- Freeradius-Users - lists.freeradius.org

freeradius_1.1.2 + ldap
by Damon McDougald 25 Jul '06

25 Jul '06

Hello to all, I am encountering a problem when I start my radius server: radiusd -X Failed to link to module 'rlm_ldap': liblber-2.3.so.0: cannot open shared object file: No such file or directory when I ldd rlm_ldap I receive the following: linux-gate.so.1 => (0xffffe000) libradius-1.1.2.so => /usr/local/lib/libradius-1.1.2.so (0xb7fd7000) libldap_r-2.3.so.0 => /usr/local/lib/libldap_r-2.3.so.0 (0xb7f9b000) libnsl.so.1 => /lib/libnsl.so.1 (0xb7f81000) libresolv.so.2 => /lib/libresolv.so.2 (0xb7f6e000) libpthread.so.0 => /lib/tls/libpthread.so.0 (0xb7f5c000) libc.so.6 => /lib/tls/libc.so.6 (0xb7e42000) libcrypt.so.1 => /lib/libcrypt.so.1 (0xb7e13000) liblber-2.3.so.0 => not found libssl.so.0.9.7 => /usr/lib/libssl.so.0.9.7 (0xb7de2000) libcrypto.so.0.9.7 => /usr/lib/libcrypto.so.0.9.7 (0xb7ce1000) /lib/ld-linux.so.2 (0x80000000) libdl.so.2 => /lib/libdl.so.2 (0xb7cdd000) It is obvious I do not have liblber-2.3.so.0 or it is not linked. When compiling openldap and/or freeradius is their something special I need during the .configure? Here is what I used to compile freeradius: ./configure --with-rlm-ldap-include=/usr/local/include --with-rlm-ldap-include=/usr/local/lib --enable-ltdg-install --enable-ltdl-install Here is what I used to compile openldap: ./confiugre --disable-slapd --disable-slurpd --disable-ldbm Anything I am missing or am blind to? Thanks, Damon __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 2

Active directory and MS-CHAP Authentication.
by Antonio Matera 25 Jul '06

25 Jul '06

Hi, I have a problem with the authentication of active directory users on freeradius. I correctly set up samba and kerberos and if I write: # ntlm_auth --request-nt-key --domain=mydomain --username=myuser if I insert the correct password I receive the authentication ok. My problem is to configure the mschap module on freeradius. My mschap config is: mschap { auth-type = MS-CHAP with_ntdomain_hack = yes ntlm_auth ="/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } If I insert in the users file "DEFAULT Auth-Type := MS-CHAP", in the log file I read this error: rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NM-Password. rlm_mschap: No MS-CHAP-Challenge in the request If I remove the DAFAULT user in the users file in the log I can't find a mschap authentication and the user is reject. What is wrong? Thanks a lot Bye Antonio

7 19

post_proxy_authorize option
by Geoff Silver 25 Jul '06

25 Jul '06

Hi folks, I noticed in the included raddb/proxy.conf file, the post_proxy_authorize option notes that it's "deprecated and will be removed in the future". I'm using that feature right now, so I'd like to find out if there's a better way to handle the authorization step, or else if this option can be left in the code. I *presume* the right way is to add something to post-proxy {}, but when I tried to duplicate my authorize section, I get nothing but errors when trying to start radiusd. For reference, my authorize section looks like: authorize { preprocess auth_log files } My authorization step can go in either the pre-proxy or post-proxy section - the important thing is that the proxy server can handle authentication, but I need to use the users file to do authorization. Ideas on how to do this right are appreciated. Thanks.

2 1

Still cannot get ldap_r to be linked
by Roger Thomas 25 Jul '06

25 Jul '06

I am attempting to configure FreeRadius to use our LDAP directory for authentication and have made the necessary modifications to radiusd.conf, but get the following error when starting radiusd with: # /usr/local/sbin/radiusd -X -A --- start of text --- ... ... radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) radiusd.conf[738] Failed to link to module 'rlm_ldap': file not found radiusd.conf[1917] Unknown module "ldap". radiusd.conf[1917] Failed to parse "ldap" entry. --- end of text --- If I were to go to ~/freeradius-1.1.2/src/modules/rlm_ldap and do a ./configure, I would get these: --- start of text --- # ./configure creating cache ./config.cache checking for gcc... gcc checking whether the C compiler (gcc ) works... yes checking whether the C compiler (gcc ) is a cross-compiler... no checking whether we are using GNU C... yes checking whether gcc accepts -g... yes checking for pthread_create in -lpthread... yes checking for ldap_init in -lldap_r... no checking for ldap.h... yes configure: warning: silently not building rlm_ldap. configure: warning: FAILURE: rlm_ldap requires: libldap_r. updating cache ./config.cache creating ./config.status creating Makefile # --- end of text --- and # ls -l /usr/local/lib/libldap_r* lrwxrwxrwx 1 root root 22 Jul 26 2004 /usr/local/lib/libldap_r-2.2.so.7 -> libldap_r-2.2.so.7.0.6 -rw-r--r-- 1 root root 2255178 Jul 26 2004 /usr/local/lib/libldap_r-2.2.so.7.0.6 -rw-r--r-- 1 root root 2241358 Sep 9 2005 /usr/local/lib/libldap_r.a -rw-r--r-- 1 root root 759 Sep 9 2005 /usr/local/lib/libldap_r.la lrwxrwxrwx 1 root root 19 Sep 9 2005 /usr/local/lib/libldap_r.so -> libldap_r.so.2.0.16 lrwxrwxrwx 1 root root 19 Sep 9 2005 /usr/local/lib/libldap_r.so.2 -> libldap_r.so.2.0.16 -rw-r--r-- 1 root root 2073246 Sep 9 2005 /usr/local/lib/libldap_r.so.2.0.16 -- I'm using freeradius-1.1.2 on Redhat Linux 9 and openldap-2.0.25, everything appeared to compile okay. I'm no C programmer. So please go slow. Any suggestions would be most appreciated. Regards Roger Thomas --------------------------------------------------- Sign Up for free Email at http://ureg.home.net.my/ ---------------------------------------------------

4 5

Active Directory (Win2003) rlm_ldap
by Charlie B 25 Jul '06

25 Jul '06

Question: What is causing the password to be encrypted? It is not the password entered. radtest bradbrookc putz041277! localhost 0 xxxxxxx rad_recv: Access-Request packet from host 127.0.0.1:32806, id=152, length=62 User-Name = "bradbrookc" User-Password = "\t\354B\252\355\345BI\237\034\217\316\315\363\351\271" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "bradbrookc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry bradbrookc at line 218 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for bradbrookc radius_xlat: '(&(SamAccountName=bradbrookc))' radius_xlat: 'ou=xxxxx,dc=xxx,dc=xxx,dc=xxx' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to cnsxxxxxxxxx:389, authentication 0 rlm_ldap: bind as xxxxxx/xxxxxx to cnsxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=xxxx,dc=xx,dc=xxxx,dc=xxx, with filter (&(SamAccountName=bradbrookc)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user bradbrookc authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "bradbrookc" with password "?ìBªíåBI???ÎÍóé¹" rlm_ldap: user DN: CN=xxxxxx\, xxx,OU=xxx,OU=xxx,DC=xxx,DC=xxx,DC=xxx rlm_ldap: (re)connect to cnsad.ads.nint.org:389, authentication 1 rlm_ldap: bind as CN=xxxx\, xxxx,OU=xxx,OU=xxx,DC=xxxx,DC=xxx,DC=org/ ?ìBªíåBI???ÎÍóé¹ to cnsxxxxx:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [bradbrookc] (from client localhost port 0) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- OS:Fedora Core 5 FreeRadius 1.0.5-1.2 Help would be great, I have been attempting different combination with no luck. thx

2 4

unsubscribe
by Sudhananda 25 Jul '06

25 Jul '06

unsubscribe This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message.Global Edge Software Ltd has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Global Edge Software Ltd reserves the right to monitor and review the content of all messages sent to or from this e-mail address

1 0

EAP utilities--urgent
by darshak＠elitecore.com 25 Jul '06

25 Jul '06

hi, all I need some help from group. I want to start free radius that only has EAP utilities. no proxy,nothing else then diff.. eap types. Which files can i take from free radius that i can independently use for eap / wireless authentication. In short my free-radius has only files replated to eap no xtra. Rgds Darshak

1 0

PEAP short question
by wekz 25 Jul '06

25 Jul '06

Hi all, I've been watching the logs and my question is why localhost takes part in the process.

3 3

verifying "/" exists in User-Password field
by Geoff Silver 24 Jul '06

24 Jul '06

I'm running FreeRadius 1.1 on two different ports, allowing slightly different auth methods on each port. On one of the ports, I would like to verify that the password sent contains a slash ("/") before attempting to authenticate the user. Why, you might ask? Well because on that port I'm actually just proxying the authentication requests. So, my users file entries look like: # Cisco NAS doing SSL authentication bob Huntgroup-Name=="Office", Hint==Port-1812, Auth-Type:=Accept Connect-Info="OFFICE_ACCESS" # Cisco NAS doing username/password authentication, proxied to another server bob Huntgroup-Name=="Office", Hint==Port-1645, Proxy-To-Realm:=UAS Connect-Info="OFFICE_ACCESS" My huntgroups file contains the "Office" to NAS-IP-Address mappings, and my hints file (which maps the UDP port the NAS connected on to one of the two above auth lines) looks like this: DEFAULT User-Name =~ "^(.*)$" Hint = "Port-%{request:Packet-Dst-Port}" What I need to do is figure out how to ensure that anyone authenticating with Hint==Port-1645 has a "/" in their User-Password attribute. People authenticating with Hint==Port-1812 will always have a User-Password attribute which matches their Username (but because SSL authentication is handled by the NAS, this area is authorization only, so we never check the User-Password attribute). I'm thinking this should be possible, but I'm just not sure the best way to handle it. Any advice is greatly appreciated.

2 4

Why doesn't := "Always match?"
by Paul Long 24 Jul '06

24 Jul '06

A man page (http://www.die.net/doc/linux/man/man5/users.5.html) for the users file says, "Attribute := Value ... Always matches as a check item..." So does that mean, no matter what the value is, it will always match the attribute? I don't see that happening. As an experiment, I have a supplicant in a WiFi phone with user name of "plong" and password of "123". With the following entry in the users file: plong Auth-Type = Local, User-Password := "126" ...I assumed it would match even though the value is different; however, it does not match, and the access request is rejected: rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 126 for user plong authentication. rlm_chap: Pasword check failed To get it to match, I have to have the correct value: plong Auth-Type = Local, User-Password := "123" which results in this debug output: rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 123 for user plong authentication. rlm_chap: chap user plong authenticated succesfully In fact, := behaves exactly like == in this case. What's the deal? Why doesn't := "always match?" Am I misunderstanding what it means to "match?" Paul

4 8