- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 12, Issue 41 (Away from the office)
by Robert Wills 10 Apr '06

10 Apr '06

I am away from the office, returning on the 26th of April 2006, if you have any urgent problems please forward them to SWRC IT (it(a)bunbury.training.wa.gov.au) Or Call 9780 7314 . See you soon Robert

1 0

Re: dialup admin & ippool administraton
by Olaf Schäfer 10 Apr '06

10 Apr '06

> the sqlippool module in cvs does this.. This module sounds interesting - something I haven't take into my considerations keeping the dynamic ippool data in the sql-db, too. And it's obvious to do it this way using a primary and a backup server. But the configuration information like "range-start" etc. is still stored in the radiusd.conf. My idea was to put these configuration information for each ippool into the mysql-db. Some background information for better understanding :) My task is to migrate from MS-IAS to freeradius. Thus people are used to do administration tasks with a GUI. :) At least normal production administration tasks should be integrated within a GUI. Putting configuration information into a db would save the parsing and editing the radius.conf by dialup-admin scripts. best regards, Olaf

3 3

Re: /usr/local/lib/rlm_pam.a: invalid ELF header [SOLVED]
by Aaron Paetznick 10 Apr '06

10 Apr '06

After further testing, I seem to have discovered a fix/workaround. The key was to define --with-system-libtool. I don't know if this affects other 64-bit systems, but if other systems will also need to use the system libtool in this way, I suggest adding something in the documentation. What version of libtool comes with FreeRADIUS, and could/should it be upgraded? Thanks for the help. --Aaron Alan DeKok wrote: > Aaron Paetznick <aaronp(a)critd.com> wrote: >> Is rlm_pam compatible with 64-bit systems? Thanks in advance. > > It's not an issue with rlm_pam. It's probably a 32/64-bit > compatibility problem. > > If your compiler produces 64-bit libraries, the system should be > able to load 64-bit libraries. Not having access to your system, I > don't know what format rlm_pam is in, or what's going wrong. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Digest& Messenger
by saman alaniazar 09 Apr '06

09 Apr '06

Dear All I have installed FreeRadius 1.1.0 as an authentication server for our sip proxy, I am using MSN messenger and some other sip phone to test. everything in my database is ok and I receive access packet by the sip phones except MSN messenger , when I am using MSN mesenger , I receive reject packet. I searched all mailing list but no answer. do you think that there is any incompatability between MSN messenger and FreeRadius. is there any differences between digest method of freeradius and MSN messenger? I appreciate any help and be grateful for your favours. Best regard -- S.A.A

2 1

/usr/local/lib/rlm_pam.a: invalid ELF header
by Aaron Paetznick 09 Apr '06

09 Apr '06

I'm trying to build FreeRADIUS v1.1.1 on CentOS 4.3 x86_64. I'm not passing configure any special arguments. When I start the server, here's what I get in the log: Sun Apr 9 03:51:28 2006 : Error: radiusd.conf[589] Failed to link to module 'rlm_pam': /usr/local/lib/rlm_pam.a: invalid ELF header Sun Apr 9 03:51:28 2006 : Error: radiusd.conf[1872] Unknown module "pam". Sun Apr 9 03:51:28 2006 : Error: radiusd.conf[1840] Failed to parse authenticate section. Is rlm_pam compatible with 64-bit systems? Thanks in advance. --Aaron

2 1

RADIUS stops responding after a while
by Alex M 08 Apr '06

08 Apr '06

I've got strange behavior on y FR, need to find the way to prevent it, and find out what caused it. I've just went to my radius server and found out that it doesn't want to handle requests.. I restarted it in debug and it told me that SQL module is unknown. (was working fine for 1 month) I restarted again in debug and now it went OK and works fine, but this thing is not acceptable in the field . So does any one knows what could cause such a behavior (not accepting requests, due to module malfunction) and more importantly is there any way to monitor the server functionality? Let's say something like send testing request each 30min or something and if server doesn't reply send email notification? Thanks!

4 12

FreeRadius - Cisco 7204 - L2TP Tunnel
by TS 08 Apr '06

08 Apr '06

Hi all I'm having major issues with getting Freeradius to authenticate from a Cisco 7204 that is terminating an L2TP tunnel and sending radius auth to a FreeRadius server. Using a default install of Freeradius and configuring it to accept auth requests from the Cisco in clients.conf it just fails on authentication. Even though the username and password in the users files is correct, proven using radtest. >From radius -X without changing any config options it gives me Login is incorrect sending a plain text password. No matter what I change in the config files it always fails. I've tried adding Auth-Type's to the users entry such as Local and this gives me things like no password is configured for the user. Removing the "Default Auth-Type" from the top of the users file and setting an Auth-Type in the users entry gives me no Auth-Type set. Really not sure where the error is. So I guess my question is does anyone use FreeRadius to authenticate from a Cisco 7200 series with success? If so is it possible to supply: - The virtual template section that specifies the ppp authentication? - A copy of the radius.conf file? - The users file with an example users entry that works. Then I can see if I've got it all setup correctly. This used to work fine when I was using a Linux server to terminate the L2TP tunnel, I used L2TPNS to do the termination and it sent radius authentication to the FreeRadius server. Thanks Tony -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 4

ads questions and multiple values
by liz 08 Apr '06

08 Apr '06

Greetings, A few more questions :) I've now gone through the book ( I feel like such a snob reading it on the bus ==) and have a better understanding of how Freeradius works. I have gotten it to search for an attribute in LDAP and return it the NAS. What I would like to do is to have it be able to query the memberOf attribute in the acrtive directory server and then verify if the user is in any of those groups and than permit access based on that membership. Heres what im wondering a) When I query the attribute it returns multiple cn=... results. In the debug log I see it setting this as xxx.xxxx which is understood by our nas equipment. It does it four times, But in the reply packet I only see it sending one and not four. Am I correct to assume that it will only send one of the responses to the Nas. b) I think I can use the Users file to determine which group the user is a member of and then have it send an attribute back to the Nas telling it which role to set. Is the the attribute returning multiple groups a problem (not multiple attributes, one attribute several bits of data seperated by a delimiter) ? c) can I strip the leading cn= bit from the response the ldap server sends ( I saw an article somewhere about using an operator in the LDAP.attrmap file) and once thats done can it use the groups returned in the users file? Thanks! Liz

2 2

sql_log question
by Miguel 08 Apr '06

08 Apr '06

hi, i have a reporting system, this will perform intensive calculations, agregate functions etc using accounting data, so i dont want to run this system in the same server where the account is stored, i plan to use the sql_log/sql-relay combo, however i do need that the account data be stored online in the database running in the radius server, because i have triggers in the stoptable that calculate the h323-credit-amount using a modified excelent peter nixon's voip schema. the line in radius.conf says accounting { # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log } cant i have both sql account feature and sql_log at the same time? --- Miguel

2 1

Couldn't stop freeradius server!!
by lmyho 07 Apr '06

07 Apr '06

Hi All, Installed freeradius 1.1.0-1 on debian system (2.6.15-1-686). The radius server started automatically well each time when the system booting. But I wanted to stop it to do some testing using my modified configuration files. I tried to stop the server using command: 'freeradius stop' ('radiusd' doesn't work on this debian - anyone knows why??) But so werid, no matter what command I gave, with parameter stop|start|restart, the server ALWAYS goes to START again!! even from the /etc/init.d/freeradius I can read that the 'stop' param should stop the server! Can anyone tell me why the command couldn't stop the server?? and how should I stop it?? The log file shows entries like this for each of my trying, even the command viven was to "stop": Tue Apr 4 01:14:13 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Apr 4 01:14:13 2006 : Error: There appears to be another RADIUS server running on the authenticat What is happenning here? (I couldn't top the running deamon, so is the 2nd line above) Also, from the log file I noticed: even when the system automatically started the freeradius server deamon, it was "Using deprecated naslist file". Log entries show like this: Fri Mar 31 13:51:54 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Fri Mar 31 13:51:54 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Mar 31 13:51:55 2006 : Info: Ready to process requests. Can anyone tell me what is happenning here?? Why it's using the deprecating naslist file? The installed radiusd.conf file doesn't show the server will use the naslist file at all! from where I can stop the server to use this deprecating file? Also what does the 2nd line of the above log entries mean? Any help would be greatly appreciated! Thank you so much for help in advance!! Best regrads, leo __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

9 18