- Freeradius-Users - lists.freeradius.org

Problem Seg Fault
by Breuer Nicolas 10 Feb '06

10 Feb '06

Hello I've just installed Fedora 4 with MYSQL 4.1.18 I tried to install the last version of freeradius and i 've a big error at the startup Mysql is correctly installed into the system.. startup with -X Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "xxx.yyy.be" sql: port = "" sql: login = "" sql: password = "" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/var/log//sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" ........................ sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ012 3456789.-_: /" Segmentation fault

2 2

ld: error fatal: library -lssl: no encontrado
by Alvaro Quiñones 10 Feb '06

10 Feb '06

Hi I have this mistake "ld: error fatal: library -lssl: no encontrado" when i try to make. Version is freeradius-1.1.0 and my SO is Solaris10. how can i compile freeradius without support OpenSSL?? i tried: ./configure --without-OpenSSL however appear checking for openssl/ssl.h... yes checking for openssl/err.h... yes checking for openssl/crypto.h... yes checking for openssl/rand.h... yes checking for openssl/engine.h... yes checking for OpenSSL version >= 0.9.7... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking for openssl/ssl.h... yes checking for DH_new in -lcrypto... yes checking for SSL_new in -lssl... yes checking how to run the C preprocessor... (cached) gcc -E checking for openssl/err.h... (cached) yes checking for openssl/engine.h... (cached) yes creating ./config.status checking for SSL_new in -lssl... (cached) yes checking for openssl/des.h... yes checking for openssl/hmac.h... yes checking for openssl/md4.h... yes checking for openssl/md5.h... yes checking for openssl/sha.h... yes What can i do? Regards Alvaro

2 1

prepaid counter
by Rusma 10 Feb '06

10 Feb '06

dear all, I need your advice for my prepaid billing, i have several scenario : 1. prepaid for 4 hours and expire in 2 days after login. 2. prepaid for 8 hours and expire in 4 days after login. 3. prepaid for 24 hours and expire in 1 day. i have configured my freeradius and mysql using rlm_sqlcounter, i have tested with sample account from sqlcounter doc and its works. . i need to make or change default scripts for above schemes. can any body help me. best regards, rusma permana

1 0

problem with simultanous use...any idea???
by tommy garsia 10 Feb '06

10 Feb '06

Hi guys... I've finished compile and install freeradius v1.1.0 with mysql...and work great... and i'm happy with it... now i have a problem during the accounting.... what should i do if i want to limit only one connection per one user..?? what should i do with my freeradius configuration? best regards, tommy __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

radutmp file administration
by Leonardo Reginin 09 Feb '06

09 Feb '06

Hi fellows. I am relatively newbie with freeradius. Are there problem in remove the radutmp file ( radius stop; rm; radius start of course) ? What kind of information are lost ? Are there any utility to admin the radutmp file such to remove an user entry ? Sorry for that elementary questions :-) Thanks !

2 3

MS-CHAP, LDAP, ADS
by Elizabeth Palomino 09 Feb '06

09 Feb '06

Greetings, I have poked about on google and read several how to's. Is it possible using any authentication module ( rlm_pam,rlm_ldap...) To authenticate a connection from a client using CHAP or MS-CHAP to an Active Directory Server (TM) *cough*. I can authenticate just fine with cleartext to the radius server using PAM---Winbind -->ADS Gives the same error as below LDAP -->ADS Error: User-Password is Required for authentication. Cannot use "CHAP-Password" Looking at the debug output I see the request with the CHAP-Password. I am now thoroughly confused. I had this working with a mirapoint (LDAP server), Any ideas on getting chap-pap authentication working against an ADS server. To Summarize: 1) What should the users file contain? 2) Which is a better way to authenticate? ldap,PAM-->Winbind? 3) Can I use the ntlm_auth line with the chap 4) I have read about peap and eap. Perhaps this would work? 5) Is there a good freeradius book you would recommend? Heck, I'll even volunteer to write a howto on it! (I write heaps of documentation). What I am trying to avoid is having password transmitted clear text over the network. Is there perhaps a better Solution? Thanks!

2 1

users file before ldap
by Stephane Branchoux 09 Feb '06

09 Feb '06

Hello, i use freeradius with openldap When i try to autenticate some users with users file for wifi connections (cisco bbsm captive portal) , authentication fails. user is defined like this : toto Auth-Type := Local, User-Password == "clear password" ou toto1 User-Password == "clear password" My authorize section of free radius is defined like this (files before ldap) : authorize { preprocess auth_log chap mschap suffix eap files ldap } But when i use ntradping tool, authentication succeeds with ldap and with user fille. Any idea ? Many thanks in advance. -- stephane BRANCHOUX Centre de Ressources Informatiques de l'Université de Perpignan. Systèmes/Réseaux mailto:stephane.branchoux@univ-perp.fr 04 68 66 21 24 Validation signature / Trusting signature: http://igc.cru.fr/trust.html

1 1

dictionary: override attribute type/id mapping
by Andriy Gapon 09 Feb '06

09 Feb '06

I use freeradius-1.1.0 built from FreeBSD ports on FreeBSD. There is the following comment in default raddb/dictionary.sample (this file probably comes from the FreeBSD port): # # Place additional attributes or $INCLUDEs here. They will # over-ride the definitions in the pre-defined dictionaries. # But this doesn't seem to be true or, at least, entirely true. For example, I place the following lines in my raddb/dictionary: # big all-inclusive freeradius dictionary $INCLUDE /usr/local/share/freeradius/dictionary # my local dictionary $INCLUDE /usr/local/local/dictionary.mine And dictionary.mine has this content: #try to override Digest-Response with value from # draft-ietf-radext-digest-auth-06.txt ATTRIBUTE Digest-Response 102 string Then I get the following error on radiusd startup: $ radiusd -sfxxyz -l stdout ... Errors reading dictionary: dict_init: /usr/local/local/dictionary.mine[3]: dict_addattr: Duplicate attribute name Digest-Response Errors reading radiusd.conf Shouldn't I be able to override name->number mapping for attributes ? How to work around this problem ? Is copying the "all-inclusive" dictionary and throwing out the following line the only solution ? ATTRIBUTE Digest-Response 206 string On a related note - is it a good idea in general to have digest authentication stuff defined in main dictionary file and dictionary.freeradius.internal ? Especially given that those definitions are based on the very old and expired draft and are very unlikely to become standard. I think that those definitions should be clearly separated into their own dictionary and they should also somehow be marked as based on the draft-sterman-aaa-sip-00.txt and conflicting with the subsequent drafts, including the latest one (draft-ietf-radext-digest-auth-06.txt). -- Andriy Gapon

2 5

radclient windows
by alfonso 09 Feb '06

09 Feb '06

is there a compile version fro windows ?? thanks, Alfonso Guerendiain oliver

1 0

rsa key length in EAP-TLS.
by Andrea G Forte 09 Feb '06

09 Feb '06

Hi all, as of yesterday I have updated the certificates to use a 2048 bit key. The odd thing is that when I start freeradius, I get the message: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 the length seems to be 512. (?) I would also like to know if the rsa key exchange should be enabled instead of the dh key exchange, and if so how do I enable it? I could not find anything in the config file. Thank you, Andrea

1 0