- Freeradius-Users - lists.freeradius.org

authorize and authenticate methods ina custom module
by Susana Macias 03 Jan '06

03 Jan '06

Hy all, I have started working with the RADIUS protocol (and with FreeRadius in particular) three weeks ago. Congratulations for the product, it is really powerful! Now I want to develop a custom module. I have been reading some documents (module_interface, configurable_failover, the rlm_example skeleton...) but I have a pair of doubts. When a module is loaded, its init() method is called. After the init() method, the instantiate() method is called. The detcah() method is called when the server is being shut down, and afterwards the destroy() method. But, when are the authorize() and authenticate() methods called? Is it necessary to include in the radiusd.conf the name of the instance (of the new module created) in the authorize section in order to call its authorize() method? Sorry if these questions are already answered or are stupid, but I am doing my best to understand FreeRadius Best regards, Susana Pd: sorry if my english is not enough good. I will try to explain me better if you request me :-) --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

2 1

Freeradius probleming help me
by Kai Geek 03 Jan '06

03 Jan '06

Hello, root@kaigeek:/etc/raddb# radiusd -p 1645 Ignoring deprecated command-line option -pTue Jan 3 10:06:51 2006 : Info: Starting - reading configuration files ... why problem on radiusd ? root@kaigeek:/etc/raddb# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: bind_address = 10.0.0.6 IP address [10.0.0.6] main: user = "root" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded DIGEST Module: Instantiated digest (digest) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded attr_filter attr_filter: attrsfile = "/etc/raddb/attrs" rlm_attr_filter: Authorize method will be deprecated. Module: Instantiated attr_filter (attr_filter) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 10.0.0.6:1645 Listening on accounting 10.0.0.6:1646 Listening on proxy 10.0.0.6:1647 Ready to process requests. #vi users steve Auth-Type := System Service-Type = Shell-User, Login-Service = Telnet, Login-IP-Host = 0.0.0.0, Login-TCP-Port = Telnet #vi clients.conf client 10.0.0.250 { secret = 250 shortname = switch nastype = dlink } i am not authentication radius server and dlink switch. what is problem ? #pico /etc/services # IMPORTANT NOTE: Ports 1645/1646 are the traditional radius ports used by # many vendors without obtaining official IANA assignment. The official # assignment is now ports 1812/1813 and users are encouraged to migrate # when possible to these new ports. radius 1645/udp #RADIUS authentication protocol (old) radacct 1646/udp #RADIUS accounting protocol (old) help me please... +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

freeradius-1.0.5 compilation error (library -lz not found)
by K Pang 03 Jan '06

03 Jan '06

Hi All, Happy New Year to all of you! i encounterd some compilation errors when compiling freeradius-1.0.5 on solaris 8. below is the errors. /usr/local/src/freeradius-1.0.5-pi/libtool --mode=link gcc -release 1.0.5 \ -module -export-dynamic -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/local/ssl/include -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include \ -I/usr/local/mysql/include -I/usr/local/src/freeradius-1.0.5-pi/libltdl -o rlm_sql_mysql.la -rpath /usr/local/radius5/lib sql_mysql.lo -L/usr/local/mysql/lib/mysql -lmysqlclient -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lnsl -lresolv -lsocket -lposix4 -lpthread -lz rm -fr .libs/rlm_sql_mysql.la .libs/rlm_sql_mysql.* .libs/rlm_sql_mysql-1.0.5.* /usr/ccs/bin/ld -G -h rlm_sql_mysql-1.0.5.so -o .libs/rlm_sql_mysql-1.0.5.so sql_mysql.lo -R/usr/local/mysql/lib/mysql -R/usr/local/mysql/lib/mysql -L/usr/local/BerkeleyDB.4.2 -L/usr/local/mysql/lib/mysql /usr/local/mysql/lib/mysql/libmysqlclient.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lc ld: fatal: library -lz: not found ld: fatal: library -lz: not found ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-1.0.5.so make[10]: *** [rlm_sql_mysql.la] Error 1 make[10]: Leaving directory `/usr/local/src/freeradius-1.0.5-pi/src/modules/rlm_sql/drivers/rlm_sql_mysql' what's 'library -lz not found'? i've no idea what's this library. is it caused by missing of certain packages? if so, which package should i install? pls advise. thanks in advance! Rgds, Pang

2 1

freeradius-1.0.5 compilation error (library -lz not found)
by K Pang 03 Jan '06

03 Jan '06

Hi All, Happy New Year to all of you! i encounterd some compilation errors when compiling freeradius-1.0.5 on solaris 8. below is the errors. /usr/local/src/freeradius-1.0.5-pi/libtool --mode=link gcc -release 1.0.5 \ -module -export-dynamic -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/local/ssl/include -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../.. -I../../../../include \ -I/usr/local/mysql/include -I/usr/local/src/freeradius-1.0.5-pi/libltdl -o rlm_sql_mysql.la -rpath /usr/local/radius5/lib sql_mysql.lo -L/usr/local/mysql/lib/mysql -lmysqlclient -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lnsl -lresolv -lsocket -lposix4 -lpthread -lz rm -fr .libs/rlm_sql_mysql.la .libs/rlm_sql_mysql.* .libs/rlm_sql_mysql-1.0.5.* /usr/ccs/bin/ld -G -h rlm_sql_mysql-1.0.5.so -o .libs/rlm_sql_mysql-1.0.5.so sql_mysql.lo -R/usr/local/mysql/lib/mysql -R/usr/local/mysql/lib/mysql -L/usr/local/BerkeleyDB.4.2 -L/usr/local/mysql/lib/mysql /usr/local/mysql/lib/mysql/libmysqlclient.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lnsl -lresolv -lsocket -lposix4 -lpthread -lz -lc ld: fatal: library -lz: not found ld: fatal: library -lz: not found ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-1.0.5.so make[10]: *** [rlm_sql_mysql.la] Error 1 make[10]: Leaving directory `/usr/local/src/freeradius-1.0.5-pi/src/modules/rlm_sql/drivers/rlm_sql_mysql' what's 'library -lz not found'? i've no idea what's this library. is it caused by missing of certain packages? if so, which package should i install? pls advise. thanks in advance! Rgds, Pang

2 1

RE: FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 1/2/2006 5:57 PM To: FreeRadius users mailing list Subject: Re: FreeRADIUS with PEAP problems "Alhagie Puye" <APuye(a)datawave.com> wrote: > Here is exactly what my eap.conf file looks like (I have removed every = > line that is commented) ... > tls { ... > peap { > default_eap_type =3D mschapv2 > } <sigh> So you didn't just uncomment the "peap" section. You edited & re-arranged it. Your edits broke it. Yes, I did....the re-arranging part was completely unintentional. My apologies... :-( There's a simple solution: read the stock "eap.conf" again. Follow it's layout. It WORKS. Yes, you are absolutely right. It DOES work. Thanks for all your help!!!! Alhagie This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Alhagie Puye Sent: Mon 1/2/2006 3:43 PM To: FreeRadius users mailing list Subject: RE: FreeRADIUS with PEAP problems ________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 1/2/2006 2:28 PM To: FreeRadius users mailing list Subject: Re: FreeRADIUS with PEAP problems Ok, I found what the problem is....thanks to Zoltan. The last "}" should have been before the "peap" section. I had accidentally placed the "peap" section inside the "tls" section. I have changed the eap.conf file to look like this now and it works fine. eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/freebsd.puyenet.com.pem certificate_file = ${raddbdir}/certs/freebsd.puyenet.com.pem CA_file = ${raddbdir}/certs/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } peap { default_eap_type = mschapv2 } mschapv2 { } } Thanks everybody that give me a hand. Alhagie. Thanks Alan for the reply. The "peap" section was already uncommented. Here is exactly what my eap.conf file looks like (I have removed every line that is commented) eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/freebsd.puyenet.com.pem certificate_file = ${raddbdir}/certs/freebsd.puyenet.com.pem CA_file = ${raddbdir}/certs/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random peap { default_eap_type = mschapv2 } mschapv2 { } } } Thanks, Alhagie. "Alhagie Puye" <APuye(a)datawave.com> wrote: > rlm_eap: Loaded and initialized type tls > rlm_eap: No such sub-type for default EAP type peap Try reading eap.conf, and uncommenting the "peap" section. I'm not sure how to make that error message more descriptive, or update the comments in eap.conf so that people will *read* them. Alan DEKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request. This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

RE: FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

________________________________ From: freeradius-users-bounces+apuye=datawave.com(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 1/2/2006 2:28 PM To: FreeRadius users mailing list Subject: Re: FreeRADIUS with PEAP problems Thanks Alan for the reply. The "peap" section was already uncommented. Here is exactly what my eap.conf file looks like (I have removed every line that is commented) eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/freebsd.puyenet.com.pem certificate_file = ${raddbdir}/certs/freebsd.puyenet.com.pem CA_file = ${raddbdir}/certs/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random peap { default_eap_type = mschapv2 } mschapv2 { } } } Thanks, Alhagie. "Alhagie Puye" <APuye(a)datawave.com> wrote: > rlm_eap: Loaded and initialized type tls > rlm_eap: No such sub-type for default EAP type peap Try reading eap.conf, and uncommenting the "peap" section. I'm not sure how to make that error message more descriptive, or update the comments in eap.conf so that people will *read* them. Alan DEKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1

wireless - freeradius - MS ldap
by Dickson, John 02 Jan '06

02 Jan '06

I am looking for a little direction configuring a Freeradius server that will authenticate wireless clients from Cisco to MS LDAP. 1.Wireless - 2.Cisco - 3.Radius - 4.Windows LDAP Looking to see if someone has already done this. John

2 1

freeRADIUS + openLDAP
by Carlo Prestopino 02 Jan '06

02 Jan '06

Hi all, I'm trying to develop a prepaid solution for Wi-Fi users based on freeRADIUS+openLDAP. Hotspot gateway, working as NAS, is Mikrotik (www.mikrotik.com).Does anybody have links to already developed (and working) projects that uses the same architecture? Main problem is: how to let freeRADIUS know that user's usage limit expired? Regards, Carlo

2 1

FreeRADIUS with PEAP problems
by Alhagie Puye 02 Jan '06

02 Jan '06

Hello all, I am trying to configure FreeRADIUS with PEAP support. Here are my specs: OS: FreeBSD 5.4 OpenSSL: version 0.9.7d FreeRADIUS: 1.0.5 I have tested the configuration with EAP/TLS and it works just fine however, when I change "default_eap_type = tls" to "default_eap_type = peap" in the eap.conf file, I'm getting.... Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/freebsd.puyenet.com.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/freebsd.puyenet.com.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "XXXXXXXX" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls rlm_eap: No such sub-type for default EAP type peap Bus error (core dumped) bash-2.05b# I have found this article from 2004 (http://lists.freeradius.org/pipermail/freeradius-users/2004-October/036 946.html). I'm not sure if this applies to me. Any help is greatly appreciated Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

3 2