- Freeradius-Users - lists.freeradius.org

OS Update broke FR - rlm_exec-1.0.0.so not found
by Landon Cox 07 Dec '05

07 Dec '05

Hi FR community, I've been running FR on an updated (recently fully patched apps) SuSE 9.2 (kernel 2.6.8-24-default) I was successfully running an earlier version of FR and when I decided to do an update of FR through SuSE's online update, FR will no longer come up and fails with a dynamic link error: radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': /usr/lib/ freeradius/rlm_exec-1.0.0.so: cannot open shared object file: No such file or directory radius2:/home/lcox # ls /usr/lib/freeradius/rlm_exec-1* /usr/lib/freeradius/rlm_exec-1.0.0.la /usr/lib/freeradius/ rlm_exec-1.0.0.so As you can see, my /usr/lib/freeradius directory does have the .so file, but I can't tell from the output if rlm_exec is dependent upon some other file that is not found or the dynamic linker can't find rlm_exec-1.0.0.so. So, that's one question - what is not being found? Sounds obvious, except that I have the exact .so filename in the library search path. SuSE Yast claims it has installed FR 1.0.0-5.6. A radiusd -v produces: radiusd: FreeRADIUS Version 1.0.0, for host , built on May 30 2005 at 21:02:41 Copyright (C) 2000-2003 The FreeRADIUS server project. I've seen numerous references to this exact linkage error on various freeradius lists as well as have seen it on lists for various architectures and *nix's, not just x86/SuSE Linux. However, there is typically no response given to fix the problem except to rebuild FR with no shared libraries and even in those cases, the build often seems to break later leaving the admin stuck further down the line. Is there a known solution to what seems like a relatively common problem of rlm_exec dynamic linkage issues? What am I missing and what needs to be done to cause this to work with the shared .so lib file vs having to rebuild it with static libs? Thanks in advance for any help or direction. Landon (Full text of -X output follows) radius2:/home/lcox # /usr/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius radiusd.conf[1367] Failed to link to module 'rlm_exec': /usr/lib/ freeradius/rlm_exec-1.0.0.so: cannot open shared object file: No such file or directory radius2:/home/lcox # ls /usr/lib/freeradius/rlm_exec-1* /usr/lib/freeradius/rlm_exec-1.0.0.la /usr/lib/freeradius/ rlm_exec-1.0.0.so

2 1

Re: IPv6 Support
by Paulo Alexandre Caceres Ferreira 06 Dec '05

06 Dec '05

> > > I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 > > Freeradius functioning. > > Why? Because I didn't arrange a machine for test it yet :) > > > Did the communications between NAS and Freeradius, in IPv6 only > networks, > > are made only with IPv6 packets (Access request packets, etc.)? > > Uh... you're asking if non-IPv6 packets are sent in an IPv6-only > network. > > That makes *no* sense. No, I wanted an IPv6 only, but I wasn't sure if Freeradius was communicating with NAS in IPv6 only packets, or if it was encapsulating IPv6 attributes (RFC 3162) over IPv4 packets. > > > Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated in > > IPv4 packets? > > Read the RFC's. The data in a RADIUS packet is completely > independent of the IPv4 or IPv6 transport. I already red the RFC 3162, and I think that was the idea, but I asked to the list this questions to had sure. Good, that means that it works with packets in both network protocols, depending of NAS support. > > Alan DeKok. > Thanks for the help, and I will try that when I will have opportunity. Regards, Paulo Ferreira

1 0

RE: RADIUS Auth-Type
by Bohannan, Chad W 06 Dec '05

06 Dec '05

Yes, Phil suggested that earlier. Looking into it now..thanks -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok "Bohannan, Chad W" <Chad_Bohannan(a)reyrey.com> wrote: > .....so is there not a way to have FR proxy request out to the AD > server? AD doesn't do RADIUS, so FreeRADIUS can't proxy requests to it. Terminology matters. If you want to authenticate PAP from FreeRADIUS to AD, use the LDAP module in the "authenticate" section. it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: IPv6 Support
by Paulo Alexandre Caceres Ferreira 06 Dec '05

06 Dec '05

Hi, it's me again with IPv6 questions :) I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 Freeradius functioning. My questions are: Did the communications between NAS and Freeradius, in IPv6 only networks, are made only with IPv6 packets (Access request packets, etc.)? Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated in IPv4 packets? Hi have these doubts, if anyone could help me, I thaks. Thanks in advance, Paulo Ferreira > -----Mensagem original----- > De: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] Em nome de Nicolas Baradakis > Enviada: sexta-feira, 2 de Dezembro de 2005 12:03 > Para: FreeRadius users mailing list > Assunto: Re: IPv6 Support > > Paulo Alexandre Caceres Ferreira wrote: > > > How I can test IPv6 Freeradius authentication? > > You know any IPv6 RADIUS client to interact with Freeradius and perform > an > > IPv6 authentication? > > There is a program called "radclient" in the FreeRADIUS source tree. > > -- > Nicolas Baradakis

2 1

RE: RADIUS Auth-Type
by Bohannan, Chad W 06 Dec '05

06 Dec '05

>>You cannot set the Auth-Type to "MS-CHAP" and have it work unless the >>MS-CHAP challenge and response are in the radius request, which means >>the NAS has to add them. - .....so is there not a way to have FR proxy request out to the AD server?

4 3

RE: XP auth + PEAP
by King, Michael 06 Dec '05

06 Dec '05

Several clients ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of debik Sent: Monday, December 05, 2005 6:30 PM To: FreeRadius users mailing list Subject: XP auth + PEAP Have enybody connect the client running Windows XP SP2 to the radius server with peap auth ???

5 11

Freeradius wont retry to connect SQL
by Fernando Brito 06 Dec '05

06 Dec '05

Hello. I'm using freeradius 1.0.5. I have 3 radiusd running on the same machine (a radiusd connects to mysql, the other two, connects to SQL using unixODBC 2.2.4-11 and freetds 0.61-6.2). Everything works fine until I stop the SQL server. The radiusd won't try to re-connect to SQL and I get the following error on my radiusd log file: Mon Dec 5 19:36:21 2005 : Error: rlm_sql_unixodbc: '00000 ' Mon Dec 5 19:36:21 2005 : Error: rlm_sql_getvpdata: database query error Mon Dec 5 19:36:21 2005 : Error: rlm_sql (mssql): SQL query error; rejecting user Mon Dec 5 19:36:24 2005 : Error: Discarding duplicate request from client MikroTik:1169 - ID: 178 due to unfinished request 164 Any idea?. Thanks in advance.

1 0

dictionary: adding MONTHLY-TIME-LIMIT
by don 06 Dec '05

06 Dec '05

Hi, I am trying to add MONTHLY-TIME-LIMIT to the freeradius dictionary. I will be using this parameter in the radreply table of the freeradius database. Exactly how do I add this to the freeradius dictionary? Sincerely, Don James

1 0

freeradius + LAN + auth + bandwidth (+ PPPOE?)
by TwoMan 06 Dec '05

06 Dec '05

Hi All, I would like to use radius to authenticate our users (using desktop pcs) on our lan, and give them access to internet based on their authentication data. (to give them bandwidth). I am planning it using a pppoe server, and then our users will use a pppoe client (eg. rasppoe) to make the connection. Clients can be linux,w9x,w2k,wxp Is it a good plan? :) If there's a better solution, could You tell me what it is? Which pppoe server is good enough to use for large number of users? (eg. Roaring Pengiuns' RP-PPPoE server?) How can I control their bandwidth? I could successfully install freeradius wisth myql backend, and I can use this to authenticate our wifi users, so, the basics of freeradius is ok. But this time I have to authenticate lan users with oridnary ethernet network card. Thx TM

2 1

persistent ldap connection
by Alexei Vasilyev 06 Dec '05

06 Dec '05

Freeradius uses persistent ldap connection. There are many reasons for this. But we have freeradius installed on server in dmz, and ldap-server in inside-zone. It is used just for vpn (1-2 times per day). Cisco PIX destroyes not used connections, so freeradius need to reconnect to ldap server. But freeradius detects lost connection for 5 minutes: Tue Dec 6 03:40:33 2005 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Tue Dec 6 03:43:03 2005 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Tue Dec 6 03:45:33 2005 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Tue Dec 6 03:46:45 2005 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Tue Dec 6 03:46:45 2005 : Info: rlm_ldap: Attempting reconnect How can I configure freeradius to reconnect to LDAP for each request? Thanks. -- Best regards, Alexei Vasilyev

2 1