- Freeradius-Users - lists.freeradius.org

attrs file
by Chuck 07 Dec '05

07 Dec '05

I have a need on one of my radius servers to pass every reply attribute my realms I proxy for send up to me regardless of what they are. I then pass these replies upstream. Everything I read describing the default 'realm' in the attrs file mention adding attributes I want to pass on. However in this one instance I would have to list every dictionary attribute. Is there not a way to tell radius to pass everything, maybe with a * on a single line or maybe nothing in the default section? Or must I list every single one? -- Chuck

2 2

(no subject)
by Josh 07 Dec '05

07 Dec '05

I'm using FreeRadius (with mysql) to authenticate VPN users on a PIX. I have multiple vpngroups setup on the PIX and want to be able to assign users in the radius database to specific vpngroups on the PIX. For instance, I have a username 'bob' in radcheck (mysql). Bob can use any valid vpngroup (setup on the PIX) and then authenticate (via radius) with his 'bob' username and successfully connect. -- not exactly what I had in mind. Bob should only be able to connect to vpngroup 'usersvpn' and not 'adminsvpn'. I figured there must be an attribute to get this to work? Anyone have any success doing this with a PIX in the picture? __________________________________________ Yahoo! DSL Something to write home about. Just $16.99/mo. or less. dsl.yahoo.com

2 1

rlm_counter
by Lisa Casey 07 Dec '05

07 Dec '05

Hi, I have Freeradius 1.01 on FreeBSD 5.3. Two questions: 1) Is there a way to show which modules are currently installed? 2) I want to use the rlm_counter module. So I went to /usr/ports/distfiles/freeradius-1.0.1/src/modules/rlm_counter and did a ./configure. That went OK, no errors. I next typed make with the following result: radius# make "../rules.mak", line 65: Missing dependency operator Error expanding embedded variable. I did some googling and found a suggestion that I probably should use gmake on FreeBSD. That bombed also: radius# gmake ../rules.mak:137: warning: overriding commands for target `clean' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:107: warning: ignoring old commands for target `clean' ../rules.mak:157: warning: overriding commands for target `install' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:111: warning: ignoring old commands for target `install' gmake: *** No rule to make target `radiusd.c', needed by `radiusd.o'. Stop. radius# gmake rlm_counter ../rules.mak:137: warning: overriding commands for target `clean' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:107: warning: ignoring old commands for target `clean' ../rules.mak:157: warning: overriding commands for target `install' /usr/ports/distfiles/freeradius-1.0.1/src/main/00-OLD/Make.inc:111: warning: ignoring old commands for target `install' cc -I../../include -I/usr/local/include/ -c rlm_counter.c -o rlm_counter.o rlm_counter.c:26:22: autoconf.h: No such file or directory In file included from rlm_counter.c:27: ../../include/libradius.h:12:22: autoconf.h: No such file or directory In file included from ../../include/libradius.h:59, from rlm_counter.c:27: ../../include/sha1.h:15: error: syntax error before "uint32_t" ../../include/sha1.h:20: error: syntax error before "state" ../../include/sha1.h:22: error: syntax error before '*' token ../../include/sha1.h:23: error: syntax error before "digest" ../../include/sha1.h:29: error: syntax error before "digest" ../../include/sha1.h:34: error: syntax error before "mk" In file included from ../../include/libradius.h:60, from rlm_counter.c:27: ../../include/md4.h:72: error: syntax error before "uint32_t" ../../include/md4.h:81: error: syntax error before '*' token ../../include/md4.h:83: error: syntax error before '[' token ../../include/md4.h:85: error: syntax error before '[' token In file included from rlm_counter.c:27: ../../include/libradius.h:100: error: syntax error before "uint8_t" ../../include/libradius.h:138: error: syntax error before "uint32_t" ../../include/libradius.h:140: error: syntax error before "uint8_t" ../../include/libradius.h:156: error: syntax error before "uint32_t" ../../include/libradius.h:162: error: syntax error before "uint8_t" ../../include/libradius.h:165: error: syntax error before "uint8_t" ../../include/libradius.h:221: error: syntax error before '*' token ../../include/libradius.h:244: error: syntax error before '*' token ../../include/libradius.h:288: error: syntax error before "uint32_t" ../../include/libradius.h:289: error: syntax error before "ip_getaddr" ../../include/libradius.h:289: warning: data definition has no type or storage class ../../include/libradius.h:290: error: syntax error before "uint32_t" ../../include/libradius.h:291: error: syntax error before "ip_addr" ../../include/libradius.h:291: warning: data definition has no type or storage class ../../include/libradius.h:292: error: syntax error before "uint8_t" ../../include/libradius.h:293: error: syntax error before '*' token ../../include/libradius.h:293: error: syntax error before "uint8_t" ../../include/libradius.h:293: warning: data definition has no type or storage class ../../include/libradius.h:318: error: syntax error before "uint32_t" ../../include/libradius.h:328: error: syntax error before "lrad_rand" ../../include/libradius.h:328: warning: data definition has no type or storage class In file included from rlm_counter.c:34: ../../include/radiusd.h:11:22: radpaths.h: No such file or directory In file included from rlm_counter.c:34: ../../include/radiusd.h:26: error: syntax error before "child_pid_t" ../../include/radiusd.h:26: warning: data definition has no type or storage class In file included from ../../include/radiusd.h:38, from rlm_counter.c:34: ../../include/missing.h:12: error: conflicting types for 'strncasecmp' /usr/include/strings.h:53: error: previous declaration of 'strncasecmp' was here ../../include/missing.h:12: error: conflicting types for 'strncasecmp' /usr/include/strings.h:53: error: previous declaration of 'strncasecmp' was here ../../include/missing.h:16: error: conflicting types for 'strcasecmp' /usr/include/strings.h:52: error: previous declaration of 'strcasecmp' was here ../../include/missing.h:16: error: conflicting types for 'strcasecmp' /usr/include/strings.h:52: error: previous declaration of 'strcasecmp' was here In file included from rlm_counter.c:34: ../../include/radiusd.h:56: error: syntax error before "uint32_t" ../../include/radiusd.h:67: error: syntax error before "child_pid_t" ../../include/radiusd.h:105: error: syntax error before "uint32_t" ../../include/radiusd.h:108: error: syntax error before "u_char" ../../include/radiusd.h:117: error: syntax error before "uint32_t" ../../include/radiusd.h:128: error: syntax error before "uint32_t" ../../include/radiusd.h:171: error: syntax error before "uint32_t" ../../include/radiusd.h:181: error: syntax error before "uint32_t" ../../include/radiusd.h:277: error: syntax error before "expiration_seconds" ../../include/radiusd.h:277: warning: data definition has no type or storage class ../../include/radiusd.h:292: error: syntax error before "nasaddr" ../../include/radiusd.h:294: error: syntax error before "uint32_t" ../../include/radiusd.h:325: error: syntax error before "ipno" ../../include/radiusd.h:326: error: syntax error before "ipno" ../../include/radiusd.h:332: error: syntax error before "ipno" ../../include/radiusd.h:334: error: syntax error before "ipno" ../../include/radiusd.h:342: error: syntax error before "ipno" ../../include/radiusd.h:343: error: syntax error before "ipno" ../../include/radiusd.h:345: error: syntax error before "uint32_t" ../../include/radiusd.h:410: error: syntax error before "rad_fork" ../../include/radiusd.h:410: warning: data definition has no type or storage class ../../include/radiusd.h:411: error: syntax error before "rad_waitpid" ../../include/radiusd.h:411: error: syntax error before "pid" ../../include/radiusd.h:411: warning: data definition has no type or storage class ../../include/radiusd.h:412: error: syntax error before "pid" rlm_counter.c: In function `counter_cmp': rlm_counter.c:156: error: structure has no member named `strvalue' rlm_counter.c:167: error: structure has no member named `lvalue' rlm_counter.c: In function `reset_db': rlm_counter.c:223: error: `errno' undeclared (first use in this function) rlm_counter.c:223: error: (Each undeclared identifier is reported only once rlm_counter.c:223: error: for each function it appears in.) rlm_counter.c: In function `counter_instantiate': rlm_counter.c:466: error: `errno' undeclared (first use in this function) rlm_counter.c: In function `counter_accounting': rlm_counter.c:556: error: structure has no member named `lvalue' rlm_counter.c:567: error: structure has no member named `strvalue' rlm_counter.c:593: error: structure has no member named `lvalue' rlm_counter.c:604: error: structure has no member named `lvalue' rlm_counter.c:605: error: structure has no member named `lvalue' rlm_counter.c:632: error: structure has no member named `strvalue' rlm_counter.c:635: error: structure has no member named `strvalue' rlm_counter.c:643: error: structure has no member named `strvalue' rlm_counter.c:655: error: structure has no member named `strvalue' rlm_counter.c:659: error: structure has no member named `strvalue' rlm_counter.c:661: error: structure has no member named `strvalue' rlm_counter.c:676: error: structure has no member named `lvalue' rlm_counter.c:676: error: structure has no member named `lvalue' rlm_counter.c:683: error: structure has no member named `lvalue' rlm_counter.c:693: error: structure has no member named `strvalue' rlm_counter.c: In function `counter_authorize': rlm_counter.c:769: error: structure has no member named `strvalue' rlm_counter.c:779: error: structure has no member named `strvalue' rlm_counter.c:794: error: structure has no member named `lvalue' rlm_counter.c:795: error: structure has no member named `lvalue' rlm_counter.c:823: error: structure has no member named `lvalue' rlm_counter.c:827: error: structure has no member named `lvalue' rlm_counter.c:828: error: structure has no member named `lvalue' rlm_counter.c:834: error: structure has no member named `lvalue' rlm_counter.c:843: error: structure has no member named `strvalue' rlm_counter.c:843: error: structure has no member named `lvalue' rlm_counter.c:845: error: structure has no member named `strvalue' rlm_counter.c:865: error: structure has no member named `strvalue' rlm_counter.c:865: error: structure has no member named `lvalue' gmake: *** [rlm_counter.o] Error 1 Any suggestions? Thanks! Lisa Casey

3 2

RE:Configuring freeRADIUS and NAS
by Sean 07 Dec '05

07 Dec '05

Hi, I use Linksys WRT54G Routers and I suggest that you check out DD-WRT firmware. It includes Chillispot and is easy to setup. I've posted a tutorial here http://swarmhotspots.com/faq.html BTW the new WRT54G (Release 5 Firmware) uses VxWorks and not Linux anyone needing to use third party firmware like DD-WRT should buy WRT54GL instead. I hope this helps. Regards, Sean Bracken

1 0

radius server reply
by Dinil Divakaran 07 Dec '05

07 Dec '05

Greetings !! I am using freeradius 1.0.4 server. I am trying to achieve the following. The radius client is supposed to send username, password and a text (say, abc). The server is supposed to authenticate using the system /etc/passwd and shadow (which it does currently). Apart from this the server should take the text and find another matching text (abc -> xyz). If such a matching entry exists, the radius server should send the matching text (xyz, here) along with the Access packet, or else it should send Access Reject packet. This can be achieved if we are able to define new attributes (like `Framed-IP-Address'), in which case we can add an entry Check-Item="abc", Reply-Item="xyz" for a user in the users file. But, unfortunately there are no user-defined attributes that are permitted ! Is there any other way to get this done ? Thanks in advance. - Dinil

2 2

Configuring freeRADIUS and NAS
by Madhuraka Godahewa 07 Dec '05

07 Dec '05

Hi All, First of all, let me thank for all those, who helped me to configure the freeRADIUS server. I have installed freeRADIUS 1.0.5 recently and configured it. I tested the server using RADIUS Test Client utility from IEA Software and it works well (both for authentication and accounting). Then, I configured a LinkSys WRT54G as a NAS and I configure it to make use of the freeRADIUS server to authenticate users. Now I can connect to the network using an XP Supplicant through the LinkSys WRT54G after authenticating through the RADIUS server (using PEAP). Now, I have a problem with the Session-Timeout attribute. With the Access- Accept packet, I send the Session-Timeout and Terminate-Action attributes to the NAS, but the NAS does not terminate the session as specified in the Session- Terminate parameter. And the NAS does not send any Account-Start or Account- Stop packets to the RADIUS server. Is this a problem with the configuration of the NAS or is it a limitation of the NAS? Have any body tried using LinkSys WRT54G as the NAS to do RADIUS accounting? I use the orginal firmware, which comes with the WRT54G. Thanking You., -------------------------------------------------------------------------------- Madhuraka Godahewa Telecommunications Engineer Research and Development Unit Electroteks Global Networks (Pvt.) Ltd. Mobile: + 94-777-647055

2 1

OS Update broke FR - rlm_exec-1.0.0.so not found
by Landon Cox 07 Dec '05

07 Dec '05

Hi FR community, I've been running FR on an updated (recently fully patched apps) SuSE 9.2 (kernel 2.6.8-24-default) I was successfully running an earlier version of FR and when I decided to do an update of FR through SuSE's online update, FR will no longer come up and fails with a dynamic link error: radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': /usr/lib/ freeradius/rlm_exec-1.0.0.so: cannot open shared object file: No such file or directory radius2:/home/lcox # ls /usr/lib/freeradius/rlm_exec-1* /usr/lib/freeradius/rlm_exec-1.0.0.la /usr/lib/freeradius/ rlm_exec-1.0.0.so As you can see, my /usr/lib/freeradius directory does have the .so file, but I can't tell from the output if rlm_exec is dependent upon some other file that is not found or the dynamic linker can't find rlm_exec-1.0.0.so. So, that's one question - what is not being found? Sounds obvious, except that I have the exact .so filename in the library search path. SuSE Yast claims it has installed FR 1.0.0-5.6. A radiusd -v produces: radiusd: FreeRADIUS Version 1.0.0, for host , built on May 30 2005 at 21:02:41 Copyright (C) 2000-2003 The FreeRADIUS server project. I've seen numerous references to this exact linkage error on various freeradius lists as well as have seen it on lists for various architectures and *nix's, not just x86/SuSE Linux. However, there is typically no response given to fix the problem except to rebuild FR with no shared libraries and even in those cases, the build often seems to break later leaving the admin stuck further down the line. Is there a known solution to what seems like a relatively common problem of rlm_exec dynamic linkage issues? What am I missing and what needs to be done to cause this to work with the shared .so lib file vs having to rebuild it with static libs? Thanks in advance for any help or direction. Landon (Full text of -X output follows) radius2:/home/lcox # /usr/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': /usr/lib/ freeradius/rlm_exec-1.0.0.so: cannot open shared object file: No such file or directory radius2:/home/lcox # ls /usr/lib/freeradius/rlm_exec-1* /usr/lib/freeradius/rlm_exec-1.0.0.la /usr/lib/freeradius/ rlm_exec-1.0.0.so

2 1

Re: IPv6 Support
by Paulo Alexandre Caceres Ferreira 06 Dec '05

06 Dec '05

> > > I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 > > Freeradius functioning. > > Why? Because I didn't arrange a machine for test it yet :) > > > Did the communications between NAS and Freeradius, in IPv6 only > networks, > > are made only with IPv6 packets (Access request packets, etc.)? > > Uh... you're asking if non-IPv6 packets are sent in an IPv6-only > network. > > That makes *no* sense. No, I wanted an IPv6 only, but I wasn't sure if Freeradius was communicating with NAS in IPv6 only packets, or if it was encapsulating IPv6 attributes (RFC 3162) over IPv4 packets. > > > Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated in > > IPv4 packets? > > Read the RFC's. The data in a RADIUS packet is completely > independent of the IPv4 or IPv6 transport. I already red the RFC 3162, and I think that was the idea, but I asked to the list this questions to had sure. Good, that means that it works with packets in both network protocols, depending of NAS support. > > Alan DeKok. > Thanks for the help, and I will try that when I will have opportunity. Regards, Paulo Ferreira

1 0

RE: RADIUS Auth-Type
by Bohannan, Chad W 06 Dec '05

06 Dec '05

Yes, Phil suggested that earlier. Looking into it now..thanks -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok "Bohannan, Chad W" <Chad_Bohannan(a)reyrey.com> wrote: > .....so is there not a way to have FR proxy request out to the AD > server? AD doesn't do RADIUS, so FreeRADIUS can't proxy requests to it. Terminology matters. If you want to authenticate PAP from FreeRADIUS to AD, use the LDAP module in the "authenticate" section. it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: IPv6 Support
by Paulo Alexandre Caceres Ferreira 06 Dec '05

06 Dec '05

Hi, it's me again with IPv6 questions :) I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 Freeradius functioning. My questions are: Did the communications between NAS and Freeradius, in IPv6 only networks, are made only with IPv6 packets (Access request packets, etc.)? Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated in IPv4 packets? Hi have these doubts, if anyone could help me, I thaks. Thanks in advance, Paulo Ferreira > -----Mensagem original----- > De: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] Em nome de Nicolas Baradakis > Enviada: sexta-feira, 2 de Dezembro de 2005 12:03 > Para: FreeRadius users mailing list > Assunto: Re: IPv6 Support > > Paulo Alexandre Caceres Ferreira wrote: > > > How I can test IPv6 Freeradius authentication? > > You know any IPv6 RADIUS client to interact with Freeradius and perform > an > > IPv6 authentication? > > There is a program called "radclient" in the FreeRADIUS source tree. > > -- > Nicolas Baradakis

2 1