- Freeradius-Users - lists.freeradius.org

Free Radius 1.1.2, Fedora 5 & "invalid ELF header"
by Bill 02 Aug '06

02 Aug '06

Hi, I am replacing a server that is currently running RedHat 9 and FreeRadius 0.9.3 to a newer server with Fedora 5 and FreeRadius 1.1.2. While using my old FreeRadius notes I've come across this error message on startup that I can't seem to beat. I've tried configuring FreeRadius with "--disable-shared" and "--with-gnu-ld" seperately and neither of these worked. My older of FreeRadius (0.9.3) won't even make on Fedora 5. I normally configure it using: ./configure --with-radacctdir=/var/log --with-raddbdir=/etc/raddb --with-log dir=/var/log/radacct This is the error from /var/log/radacct/radius.log Error: radiusd.conf[1565] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header Some of the errors had the rlm_exec.a path as these. You can see the "usr" in the path was "busted". Pb<ED>?/local/lib/rlm_exec.a P2<D2>?/local/lib/rlm_exec.a <F8><e?/local/lib/rlm_exec.a h<C2>??/local/lib/rlm_exec.a Thanks, Bill

3 2

rlm_perl CORE DUMPED(part 3)
by KES 02 Aug '06

02 Aug '06

Здравствуйте, freeradius-users. # perl -v This is perl, v5.8.7 built for i386-freebsd-64int sorry for many posts... -- С уважением, KES mailto:kes-kes@yandex.ru

2 1

freeradius-1.1.1 + mschap + ldap with encrypted password
by wekz 02 Aug '06

02 Aug '06

Hi all, I've configured freeradius-1.1.1 to do eap-tls and peap to authenticate windows wireless users against an ldap. The problem now is that I have to authenticate doing peap against an ldap which has userpassword encrypted ( and is a point that I can't change unless it is impossible to do ). I know that when I'm using peap what I finally use is mschapv2 and that this protocol makes a challenge ( with username, password and somestuff ) that the user must response. As my ldap-user-passwords are encrypted and microsoft clients make the response with a clear-test password, it couldn't work. At least that's what I've understood ( and my knowledge about this is very limited, so correct me if I'm wrong ). My question is if there is anyway to make it work configuring ntlm_auth ? Thanks in advance.

2 2

Error with libmysqlclient_r.so.14
by Bruno Machado 02 Aug '06

02 Aug '06

Hi all Im trying to use Radius, but Im receiving this error: rlm_sql (sql): Could not link driver rlm_sql_mysql: libmysqlclient_r.so.14: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. radiusd.conf[1825] Unknown module "sql". radiusd.conf[1754] Failed to parse authorize section. The server already have MySQL 5.0.22 installed. Anybody knows what is happening? Thanks --------------------------------- Yahoo! Acesso Grátis - Internet rápida e grátis. Instale o discador agora!

2 2

help
by c k 02 Aug '06

02 Aug '06

Hi friends, I want to deploy freeradius authentication in my wireless lan. I m using EAP-TLS with Windows XP SP2 inbuilt supplicant. Everything works fine till the freeradius server and hostapd is initialized.But then i think authentication fails.It shows a list of "REAUTH_TIMER entering state INITIALIZE" message.For more details i m pasting he hostapd output.Plz help. hostapd -dd hostapd.conf Configuration file: hostapd.conf ctrl_interface_group=0 madwifi_set_iface_flags: dev_up=0 Using interface ath0 with hwaddr 00:15:6d:50:02:53 and ssid 'Havanet-EDS' ath0: RADIUS Authentication server 192.168.2.224:1812 ath0: RADIUS Accounting server 192.168.2.224:1813 madwifi_set_ieee8021x: enabled=1 madwifi_configure_wpa: group key cipher=1 madwifi_configure_wpa: pairwise key ciphers=0xa madwifi_configure_wpa: key management algorithms=0x1 madwifi_configure_wpa: rsn capabilities=0x0 madwifi_configure_wpa: enable WPA= 0x1 madwifi_set_iface_flags: dev_up=1 WPA: group state machine entering state GTK_INIT GMK - hexdump(len=32): [REMOVED] GTK - hexdump(len=32): [REMOVED] WPA: group state machine entering state SETKEYSDONE madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=1 madwifi_set_privacy: enabled=1 ath0: RADIUS Sending RADIUS message to accounting server ath0: RADIUS Next RADIUS client retransmit in 3 seconds SIOCGIWRANGE: WE(compiled)=19 WE(source)=13 enc_capa=0xf Flushing old station entries madwifi_sta_deauth: addr=ff:ff:ff:ff:ff:ff reason_code=3 Deauthenticate all stations l2_packet_receive - recvfrom: Network is down Wireless event: cmd=0x8c03 len=20 ath0: STA 00:16:b6:99:81:13 IEEE 802.11: associated New STA ath0: STA 00:16:b6:99:81:13 WPA: event 1 notification madwifi_del_key: addr=00:16:b6:99:81:13 key_idx=0 ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: start authentication IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_KEY_TX entering state NO_KEY_TRANSMIT IEEE 802.1X: 00:16:b6:99:81:13 KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:16:b6:99:81:13 CTRL_DIR entering state IN_OR_BOTH IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state IDLE IEEE 802.1X: 00:16:b6:99:81:13 KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:16:b6:99:81:13 CTRL_DIR entering state FORCE_BOTH IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 KEY_RX entering state NO_KEY_RECEIVE ath0: STA 00:16:b6:99:81:13 WPA: start authentication WPA: 00:16:b6:99:81:13 WPA_PTK entering state INITIALIZE madwifi_del_key: addr=00:16:b6:99:81:13 key_idx=0 WPA: 00:16:b6:99:81:13 WPA_PTK_GROUP entering state IDLE WPA: 00:16:b6:99:81:13 WPA_PTK entering state AUTHENTICATION WPA: 00:16:b6:99:81:13 WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state DISCONNECTED ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: unauthorizing port madwifi_set_sta_authorized: addr=00:16:b6:99:81:13 authorized=0 IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state RESTART IEEE 802.1X: station 00:16:b6:99:81:13 - new auth session, clearing State IEEE 802.1X: Generated EAP Request-Identity for 00:16:b6:99:81:13 (identifier 0, timeout 30) IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:16:b6:99:81:13 (identifier 0) TX EAPOL - hexdump(len=42): 00 16 b6 99 81 13 00 15 6d 50 02 53 88 8e 01 00 00 18 01 00 00 18 01 57 65 6c 63 6f 6d 65 54 6f 48 61 76 61 6e 65 74 57 44 53 IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 15 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=0 length=11 EAP: code=2 identifier=0 length=11 (response) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: received EAP packet (code=2 id=0 len=11) from STA: EAP Response-Identity (1) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: STA identity 'client' IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state RESPONSE Encapsulating EAP message into a RADIUS packet ath0: RADIUS Sending RADIUS message to authentication server ath0: RADIUS Next RADIUS client retransmit in 0 seconds IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 5 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=1 length=0 ignoring 1 extra octets after IEEE 802.1X packet ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: received EAPOL-Start from STA ath0: STA 00:16:b6:99:81:13 WPA: event 5 notification WPA: 00:16:b6:99:81:13 WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state ABORTING IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state INITIALIZE ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: aborting authentication IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state RESTART IEEE 802.1X: station 00:16:b6:99:81:13 - new auth session, clearing State IEEE 802.1X: Generated EAP Request-Identity for 00:16:b6:99:81:13 (identifier 1, timeout 30) IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state IDLE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:16:b6:99:81:13 (identifier 1) TX EAPOL - hexdump(len=42): 00 16 b6 99 81 13 00 15 6d 50 02 53 88 8e 01 00 00 18 01 01 00 18 01 57 65 6c 63 6f 6d 65 54 6f 48 61 76 61 6e 65 74 57 44 53 IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 15 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=0 length=11 EAP: code=2 identifier=1 length=11 (response) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: received EAP packet (code=2 id=1 len=11) from STA: EAP Response-Identity (1) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: STA identity 'client' IEEE 802.1X: 00:16:b6:99:81:13 BE_AUTH entering state RESPONSE Encapsulating EAP message into a RADIUS packet ath0: RADIUS Sending RADIUS message to authentication server ath0: RADIUS Next RADIUS client retransmit in 0 seconds IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 15 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=0 length=11 EAP: code=2 identifier=0 length=11 (response) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 15 bytes from 00:16:b6:99:81:13 IEEE 802.1X: version=1 type=0 length=11 EAP: code=2 identifier=1 length=11 (response) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: received EAP packet (code=2 id=1 len=11) from STA: EAP Response-Identity (1) ath0: STA 00:16:b6:99:81:13 IEEE 802.1X: STA identity 'client' IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE ath0: STA 00:00:00:00:00:00 RADIUS: Resending RADIUS message (id=0) ath0: RADIUS Next RADIUS client retransmit in 3 seconds IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:16:b6:99:81:13 REAUTH_TIMER entering state INITIALIZE ath0: STA 00:16:b6:99:81:13 RADIUS: Resending RADIUS message (id=2) ath0: STA 00:16:b6:99:81:13 RADIUS: Resending RADIUS message (id=1) ath0: RADIUS Next RADIUS client retransmit in 3 seconds. The authentication does not get successful and the wireless network notification icon on the windows XP side shows "validating" status for hours. Plzzz help. --------------------------------- How low will we go? Check out Yahoo! Messengers low PC-to-Phone call rates.

2 1

framed ip in raddacct
by Rheindorf Jan 02 Aug '06

02 Aug '06

Hello freeradius users I am using freeradius 1.0.4 with pgsql and dialupadmin(version 1.70.2). Everything works great, but there is only one thing i want to know. In dialupadmin there is this online users page, where i can see which users are currently online. I see the username, name and duration, but Ip-address and caller-ID is empty. Caller-Id is emtpy, because it isnt sended , the cisco server who is acting as the LNS is not able to send the Caller Id. Thats allright. The Ip-adress is from the main_pool of the radius server, but it is not put in the first INSERT-query when the user logs in. So i cant see it in dialup_admin, because the query for online-users is only looking for sessions without an accstoptime. If i logout(sending an acc-stop) radius puts the right ip-address of the client in the radacct-table. Is there a way to put the Ip-adress in the first INSERT or another way to see it in the online-users page, because it would be very userful to see the ip-adress of the online users. thanks for help greez from vienna jan

1 0

AAA
by Roger Thomas 02 Aug '06

02 Aug '06

My LDAP knowledge is quite shallow and as such I would like to use - openLDAP only for authentication - MySQL for authorization and accounting If that is possible, do I *still* need to extend my LDAP schema with ~/doc/examples/openldap.schema ? --------------------------------------------------- Sign Up for free Email at http://ureg.home.net.my/ ---------------------------------------------------

3 4

Synchronous Proxy mode
by Geoffroy Arnoud 01 Aug '06

01 Aug '06

Hi, I have observed the following behaviour with FreeRADIUS 1.0.2, working in proxy mode, with synchronous set to YES: If the realm server is not responding, after max_request_time has expired, the request is rejected, and the realm is marked to dead. I tried to add a backup server to the realm, and actually, the other incoming requests are sent to the secondary server (until dead_time is expired). My questions are: 1/ Is this behaviour known? as it is stated in proxy.conf that "Additionally, if you want 'failover' to work, the server must manage retries and timeouts. Therefore, if this is set to yes, then no failover functionality is possible." 2/ Is it still present in current stable (1.1.2)? Thank you for any answer. Best regards, Geof.

2 1

RE: Translate between auth requests between Radius Servers.
by Adam.Staub＠rascompanies.com 01 Aug '06

01 Aug '06

I've Devices that use PAP. I'd like to translate to mschap and auth against Active Directory. I've looked at using LDAP but I'm unable encrypt the ldap queries / responses. -----Original Message----- From: freeradius-users-bounces+adam.staub=rascompanies.com(a)lists.freeradius.or g [mailto:freeradius-users-bounces+adam.staub=rascompanies.com@lists.freer adius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 01, 2006 3:44 PM To: FreeRadius users mailing list Subject: Re: Translate between auth requests between Radius Servers. Adam.Staub(a)rascompanies.com wrote: > I've setup a FR server that I've proxied to an IAS server. If a > request hits my FR server with an Auth-type PAP can I translate the > auth-request to ms-chapv2 and forward to my IAS server for > authentication? If so how do I accomplish that? I have no idea why this would be necessary. There is no way to do this in the server. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------------ Note: This E-mail and any attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this E-mail and any attachments is strictly prohibited. If you have received this E-mail in error, please notify us immediately by returning it to the sender and deleting it from your computer system. Thank you for your cooperation. ==============================================================================

2 1

Translate between auth requests between Radius Servers.
by Adam.Staub＠rascompanies.com 01 Aug '06

01 Aug '06

I've setup a FR server that I've proxied to an IAS server. If a request hits my FR server with an Auth-type PAP can I translate the auth-request to ms-chapv2 and forward to my IAS server for authentication? If so how do I accomplish that? ------------------------------------------------------------------------------ Note: This E-mail and any attachments may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of this E-mail and any attachments is strictly prohibited. If you have received this E-mail in error, please notify us immediately by returning it to the sender and deleting it from your computer system. Thank you for your cooperation. ==============================================================================

2 1