- Freeradius-Users - lists.freeradius.org

RPM build problems on RedHat AS4
by B Thompson 20 Jun '06

20 Jun '06

Hi Following previous posts on this mailing list I patched my freeradius.spec as shown at the end of this email. I ran rpmbuild -bb and got the lib_eap packaging problems and during the build many messages like this :- (cd /usr/src/redhat/BUILD/freeradius-1.1.2/src/modules/rlm_eap; /bin/sh /usr/src/redhat/BUILD/freeradius-1.1.2/libtool --mode=relink gcc -release 1.1.2 -modul\e -export-dynamic -o rlm_eap.la -rpath /usr/lib rlm_eap.lo eap.lo mem.lo state.lo rlm_eap.c eap.c mem.c state.c /usr/src/redhat/BUILD/freeradius-1.1.2/src/lib\/libradius.la libeap/libeap.la -lltdl -lnsl -lresolv -lpthread) gcc -shared rlm_eap.lo eap.lo mem.lo state.lo -L/usr/src/redhat/BUILD/freeradius-1.1.2/src/lib/.libs -L/usr/lib -lradius -leap -lltdl -lnsl -lresolv -lpthre\ad -Wl,-soname -Wl,rlm_eap-1.1.2.so -o .libs/rlm_eap-1.1.2.so /usr/bin/ld: cannot find -leap collect2: ld returned 1 exit status libtool: install: error: relink `rlm_eap.la' with the above command before installing it libtool: install: warning: remember to run `libtool --finish /usr/lib' gmake[6]: Leaving directory `/usr/src/redhat/BUILD/freeradius-1.1.2/src/modules/rlm_eap' I then ran rpmbuild again and although I don't remember changing anything it worked fine and built me an rpm. However when I came to install, I still have the following dependency problem :- error: Failed dependencies: /usr/local/bin/perl is needed by freeradius-1.1.2-0.i386 The output of "whereis perl" :- perl: /usr/bin/perl /usr/local/bin/perl /usr/share/man/man1/perl.1.gz # ls -l /usr/local/bin/perl lrwxrwxrwx 1 root root 13 Jun 21 2004 /usr/local/bin/perl -> /usr/bin/perl Could anyone suggest why I am gettting the failed dependendcy? Thanks Ben Thompson Here is the patch :- --- freeradius.spec.orig 2006-05-21 18:32:53.000000000 +0100 +++ freeradius.spec 2006-06-20 11:40:59.000000000 +0100 @@ -38,6 +38,9 @@ --with-rlm-krb5-lib-dir=/usr/kerberos/lib make +sed -i "s@doc/freeradius@doc/freeradius-%{version}@" doc/Makefile doc/examples/Makefile doc/rfc/Makefile + + %install [ "$RPM_BUILD_ROOT" != "/" ] && rm -rf $RPM_BUILD_ROOT @@ -111,6 +114,18 @@ %attr(0700,radiusd,radiusd) %dir /var/log/radius/radacct %attr(0700,radiusd,radiusd) %dir /var/run/radiusd + +%doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX +%doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema +%doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend +%doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover +%doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas +%doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file +%doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ +%doc doc/rlm* doc/supervise-radiusd.txt +%doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL + + %changelog * Thu Dec 15 2004 Alan DeKok - update for 1.1.0

1 0

Re[2]: rlm_detail bug when "locking = yes"
by Michael Chernyakhovsky 20 Jun '06

20 Jun '06

Nicolas wrote: >> we need close outfd right before "return RLM_MODULE_FAIL;" at line 236. > .... or get the fixes from CVS head which solve many other problems > in rlm_detail. (for example file renamed or unlinked by another > program) > Everyone will save a considerable amount of time if you could backport > the changes from CVS to 1.1.2, run tests to check the new code, and > send unified diff to the list. > http://freeradius.org/radiusd/doc/DIFFS i try to examine snapshot-20060616 btw, there are old bug in rlm_detail.c. 279: if ((outfd = open(buffer, O_WRONLY | O_APPEND | O_CREAT, 280: inst->detailperm)) < 0) { 281: radlog(L_ERR, "rlm_detail: Couldn't open file %s: %s", 282: buffer, strerror(errno)); 283: return RLM_MODULE_FAIL; 284: } 286: /* 287: * If we fail to aquire the filelock in 80 tries 288: * (approximately two seconds) we bail out. 289: */ 290: if (inst->locking) { 291: lseek(outfd, 0L, SEEK_SET); 292: if (rad_lockfd_nonblock(outfd, 0) < 0) { 293: close(outfd); 294: tv.tv_sec = 0; 295: tv.tv_usec = 25000; 296: select(0, NULL, NULL, NULL, &tv); 297: lock_count++; 298: continue; 299: } open() executed once. but while we failed to get lock at first try, close(outfd) executed and all the subsequent attempts to lock file fails i comment line 293 out. After this i havn't got any messages like "Error: rlm_detail: Failed to aquire filelock for /var/log/radius/radacct/detail, giving up" in log! so now rlm_detail with "lock=yes" and radrelay all works fine. Mike.

2 2

Freeradius with Win2K Active Directory
by Naveen 20 Jun '06

20 Jun '06

Hi Experts, I am new to freeradius. Can some one point me how to do the Authenticate users in Windows 2000 Active Directory with Freeradius. Is there any how to / step by step document available? Thanks for your Help Regards Naveen

1 0

Re: Auth Problems 2 !!
by Emerson 19 Jun '06

19 Jun '06

Hi Alan, in mysql table, i remove this options ":= Local", and now others errors appear: Thank's a Lot Alan..... Emerson rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A 7791:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca:s3_pkt.c:1052:SSL alert number 48 7791:error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure:s3_pkt.c:837: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 3 modcall: leaving group authenticate (returns reject) for request 3 auth: Failed to validate the user. Login incorrect: [usuario1/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) Delaying request 3 for 1 seconds Finished request 3 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 65 with timestamp 4496e659 Cleaning up request 1 ID 66 with timestamp 4496e659 Cleaning up request 2 ID 67 with timestamp 4496e659 Sending Access-Reject of id 68 to 10.254.0.254 port 2053 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 3 ID 68 with timestamp 4496e659 Nothing to do. Sleeping until we see a request.

2 1

peap cisco edirectory & windows xp
by Marc-Andre Vallee 19 Jun '06

19 Jun '06

Hi, I'm trying to make windows xp (sp2) work with cisco Aironet 1130AG series Access Point with 802.1x authentification on a freeradius server. I'm using freeradius 1.0.5 from SLES9 SP3. The eDirectory (LDAP) authentification seems to be working, ntradping works fine in chap, and logs shows success. Looks like it's the PEAP that is not working. After some research, I've even installed KB 885453 from MS, also KB893357 without any help... Is someone able to tell me where the problem is ? cisco ? freeradius ? windows ? I've seen a similar setup agains a 3com access point, that worked. Basicly, it's the same cfg file, adapted..... Thanks a lot Marc Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "CN=radius_admin,O=GES" ldap: tls_mode = no ldap: start_tls = yes ldap: tls_cacertfile = "/etc/raddb/certs/rootder.b64" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "mypassword" ldap: basedn = "O=GES" ldap: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "nspmPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8113028 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "mysecret" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.60.255.5:1645, id=50, length=131 User-Name = "complys" Framed-MTU = 1400 Called-Station-Id = "0014.f1ae.0210" Calling-Station-Id = "0013.ce6e.6cf3" Service-Type = Login-User Message-Authenticator = 0x41f142dff44964dfc0d97cb331892429 EAP-Message = 0x0202000c01636f6d706c7973 NAS-Port-Type = Wireless-802.11 NAS-Port = 326 NAS-IP-Address = 10.60.255.5 NAS-Identifier = "2300-2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "complys", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for complys radius_xlat: '(cn=complys)' radius_xlat: 'O=GES' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder.b64 rlm_ldap: starting TLS rlm_ldap: bind as CN=radius_admin,O=GES/mypassword to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in O=GES, with filter (cn=complys) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user complys authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 50 to 10.60.255.5:1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf0fc7e3df1b791cb726358765b041b83 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.60.255.5:1645, id=50, length=131 Sending duplicate reply to client wifi:1645 - ID: 50 Re-sending Access-Challenge of id 50 to 10.60.255.5:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 50 with timestamp 4496f5b0 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.60.255.5:1645, id=50, length=131 User-Name = "complys" Framed-MTU = 1400 Called-Station-Id = "0014.f1ae.0210" Calling-Station-Id = "0013.ce6e.6cf3" Service-Type = Login-User Message-Authenticator = 0x41f142dff44964dfc0d97cb331892429 EAP-Message = 0x0202000c01636f6d706c7973 NAS-Port-Type = Wireless-802.11 NAS-Port = 326 NAS-IP-Address = 10.60.255.5 NAS-Identifier = "2300-2" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "complys", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for complys radius_xlat: '(cn=complys)' radius_xlat: 'O=GES' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in O=GES, with filter (cn=complys) rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user complys authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 50 to 10.60.255.5:1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdc004b86ccc1febf7e0fb8fc813caf00 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.60.255.5:1645, id=50, length=131 Sending duplicate reply to client wifi:1645 - ID: 50 Re-sending Access-Challenge of id 50 to 10.60.255.5:1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 50 with timestamp 4496f5ba Nothing to do. Sleeping until we see a request. Marc-Andre Vallee, CLE9, CLE, CLP, CNA Conseiller, Integration et technologies Complys technologies inc. Solutions informatiques sur mesure pour votre entreprise. Montreal : (514) 645-2875 Quebec : (418) 648-9270 http://www.complys.com AVIS DE CONFIDENTIALITE: L' information transmise avec ce courrier electronique est de nature privilegie et confidentielle. Elle est destinee l'usage exclusif de son destinataire. Si vous n'etes pas le destinataire vise, vous etes par la presente avise qu'il est strictement interdit d'utiliser cette information, de la copier, la distribuer ou la diffuser. Veuillez s'il vous plait contacter l'expediteur initial du courrier electronique et le detruire de votre ordinateur.

1 0

RE: freeradius-mysql rpm
by Jin Fan 19 Jun '06

19 Jun '06

It didn't work for me. If you look closely, the rpm is for freeradius 1.0.2-2. I am using freeradius 1.0.2. -----Original Message----- From: freeradius-users-bounces+jfan=cwlab.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jfan=cwlab.com@lists.freeradius.org] On Behalf Of Leandro Pereira de Lima e Silva - ViaLink Sent: Monday, June 19, 2006 10:03 AM To: FreeRadius users mailing list Subject: Re: freeradius-mysql rpm Why don't just rpm -i freeradius-mysql-0.9.3-1.1.i386.rpm ? Best regards, Leandro. Jin Fan escreveu: > I am using an older version of freeradius 1.0.2 and Fedora 4. > > My way to solve the missing rlm_sql_mysql.so problem is the following. > > 1. I download the freeradius-mysql rpm package from this website. > http://rpmfind.net/linux/RPM/fedora/updates/1/i386/freeradius-mysql-0. > 9. > 3-1.1.i386.html > > 2. Then I used 7-Zip to extract rlm_sql_mysql.so from the rpm. There > are two files in the rpm, rlm_sql_mysql-1.0.2.so and rlm_sql_mysql.so. > The second file is the link file to the first file. > > 3. Then load the first file into /use/lib/ folder, which contains all > the link library files. Make a link to the file and name it > rlm_sql_mysql.so. You also need to use chmod command to change the > file permission. > > 4. Restart freeradius server and it might run. > > You might need to find the correct rpm package for your system. > > Jin Fan > > -----Original Message----- > From: freeradius-users-bounces+jfan=cwlab.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+jfan=cwlab.com@lists.freeradius.org] > On Behalf Of Abul Monsur Mannan > Sent: Monday, June 19, 2006 8:45 AM > To: FreeRadius users mailing list > Subject: Re: freeradius-mysql rpm > > > First of all Thank You for your response. > > Actuallu I'm using Redhat Linux Enterprise 4 .I've 4 cds.After > installation, I've got Mysql_devel,mysql_client and mysql_server.But I > don't get any rlm_mysql.so file in any directory. > > In the meantime, I found the freeradius_mysql rpm from web and want to > install it. But my Q. is where should I install the file.I want your > Help... > > Please help me out of this problem. > Thank You again. > > On 6/19/06, Kofi Adusei Koduah-Sarpong <Kofikoduah(a)hotmail.com> wrote: > >> It's on the one of cds I can't remember which one which version are >> you using? Dvd or cds? Just look through the cds. I actually saw it >> this week while looking for it to make a package for a cobalt RaQ550 >> box. It has the mysql rpm too. I'll try see which cd it's on when I >> get home. Hope this helped >> >> -----Original Message----- >> From: Abul Monsur Mannan [mailto:monsurc1@gmail.com] >> Sent: 18 June 2006 14:56 >> To: FreeRadius users mailing list >> Subject: freeradius-mysql rpm >> >> Dear FR users >> >> I've an enquiry.Please response. >> >> I'm using RHEL 4.It has no rlm_mysql.so files and I found that it has >> no freeradius-mysql rpm either. >> >> So, can anyone help me providing the info. that where I find that rpm >> for redhat linux enterprise 4 to use with freeradius-1.1.2? >> >> I'm looking fr ur response soon. >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- Leandro Pereira de Lima e Silva http://www.vialink.com.br/ "A verdadeira medida do caráter de um homem é o que ele faria se soubesse que nunca seria descoberto." -- Thomas B. Macaulay - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

freeradius-mysql rpm
by Abul Monsur Mannan 19 Jun '06

19 Jun '06

Dear FR users I've an enquiry.Please response. I'm using RHEL 4.It has no rlm_mysql.so files and I found that it has no freeradius-mysql rpm either. So, can anyone help me providing the info. that where I find that rpm for redhat linux enterprise 4 to use with freeradius-1.1.2? I'm looking fr ur response soon.

3 4

Active Directory Integration with FreeRADIUS - NTLM_Auth
by Doug White 19 Jun '06

19 Jun '06

Hello, I am trying to walk through the following document: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf in order to authenticate Cisco router and switch logins against FreeRadius/Active Directory. Using the HowTo, I have successfully joined a FC2 box to our Windows 2003 AD for testing purposes. I have also successfully used the manual ntlm_auth command to authenticate a user from the Radius server. I have configured the Cisco switch to point to the Radius server for authentication. I am not trying to authenticate an actual PC from a switch port, so I have not followed through with the EAP portion of the HowTo. Here is the output of the Radiusd -X and the attempted telnet login to the switch: # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain= %{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge= %{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.0.3:1645, id=68, length=78 NAS-IP-Address = 172.16.0.3 NAS-Port = 66 NAS-Port-Type = Virtual User-Name = "dwhite" Calling-Station-Id = "172.16.2.122" User-Password = "Password1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "dwhite", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 68 to 172.16.0.3:1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 68 with timestamp 448daaf9 Nothing to do. Sleeping until we see a request. Any help as to my next step would be greatly appreciated. Thanks, Doug White

4 5

Auth Problems 2 !!!
by Emerson 19 Jun '06

19 Jun '06

Hi, The problem was a error in eap.conf, i change default eap to tls (and not md5), and work. Now has a another problem, i try to authnticate, but this messages appear. My radius client is a Access Point wl-5460AP with IP 10.254.0.254, and my pc with Airlink 802.11g authing in AP, my IP is 10.254.0.240. I use freeradius with auth eap/tls in MYSQL. Anyone can help me.... Thank's Emerson **********************************Out of radiusd -X************************************************** Sending Access-Reject of id 54 to 10.254.0.254 port 2053 Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.254.0.254:2053, id=55, length=173 User-Name = "usuario1" NAS-IP-Address = 10.254.0.254 NAS-Port = 0 Called-Station-Id = "004f62087474" Calling-Station-Id = "0014a53c478d" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000d017573756172696f31 Message-Authenticator = 0x7f0c4bd69d33ce3fe0cb757219d2f05e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 18 radius_xlat: 'usuario1' rlm_sql (sql): sql_set_user escaped user --> 'usuario1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'usuario1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'usuario1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'usuario1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'usuario1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 18 modcall: leaving group authorize (returns updated) for request 18 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [usuario1/<no User-Password attribute>] (from client mslink-radius port 0 cli 0014a53c478d) Delaying request 18 for 1 seconds Finished request 18 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 16 ID 53 with timestamp 4496c6c7 Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 55 to 10.254.0.254 port 2053 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 17 ID 54 with timestamp 4496c6c9 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 18 ID 55 with timestamp 4496c6cc Nothing to do. Sleeping until we see a request.

2 1

NAS pool
by Mircea Harapu 19 Jun '06

19 Jun '06

Hello, I have a /24 of NAS IP's . What I want is to have an entry in users file that match every IP from that /24 class . Is this possible ? -- ................................................................ Mircea Harapu Abuse Engineer, RDS NOC in Bucharest t: 021-301.08.50 f: 021-301.08.51 e: mircea.harapu(a)rcs-rds.ro w: www.rdslink.ro ................................................................ Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail.

2 1