- Freeradius-Users - lists.freeradius.org

Compiling freeradius 1.1.1 in FreeBSD 6.0 with mysql support
by Mark Hennessy 11 Apr '06

11 Apr '06

I'm trying to build freeradius 1.1.1 on a FreeBSD 6.0 system with MySQL 4.1.15 I'm using the following configure commandline: ./configure --with-mysql-lib=/usr/local/mysql/lib/mysql --with-mysql-include=/usr/local/mysql/include/mysql --prefix=/usr/local/adm/freeradius-1.1.1 I'd include the full output, but I figure that I should only do that if asked. Here's the problematic section: configuring in ./drivers/rlm_sql_mysql running /bin/sh ./configure --with-mysql-lib-dir=/usr/local/mysql/lib/mysql --with-mysql-include-dir=/usr/local/mysql/include/mysql --prefix=/usr/local/adm/freeradius-1.1.1 --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for mysql_config... (cached) yes checking for pthread_create in -lpthread... (cached) yes checking for mysql_init in -lmysqlclient_r (using mysql_config)... no checking for mysql_init in -lmysqlclient_r... no configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql.h (using mysql_config)... yes configure: warning: sql submodule 'mysql' disabled updating cache ../../../../.././config.cache creating ./config.status creating Makefile creating config.h config.h is unchanged It's not seeing mysql libraries, but they do indeed exist: # ls -al /usr/local/mysql/lib/mysql total 1974 drwxr-xr-x 2 root wheel 512 Apr 5 10:39 . drwxr-xr-x 3 root wheel 512 Apr 5 10:39 .. -rw-r--r-- 1 root wheel 14446 Apr 5 10:39 libdbug.a -rw-r--r-- 1 root wheel 41928 Apr 5 10:39 libheap.a -rw-r--r-- 1 root wheel 13640 Apr 5 10:39 libmerge.a -rw-r--r-- 1 root wheel 331488 Apr 5 10:39 libmyisam.a -rw-r--r-- 1 root wheel 24934 Apr 5 10:39 libmyisammrg.a -rw-r--r-- 1 root wheel 472466 Apr 5 10:39 libmysqlclient.a -rwxr-xr-x 1 root wheel 871 Apr 5 10:39 libmysqlclient.la lrwxr-xr-x 1 root wheel 20 Apr 5 10:39 libmysqlclient.so -> libmysqlclient.so.14 -rwxr-xr-x 1 root wheel 387482 Apr 5 10:39 libmysqlclient.so.14 -rw-r--r-- 1 root wheel 237570 Apr 5 10:39 libmystrings.a -rw-r--r-- 1 root wheel 253852 Apr 5 10:39 libmysys.a -rw-r--r-- 1 root wheel 105640 Apr 5 10:39 libnisam.a -rw-r--r-- 1 root wheel 5472 Apr 5 10:39 libvio.a # ls -al /usr/local/mysql/include/mysql total 288 drwxr-xr-x 2 root wheel 1024 Apr 5 10:39 . drwxr-xr-x 3 root wheel 512 Apr 5 10:39 .. -rw-r--r-- 1 root wheel 3428 Apr 5 10:39 errmsg.h -rw-r--r-- 1 root wheel 6778 Apr 5 10:39 keycache.h -rw-r--r-- 1 root wheel 17899 Apr 5 10:39 m_ctype.h -rw-r--r-- 1 root wheel 8085 Apr 5 10:39 m_string.h -rw-r--r-- 1 root wheel 1859 Apr 5 10:39 my_alloc.h -rw-r--r-- 1 root wheel 28650 Apr 5 10:39 my_config.h -rw-r--r-- 1 root wheel 3463 Apr 5 10:39 my_dbug.h -rw-r--r-- 1 root wheel 3509 Apr 5 10:39 my_dir.h -rw-r--r-- 1 root wheel 3000 Apr 5 10:39 my_getopt.h -rw-r--r-- 1 root wheel 39298 Apr 5 10:39 my_global.h -rw-r--r-- 1 root wheel 1515 Apr 5 10:39 my_list.h -rw-r--r-- 1 root wheel 3588 Apr 5 10:39 my_net.h -rw-r--r-- 1 root wheel 1245 Apr 5 10:39 my_no_pthread.h -rw-r--r-- 1 root wheel 24387 Apr 5 10:39 my_pthread.h -rw-r--r-- 1 root wheel 1784 Apr 5 10:39 my_semaphore.h -rw-r--r-- 1 root wheel 32346 Apr 5 10:39 my_sys.h -rw-r--r-- 1 root wheel 2007 Apr 5 10:39 my_xml.h -rw-r--r-- 1 root wheel 27615 Apr 5 10:39 mysql.h -rw-r--r-- 1 root wheel 15028 Apr 5 10:39 mysql_com.h -rw-r--r-- 1 root wheel 1241 Apr 5 10:39 mysql_embed.h -rw-r--r-- 1 root wheel 2184 Apr 5 10:39 mysql_time.h -rw-r--r-- 1 root wheel 781 Apr 5 10:39 mysql_version.h -rw-r--r-- 1 root wheel 11315 Apr 5 10:39 mysqld_error.h -rw-r--r-- 1 root wheel 5841 Apr 5 10:39 raid.h -rw-r--r-- 1 root wheel 6499 Apr 5 10:39 readline.h -rw-r--r-- 1 root wheel 1751 Apr 5 10:39 sql_common.h -rw-r--r-- 1 root wheel 6401 Apr 5 10:39 sql_state.h -rw-r--r-- 1 root wheel 1055 Apr 5 10:39 sslopt-case.h -rw-r--r-- 1 root wheel 1883 Apr 5 10:39 sslopt-longopts.h -rw-r--r-- 1 root wheel 970 Apr 5 10:39 sslopt-vars.h -rw-r--r-- 1 root wheel 1265 Apr 5 10:39 typelib.h I'm thoroughly perplexed. What should I try next? -- Mark Hennessy

8 11

Digest & Messenger
by saman alaniazar 11 Apr '06

11 Apr '06

dear Alan I changed the version of freeradius to 1.1.1 and we kept the last radiusd.conf file from 1.0.5 version unchanged. Belove you can see the excerpt of radiusd.conf file expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { # preprocess # auth_log # attr_filter # chap # mschap digest # eap sql } authenticate { # Auth-Type PAP { # pap # } # Auth-Type CHAP { # chap # } # Auth-Type MS-CHAP { # mschap # } digest # unix # eap } =============================================================== When I test the server with some open source sip phones, everything is ok but when I want to test following user with MSN messenger , reject packet was received : user = server2_user1 password = test URI =user(a)testrealm.icii.com Method = REGISTER Algorithm = "MD5" Here it is the dubug of freeradius for this packet : rad_recv: Access-Request packet from host 10.10.1.3:2309, id=242, length=200 NAS-Identifier = "testrealm" Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x0a0f736572766572325f7573657231 Digest-Attributes = 0x02226530663765326631373633376638323638316463323461396262363264643637 Digest-Attributes = 0x06054d4435 User-Name = "server2_user1" Digest-Attributes = 0x04187369703a746573747265616c6d2e696369692e636f6d Digest-Response = "5f0fc8449eb607379d80ad34a83fe512" Digest-Attributes = 0x0114746573747265616c6d2e696369692e636f6d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 0 radius_xlat: 'server2_user1' rlm_sql (sql): sql_set_user escaped user --> 'server2_user1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'server2_user1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'server2_user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'server2_user1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_digest: Converting Digest-Attributes to something sane... Digest-Method = "REGISTER" Digest-User-Name = "server2_user1" Digest-Nonce = "e0f7e2f17637f82681dc24a9bb62dd67" Digest-Algorithm = "MD5" Digest-URI = "sip:testrealm.icii.com" Digest-Realm = "testrealm.icii.com" A1 = server2_user1:testrealm.icii.com:test A2 = REGISTER:sip:testrealm.icii.com KD = 590b483ad6e6df65edb1826f5404e3a5:e0f7e2f17637f82681dc24a9bb62dd67:684a8ca612e13a06c419dc89351ac183 rlm_digest: FAILED authentication modcall[authenticate]: module "digest" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. ======================================================= Now let's look at a correct authentication that was sent by open source sip phone. rad_recv: Access-Request packet from host 10.10.1.3:2773, id=22, length=200 NAS-Identifier = "testrealm" Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x0a0f736572766572325f7573657231 Digest-Attributes = 0x02226562376234336638333032613234656261343338313533366338346334393335 Digest-Attributes = 0x06054d4435 User-Name = "server2_user1" Digest-Attributes = 0x04187369703a746573747265616c6d2e696369692e636f6d Digest-Response = "d1b993f54dc5e242c4b67389188db5dd" Digest-Attributes = 0x0114746573747265616c6d2e696369692e636f6d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 36 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 36 radius_xlat: 'server2_user1' rlm_sql (sql): sql_set_user escaped user --> 'server2_user1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'server2_user1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'server2_user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'server2_user1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'server2_user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 36 modcall: leaving group authorize (returns ok) for request 36 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 36 rlm_digest: Converting Digest-Attributes to something sane... Digest-Method = "REGISTER" Digest-User-Name = "server2_user1" Digest-Nonce = "eb7b43f8302a24eba4381536c84c4935" Digest-Algorithm = "MD5" Digest-URI = "sip:testrealm.icii.com" Digest-Realm = "testrealm.icii.com" A1 = server2_user1:testrealm.icii.com:test A2 = REGISTER:sip:testrealm.icii.com KD = 590b483ad6e6df65edb1826f5404e3a5:eb7b43f8302a24eba4381536c84c4935:684a8ca612e13a06c419dc89351ac183 modcall[authenticate]: module "digest" returns ok for request 36 modcall: leaving group authenticate (returns ok) for request 36 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 36 rlm_sql (sql): Processing sql_postauth radius_xlat: 'server2_user1' rlm_sql (sql): sql_set_user escaped user --> 'server2_user1' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'server2_user1', 'Chap-Password', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'server2_user1', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 36 modcall: leaving group post-auth (returns ok) for request 36 Sending Access-Accept of id 22 to 10.10.1.3 port 2773 >* I have installed FreeRadius 1.1.0 as an authentication server for our sip *>* proxy, I am using MSN messenger and some other sip phone to test. *>* everything in my database is ok and I receive access packet by the sip *>* phones except MSN messenger , when I am using MSN mesenger , I receive *>* reject packet. * Run the server in debugging mode to see what's going wrong. Also, you might try using version 1.1.1, which has updates to the digest module. Alan DeKok. -- S.A.A

1 0

Modifying username before its handed off to other modules?
by David Lais 11 Apr '06

11 Apr '06

Hello, I need to modify the username attribute dynamically before its handed off to other modules. Is it possible to use the "rlm_attr_rewrite"-module in a simple perl script? I want to change usernumbers to username. Any ideas about that one? Thanks, David Lais david.lais(a)urz.uni-heidelberg.de

1 0

filter to authenticate posixAccount users
by monish ar 11 Apr '06

11 Apr '06

Hi, I was a little confused about radiusd.conf settings for ldap authentication. These are a few doubts i have ... 1) Is there any specific filter entry to authenticate posixAccount users? The default is filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" , will this work for posixAccount / shadowAccount users? 2) Do i need to comment the password_attribute = "userPassword" entry for successful bind to the ldap server? 3) Why does the entry : base_filter = "(objectclass=radiusprofile)" gets set when radiusd runs even though i comment it in the radiusd.conf file? Is the base filter entry required for ldap authentication? If yes, is the above default entry correct? I've tried rlm_ldap authentication but failed till now,i get the error message during authentication. rlm_ldap: Bind failed with invalid credentials However,bind is successful during authorization but fails during authentication... any ideas?

1 0

Version 1.1.1 stops responding
by King, Michael 10 Apr '06

10 Apr '06

So I built 1.1.1 on Debian. After a period of so many hours (variable) it stops responding. (Sometimes 2hours, sometimes 16hours) Now here's where it get's weird, (and makes me suspect it might not be freeRADIUS at the root cause) If I stop and restart the freeRADIUS service, it continues to ignore RADIUS packets. But if I restart the server (hard reboot) it works fine. Till it stops responding again. Obviously this is not enough information to help you diagnose the problem. How do I gather that information? The box is a 233 Pentium with 64 megs of ram. Has about 15 AP's, with around 100 users (not simultaneous, maybe 30 simultaneous) So what's the suggested way of gathering more info? Running debug mode piping to a text file?

7 8

radaccounting, what does octets mean?
by Alex M 10 Apr '06

10 Apr '06

In accounting, what does an octet mean? Thanks!

3 2

Re: Freeradius-Users Digest, Vol 12, Issue 41 (Away from the office)
by Robert Wills 10 Apr '06

10 Apr '06

I am away from the office, returning on the 26th of April 2006, if you have any urgent problems please forward them to SWRC IT (it(a)bunbury.training.wa.gov.au) Or Call 9780 7314 . See you soon Robert

1 0

Re: dialup admin & ippool administraton
by Olaf Schäfer 10 Apr '06

10 Apr '06

> the sqlippool module in cvs does this.. This module sounds interesting - something I haven't take into my considerations keeping the dynamic ippool data in the sql-db, too. And it's obvious to do it this way using a primary and a backup server. But the configuration information like "range-start" etc. is still stored in the radiusd.conf. My idea was to put these configuration information for each ippool into the mysql-db. Some background information for better understanding :) My task is to migrate from MS-IAS to freeradius. Thus people are used to do administration tasks with a GUI. :) At least normal production administration tasks should be integrated within a GUI. Putting configuration information into a db would save the parsing and editing the radius.conf by dialup-admin scripts. best regards, Olaf

3 3

Re: /usr/local/lib/rlm_pam.a: invalid ELF header [SOLVED]
by Aaron Paetznick 10 Apr '06

10 Apr '06

After further testing, I seem to have discovered a fix/workaround. The key was to define --with-system-libtool. I don't know if this affects other 64-bit systems, but if other systems will also need to use the system libtool in this way, I suggest adding something in the documentation. What version of libtool comes with FreeRADIUS, and could/should it be upgraded? Thanks for the help. --Aaron Alan DeKok wrote: > Aaron Paetznick <aaronp(a)critd.com> wrote: >> Is rlm_pam compatible with 64-bit systems? Thanks in advance. > > It's not an issue with rlm_pam. It's probably a 32/64-bit > compatibility problem. > > If your compiler produces 64-bit libraries, the system should be > able to load 64-bit libraries. Not having access to your system, I > don't know what format rlm_pam is in, or what's going wrong. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Digest& Messenger
by saman alaniazar 09 Apr '06

09 Apr '06

Dear All I have installed FreeRadius 1.1.0 as an authentication server for our sip proxy, I am using MSN messenger and some other sip phone to test. everything in my database is ok and I receive access packet by the sip phones except MSN messenger , when I am using MSN mesenger , I receive reject packet. I searched all mailing list but no answer. do you think that there is any incompatability between MSN messenger and FreeRadius. is there any differences between digest method of freeradius and MSN messenger? I appreciate any help and be grateful for your favours. Best regard -- S.A.A

2 1