- Freeradius-Users - lists.freeradius.org

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 29 Mar '06

29 Mar '06

Hi, > From: "Natalia Escalera" <nescalera(a)gmail.com> > > We tried FR 1.1.1 and we are still having problems with > passwords containing > special characters like '$' for the LDAP authentication. In > FR 1.1.0 the '$' > was replaced by a character such as '%24'. For the new > version, the symbol > '$' is deleted as well as the character that is next to it. Here is an > example of the executed command and its output: > > Command: > /usr/local/bin/radtest username "test$2006" x.x.x.x 1 test123 > Output: > Sending Access-Request of id 215 to x.x.x.x port 1812 > User-Name = "username" > User-Password = "test006" #<----- No dollar sign, no number 2 > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1 > rad_recv: Access-Reject packet from host x.x.x.x:1812, > id=215, length=20 That seems to be a problem with the radtest/radclient. Can you test with some "real" RADIUS client? The server may now work correctly but the special characters in User-Password seem to be "destroyed" by the radtest/radclient so they are never sent to the server. I haven't tested 1.1.1 yet, so unfortunately I cannot give more specific help :( -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

2 1

opening sockets in modules
by radhika putty 29 Mar '06

29 Mar '06

Hi.. Are we allowed to open sockets inside a module and communicate with other programs. If not then how else can we communicate with other network programs.. --------------------------------- New Yahoo! Messenger with Voice. Call regular phones from your PC and save big.

3 2

Re: RADTEST
by Atkins, Dwane P 29 Mar '06

29 Mar '06

Alan and all, Thanks for your help. Here is an issue that I cannot get worked out. However, if I run the > mysql -u radius -p radius command it will take me right to the radius database so it is working (right?) sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Then tell the server to use that password instead of the Unix module Where is this process at? I cannot find it in the Radius book I bought. Thanks Dwane Message: 3 Date: Thu, 23 Mar 2006 14:30:00 -0500 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: RADTEST To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20060323193001.1C92716CC1(a)mail.nitros9.org> "Atkins, Dwane P" <ATKINSD(a)uthscsa.edu> wrote: > I have looked at the radius.log file Don't. Run the server in debugging mode. > Thu Mar 23 12:47:48 2006 : Auth: rlm_unix: [atkinsd]: invalid password The Unix module says that the password is wrong, or the user doesn't exist in /etc/passwd. > But I have it in radcheck and can prove it. Then tell the server to use that password instead of the Unix module. Alan DeKok. Dwane Atkins T&N 210-567-0158 <mailto:atkinsd@uthscsa.edu>

3 6

(no subject)
by Mark Supersonik 29 Mar '06

29 Mar '06

Hi friends! I speak from the tongue of an engineering student in a research group trying to implement a RADIUS proxy system. My doubt is: can a freeradius server do first an authorization of a request throught a DB (i.e MySQL) and proxy then if so or reject it (if all isn't in rule)? I mean, summarizing: Can a request be authenticated/authorized for two times? We want only to accept access if each one of the two servers process the authentication successfully. Thanks in advance for all the support you can give us, hope to hear from you Marc (Nets Research Group [Pompeu Fabra University]) _________________________________________________________________ ¿Estás pensando en cambiar de coche? Todas los modelos de serie y extras en MSN Motor. http://motor.msn.es/researchcentre/

1 0

Upgrade Freeradius
by Paulo Cabrita 29 Mar '06

29 Mar '06

Hello. I have a network where wireless users use the freeradius to authenticate via OpenLDAP (in an another box) I recently installed the 1.1.0 version using last version of the SLES for OS and everything worked well. I did the following: ./configure --with-openssl-includes=/usr/local/openssl/include --with-openssl-libraries=/usr/local/openssl/lib --prefix=/usr/local/radius --with-rlm-ldap-lib-dir=/usr/local/openldap/lib/ --with-rlm-ldap-include-dir=/usr/local/openldap/include/ make make install Before, I installed openssl (0.9.8a) like this: ./config --prefix=/usr/local/openssl shared make make install From the radiusd.conf I have: ... ldap { server = "192.168.2.4" port = 636 basedn = "ou=users,dc=ual,dc=pt" filter = "(mail=%{User-Name})" start_tls = no access_attr = "radiusClientIPAddress" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 30 timeout = 60 timelimit = 60 net_timeout = 60 } ... It runs perfectly well but when it received a request from a client, I have the following error: Error: rlm_ldap: could not set LDAP_OPT_X_TLS option Success Using "clear" comunication (ldap://), it works well, so I definitively have a problem with TLS/SSL. I have the same configuration in an another box using freeradius 1.0.5 and it works fine. Any idea? TIA -- Atentamente, ------------------------------------ |Paulo Cabrita, Msc | |Director do Centro de Informática | |da Universidade Autónoma de Lisboa| |Tel: +351-213177635 | |Fax: +351-213533702 | |E-mail: pjc(a)ual.pt | ------------------------------------

1 0

v1.1.1 build problems (SSL, EAP)
by Bill Roberts 29 Mar '06

29 Mar '06

Hi, I'm just posting my experiences in building v1.1.1 in case it is of use to anyone else with similar problems. My system is Solaris 10 Sparc, Freeradius v1.1.1, OpenSSL 0.9.8a, Sun compiler version 5.7 (SunStudio 10). I ran configure like this: ./configure --with-raddbdir=/usr/local/etc/raddb --with-openssl-includes=/usr/local/ssl/include --with-openssl-libraries=/usr/local/ssl/lib (OpenSSL 0.9.8a is installed in /usr/local/ssl) In the midst of the configure output I saw this: configure: warning: skipping test for openssl/ssl.h This ultimately caused compilation errors in rlm_eap_peap.c: "../../libeap/eap_tls.h", line 138: syntax error before or at: SSL "../../libeap/eap_tls.h", line 141: syntax error before or at: BIO "../../libeap/eap_tls.h", line 186: syntax error before or at: SSL "../../libeap/eap_tls.h", line 186: warning: undefined or missing type for: SSL "../../libeap/eap_tls.h", line 187: warning: undefined or missing type for: cons When I investigated by looking at the config.log there was a "not found" error for libcrypto. It turns out that the configure script has this line in the "test for libcrypto" section: LIBS="-lcrypto $LIBS" In my case, this expands to: -lcrypto -L/usr/local/ssl/lib .....<other stuff deleted>.... Which means libcrypto is not found because it is listed before the -L directive telling the compiler where it can be found. OK, easy fix, so I edit configure and change the LIBS line to be "$LIBS -lcrypto". This gets me past the libcrypto test but the scsript then fails the next test for libssl and I can't use the same fix (I suspect for reasons related to library order). In the end I decide to fudge the crypto and ssl tests by removing the DH_new(); and SSL_new(); calls from the conftest C programs. Everything then builds OK until rlm_perl.c when I see: "rlm_perl.c", line 165: syntax error before or at: CV I found an article on the FreeRadius users mailing list archive ( http://www.archivesat.com/FreeRadius_users_mailing_list/thread357241.htm ) about rlm_eap compilation problems where it was suggested that removing the rlm_eap directory would allow the build to finish and the server to run. So I removed src/modules/rlm_perl and src/modules/rlm_eap and I now have a running server. Regards, Bill Roberts

2 1

Installed freeradius v1.1.1 ok but running got "Floating point exception"?
by Albert Lin 29 Mar '06

29 Mar '06

Hi! My Linux: uname -a Linux ANVL-Workstation 2.4.20-8smp #1 SMP Thu Mar 13 17:45:54 EST 2003 i686 i686 i386 GNU/Linux [root@ANVL-Workstation etc]# radiusd -X Floating point exception Any help? Thanks! __Albert SPECIAL NOTICE All information transmitted hereby is intended only for the use of the addressee(s) named above and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution of confidential and privileged information is prohibited. If the reader of this message is not the intended recipient(s) or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that you must not read this transmission and that disclosure, copying, printing, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. Anyone who receives confidential and privileged information in error should notify us immediately by telephone and mail the original message to us at the above address and destroy all copies. To the extent any portion of this communication contains public information, no such restrictions apply to that information. (gate01)

4 3

Compile errors in Freeradius-1.1.1
by Alan 29 Mar '06

29 Mar '06

I am currently trying to compile the new version of FreeRadius 1.1.1. I've used the same configure statement just like in 1.1.0 and for some reason I am receiving a few build errors. Please help. ~Alan ---- OS: Red Hat Enterprise v.3 (2.4.21-4.EL 32bit) Configure Statement: ./configure --prefix=/custom/freeradius-1.1.1 \ --without-rlm_x99_token \ --without-rlm_krb5 \ --without-rlm_sql_postgresql \ -without-rlm_sql_oracle After running "make install" the ls command shows a few weird symlinks in the install directory: [johnny5@sip][09:37:34 Tue Mar 28]-[/custom/freeradius-1.1.1] $ ls total 436 drwxr-xr-x 2 root root 4096 Mar 28 09:34 bin drwxr-xr-x 3 root root 4096 Mar 28 09:34 etc -rwxr-xr-x 1 root root 170033 Mar 28 09:36 libradius-1.1.1.so -rw-r--r-- 1 root root 233620 Mar 28 09:36 libradius.a -rwxr-xr-x 1 root root 749 Mar 28 09:36 libradius.la lrwxrwxrwx 1 root root 18 Mar 28 09:36 libradius.so -> libradius-1.1.1.so drwxr-xr-x 5 root root 4096 Mar 28 09:34 man drwxr-xr-x 2 root root 4096 Mar 28 09:34 sbin drwx------ 3 root root 4096 Mar 28 09:34 share drwxr-xr-x 4 root root 4096 Mar 28 09:34 var Output error after running "make install": [johnny5@sip][09:36:43 Tue Mar 28]-[~/freeradius-1.1.1] $ sudo make install /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/sbin /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/bin /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/etc/raddb /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/man /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/var/run/radiusd /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 700 /custom/freeradius-1.1.1/var/log/radius /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 700 /custom/freeradius-1.1.1/var/log/radius/radacct /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 700 /custom/freeradius-1.1.1/share /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/share/freeradius for i in 1 5 8; do \ /home/johnny5/freeradius-1.1.1/install-sh -c -d -m 755 /custom/freeradius-1.1.1/man/man$i; \ for p in man/man$i/*.$i; do \ /home/johnny5/freeradius-1.1.1/install-sh -c -m 644 $p /custom/freeradius-1.1.1/man/man$i; \ done \ done gmake[1]: Entering directory `/home/johnny5/freeradius-1.1.1' Making install in src... gmake[2]: Entering directory `/home/johnny5/freeradius-1.1.1/src' gmake[3]: Entering directory `/home/johnny5/freeradius-1.1.1/src' Making install in include... gmake[4]: Entering directory `/home/johnny5/freeradius-1.1.1/src/include' gmake[4]: Nothing to be done for `install'. gmake[4]: Leaving directory `/home/johnny5/freeradius-1.1.1/src/include' Making install in lib... gmake[4]: Entering directory `/home/johnny5/freeradius-1.1.1/src/lib' /home/johnny5/freeradius-1.1.1/libtool --mode=install /home/johnny5/freeradius-1.1.1/install-sh -c -c libradius.la /custom/freeradius-1.1.1/lib /home/johnny5/freeradius-1.1.1/install-sh -c -c .libs/libradius-1.1.1.so /custom/freeradius-1.1.1/libradius-1.1.1.so (cd /custom/freeradius-1.1.1 && rm -f libradius.so && ln -s libradius-1.1.1.so libradius.so) /home/johnny5/freeradius-1.1.1/install-sh -c -c .libs/libradius.lai /custom/freeradius-1.1.1/libradius.la /home/johnny5/freeradius-1.1.1/install-sh -c -c .libs/libradius.a /custom/freeradius-1.1.1/libradius.a ranlib /custom/freeradius-1.1.1/libradius.a chmod 644 /custom/freeradius-1.1.1/libradius.a libtool: install: warning: remember to run `libtool --finish /custom/freeradius-1.1.1/lib' rm -f /custom/freeradius-1.1.1/lib/libradius-1.1.1.la; ln -s libradius.la /custom/freeradius-1.1.1/lib/libradius-1.1.1.la ln: creating symbolic link `/custom/freeradius-1.1.1/lib/libradius-1.1.1.la' to `libradius.la': No such file or directory gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/home/johnny5/freeradius-1.1.1/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/johnny5/freeradius-1.1.1/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/home/johnny5/freeradius-1.1.1/src' gmake[1]: *** [common] Error 2 make: *** [install] Error 2

4 3

Having multiple authentication query in sql.conf
by vignesh 29 Mar '06

29 Mar '06

Hello all Can I have multiple authentication queries in sql.conf file. There are different ways by which we want to autheticate the users. I will let you know what I exactly want. I want to authenticate users based on the CLID and the remote ip address. The problem is that the remote address has to be searched from a set of ips. I will give you a example Suppose that we have a user 9204 and if the call for this particular user comes from a set of ips like 222.223.33.24 or 33.44.334.44( which will be present in some database tables) etc only then user will be authenticated. Vignesh

3 2

freeradius 1.1.1 does not make on 64 bit intel platfrom
by Ashwin Gobind 29 Mar '06

29 Mar '06

Hi all. I am trying to install freeradius 1.1.1 on a 64 bit intel platform. I get the ffg error : rm -fr .libs/rlm_counter.la .libs/rlm_counter.* .libs/rlm_counter-1.1.1.* gcc -shared rlm_counter.lo -Wl,--rpath -Wl,/usr/software/freeradius-1.1.1/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /usr/software/freeradius-1.1.1/src/lib/.libs/libradius.so /usr/lib/libgdbm.so -lnsl -lresolv -lpthread -Wl,-soname -Wl,rlm_counter-1.1.1.so -o .libs/rlm_counter-1.1.1.so /usr/lib/libgdbm.so: could not read symbols: Invalid operation collect2: ld returned 1 exit status gmake[6]: *** [rlm_counter.la] Error 1 Please indicate how to install freeradius 1.1.1 on a 64 bit platform ? \ �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.co.za/legal/email.jsp "

1 0