaration of function `SSL_CTX_use_certificate_chain_file' rlm_eap_tls.c:322: warning: implicit declaration of function `ERR_error_string' rlm_eap_tls.c:322: warning: implicit declaration of function `ERR_get_error' rlm_eap_tls.c:322: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:327: warning: implicit declaration of function `SSL_CTX_use_certificate_file' rlm_eap_tls.c:328: warning: redundant redeclaration of `ERR_error_string' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_error_string' rlm_eap_tls.c:328: warning: redundant redeclaration of `ERR_get_error' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_get_error' rlm_eap_tls.c:328: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:335: warning: implicit declaration of function `SSL_CTX_load_verify_locations' rlm_eap_tls.c:336: warning: redundant redeclaration of `ERR_error_string' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_error_string' rlm_eap_tls.c:336: warning: redundant redeclaration of `ERR_get_error' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_get_error' rlm_eap_tls.c:336: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:340: warning: implicit declaration of function `SSL_CTX_set_client_CA_list' rlm_eap_tls.c:340: warning: implicit declaration of function `SSL_load_client_CA_file' rlm_eap_tls.c:342: warning: implicit declaration of function `SSL_CTX_use_PrivateKey_file' rlm_eap_tls.c:343: warning: redundant redeclaration of `ERR_error_string' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_error_string' rlm_eap_tls.c:343: warning: redundant redeclaration of `ERR_get_error' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_get_error' rlm_eap_tls.c:343: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:351: warning: implicit declaration of function `SSL_CTX_check_private_key' rlm_eap_tls.c:359: `SSL_OP_NO_SSLv2' undeclared (first use in this function) rlm_eap_tls.c:360: `SSL_OP_NO_SSLv3' undeclared (first use in this function) rlm_eap_tls.c:371: `SSL_OP_SINGLE_DH_USE' undeclared (first use in this function) rlm_eap_tls.c:372: warning: implicit declaration of function `SSL_CTX_set_options' rlm_eap_tls.c:389: warning: implicit declaration of function `SSL_CTX_set_info_callback' rlm_eap_tls.c:410: `SSL_VERIFY_PEER' undeclared (first use in this function) rlm_eap_tls.c:411: `SSL_VERIFY_FAIL_IF_NO_PEER_CERT' undeclared (first use in this function) rlm_eap_tls.c:412: `SSL_VERIFY_CLIENT_ONCE' undeclared (first use in this function) rlm_eap_tls.c:413: warning: implicit declaration of function `SSL_CTX_set_verify' rlm_eap_tls.c:416: warning: implicit declaration of function `SSL_CTX_set_verify_depth' rlm_eap_tls.c:420: warning: implicit declaration of function `RAND_load_file' rlm_eap_tls.c:421: warning: redundant redeclaration of `ERR_error_string' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_error_string' rlm_eap_tls.c:421: warning: redundant redeclaration of `ERR_get_error' in same scope rlm_eap_tls.c:322: warning: previous declaration of `ERR_get_error' rlm_eap_tls.c:421: warning: format argument is not a pointer (arg 3) rlm_eap_tls.c:430: warning: implicit declaration of function `SSL_CTX_set_cipher_list' rlm_eap_tls.c: In function `eaptls_detach': rlm_eap_tls.c:446: `inst' undeclared (first use in this function) rlm_eap_tls.c:448: syntax error before ')' token rlm_eap_tls.c:452: warning: implicit declaration of function `free' rlm_eap_tls.c:467: warning: implicit declaration of function `SSL_CTX_free' rlm_eap_tls.c:470: warning: redundant redeclaration of `free' in same scope rlm_eap_tls.c:452: warning: previous declaration of `free' rlm_eap_tls.c:443: warning: unused parameter `arg' rlm_eap_tls.c: In function `eaptls_attach': rlm_eap_tls.c:482: `inst' undeclared (first use in this function) rlm_eap_tls.c:485: syntax error before ')' token rlm_eap_tls.c: At top level: rlm_eap_tls.c:552: syntax error before "EAP_HANDLER" rlm_eap_tls.c:553: warning: function declaration isn't a prototype rlm_eap_tls.c: In function `eaptls_initiate': rlm_eap_tls.c:555: `tls_session_t' undeclared (first use in this function) rlm_eap_tls.c:555: `ssn' undeclared (first use in this function) rlm_eap_tls.c:556: `inst' undeclared (first use in this function) rlm_eap_tls.c:559: `SSL_VERIFY_NONE' undeclared (first use in this function) rlm_eap_tls.c:561: syntax error before ')' token rlm_eap_tls.c:569: `handler' undeclared (first use in this function) rlm_eap_tls.c:569: `PW_EAP_TLS' undeclared (first use in this function) rlm_eap_tls.c:596: `SSL_VERIFY_PEER' undeclared (first use in this function) rlm_eap_tls.c:597: `SSL_VERIFY_FAIL_IF_NO_PEER_CERT' undeclared (first use in this function) rlm_eap_tls.c:598: `SSL_VERIFY_CLIENT_ONCE' undeclared (first use in this function) rlm_eap_tls.c:600: warning: implicit declaration of function `SSL_set_verify' rlm_eap_tls.c:610: warning: implicit declaration of function `SSL_set_ex_data' rlm_eap_tls.c:633: `PW_EAP_PEAP' undeclared (first use in this function) rlm_eap_tls.c:665: `AUTHENTICATE' undeclared (first use in this function) rlm_eap_tls.c: At top level: rlm_eap_tls.c:673: syntax error before "EAP_HANDLER" rlm_eap_tls.c:674: warning: function declaration isn't a prototype rlm_eap_tls.c: In function `eaptls_authenticate': rlm_eap_tls.c:675: `eaptls_status_t' undeclared (first use in this function) rlm_eap_tls.c:675: syntax error before "status" rlm_eap_tls.c:676: `tls_session_t' undeclared (first use in this function) rlm_eap_tls.c:676: `tls_session' undeclared (first use in this function) rlm_eap_tls.c:676: syntax error before ')' token rlm_eap_tls.c:680: `status' undeclared (first use in this function) rlm_eap_tls.c:680: warning: implicit declaration of function `eaptls_process' rlm_eap_tls.c:680: `handler' undeclared (first use in this function) rlm_eap_tls.c:687: `EAPTLS_SUCCESS' undeclared (first use in this function) rlm_eap_tls.c:695: `EAPTLS_HANDLED' undeclared (first use in this function) rlm_eap_tls.c:702: `EAPTLS_OK' undeclared (first use in this function) rlm_eap_tls.c:723: warning: implicit declaration of function `eaptls_fail' rlm_eap_tls.c:737: warning: implicit declaration of function `eaptls_success' rlm_eap_tls.c:738: warning: implicit declaration of function `eaptls_gen_mppe_keys' rlm_eap_tls.c: At top level: rlm_eap_tls.c:748: syntax error before "rlm_eap_tls" rlm_eap_tls.c:748: warning: type defaults to `int' in declaration of `rlm_eap_tls' rlm_eap_tls.c:749: warning: initialization makes integer from pointer without a cast rlm_eap_tls.c:750: warning: excess elements in scalar initializer rlm_eap_tls.c:750: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:751: warning: excess elements in scalar initializer rlm_eap_tls.c:751: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:752: warning: excess elements in scalar initializer rlm_eap_tls.c:752: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:753: warning: excess elements in scalar initializer rlm_eap_tls.c:753: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:755: warning: excess elements in scalar initializer rlm_eap_tls.c:755: warning: (near initialization for `rlm_eap_tls') rlm_eap_tls.c:755: warning: data definition has no type or storage class make[9]: *** [rlm_eap_tls.lo] Error 1 make[9]: Leaving directory `/root/syssec/reverb/src/modules/rlm_eap/types/rlm_eap_tls' make[8]: *** [common] Error 2 make[8]: Leaving directory `/root/syssec/reverb/src/modules/rlm_eap/types' make[7]: *** [all] Error 2 make[7]: Leaving directory `/root/syssec/reverb/src/modules/rlm_eap/types' make[6]: *** [common] Error 2 make[6]: Leaving directory `/root/syssec/reverb/src/modules/rlm_eap' make[5]: *** [common] Error 2 make[5]: Leaving directory `/root/syssec/reverb/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/syssec/reverb/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/root/syssec/reverb/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/syssec/reverb/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/root/syssec/reverb' make: *** [all] Error 2 Alan DeKok wrote: > Geoff Silver <geoff+freeradius(a)uslinux.net> wrote: >> I'm running FreeRadius 1.1.0 on Red Hat Linux, and appear to be >> running into an issue where heavy load causes rlm_proxy to stop >> responding. If I restart radiusd, authentication will be properly >> proxied for 15-30 seconds, at which point I see incoming >> Access-Request messages logged, but I don't see any Access-Request >> messages being send to the backend server, and I don't see any >> Access-Accept or Access-Reject messages (or I see a few >> Access-Reject messages which appear to come from my proxy server, as >> there is no Reply-Message attribute set in them). > > See http://bugs.freeradius.org/show_bug.cgi?id=331 > > If the patch works, we can include it in 1.1.3. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 8

Eap-Tls Problem
by Matteo Lazzarini 21 Aug '06

21 Aug '06

Hello I'm a new user, and i'm trying to set an Eap-Tls authentication using freeradius 1.1.2. My system is debian stable. I installed freeradius 1.1.2 (./confidure, make ,make install) and libssl-dev (apt-get install libssl-dev) like here: http://web.archive.org/web/20031206113912/http://www.impossiblereflex.com/8… http://www.alphacore.net/spip/article.php3?id_article=33 When I turn on freeradius I can see this: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/1x/jagger.pem" tls: certificate_file = "/etc/1x/jagger.pem" tls: CA_file = "/etc/1x/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/1x/dh" tls: random_file = "/etc/1x/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. After I made the certificate and installed in the client I tried to request an authentication but the output show me an error: rad_recv: Access-Request packet from host 192.168.1.5:1217, id=17, length=139 User-Name = "marcello" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-0C-F1-15-17-59" NAS-Identifier = "DLink-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020d000d016d617263656c6c6f Message-Authenticator = 0x5cf6d0c113ea537193f632be5324ddac Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.1.5/auth-detail-20060821' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.1.5/auth-detail-20060821 modcall[authorize]: module "auth_log" returns ok for request 8 rlm_eap: EAP packet type response id 13 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 152 users: Matched entry marcello at line 219 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 8 modcall: leaving group authenticate (returns handled) for request 8 Sending Access-Challenge of id 17 to 192.168.1.5 port 1217 EAP-Message = 0x010e00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf07c05d2e094204483f4809fce1d0c28 Finished request 8 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.5:1217, id=18, length=224 User-Name = "marcello" NAS-IP-Address = 0.0.0.0 NAS-Port = 0 Called-Station-Id = "00-40-05-30-C5-86" Calling-Station-Id = "00-0C-F1-15-17-59" NAS-Identifier = "DLink-900AP+" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020e00500d800000004616030100410100003d030144e9b43485e72b29db6f1029820e8626f3358dc31aacc52a129ce61689ebe58f00001600040005000a000900640062000300060013001200630100 State = 0xf07c05d2e094204483f4809fce1d0c28 Message-Authenticator = 0x975a5fb5db9745857a408bd7f840d26b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.1.5/auth-detail-20060821' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.1.5/auth-detail-20060821 modcall[authorize]: module "auth_log" returns ok for request 9 rlm_eap: EAP packet type response id 14 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 152 users: Matched entry marcello at line 219 modcall[authorize]: module "files" returns ok for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 063f], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 009a], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 9 modcall: leaving group authenticate (returns handled) for request 9 Sending Access-Challenge of id 18 to 192.168.1.5 port 1217 EAP-Message = 0x010f040a0dc000000732160301004a02000046030144e9b49287208e1cb70e241db79d5673d7ab9517790375764670f4188240a51b20b4c816e499d080e2c6ab6b38806ea3fc5a2b57dd3b82c059da7f28e607c6eb47000400160301063f0b00063b0006380002ad308202a930820212a003020102020900ede70675d53a5468300d06092a864886f70d0101040500308188310b3009060355040613024954310e300c060355040813054954414c593110300e0603550407130742657267616d6f31123010060355040a130947727570706f696d693110300e060355040b1307494d492073726c3111300f060355040313084341726164697573311e30 EAP-Message = 0x1c06092a864886f70d010901160f63614067727570706f696d692e6974301e170d3036303832313130353231345a170d3037303832313130353231345a30818a310b3009060355040613024954310e300c060355040813054954414c593110300e0603550407130742657267616d6f31123010060355040a130947727570706f696d693110300e060355040b1307494d492073726c310f300d060355040313066a61676765723122302006092a864886f70d01090116136a61676765724067727570706f696d692e697430819f300d06092a864886f70d010101050003818d0030818902818100bbe2fe9126b2b0849877a8b391dda33f98ee5de4a34d EAP-Message = 0xb307dbb442f919f774a3b98af3fda705df91aa46c4659cc59b4a8059e6e93a21b99a778eb6474ec4339b6c1c3e69486dca6acf502004018ed8c095a4361e5295134d29e2fc3d3b9117aa5f6a4ffcf37669b86a7bc7fcd4687afb1e5ee869174509284bf6c1ca696e6f450203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000381810041308e67937e52103d21b47bcddebe72ef2cf474244a508ff5f74c34d95ece99284a24eee2fa85bbdbb8f38fcb4b04107f4d931bea52a34074fe53005163ddbe392f9b603b748a0acfe27a12b088b5bf18367fb666fee87286ecd730f49d5af0aaec EAP-Message = 0x068ea99f5b2f42aec356b15d82d4cf4d925dc611c0a4037aec9c5743625600038530820381308202eaa003020102020900ede70675d53a5467300d06092a864886f70d0101040500308188310b3009060355040613024954310e300c060355040813054954414c593110300e0603550407130742657267616d6f31123010060355040a130947727570706f696d693110300e060355040b1307494d492073726c3111300f060355040313084341726164697573311e301c06092a864886f70d010901160f63614067727570706f696d692e6974301e170d3036303832313130353035345a170d3036303932303130353035345a308188310b3009060355 EAP-Message = 0x040613024954310e300c060355040813054954414c59 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8bfc44c788f3b51de96ef0e08569c6e5 Finished request 9 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 17 with timestamp 44e9b492 Cleaning up request 9 ID 18 with timestamp 44e9b492 Nothing to do. Sleeping until we see a request. Can Somebody help me? Thanks Matteo

1 0

Ascend-Send-Secret problem
by Jean-Michel Foucher 21 Aug '06

21 Aug '06

Hello, i'm new to freeradius and i tried to install it so that i could use cdrtool, openser and freeradius together to make a Call Data Recorder. Unfortunately, i haven't been able to make it work even once because of this error : ERROR: Ascend-Send-Secret attribute in request: Cannot decrypt it. Here's an output example with freeradius -xxyz -l stdout : 1 rad_recv: Accounting-Request packet from host 127.0.0.1:42631, id=142, length=428 2 --- Walking the entire request list --- 3 Waking up in 31 seconds... 4 Threads: total/active/spare threads = 5/0/5 5 Thread 1 got semaphore 6 Thread 1 handling request 0, (1 handled so far) 7 Acct-Status-Type = Failed 8 Service-Type = IAPP-Register 9 Attr-102 = 0x000001e6 10 Error-Cause = 1 11 User-Name = "jam@XXXXXXXX" 12 Calling-Station-Id = "sip:jam@XXXXXXX" 13 Called-Station-Id = "sip:jam@XXXXXXXX" 14 Attr-107 = 0x7369703a6a616d403139322e3136382e37302e37303a35303630 15 Acct-Session-Id = "0574F5DC-1DD2-11B2-828C-DFA7BFD08F9B(a)192.168.2.1" 16 Attr-104 = 0x38323933333436343731393436323038303033 17 Attr-105 = 0x38323933333436313631333537333735373638 18 Attr-103 = 0x31 19 X-Ascend-Third-Prompt = "n/a" 20 ERROR: Ascend-Send-Secret attribute in request: Cannot decrypt it. 21 Server rejecting request 0. 22 Finished request 0 23 Going to the next request 24 Thread 1 waiting to be assigned a request 25 rad_recv: Accounting-Request packet from host 127.0.0.1:42631, id=142, length=428 26 Discarding duplicate request from client localhost:42631 - ID: 142 Best regards, -- Jean-Michel Foucher OpenWengo, the free and multiplatform VoIP client http://dev.openwengo.com/

2 1

auth to LDAP via two mechanisms
by Rob Shepherd 21 Aug '06

21 Aug '06

Dear FreeRadius-users, I have a cisco VPN concentrator, which uses radius (Currently ACS) also a WLAN controller, again using radius, again currently ACS. I'll use PAP (ldap auth) from the VPN concentrator but mschapv2 from the wireless, as it'll go through a peap or eap-tls tunnel. I have NT and LM hashes already in the LDAP, I just need to extract them... Could I get a pointers on how I command the right auth type for the right device. And how I get the nt/lm hashes from ldap and do mschapv2.. Cheers Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ rob(a)techniumcast.com | 01248 675024 | 07776 210516

4 4

RE: No memory
by Hasan Ovuc 21 Aug '06

21 Aug '06

FC5 kernel-smp-2.6.15-1.2054_FC5 Additional info: Sybase ODBC-12_5 odbc drivers Which db connection type do you suggest to connect SYBASE database ? Rlm_unixodbc, rlm_iodbc or rlm_perl > -----Original Message----- > From: Peter Nixon [mailto:listuser@peternixon.net] > Sent: Friday, August 18, 2006 3:22 PM > To: freeradius-users(a)lists.freeradius.org > Cc: Hasan Ovuc > Subject: Re: No memory > > On Fri 18 Aug 2006 14:39, Hasan Ovuc wrote: > > Dear Members, > > > > I am trying to use > > freeradius-snapshot-20060817 > > unixODBC-2.2.11 > > ODBC-12_5 > > > > Radiusd successfully started, after first sql query it dies with no > > memory error. > > Which Linux version? > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

2 1

radiusd.sh
by KES 21 Aug '06

21 Aug '06

Hello, freeradius-users. Patch for radiusd.sh #!/bin/sh # PROVIDE: radiusd -# REQUIRE: NETWORKING SERVERS -# BEFORE: DAEMON +# REQUIRE: NETWORKING SERVERS mysql # KEYWORD: shutdown radiusd must start after DBServers(mysql) do because of some problems with some rlm_sql* modules (rlm_nibs - can't connect to MySQL) so I have added # REQUIRE: NETWORKING SERVERS mysql adding mysql is case for loop dependency of 'rcorder' so I have removed -# BEFORE: DAEMON Does any have such problems? -- KES mailto:kes-kes@yandex.ru

3 5

Changing the RAD_REPLY with rlm_perl
by Pshem Kowalczyk 21 Aug '06

21 Aug '06

Hi, I'm using freeradius 1.1.0 (this version comes with ubuntu). I'm trying to build a radius proxy using freeradius and rlm_perl, but I struck a problem. The proxy will be responsible for rewriting the auth packets: adding IPs, rewriting certain attributes and changing values of some others. All that to give a nice abstract access to all device to external companies. Because of the complex rewrites required I decided to use rlm_perl. I found the patch to modify existing attributes, but I can't find a way of removing some of them (when customer is not entilted to get certain services) Am I missing something obvious, or is this ATM simply not possible with rlm_perl? I'm not afraid of patching the source if required, I just don't have the skills to write the patch myself :-) kind regards pshemko

1 0

openser and AD
by Artur Hayne 21 Aug '06

21 Aug '06

HI, I have a big problem that seams dont have solution. I have a openser server that should autenticated the users from Active Directory trough the FreeRadius. The session of FreeRadius and Active Directory is stablished, but when the user try autenticate, its dont work. See the debug of Radius: radius_xlat: 'ou=bli,dc=blo,dc=blu,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=bli,dc=blo,dc=blu,dc=br, with filter (uid=jab) rlm_ldap: object not found or got ambiguous search result <---------- rlm_ldap: search failed <----------! rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 47 <---------- modcall: leaving group authorize (returns ok) for request 47 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 47 rlm_digest: Configuration item "User-Password" or MD5-Password is required for authentication. <---------- essa linha!!! modcall[authenticate]: module "digest" returns invalid for request 47 <---------- modcall: leaving group authenticate (returns invalid) for request 47 auth: Failed to validate the user. <---------- I see in some tutorials show how authenticate in a domain to use one tool called ntlm_auth, but it seams that only work with the mschap protocol, and the openser uses the digest. What to do? Any ideia? Its necessarily to do some configuration in the users or another files? Thanks.. --------------------------------- Você quer respostas para suas perguntas? Ou você sabe muito e quer compartilhar seu conhecimento? Experimente o Yahoo! Respostas!

2 1

Scripts.
by Keith Woodworth 20 Aug '06

20 Aug '06

Just a note to anyone moving from ICRadius to FreeRadius, the radacct table, while having a 4 extra fields in the structure in FR than IC, Ive been able to use the perl scripts I wrote to massage and pull data out of them with no modification to the scripts. Kind of nice to say the least. Also in my last message re: Auth-Type and setting it to PAP in radgroupcheck to read Crypt-Password from radcheck, was that the right way to do that? Thanks, Keith

1 0