- Freeradius-Users - lists.freeradius.org

Re: RPM for Mandrake 10.1 - error
by Sean 27 Apr '06

27 Apr '06

> From: "Paul Seaman" <paul(a)accesscomm.ca> > > Hello, > > I'm trying to compile a Mandrake 10.1 RPM for Freeradius-1.1.1 using the > redhat .specfile, and it gets all the way to the end and then spits out: > > ln: creating symbolic link `/tmp/freeradius-root/usr/lib/libradius-1.1.1.la' > to `libradius.la': No such file or directory > > It is correct; the /tmp/freeradius-root/usr/lib directory is simply not > there. When I look at /tmp/freeradius-root/usr, I see the following: > > drwxr-xr-x 2 root root 4096 Apr 27 00:12 bin/ > -rwxr-xr-x 1 root root 94141 Apr 27 00:12 libradius-1.1.1.so* > -rw-r--r-- 1 root root 103052 Apr 27 00:12 libradius.a > -rwxr-xr-x 1 root root 814 Apr 27 00:12 libradius.la* > lrwxrwxrwx 1 root root 18 Apr 27 00:12 libradius.so -> > libradius-1.1.1.so* > drwxr-xr-x 2 root root 4096 Apr 27 00:12 sbin/ > drwxr-xr-x 4 root root 4096 Apr 27 00:12 share/ > > No ./lib/ directory. Anybody have any ideas that runs Freeradius under > Mandrake or might've done this already? > > Paul Hi Paul, I've been running Freeradius with Mandrake 10.1 and Mandriva 2006 for over a year now. I always compile from the tar files and the only problem I ever had was forgetting to install the MySQL development extensions. I'd recommend that you use the tar files instead of the RPM. I've written a short tutorial that will help you at http://swarmhotspots.com/faq.html Regards, Sean Bracken

1 0

Re: freeradius, deb (sid)
by Gabor Szelei 27 Apr '06

27 Apr '06

Nicolas Baradakis wrote: >You don't need to worry about that, dpkg-buildpackage checks everything >for you. Just run the commands written in the FAQ, and it'll be fine. You are right. I was trying configure and ./debian/rules binary-arch. Thank you. br, gabor

1 0

EAP TLS authentification
by pch＠cci-brest.fr 26 Apr '06

26 Apr '06

Hello, After an authentification with a certificate, the user-name who is return is the common name of the certificate. How can i do to use another field (subject, email, serial number...) because some person can have a same common name ? Thanks in advance

2 1

Execute scripts
by Andrzej Żmijewski 26 Apr '06

26 Apr '06

I'm new in FreeRadius. I want to make my own log on script which will execute same bash functions. Is it possible?? Andrew

2 1

Messenger
by sami aa 26 Apr '06

26 Apr '06

Dear all, I am using freeradius 1.1.1 to authenticate SIP users. Using Windows Messenger as SIP phone is very important for me. I tested my servers(Sip proxy and freeradius) with free SIP phones and everything is OK. But with windows messenger I face some problems. I think the Function that Windows uses for Digest encription has some differences with FreeRadius functions (perhaps, I guess). Let me Know if anyone has tested the FreeRadius with windows messenger. "Is it possible or not?" I appericiate any help. Best wishes Saman --------------------------------- Celebrate Earth Day everyday! Discover 10 things you can do to help slow climate change. Yahoo! Earth Day

2 1

RE: Re: Create and Send attributes
by Carlos Peñafiel 26 Apr '06

26 Apr '06

>Carlos Peñafiel wrote: > > Hello!!! > > > > I want to send from my radius server several attributes to the client, > > but I've been looking at the documenation. I can do that if my > > attribute-ID is between 1 and 100 (I guess, maybe is it 256), but also > > the documentation says that a new attribute has to have an ID greater > > than 3000. > > > > So, are not "the attributes between 100 (256) and 3000" sent to the > > client radius? (I guess, they could be used for local management) If it > > is not, how can I create an attribute with id grater that 3000 and send > > to the radius client? > >If you are creating your own attributes, get an IANA enterprise number >(either apply for one or re-use one if AND ONLY IF you're certainly it >will only be used internally) and use a vendor-specific attribute space. >See the dictionary.$vendor files for examples. > >Alternatively, have a dig in the dictionary files and/or RFCs for an >existing attribute that closely matches the purpose. What are you trying >to do? > >Obviously you'll have to have control over the radius client to make it >actually use the new attribute. Most will only use attributes they >already know about. > > Hello and thank you to answer so soon. I am trying to do something like "amount of quality of service" that a user have. I have the control over the radius client because I am using a HostAP, but looking at the documentation and on Google, I cant find a way to solve this. can you help me a little but more? Thank you in advance.

3 3

Re: freeradius, deb (sid)
by Gabor Szelei 26 Apr '06

26 Apr '06

Hi, >You might download FreeRADIUS 1.1.1 and build a Debian package >from sources. I've tried, but faild to collect all the needed modules. Which version of libcrypt is need? Which version of openlls is needed? Can I find ldap headers from deb ? Is there some page about dependency requirments? Thanks. br, Gabor Szelei

2 1

Re: Freeradius + ldap
by Phil Mayers 26 Apr '06

26 Apr '06

ludovic cailleau wrote: > Good morning, > > I send this email because I don't found my error about freeradius + ldap. > I thinhk, I have an error of the userPassword at the request 7. Please don't send mails directly to me. I'm not a personal helpline. The mailing list is the appropriate place. Looking below, you see: > rlm_ldap: user VoisinC authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > modcall[authenticate]: module "unix" returns notfound for request 0 > modcall: group authenticate returns notfound for request 0 > auth: Failed to validate the user. Something is setting Auth-Type to System. It's probably this, higher up: > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 Fix your config and it will work. > > You can see the output of radiusd -X : > > Can you help me? > Thanks a lot > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/raddb/clients.conf > Config: including file: /etc/raddb/snmp.conf > Config: including file: /etc/raddb/eap.conf > Config: including file: /etc/raddb/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/radius" > main: libdir = "/usr/lib" > main: radacctdir = "/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = yes > main: log_file = "/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = yes > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "radiusd" > main: group = "radiusd" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "/etc/shadow" > unix: group = "(null)" > unix: radwtmp = "/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded LDAP > ldap: server = "10.49.0.101" > ldap: port = 389 > ldap: net_timeout = 1 > ldap: timeout = 4 > ldap: timelimit = 3 > ldap: identity = "cn=adminlp,o=crt" > ldap: tls_mode = no > ldap: start_tls = no > ldap: tls_cacertfile = "(null)" > ldap: tls_cacertdir = "(null)" > ldap: tls_certfile = "(null)" > ldap: tls_keyfile = "(null)" > ldap: tls_randfile = "(null)" > ldap: tls_require_cert = "allow" > ldap: password = "azerty" > ldap: basedn = "o=crt" > ldap: filter = > "(&(objectclass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" > ldap: base_filter = "(objectclass=radiusprofile)" > ldap: default_profile = "(null)" > ldap: profile_attribute = "(null)" > ldap: password_header = "(null)" > ldap: password_attribute = "userPassword" > ldap: access_attr = "(null)" > ldap: groupname_attribute = "cn" > ldap: groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > ldap: groupmembership_attribute = "(null)" > ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" > ldap: ldap_debug = 0 > ldap: ldap_connections_number = 5 > ldap: compare_check_items = no > ldap: access_attr_used_for_allow = yes > ldap: do_xlat = yes > rlm_ldap: Registering ldap_groupcmp for Ldap-Group > rlm_ldap: Registering ldap_xlat with xlat_name ldap > rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap > rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ > rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type > rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use > rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id > rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id > rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password > rlm_ldap: LDAP userPassword mapped to RADIUS NT-Password > rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT > rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration > rlm_ldap: LDAP radiusVSA mapped to RADIUS Symbol-SSID > rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type > rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol > rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address > rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask > rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route > rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing > rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id > rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU > rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression > rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host > rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service > rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port > rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number > rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id > rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network > rlm_ldap: LDAP radiusClass mapped to RADIUS Class > rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout > rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout > rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action > rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service > rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node > rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group > rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS > Framed-AppleTalk-Link > rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS > Framed-AppleTalk-Network > rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS > Framed-AppleTalk-Zone > rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit > rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port > conns: 0x8d07af0 > Module: Instantiated ldap (ldap) > Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = yes > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/etc/raddb/certs/dh" > tls: random_file = "/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = yes > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/etc/raddb/huntgroups" > preprocess: hints = "/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded detail > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (auth_log) > Module: Loaded attr_filter > attr_filter: attrsfile = "/etc/raddb/attrs" > rlm_attr_filter: Authorize method will be deprecated. > Module: Instantiated attr_filter (attr_filter) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/etc/raddb/users" > files: acctusersfile = "/etc/raddb/acct_users" > files: preproxy_usersfile = "/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > detail: detailfile = > "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (reply_log) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32825, id=234, length=59 > User-Name = "VoisinC" > User-Password = "password" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20060426' > rlm_detail: > /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands > to /var/log/radius/radacct/127.0.0.1/auth-detail-20060426 > modcall[authorize]: module "auth_log" returns ok for request 0 > modcall[authorize]: module "attr_filter" returns noop for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "VoisinC", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for VoisinC > radius_xlat: '(&(objectclass=posixAccount)(uid=VoisinC))' > radius_xlat: 'o=crt' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to 10.49.0.101:389, authentication 0 > rlm_ldap: bind as cn=adminlp,o=crt/azerty to 10.49.0.101:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in o=crt, with filter > (&(objectclass=posixAccount)(uid=VoisinC)) > rlm_ldap: Added password password in check items > rlm_ldap: looking for check items in directory... > rlm_ldap: Adding radiusVSA as Symbol-SSID, value CRTguest & op=21 > rlm_ldap: Adding userPassword as NT-Password, value password & op=21 > rlm_ldap: looking for reply items in directory... > rlm_ldap: user VoisinC authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > modcall[authenticate]: module "unix" returns notfound for request 0 > modcall: group authenticate returns notfound for request 0 > auth: Failed to validate the user. > Login incorrect: [VoisinC/password] (from client localhost port 1812) > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 234 to 127.0.0.1:32825 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 234 with timestamp 444f82d2 > Nothing to do. Sleeping until we see a request. > > ------------------------------------------------------------------------ > *Faites de Yahoo! votre page d'accueil sur le web* pour retrouver > directement vos services préférés : vérifiez vos nouveaux mails, lancez > vos recherches et suivez l'actualité en temps réel. Cliquez ici > <http://us.rd.yahoo.com/mail/mail_taglines/yahoofr/*http://fr.yahoo.com/set>. > > ------------------------------------------------------------------------ > *Faites de Yahoo! votre page d'accueil sur le web* pour retrouver > directement vos services préférés : vérifiez vos nouveaux mails, lancez > vos recherches et suivez l'actualité en temps réel. Cliquez ici > <http://us.rd.yahoo.com/mail/mail_taglines/yahoofr/*http://fr.yahoo.com/set>. >

1 0

RE: Re: Use of Service type attribute
by Carlos Peñafiel 26 Apr '06

26 Apr '06

>=?iso-8859-1?B?Q2FybG9zIFBl8WFmaWVs?= <carpeher(a)hotmail.com> wrote: > > I am trying to do something like "amount of quality of service" that a >user > > have. > > What does that mean? Im sorry for my English. I want to have a variable (attribute) saying that for each user who has authorization using the network, I want to offer a QoS going outside (to the internet) for him/her. > > > I have the control over the radius client because I am using a HostAP, >but > > looking at the documentation and on Google, I cant find a way to solve >this. > > can you help me a little but more? > > Edit the source code to the client to look for, and interpret, the >new attribute. Re-use an attribute of a similar name, or invent a new >one. If the attribure is used only in your local deployment, it >doesn't really matter what number you pick. It just has to be a >number that goes into a RADIUS packet. > > Alan DeKok. > Ok. Thank you for your time.

1 0

Réf. : Freeradius-Users Digest, Vol 12, Issue 98
by JVUVANT Yahoo 26 Apr '06

26 Apr '06

Hi I am using actually freeradius wich work fine for linux box with one if (eth0). I've added another if (eth1) for some applications else. But whe I run radiusd -X -A, freeradius doesn't start correctly, ie. log stop reading at clients file. so My question is how to start freeradius en specific interface (for example eth0). Thanks for any answer. Jacques

2 1