- Freeradius-Users - lists.freeradius.org

proxy failover
by Michael Markstaller 15 May '06

15 May '06

Just did some tests to verify failover and I came across two issues: - running FreeRADIUS 1.0.1 - one realm (used with DEFAULT Huntgroup,Proxy-To-Relam in users), entered with two home-servers With config proxy server { synchronous = no retry_delay = 10 retry_count = 3 dead_time = 600 default_fallback = no post_proxy_authorize = no } The first failed server *never* gets marked as "dead" using retry_delay = 5 retry_count = 3 one authentication try fails, then the server is marked as dead and subsequent suceed within dead_time The problem is, I need the larger timeout/retry-delay for lame upstream servers and I know the failover also worked with these settings some time ago, but this might have been with an earlier 0.9x release. Is there a way now (I remember some dicussions years ago it wasn't) to make the failover to multiple proxies work without losing one authentication-try each dead_time ? I checked the changelog but found no hints something was fixed or changed in later versions.. Might it be worth a try to use v1.1.1 ? (although I'd really love to keep my stable Debian-package) Michael

2 1

Attribute User-name is mising
by Assa Tal 15 May '06

15 May '06

Hi all, My Free Radiuss 1.1.1. doesn't want to Proxy an accounting request if he is missining the User-Name attribute My co partneres are Cellular company and they don't use" User-Name attribute" I was trying to use the radrelay , but it has some limitition Pls help me to resolve this issue Any help will be appriciate My setup is very basic My set up goes like this Proxy.conf Realm DEFAULT type = radius authhost = x.x.x accthost.= x.x.x.x secret = aaaaa Realm NULL type = radius authhost = x.x.x accthost.= x.x.x.x secret = aaaaa I was truing to use hints file but no sueccess Hints file DEFAULT User-Name = "ccc" , Realm = DEFAULT

2 1

accessing diferent devices
by Carlos Mauricio Reyes Sanmiguel 15 May '06

15 May '06

Hi, I just installed the fre radius in a linux box. I got it working ok, but there is a couple of thig that i don´t know how to do or if they can be done. The first one is i need to create special kind of groups of people that can access some devices but no others, like i have the admin group that has to access all of the 20 devices (switches, routers..) but i also have the operator group that only has to access 2 of them, and on the same radius i need to enable some VPN users that only need to registrate to the radius for the VPN account that connects to the PX firewall and not to any of the devices... Can that be done?, how can i specify witch equipments the users have access to? Thanks. Carlos Reyes

2 1

FreeRadius
by Matteo Lazzarini 15 May '06

15 May '06

Hello, for my net I would want to use freeradius in order to authenticate host windows XP and Linux. First of all which Access Point good ecomomico but is found in Italy? (I live to Bergamo.) Thanks Matteo

1 0

v1.1.1 rlm_eap compile problem (no prob in v1.1.0)
by Aaron Paetznick 15 May '06

15 May '06

I'll save people a lot of time and just paste the bomb out below. Help??? Otherwise, can I simple choose to not compile rlm_eap (I don't use it). I've tried --disable-eap and similar arguements. Thanks. --Aaron /usr/local/src/freeradius-1.1.1/libtool --mode=compile gcc -O2 -march=pentium4 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/usr/local/src/freeradius-1.1.1/src/include -I../.. -I../../libeap -DNO_OPENSSL -c rlm_eap_peap.c mkdir .libs gcc -O2 -march=pentium4 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/usr/local/src/freeradius-1.1.1/src/include -I../.. -I../../libeap -DNO_OPENSSL -c rlm_eap_peap.c -fPIC -DPIC -o .libs/rlm_eap_peap.lo In file included from eap_peap.h:25, from rlm_eap_peap.c:24: ../../libeap/eap_tls.h:138: error: parse error before "SSL" ../../libeap/eap_tls.h:138: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:141: error: parse error before '*' token ../../libeap/eap_tls.h:141: warning: type defaults to `int' in declaration of `into_ssl' ../../libeap/eap_tls.h:141: warning: data definition has no type or storage class ../../libeap/eap_tls.h:142: error: parse error before '*' token ../../libeap/eap_tls.h:142: warning: type defaults to `int' in declaration of `from_ssl' ../../libeap/eap_tls.h:142: warning: data definition has no type or storage class ../../libeap/eap_tls.h:172: error: parse error before '}' token ../../libeap/eap_tls.h:172: warning: type defaults to `int' in declaration of `tls_session_t' ../../libeap/eap_tls.h:172: warning: data definition has no type or storage class ../../libeap/eap_tls.h:182: error: parse error before "tls_session_t" ../../libeap/eap_tls.h:186: error: parse error before "SSL" ../../libeap/eap_tls.h:188: error: parse error before '*' token ../../libeap/eap_tls.h:371: error: parse error before "SSL_CTX" ../../libeap/eap_tls.h:371: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:372: warning: type defaults to `int' in declaration of `eap_tls_t' ../../libeap/eap_tls.h:372: warning: data definition has no type or storage class ../../libeap/eap_tls.h:383: warning: type defaults to `int' in declaration of `SSL' ../../libeap/eap_tls.h:383: error: parse error before '*' token ../../libeap/eap_tls.h:384: error: parse error before "X509_STORE_CTX" ../../libeap/eap_tls.h:386: error: parse error before "SSL" ../../libeap/eap_tls.h:387: error: parse error before '*' token ../../libeap/eap_tls.h:387: error: parse error before '*' token ../../libeap/eap_tls.h:387: warning: type defaults to `int' in declaration of `cbtls_rsa' ../../libeap/eap_tls.h:387: warning: data definition has no type or storage class ../../libeap/eap_tls.h:390: error: parse error before '*' token ../../libeap/eap_tls.h:390: error: parse error before '*' token ../../libeap/eap_tls.h:390: warning: type defaults to `int' in declaration of `eaptls_new_session' ../../libeap/eap_tls.h:390: warning: data definition has no type or storage class ../../libeap/eap_tls.h:391: error: parse error before '*' token ../../libeap/eap_tls.h:392: error: parse error before '*' token ../../libeap/eap_tls.h:393: error: parse error before '*' token ../../libeap/eap_tls.h:397: error: parse error before '*' token ../../libeap/eap_tls.h:398: error: parse error before '*' token In file included from rlm_eap_peap.c:24: eap_peap.h:52: error: parse error before "tls_session_t" rlm_eap_peap.c: In function `eappeap_authenticate': rlm_eap_peap.c:165: error: `tls_session' undeclared (first use in this function) rlm_eap_peap.c:165: error: (Each undeclared identifier is reported only once rlm_eap_peap.c:165: error: for each function it appears in.) rlm_eap_peap.c:165: error: parse error before ')' token gmake[9]: *** [rlm_eap_peap.lo] Error 1 gmake[9]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types/rlm_eap_peap' gmake[8]: *** [common] Error 2 gmake[8]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types' gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types' gmake[6]: *** [common] Error 2 gmake[6]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/freeradius-1.1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/freeradius-1.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/freeradius-1.1.1' make: *** [all] Error 2

4 3

how can i response respectively to different users?
by yao guoxian 15 May '06

15 May '06

How can I use FreeRadius and MySql to response respectively to the different users? I need to give different permissons or rights to the logined uses.ShouldI maintain a table that map detailed permission to different uses? How to write the program which handle the tables? Btw, I want to use AES cryptographic algorithm to encrypt the user's password or ID, and store the encrypted results on the FreeRadius Server machine .How can I give different authorizations to different users according to their AES encypted password? Should I write EAP program? Thanks in advance.

1 0

Interaction cisco/radius
by Pierre LEONARD 15 May '06

15 May '06

hello all I would like to use freeradius server in order to authenticate vpn client. My cisco router run as NAS and VPN concentrator too. When the NAS send access-request to radius, the server return the ip config of the vpn client but the router don't use these informations to configure the vpn client !! some ideas ?? thanks in advance

1 0

rlm_sqlippool and few issues from 14.05.2006 snapshot
by RobertB 15 May '06

15 May '06

Hi All Today I have been testing rlm_sqlippool module from the current snapshot. Here are few problems/question?: 1. Seem like it is designed to work with Postgres db only. Shouldn't be difficult to fix it: Mysql doesn't like NOW() + 3600. Mysql needs NOW() + INTERVAL 3600 SECOND. 2. # lease_duration. fix for lost acc-stop packets - lease-duration = 3600 Seems like rlm_ippool handles this much better. rlm_ippool will free an ip address either on an accounting-stop or if a new authentication request comes on an allocated nas-ip/port. Can this be done in rlm_sqlippool? 3. DEFAULT as an pool name. Is there any way to tell rlm_sqlippool to pick up an ip from any pool available? Something like rlm_ipppool's DEFAULT for the pool name? Cheers RobertB

1 0

Mysql with freeradius Error
by Monsur Mannan 15 May '06

15 May '06

Dear Freeradius users , Would anyone please help me out of my problem ? I'm testing feeradius with mysql on Linux Enterprize edition 4.I did these following things with the help of internet users and members of this site. $INCLUDE ${confdir}/sql.conf authorize { preprocess auth_log chap sql #files mschap } accounting { acct_unique detail unix sql radutmp } session { sql } root@megaphone:~# mysql -u root -p mysql> create database freeradius mysql>insert into user (Host, User, Password) values ('localhost', 'radius','radius'); mysql>grant all on freeradius.* to radius mysql> exit I install the FreeRadius MySQL schema into the freeradius database within MySQL. root@megaphone:~# mysql -u root -p freeradius < /usr/local/src/freeradius-1.1.1/src/modules/example/mysql.sql ** I configure sql.conf file sql { driver = "rlm_sql_mysql" server = "localhost" login = "radius" password = "radius" radius_db = "freeradius" ** I configure clients.conf client 127.0.0.1 { secret = radiustest shortname = localhost } After running the command "Radiusd -X" the output is ------- [root@localhost ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. --------------------------------------------------------------------------------- rad_recv: Access-Request packet from host 127.0.0.1:32769, id=180, length=56 User-Name = "radius" User-Password = "radius" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 180 to 127.0.0.1 port 32769 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 180 with timestamp 44660748 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=184, length=56 User-Name = "root" User-Password = "chishtia" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns ok for request 1 modcall: leaving group authenticate (returns ok) for request 1 Sending Access-Accept of id 184 to 127.0.0.1 port 32769 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 184 with timestamp 4466078f Nothing to do. Sleeping until we see a request. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Can you find out the problem? radius is not accept request other than root user. Please help me ,I think this will be appreciated by everyone of freeradius user. _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 2

Rewriting/Filtering Attributes based upon NAS-IP or NAS-Port-Type
by Bill Carr 15 May '06

15 May '06

I'm sure other have this problem, I've got Free-Radius Running for Wired Users against an OpenLDAP database, but need to now add some functionality for my Wireless Users. I need to (preferably based on NAS-Port-Type) look for an existing Filter-ID (passed from OpenLDAP) and remove it, but replace that attribute with three attributes to support RFC3580 Basically if the port is "Wireless", I want to trigger VLAN moves based upon the Filter ID already existing (and passed) by OpenLDAP. I saw the doc files on attr_rewrite but have been googling and searching from some example of how I implement this within the DEFAULT realm. Anybody with an example or insight into how this be accomplished, THANKS in ADVANCE!! Bill

2 1