- Freeradius-Users - lists.freeradius.org

Where are these "Client-IP-Address = 127.0.0.1" messages coming from?
by Matthew Schumacher 13 Jan '06

13 Jan '06

I'm getting accounting messages like these that seem to be coming from the loopback interface, but `tcpdump -i lo` doesn't see them so they are not coming from a local client. If they are not coming from a local client then how can I figure out where they are coming from? Thu Jan 12 07:19:58 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "user" NAS-Port = 536936515 Acct-Session-Id = "0A000067" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "1cc41474b27ed376" Timestamp = 1137082798 Thu Jan 12 07:23:50 2006 Acct-Status-Type = Stop NAS-IP-Address = x.x.x.x (legit nas IP) Acct-Delay-Time = 0 User-Name = "anotheruser" NAS-Port = 268501111 Acct-Session-Id = "0D008123" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = x.x.x.x (legit Framed-IP-Address) Acct-Session-Time = 0 Acct-Input-Octets = 0 Acct-Output-Octets = 0 Acct-Input-Packets = 0 Acct-Output-Packets = 0 Client-IP-Address = 127.0.0.1 Acct-Unique-Session-Id = "4ed0aac222580a10" Timestamp = 1137083030

4 11

help me
by trioka.dudi.p 13 Jan '06

13 Jan '06

Im newbie feeradius... error in madake 10.2 pls help my, configur in linux madrake thks oka

3 2

SIGHUP disables debugging
by Kenneth Lee 13 Jan '06

13 Jan '06

Hi there, The problem seems to be around the lines in mainconfig.c, read_mainconfig(): if ((mainconfig.debug_level > debug_flag) || (mainconfig.debug_level <= old_debug_level)) { debug_flag = mainconfig.debug_level; } librad_debug = debug_flag; old_debug_level = mainconfig.debug_level; When read_mainconfig() is called the second time, debug_flag is reset to that specified in config file. The problem is minor, but looks funny to me. I expect -X to be sticky. Kenneth

2 1

EAP-TLS and EAP-TTLS problem in my config
by Riccardo.Veraldi 13 Jan '06

13 Jan '06

Hello, I need to authenticate users with EAP-TTLS but I do not want at hte same time users who has a certificate to being able to use it to authenticate themself. I have seen that to enable eap-ttls also eap-tls modue need to be configured in eap.conf everyhing works with EAP-TTLS, but users can authenticate with EAP-TLS also using a personal certificate. I want to forbid authentication via EAP-TLS with the certificate, and allow only EAP-TTLS how can I do it ? I Was not able to find a solution unless to list all the login name of the users in the users file, but this is not very scalable... I would like to do it with a DEFAULT stanza but was unable to achieve what I need thank you very much Rick

2 1

Compiling FR 1.1.0
by Rohaizam Abu Bakar 13 Jan '06

13 Jan '06

Tested with FBSD 4.11 error with rlm_attr_rewrite... After remove the folder... then error with rlm_otp ####################################### Making all in cardops ... gmake[6]: Entering directory `/var/src/freeradius-1.1.0/src/modules/rlm_otp/cardops' gcc -g -O2 -pthread -D_THREAD_SAFE -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../../../include -DOTP_MODULE_NAME="rlm_otp" -DFREERADIUS -c cryptocard.c -o cryptocard.o In file included from /usr/include/openssl/des.h:66, from ../otp.h:32, from cryptocard.c:26: /usr/include/openssl/opensslconf.h:177: warning: `OPENSSL_NO_KRB5' redefined *Initialization*:1: warning: this is the location of the previous definition cryptocard.c: In function `cryptocard_updatecsd': cryptocard.c:230: syntax error before `PRIx32' cryptocard.c: In function `cryptocard_isconsecutive': cryptocard.c:255: syntax error before `SCNx32' cryptocard.c:252: warning: unused variable `nextewin' cryptocard.c: At top level: cryptocard.c:260: syntax error before `++' cryptocard.c:58: warning: `cryptocard_name2fm' defined but not used cryptocard.c:78: warning: `cryptocard_keystring2keyblock' defined but not used cryptocard.c:110: warning: `cryptocard_nullstate' defined but not used cryptocard.c:139: warning: `cryptocard_challenge' defined but not used cryptocard.c:184: warning: `cryptocard_response' defined but not used cryptocard.c:226: warning: `cryptocard_updatecsd' defined but not used cryptocard.c:251: warning: `cryptocard_isconsecutive' defined but not used cryptocard.h:59: warning: `cryptocard_maxtwin' declared `static' but never defined cryptocard.h:62: warning: `cryptocard_printchallenge' declared `static' but never defined gmake[6]: *** [cryptocard.o] Error 1 gmake[6]: Leaving directory `/var/src/freeradius-1.1.0/src/modules/rlm_otp/cardops' gmake[5]: *** [cardops/cryptocard.lo] Error 2 gmake[5]: Leaving directory `/var/src/freeradius-1.1.0/src/modules/rlm_otp' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/var/src/freeradius-1.1.0/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/var/src/freeradius-1.1.0/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/var/src/freeradius-1.1.0/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/var/src/freeradius-1.1.0/src' gmake: *** [common] Error 2 *** Error code 2 ###########################################3 Tested with FBSD 6.0... OK with rlm_attr_rewrite .... but problem with rlm_otp with different from FBSD4.11 ############# otp_state.c: In function `otp_state_connect': otp_state.c:482: error: storage size of 'sa' isn't known otp_state.c:482: warning: unused variable `sa' gmake[5]: *** [otp_state.o] Error 1 gmake[5]: Leaving directory `/var/src/freeradius-1.1.0/src/modules/rlm_otp' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/var/src/freeradius-1.1.0/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/var/src/freeradius-1.1.0/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/var/src/freeradius-1.1.0/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/var/src/freeradius-1.1.0/src' gmake: *** [common] Error 2 *** Error code 2 ############################## --haizam

3 2

How do you setup password encryption from Apache version 2 with Freeradius using a mysql database.
by Frank Reiss 13 Jan '06

13 Jan '06

Hi, I am looking for information on hot to implement password encryption through Freeradius using a mysql database and Apache 2 I have also installed OpenSSL. I have setup Apache, FreeRadius and mysql and can access the user information but I am looking to encrypt the password at this point. I need to know what the settings are for the configurations files. Thank you, Frank Reiss Impeva Labs, Inc. Phone: 1-850-872-7099 COMPANY CONFIDENTIAL NOTICE This electronic mail transmission and any accompanying documents contain information belonging to the sender which may be company confidential and legally privileged. If you are not the intended recipient, any disclosure, copying, distribution or action taken in reliance on the message is strictly prohibited. If you have received this message in error, please delete it. Thank You

1 0

Freeradius 1.1.0 build error
by Drew S. Dupont 13 Jan '06

13 Jan '06

When trying to compile the new release, I am unable to b/c it stops with an error in the: Making install in rlm_sql_iodbc... gmake[11]: Entering directory `/home/dsdupont/freeradius-1.1.0/src/modules/rlm_sql/drivers/rlm_sql_iodbc' [ "xrlm_sql_iodbc" = "x" ] || /home/dsdupont/freeradius-1.1.0/libtool --mode=install /home/dsdupont/freeradius-1.1.0/install-sh -c -c rlm_sql_iodbc.la /home/dsdupont/freeradius/usr/local/lib/rlm_sql_iodbc.la libtool: install: `rlm_sql_iodbc.la' is not a valid libtool archive Try `libtool --help --mode=install' for more information. It does that for any module in the rlm_sql group. However, whenn I go and type "make" inside the rlm_sql_iodbc dir. it compiles fine. I then go back one and type "make" and it compiles fine. I can then return to the main dir. and type "make" and it runs along until: Making static dynamic in rlm_otp... gmake[4]: Entering directory `/home/dsdupont/freeradius-1.1.0/src/modules/rlm_otp' Making all in cardops ... gmake[5]: Entering directory `/home/dsdupont/freeradius-1.1.0/src/modules/rlm_otp/cardops' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/local/ssl/includes -Wall -D_GNU_SOURCE -DNDEBUG -I../../../include -I/usr/local/ssl/includes -DOTP_MODULE_NAME="rlm_otp" -DFREERADIUS /usr/local/ssl/includes -c cryptocard.c -o cryptocard.o gcc: cannot specify -o with -c or -S and multiple compilations gmake[5]: *** [cryptocard.o] Error 1 If I make some of the remaining dirs. in the modules dir., it compiles those. I have not tried all the remaining dirs. yet. However, I can not get the rlm_otp dir. to compile. Thank you for your assistance, Drew Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

3 2

2 RAdius server on a single linux box
by Manuj 13 Jan '06

13 Jan '06

hello Everyone, Can anyone please tell that is there any way to run 2 (or more) FREE RADIUS Servers on a single linux machine. Thanks Manuj

5 5

Reject connections based on CallingStationId
by Ernesto Freyre Ramírez 12 Jan '06

12 Jan '06

Dear admins: Please how I could to configure free radius with mysql for rejecting users only based on CallingStationId value? Thank you for hints about this issue. Regards Ernesto Freyre Ramírez Jefe de Operaciones Qnet Soluciones Tecnológicas Jr. Natalio Sánchez 220, Of. 401 - Lima 11 Telf.: (511) 431-6565 Anexo 2245 Fax: (511) 431-7113 Visítenos en: www.qnet.com.pe

2 1

FreeRADIUS 1.1.0 has been release
by Alan DeKok 12 Jan '06

12 Jan '06

I'm happy to announce that after a long while, a new version of FreeRADIUS has been release. See http://www.freeradius.org for a link to the tar file and signature. ChangeLog: Feature improvements * rlm_ldap has "set_auth_type" configuration option, which should address some configuration problems when using it. * Fix MIT Kerberos bug * Modules can be load balanced, both in isolation and redundantly. See doc/load-balance.txt for more information. * rlm_perl is now marked "stable" * N-tier certificate patch from Mohammed Petiwala. * Copied dictionaries from the CVS head (many, many, more vendors) * Enabled support for weird VSA formats, like Lucent and Starent. * Support encrypted IP address and integers, for Juniper clients. * Add PEAP machine authentication support in module "rlm_mschap". * Support User-Password field encryption in digest mode. * rlm_x99_token has become rlm_otp (with lots of changes). * Add rlm_sqlcounter to the list of stable modules. * Read MySQL specific options in sections [freeradius] and [client] from file "my.cnf". * Support the ${Cisco-AVPair[n]} syntax. * Execute modules in {Pre,Post}-Proxy-Type stanzas. * Add new options to radclient to run stress tests on the server. * New module "rlm_sql_log" to postpone the storage of accounting data in a SQL database. See rlm_sql_log(5) manpage. * New program "radsqlrelay" which sends the SQL logfile according to the SQL server's capabilities. Bug fixes * #306 (HUP when built with threads, but executed with -s) * #285 (more attributes in dictionary.cisco.vpn3000) * rlm_digest has a number of bug fixes to authentication types. * Don't leak memory in module "rlm_sql". * Update the dictionaries, so that VALUEs with the same name, but different numbers, aren't allowed. * Queue the request before looking for available threads. * Don't free the check items after we received the proxy reply. * Expand config variables in included files, too. * Check the return value of accounting modules and don't proxy invalid requests. * In rlm_passwd, don't close a file stream more than once. * Fix format string errors in rlm_sql.c, spotted by Primoz Bratanic. * Walk the whole string in when escaping strings in rlm_ldap. * Include crypt.h if it is available so we get a prototype for crypt(), spotted by Konstantin Kubatkin. * Removed (for almost all uses) length restrictions on vendor names and VALUE names. * Don't leak memory when proxying an Access-Challenge response. * Make the sleep time user-defined, so radrelay can send more than 7 requests/s. * Fix a memory leak in rlm_checkval. * radclient doesn't resend countless times packets with invalid signature. * Fix segfault and mem leak in rlm_pam. Alan DeKok.

1 0