- Freeradius-Users - lists.freeradius.org

Solaris 10 (SPARC 64bit) - problems installing freeradius 1.0.5
by Reiko U. 10 Nov '05

10 Nov '05

hi all ... i'm trying to installing freeradius-1.0.5 on a sun-ultra-e220 (2x450MHZ ULTRASparcII), OS: Solaris 10 (SPARC 64bit), since three days without success. I've read many hours in different news-groups, mailing-lists and manuals / howtos but no way. Now i hope someone else already have successfully running freeradius on Solaris 10 - Sparc-Architcture and can tell me wat's wrong. I've attached the configure.log to this email (hope this works in mailinglists ???). Here are my environments: uname -a: SunOS r220 5.10 Generic sun4u sparc SUNW,Ultra-60 $CC /usr/local/bin/gcc $LD_LIBRARY_PATH /usr/sfw/lib/sparcv9/:/lib/sparcv9/:/usr/sfw/lib/:/lib:/usr/lib:/usr/local/lib:/usr/local/X11/lib:/usr/dt/lib:/usr/openwin/lib $PATH /usr/sbin:/usr/bin:/opt/sfw/bin/:/usr/sfw/bin:/usr/sfw/sbin/:/opt/sfw/sbin/:/sbin/:/usr/sbin/:/usr/ccs/bin/:/usr/local/bin:/usr/local/sbin:/opt/sfw/bin/:/usr/sfw/bin pkginfo | grep gcc utility GNUgcc GNU gcc 3.4.4 SPARC 64bit Solaris 10 (installed in /usr/local) system SUNWgcc gcc - The GNU C compiler system SUNWgccruntime GCC Runtime libraries /usr/local/bin/gcc -v read specs from /usr/local/lib/gcc/sparc64-sun-solaris2.10/3.4.4/specs configured with: /var/tmp/gcc-3.4.4/configure --prefix=/usr/local --host=sparc64-sun-solaris2.10 --enable-threads=posix --with-gxx-include-dir=/usr/local/include/g++ --with-system-zlib --enable-shared --with-ld=/usr/ccs/bin/ld --without-gnu-ld Thread-Modell: posix gcc-Version 3.4.4 MY PROBLEM: ./configure --localstatedir=/var/ --sysconfdir=/etc/ --with-openssl-includes=/usr/sfw/include/openssl/ --with-openssl-libraries=/usr/lib/sparcv9/ produces these warnings: ###################################################################################################### configure: warning: the comm_err library isn't found! configure: warning: silently not building rlm_krb5. configure: warning: FAILURE: rlm_krb5 requires: krb5. configure: warning: silently not building rlm_ldap. configure: warning: FAILURE: rlm_ldap requires: libldap_r. configure: warning: iodbc headers not found. Use --with-iodbc-include-dir=<path>. configure: warning: sql submodule 'iodbc' disabled configure: warning: silently not building rlm_sql_postgresql. configure: warning: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: warning: oracle headers not found. Use --with-oracle-home-dir=<path>. configure: warning: sql submodule 'oracle' disabled configure: warning: unixODBC headers not found. Use --with-unixodbc-include-dir=<path>. configure: warning: sql submodule 'unixodbc' disabled ####################################################################################################### but finished "successfully". ./make crashs with the following errors: !!!!!I've translated some lines because i use a german console!!!!! #################################################################################################################################################### . . . creating radiusd gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/sfw/include/openssl/ -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../include -DHOSTINFO=\"\" -DRADIUSD_VERSION=\"1.0.5\" -c radwho.c gcc -L../lib -o radwho radwho.o util.o log.o conffile.o -L/usr/lib/sparcv9/ -lssl -L/usr/lib/sparcv9/ -lcrypto -lnsl -lresolv -lsocket -lposix4 -lpthread -lradius -lcrypt undefined referenced for first time Symbol in file MD5Init ../lib/libradius.a(radius.o) (symbol is part of implicit dependency /lib/libmd5.so.1) MD5Final ../lib/libradius.a(radius.o) (Symbol gehört zu impliziter Abhängigkeit /lib/libmd5.so.1) MD5Update ../lib/libradius.a(radius.o) (Symbol gehört zu impliziter Abhängigkeit /lib/libmd5.so.1) ld: Fatal Error: symbol referencing error. No output in radwho written. collect2: ld returned 1 exit status gmake[4]: *** [radwho] Error 1 gmake[4]: Leaving directory `/opt/sfw/freeradius-1.0.5/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/opt/sfw/freeradius-1.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/opt/sfw/freeradius-1.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/opt/sfw/freeradius-1.0.5' make: *** [all] Error 2 ################################################################################################################################################### Now, I'm not sure is it a comiler problem, a processor problem (64 bit / big/little endian) or, i don't think so, a freeradius problem. Great thanks to all for any help and hints for solution Cheers Reiko

1 0

Re: PEAP MS_CHAP V2: problem with tunnel attributes on enterasys V2 switch
by slapeyre＠free.fr 10 Nov '05

10 Nov '05

Hello, I run my FreeRadius in debug mode. I put a sniffer between the freeRadius server and the novell Server (users LDAP base). I don't have users file because the users base is on the novell server. I set the tunnel AVs on each user with the e-directory tool of novell server(v6.5). In debug mode and with the sniffer,i see the filter_id attributs but not the tunnel attributs. Authentication with filter_id attributes work but not with the tunnel attributes. Is it necessary to active or configure something on FreeRADIUS to use "tunnel" parameters ??? Best regards Stephane Selon "Zoltan A. Ori" <z.ori(a)morehead-st.edu>: > On Wednesday 02 November 2005 04:50, you wrote: > > It wasn´t a problem to configure EAP-PEAP with freeradius server (running > > on suse) and Enterasys switches. > > I want to implement VLAN assignment at a > > enterasys switch. > > > > Any tips ?? > > Is it necessary to active or configure something on FreeRADIUS to use > > "tunnel" parameters ??? > > If you have the tunnel AVs set in you users file as replies, FreeRADIUS will > send them. Run in debug mode to see. > > Zoltan Ori > >

1 0

FreeBSD anyone?
by Miguel 10 Nov '05

10 Nov '05

Hi, im running freeradius 1.0.5 + postgres 8.0.3 on a dual xeon, gentoo 2005.1, all is working ok, but i have another server with the same hardware specs that i recently "upgraded" from gentoo to freebsd 5.3, the server was running apache + postgres and, wow , great diference, better performance, so postgres definitely liked freebsd, what about freeradius?, i have read on the website that it is developed on debian but it compiles on freebsd, what is your experience with freebsd , good?, bad? , any gotchas?. Should i migrate to freebsd or stay with gentoo?, my personal preference is bsd, but im worried of any obscure future that only works on linux api's ,etc thanks in advance, Miguel

6 11

having filter-id sent on an eap response
by Dan Newcombe 10 Nov '05

10 Nov '05

It's tired and I'm late or something like that :) Thanks to Alan's help, things are now resolving to the IAS server as mentioned in my previous posts and configs. The switches seem to be receiving the Access-Accept packets as they are marking the ports as authenticated with the correct user id. However, I'm also trying to pass back a filter-id so the switch can change the policy on the port the user has authenticated on. The IAS server returns this just fine, and when using radclient, my proxied request returns: Sending Access-Accept of id 219 to 172.25.7.11:1024 Filter-Id = "Enterasys:version=1:mgmt=su:policy=Administrator" Callback-Number = "" Service-Type = Framed-User Class = 0x570b067a000001370001a81cf03c01c5e5644a584e9e00000000000001b2 However, when my XP machine tries to authenticate with PEAP/MS-CHAPv2, everything goes to the IAS server, and the Filter-ID is passed back from the IAS server to freeradius, however Sending Access-Accept of id 9 to 172.25.7.11:1024 MS-MPPE-Recv-Key = 0x50c3bedb696d476e8ed66808b5a2e452a6554fa470ca566bd77fc6d8c170e277 MS-MPPE-Send-Key = 0x1bd55848cc4c172fece6e24a9fb00f91652e74bbf509eef674948bd2c6e4cea1 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "CCSU\\testuser" is what gets sent to the switch/NAS. I'm sure this is just my lack of understanding of the PEAP process, but what am I missing to have the other attributes go back out with the Access-Accept? Thanks all! -Dan

1 0

Problem with loading files from free radius
by Eyas Sarabi 10 Nov '05

10 Nov '05

Hi All; I faced a major problem, My Hard disk was corrupted and the free radius wasn't being able to write to database, I still have the files generated by free radius and I want to load them to the database .Is there any tool that can load the generated files to oracle database ? Regards, Eyas

1 0

authenticate against bytes in and out with sqlcounter
by Martin Potgieter 09 Nov '05

09 Nov '05

hello, I am using freeradius 1.0.5 and trying to get to a point where I can deny access to a user when he has "used" more than a specific amount of bandwidth in a month (from the 1st to the last day of the month). rlm_sqlcounter seems to be what I need. I have configured it as I think it should be but when I go into debug mode the values seem to get changed at a point. Here is my sqlcounter.conf file: +++++++++++++++++++++++++++++++++++++++++++++++++++++++ sqlcounter monthlycounter { counter-name = Max-Bytes check-name = Max-Bytes sqlmod-inst = sql key = User-Name reset = monthly Reply-Message = "You have reached your bandwidth cap for this Month" query = "SELECT sum(AcctOutputOctets) + sum(AcctInputOctets) FROM radacct where UserName = '%{%k}'" } +++++++++++++++++++++++++++++++++++++++++++++++++++++++ In my radiusd.conf my authorize section is as follows: +++++++++++++++++++++++++++++++++++++++++++++++++++++++ authorize { preprocess chap mschap suffix sql monthlycounter } +++++++++++++++++++++++++++++++++++++++++++++++++++++++ When I am in debug mode I get the following: +++++++++++++++++++++++++++++++++++++++++++++++++++++++ Thu Nov 10 00:17:41 2005 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Thu Nov 10 00:17:41 2005 : Debug: rlm_sql_mysql: query: SELECT sum(AcctOutputOctets) + sum(AcctInputOctets) FROM radacct where UserName = 'surfing@home' Thu Nov 10 00:17:41 2005 : Debug: rlm_sql (sql): - sql_xlat finished Thu Nov 10 00:17:41 2005 : Debug: rlm_sql (sql): Released sql socket id: 4 Thu Nov 10 00:17:41 2005 : Debug: radius_xlat: '9628587663' Thu Nov 10 00:17:41 2005 : Debug: rlm_sqlcounter: (Check item - counter) is greater than zero Thu Nov 10 00:17:41 2005 : Debug: rlm_sqlcounter: Authorized user surfing@home, check_item=-1073741824, counter=2147483647 Thu Nov 10 00:17:41 2005 : Debug: rlm_sqlcounter: Sent Reply-Item for user surfing@home, Type=Session-Timeout, value=1 Thu Nov 10 00:17:41 2005 : Debug: modsingle[authorize]: returned from monthlycounter (rlm_sqlcounter) for request 2 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ Why the altered negative number in the check_item? Is the radius_xlat doing something? Do I need to put in Max-Bytes in one of the dictionary files? The example in experimental.conf did not mention anything about adding attributes so I assumed not. Also the "counter=2147483647" is not the value I have in the database for that user... I am missing something here :-) Thanks for any help Martin

1 0

simultaneous use, checkrad, and MPP attempts
by Christopher Carver 09 Nov '05

09 Nov '05

Hello, Thanks everyone for the great product that I've relying on for the past several years. I am now seeing a problem I hope someone can help with. I'm using Freeradius-0.9.3 on FreeBSD 5.2.1-REALEASE. We have Freeradius doing strictly dialup authentication. Some of the NAS's querying the radius server are our equipment. Some of the NAS's are equipment we lease from another company and have no access to. We have been successfully using simultaneous checking while using all of our own equipment. However, since leasing equipment we have been getting the following entries in radius.log: Tue Nov 8 23:26:09 2005 : Auth: Multiple logins (max 1) [MPP attempt]: [user1] (from client pa-230-radius0 port 2287 cli async) Tue Nov 8 23:27:17 2005 : Auth: Multiple logins (max 1) [MPP attempt]: [user2] (from client pa-230-radius0 port 2703 cli async) Tue Nov 8 23:32:38 2005 : Auth: Multiple logins (max 1) [MPP attempt]: [user3] (from client pa-230-radius0 port 3699 cli async) The proxy'ing radius servers and NAS's of the other company from whom we lease equipment are unavailable to checkrad. By default shouldn't it be allowing these people on? I looked at the code and it seemed as though it should. I set the nastype to other in clients.conf for these entries and I still see MPP attempts. Finally, I looked at the source of checkrad. I modified the line for "other" nastypes to always return 0, which should be interpreted as no multiple login. The numbers you see to the left are line numbers: 1351 } elsif ($ARGV[0] eq 'other') { 1352 $ret = 0; 1353 } else { Any idea why this isn't behaving how I expect? Is there a more appropriate way I can ensure that users connecting via NAS's and proxy'ing radius servers we lease will never be rejected because of multiple logins? And what is the difference between MPP attempt and regular multiple login? Thank you very much for your time. Chris Carver

3 2

Problem with loading files from free radius
by Eyas Sarabi 09 Nov '05

09 Nov '05

Hi All; I faced a major problem, My Hard disk was corrupted and the free radius wasn't being able to write to database, I still have the files generated by free radius and I want to load them to the database .Is there any tool that can load the generated files to oracle database ? Regards, Eyas

2 1

Proxying a PEAP request to an IAS server
by Dan Newcombe 09 Nov '05

09 Nov '05

Hi all. I've done my best to try and figure this out myself, but am really stuck. First the basics: An enterasys C2 switch setup to do 802.1x authentication. This switch points to my freeradius server. Attached to the swich is my XP notebook, which is setup to do 802.1x via PEAP. On the back end is a Win2k3 server which is running IAS. The idea is to have all the network switches send the authentication requests to the freeradius server, which will then decide if it needs to go to the windows box (for staff) or a different box (for students). Also, the Win2k3 IAS server has a limit of 50 clients unless you scale up to the advanced server, which I find just sad that they have done this. Anyway, I have tested from the freeradius box to the IAS box using radtest, and everything is working, so I am being seen as a client. The problem is when I try and have the notebook authenticate. I see rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. in the debug output, which I gather is normal, but somehow part of the problem. Basically, the IAS server seems to ignore whatever is coming across from the freeradius box. My (uneducated) guess is that this is because it has the EAP parms in it, but is not eap??? However, a normal "clear-text" attempt via radtest works fine. I have found this post by Alan DeKok - http://thread.gmane.org/gmane.comp.dial-up.freeradius.user/26170 which sounds very similar to what I am doing First, configure the server to terminate the tunnel, and authenticate the inner session locally. Once that works, configure the server to proxy the inner session only. I guess where I am really lost is how to follow the above suggestion. This is what it is sending to the IAS box, which is being ignored. Sending Access-Request of id 1 to 172.25.8.114:1812 User-Name = "CCSU\\dan" Called-Station-Id = "00-11-88-12-6e-70" Calling-Station-Id = "00-0f-1f-43-c8-38" NAS-Identifier = "00-11-88-12-6e-5d" NAS-IP-Address = 172.25.7.11 NAS-Port = 19 Framed-MTU = 1500 NAS-Port-Type = Ethernet EAP-Message = 0x0202001201434353555c646e6577636f6d63 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3432 Thanks for any help...I'm really stuck on this part! -Dan

3 6

Re: JRadius
by Raoul Demour 09 Nov '05

09 Nov '05

Hello thanks for all the answers! > Regarding EAP-SIM, JRadius has no specific support > for it. What is it > you are trying to do? What I have understood: FreeRADIUS is able to authenticate using EAP-SIM. But you need to set the attributes: EAP-SIM-Rand1 EAP-SIM-SRES1 EAP-SIM-KC1 EAP-SIM-Rand2 EAP-SIM-SRES2 EAP-SIM-KC2 EAP-SIM-Rand3 EAP-SIM-SRES3 EAP-SIM-KC3 (do you really need to set all the 9 attributes? or just one rand, one SRES and one Kc is enough?) I dont have access to GSM network and I dont know Ki (share secret). But to check if the system is correctly set up, I would like to give manually the attributes (on the serveur). (In a way I cheat...). Or to reproduce the generation of Rand, SRES and Kc (using my own algorithm) and on the supplicant I simulate SIM card... With JRadius it is possible to create object like Attr_UserPassword (according to the given example of JRadius). After what, it is used to set the attribut UserPassord for FreeRADIUS. So I think it would not be too complicate to create new attribute like: Attr_EAP_SIM_Rand, Attr_EAP-SIM-SRES, Attr_EAP-SIM-KC. In a way, I would like to use JRadius to avoid writing a module which will set the nine above attributes. My explanation may be not realy clear because I still learning how the thing work (for exemple, I suppose that the algorith to generate Rand, SRES and Kc is mobil operator specific, but I'm not complitly sure of the fact) Raoul __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

1 0