- Freeradius-Users - lists.freeradius.org

SNMP apparently not working with FreeRadius 1.0.1 and above on Centos 4.2
by klkbranch＠hotmail.com 26 Jan '06

26 Jan '06

Hi, I am new to this list, though I've been using FreeRadius 0.9.3 for a few years now. My present goal is to get a newer version of FreeRadius (running on Centos 4.2) to work with snmp. Though I have carefully followed the snmp setup instructions as documented in radiusd.conf and snmp.conf, I have yet to get radiusd to attempt SMUX initialization (from output of radiusd -X). Net-snmp is already working (stock Centos rpm net-snmp-5.1.2-11.EL4.6). I have tried the stock Centos freeradius rpm (freeradius-1.0.1-3.RHEL4.i386.rpm). I have also tried tarball installs of freeradius 1.0.1, 1.0.2, 1.0.5, and 1.1.0, with the "--with-snmp" option, with no success. Nothing results in any SMUX-related output from radiusd -X. After reading this thread, http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-April/04286… it appeared I needed some kind of patch. Near the end of that thread, Kevin Bonner gave this solution: You're using Net-SNMP in RHAS4. FreeRADIUS 1.0.2 doesn't have the net-snmp compatibility fix. You can find the patch at http://lists.freeradius.org/archives/freeradius-users/2004/10/frm00210.html Apply that patch, rebuild, and it should work. Unfortunately this link is now broken. However, after some more digging it appeared Kevin was probably referring to: freeradius-0.9.3-net-snmp.patch which I was able to download from another source. I was able to successfully apply this patch to FreeRadius 1.0.1, 1.0.2, 1.0.5, and 1.1.0, and the subsequent compiles were successful, but still radiusd -X makes no references to SMUX and snmp queries for freeradius OIDs fail as before. I'm at my wit's end about what to try next, and would sincerely appreciate any light you all might be able to shed on this issue. My /usr/local/etc/radiusd.conf file contains snmp = yes $INCLUDE ${confdir}/snmp.conf My /usr/local/etc/snmp.conf file contains smux_password = verysecret My /etc/snmp/snmpd.conf file contains rocommunity public smuxpeer .1.3.6.1.4.1.3317.1.3.1 verysecret But every time I run this on the server snmpwalk -v2c -cpublic 127.0.0.1 .1.3.6.1.2.1.67 I get this result SNMPv2-SMI::mib-2.67 = No Such Object available on this agent at this OID Here is an example of the output I get from radiusd -X (when using 1.0.5 in this case): Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Thanks in advace for your assistance, Kevin Branch

3 3

Can't import ldap schema provided in ldap howto
by Laura Donovan 26 Jan '06

26 Jan '06

Hello, I've been trying to configure openldap for use with radius. I'm running a RedHat ES 4 server with the following rpm's installed: openldap-2.2.13-3 freeradius-1.0.1-3.RHEL4 I've been following the instructions in ldap_howto.txt, and I created the schema.ldif file exactly as outlined in the doc. But when I run the ldapadd command it gives the following error: [root@myserver]# ldapadd -f schema.ldif -x -D "cn=root,dc=mydomain,dc=com" -w secret adding new entry "dc=mydomain,dc=com" adding new entry "ou=radius,dc=mydomain,dc=com" adding new entry "ou=profiles,ou=radius,dc=mydomain,dc=com" adding new entry "ou=users,ou=radius,dc=mydomain,dc=com" adding new entry "ou=admins,ou=radius,dc=mydomain,dc=com" adding new entry "uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com" ldap_add: Object class violation (65) additional info: no structural object class provided I do have the include statement for "RADIUS-LDAPv3.schema" configured in my slapd.conf, and I already verified that it is readable by the user ldap (and that the path is correct). Here is the entry ldapadd is erroring on: dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com objectclass: radiusprofile uid: dial radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None I've found other posts with users having the same issue, but I haven't found one detailing the resolution. I've checked to ensure that there are no extra spaces at the end of the lines. Thanks in advance for any assistance! Sincerely, -Laura Donovan

3 2

problems compiling, but works, or don't??
by pelusa vali 26 Jan '06

26 Jan '06

hi every body, well trying to use freeradius v 1.0.5 to add security to a wlan, i configured this to use with openssl and eap-tls with this command: ./configure --prefix=/usr/local/ --with-openssl-includes=/usr/local/ssl/include/ --with-experimental-modules --enable-ltdl-install when i type make, get this error: Making static dynamic in rlm_perl... make[6]: Entering directory `/usr/src/freeradius-1.0.5/src/modules/rlm_perl' /usr/src/freeradius-1.0.5/libtool --mode=link gcc -release 1.0.5 \ -module -export-dynamic \ -o rlm_perl.la -rpath /usr/local//lib rlm_perl.lo `perl -MExtUtils::Embed -e ldopts` -lssl -lcrypto -lnsl -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! rm -fr .libs/rlm_perl.la .libs/rlm_perl.* .libs/rlm_perl-1.0.5.* gcc -shared rlm_perl.lo -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lpthread -lc -lcrypt -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.0.5.so -o .libs/rlm_perl-1.0.5.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/usr/src/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/usr/src/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/usr/src/freeradius-1.0.5' make: *** [all] Error 2 i have installed libsdl-perl and in /usr/src/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_tls/Makefile i have this: TARGET = rlm_eap_tls SRCS = rlm_eap_tls.c eap_tls.c cb.c tls.c mppe_keys.c RLM_CFLAGS = $(INCLTDL) -I../.. -I/usr/local/ssl/include/ HEADERS = eap_tls.h RLM_INSTALL = RLM_LDFLAGS += -I/usr/local/ssl/lib RLM_LIBS += -lssl -lcrypto $(STATIC_OBJS): $(HEADERS) $(DYNAMIC_OBJS): $(HEADERS) RLM_DIR=../../ include ${RLM_DIR}../rules.mak well why this error occurs and how could i solve?? i just can install if don't compile with --with-experimental-modules, so what happen if i don't use those experimental modules?? could freeradius work in my wlan as i hope? thanks in advance for your time. _________________________________________________________________ Charla con tus amigos en línea mediante MSN Messenger: http://messenger.latam.msn.com/

3 2

Modifying a radreply
by Thulani Maphosa (T) 26 Jan '06

26 Jan '06

Hi all, am investigating the possibility of appending to a radreply attribute. 1. This will come from ISP * Cisco-Avpair += "ip route 10.0.1.0 255.255.255.0" 2. From our radius as per Realm * Cisco-AVpair += "ip:vrf-id=client1" * Cisco-AVpair += "ip:ip-unnumbered=Loopback11" * Cisco-Avpair += "ip:addr-pool=easyvpnpool" Modify proxy reply from ISP to look like this: * Cisco-Avpair += "ip route vrf client1 10.0.1.0 255.255.255.0" Can this be achieved on post-proxy with attr_rewrite? Kind regards Thulani Maphosa IP Networks and Services (012) 311 5494 maphost(a)telkom.co.za There are 10 types of people that can understand Binary. Those who can, and those who can't. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

deny access to ms-chap
by André Lemos 26 Jan '06

26 Jan '06

1 1

SV: How to log users in radutmp
by Torkel Mathisen 26 Jan '06

26 Jan '06

Hi Thanks. I was looking on the freeradius server, but ofcourse the problem was on the AP. :) Regards, Torkel -----Opprinnelig melding----- Fra: freeradius-users-bounces+torkel.mathisen=bbs.no(a)lists.freeradius.org [mailto:freeradius-users-bounces+torkel.mathisen=bbs.no@lists.freeradius.org] På vegne av Alan DeKok Sendt: 24. januar 2006 18:29 Til: FreeRadius users mailing list Emne: Re: How to log users in radutmp "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > I don't have that radutmp file. > > How do I get freeradius to log users in that file? Make the NAS send data that FreeRADIUS can log. See the FAQ. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Yet another PEAP/LDAP Question
by Jon P. Giza 25 Jan '06

25 Jan '06

Hello all: I am trying to setup a 802.1x WiFi authentication system using freeradius. My setup is as follows: Windows XP SP2 as the supplicant using PEAP/MSCHAPv2 Cisco Aironet 1231 Freeradius 1.1.0 IBM Lotus Domino LDAP The process is mostly working - Freeradius binds to LDAP properly, the User gets authorized, Freeradius pulls the correct password hash from the Domino LDAP server.. But, then the MSCHAP portion fails. Portion of the log is shown below which I believe shows the problem. I am thinking that the problem is that I am not telling Freeradius how to hash the supplied password correctly to match the Domino password. The aggravating part is that we are using the exact same Domino LDAP server to authenticate our VPN users. Full (sanatized) copy of the debug output is here: http://www.xbytenetworks.com/debug-log.txt Copy of Radiusd.conf is here: http://www.xbytenetworks.com/radiusd.conf Thanks in advance for any help you can offer. Jon rlm_ldap: - authorize rlm_ldap: performing user authorization for jon.giza radius_xlat: '(uid=jon.giza)' radius_xlat: 'OU=Waukesha,OU=NA,O=MyCo' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Waukesha,OU=NA,O=MyCo, with filter (uid=jon.giza) rlm_ldap: Added password (6BDC5527858B28XXXXXXXXXEFAF2323F) in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jon.giza authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 5 rlm_mschap: Told to do MS-CHAPv2 for jon.giza with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: leaving group MS-CHAP (returns reject) for request 5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 5 modcall: leaving group authenticate (returns reject) for request 5 auth: Failed to validate the user. Login incorrect: [jon.giza/<no User-Password attribute>] (from client wifi.myco.com port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 152 to 10.100.224.235 port 1645 EAP-Message = 0x010800261900170301001b1bb3ec40925325e30990ce3b14a78af7abc1f7222d06716740d2 ff Message-Authenticator = 0x00000000000000000000000000000000 State = 0x132496908cd3121e6967d7ddafcdd795 Finished request 5

3 6

Dictionary files for HP Procurve switch?
by Mark Tunnell 25 Jan '06

25 Jan '06

Can anyone point me to dictionary file for an HP ProCurve 2650 switch? I've got basic authentication functioning but I don't have the information I need to get the privilege level working. Thanks, Mark

6 9

IC radius question
by Jake Messinger 25 Jan '06

25 Jan '06

I know this is the freeradius forum but I thought Id ask here. I have a customer using icradius and they say that they cant easily switch to freeradius because of several python scripts written to work with icradius. So, there problem. They are seeing THIS error in their radius logs: Check list does not match request list [USER] (from nas access-2#2/S99 cli 5094441590) It only happens with S99 and only with this 2nd Lucent Portmaster 4 they recently installed. The first pm4 and 2 other pm3's never get this error. They ARE using the NAS-PORT-TYPE attribute if that has possibly anything to do with it. Im wondering why, its coming from S99? There is no port s99 on a Portmaster 4. ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~ Jake Messinger, VP. ph:713-772-6690 Visit: portmasters.com AMS, Inc. fx:713-774-3498 advmed.com 8300 Bissonnet #400 jake(a)jakes.org profjake.com Houston, Texas 77074 http://jakes.org homestarrunner.com ICQ# 4403734 YAHOO: prof_jake AIM: profjake MSN: jake(a)jakes.org Adjunct Professor University of Houston, CBA jake(a)uh.edu ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~

5 6

error compiling freeradius-1.1.0 on fedora core three
by Tony Alexander 25 Jan '06

25 Jan '06

hello all, first time posting tothe list. i'm trying to compile freeradius-1.1.0 from source on a proliant ml350 with dual pentium III's. the box is running fedora core 3, kernel 2.6.12-1.1381_FC3smp, gcc 3.4.4 although configure goes off without a hitch the compile bombs out after three minutes with the following error: gmake[7]: Entering directory `/root/freeradius-1.1.0/src/modules/ rlm_otp/cardops' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual - Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes - Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef - I../../../include -I/usr -DOTP_MODULE_NAME="rlm_otp" -DFREERADIUS / usr -c cryptocard.c -o cryptocard.o gcc: /usr: linker input file unused because linking not done cc1: /usr: No such file or directory gmake[7]: *** [cryptocard.o] Error 1 gmake[7]: Leaving directory `/root/freeradius-1.1.0/src/modules/ rlm_otp/cardops' gmake[6]: *** [cardops/cryptocard.lo] Error 2 gmake[6]: Leaving directory `/root/freeradius-1.1.0/src/modules/rlm_otp' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/freeradius-1.1.0/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-1.1.0/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-1.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-1.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-1.1.0' make: *** [all] Error 2 a google search revealed that an 'if defined' statement in this doc 'src/modules/rlm_otp/otp_state.c' of the source package was incorrect: #if defined(__linux__) || defined(__APPLE__) #include <sys/un.h> #endif and should be changed to: #ifdef HAVE_SYS_UN_H #include <sys/un.h> #endif to fix the compile problem. i've made the correction but i still get the same compile error. my 'c' programming is a little rusty. is there anyone who can suggest what further steps i should take to try and debug this? thanx in advance. any help will be greatly appreciated. ax :-) Tony Alexander System Administrator Center for Biodiversity and Conservation American Museum of Natural History Central Park West at 79th Street New York, NY 10024 Phone: 212 496 3474 Fax: 212 769 5292 Mobile: 917 548 0560 http://cbc.amnh.org

2 2