- Freeradius-Users - lists.freeradius.org

Dictionary include error.
by Joseph 26 Sep '05

26 Sep '05

I am trying to include the dictionary.starent and getting the following error: Errors reading dictionary: dict_init: /etc/freeradius/dictionary.starent[41]: dict_addattr: ATTRIBUTE has invalid number (larger than 255). Any ideas on what would cause this? Here is the line in my dictionary file: $INCLUDE /usr/share/freeradius/dictionary $INCLUDE dictionary.starent Running on debian sarge with snapshot copy of freeradius because I need the starent dictionary. -- J

2 1

RE: Maximum size Input-Octets/Output-Octets
by Jonathan De Graeve 26 Sep '05

26 Sep '05

So is it 2147483648 or 2147483647? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Guy Fraser Verzonden: maandag 26 september 2005 17:45 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: RE: Maximum size Input-Octets/Output-Octets On Fri, 2005-23-09 at 19:42 +0200, Jonathan De Graeve wrote: > > What "radacct" are you talking about? The Acct-Input-Octets stops > >at 2G because the RFC dictates that it's a 32-bit integer. That's why > >the Acct-Input-Gigawords attribute was defined. It goes past 2G. > > I'm talking about the detail file from freeradius. > > This is what I found in RFC2869 > > 5.1. Acct-Input-Gigawords > > Description > > This attribute indicates how many times the Acct-Input-Octets > counter has wrapped around 2^32 over the course of this service > being provided, and can only be present in Accounting-Request > records where the Acct-Status-Type is set to Stop or Interim- > Update. > > So I assumed that the wrapping went @ 4GB instead of 2GB > > >From RFC2866: > > Value > > The Value field is four octets. > > Also: > > integer 32 bit unsigned value, most significant octet first. > > So its 32bit. (4GB right??) > > I will use 2147483647 for now. But I can't find the definition which > says that it should be 2GB so I need to be sure. > > J. What is right and what is in common use may be two different things. In my experience, some NAS vendors generate negative numbers when the Octet Value is greater than 2^31. By the way a GigaWord is 2147483648 bytes since a Word = 2 Bytes and Giga = 1024*1024*1024 = 1073741824. It would therefore make sense to use a modulo of 2147483648 for the Octet value which holds the "remainder" of the full byte count. Just in case you were wondering what a TeraQuad was after watching a Star Trek NG episode it is 4398046511104 Bytes. ;^) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

LDAP Radius -x help...
by Cris Boisvert 26 Sep '05

26 Sep '05

Running Freeradius on fedora core 4 When I use Radiusd -X I can authenticate via the ldap server I have running.. But when I start radius normally "service radiusd start" it starts but the error log says It can't talk to The ldap server.. Ideas? Why would it working in debug but not normally? Here's the log info --------------------------------Radius log----------------------------------- Mon Sep 26 15:55:27 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Mon Sep 26 15:55:27 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Sep 26 15:55:27 2005 : Info: Ready to process requests. Mon Sep 26 15:55:30 2005 : Error: rlm_ldap: bind to 192.168.77.6:389 failed: Can't contact LDAP server Mon Sep 26 15:55:30 2005 : Error: rlm_ldap: (re)connection attempt failed ------------------radius x output ----------------------------------------- modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "wow(a)pork.com" with password "test1234" radius_xlat: '(mail=wow(a)pork.com)' radius_xlat: 'o=pork.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.77.6:389, authentication 0 rlm_ldap: bind as / to 192.168.77.6:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=pork.com, with filter (mail=wow(a)pork.com) rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: user DN: uid=wow,ou=People,o=pork.com rlm_ldap: (re)connect to 192.168.77.6:389, authentication 1 rlm_ldap: bind as uid=wow,ou=People,o=pork.com/test1234 to 192.168.77.6:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user wow(a)pork.com authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 26 to 192.168.77.6:3665 Finished request 0

1 0

Freeradius LDAP
by Cris Boisvert 26 Sep '05

26 Sep '05

Cris Boisvert wrote: > I'm setting up freeradius to talk to a Ipswitch Imail server for > authetication. > > Just needs to do the basic User Pass... Ok. > > [..] > A snippet of the config. > ----------------------------------------------- > ldap { > server = "192.168.77.6" > #identity = "cn=root,o=My Org,c=UA" > #password = test1234 > basedn = "o=My Org,c=UA" > #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > # base_filter = "(objectclass=radiusprofile)" > > # set this to 'yes' to use TLS encrypted connections > ______________---------------------------------------------- > [..] > Below is a Cut form radiusd -X debug.. > > Anyone have any reccomendations>? > > > > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type LDAP > auth: type "LDAP" > Processing the authenticate section of radiusd.conf > modcall: entering group Auth-Type for request 0 > rlm_ldap: - authenticate > rlm_ldap: login attempt by "test at pork.com" with password "test" > radius_xlat: '(uid=test at pork.com)' > radius_xlat: 'o=My Org,c=UA' Do you really have an object with attribute iud="test at pork.com"? I think you should split the username with delimiter '@', so you search for uid=test,dc=pork,dc=com (or similiar). But if you have such objects, try ldap_debug=0xffff between ldap { } in your radiusd.conf. Linus van Geuns For testing purposes I do have a user of test(a)pork.com I have set the debug option to 0xffff .. Their was no more debug info than before. Where in the radiusd.conf am I supposed to put "uid=test,dc=pork,dc=com " reference? Sorry I'm not really up on ldap.. Thanx

1 0

PEAP Protocol
by Juan Daniel Moreno 26 Sep '05

26 Sep '05

Hi everyone, I have a little problem with freeradius 1.0.4. It's maybe something I don't understand but I really need help. With PEAP protocol, I have a user test with its own password. The first 8 packets are fine but as I send the 9th, radius says Length in packet header doesn't match actual length. Does it means that the length in the first packet (when I send a two packets certificate) is greater or less than in second packet? Or is just the header length in this very packet? Thank you four your help. Juan Daniel MORENO

2 1

Re: Cant make in openbsd3.7 freeradius 1.0.5
by Lou Goddard 26 Sep '05

26 Sep '05

Alan, Here are the errors. gmake[5]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules/rlm_files' Making static dynamic in rlm_ippool... gmake[5]: Entering directory `/home/lou/freeradius-1.0.5/src/modules/rlm_ippool' gmake[5]: Nothing to be done for `static'. gmake[5]: Nothing to be done for `dynamic'. gmake[5]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules/rlm_ippool' Making static dynamic in rlm_krb5... gmake[5]: Entering directory `/home/lou/freeradius-1.0.5/src/modules/rlm_krb5' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../../include -I/usr/include/et -c rlm_krb5.c -o rlm_krb5.o rlm_krb5.c:39:18: krb5.h: No such file or directory rlm_krb5.c:45: error: syntax error before "krb5_context" rlm_krb5.c:57: error: syntax error before "context" rlm_krb5.c:59: warning: function declaration isn't a prototype rlm_krb5.c: In function `verify_krb5_tgt': rlm_krb5.c:62: error: syntax error before "princ" rlm_krb5.c:63: error: `krb5_keyblock' undeclared (first use in this function) rlm_krb5.c:63: error: (Each undeclared identifier is reported only once rlm_krb5.c:63: error: for each function it appears in.) rlm_krb5.c:63: error: `keyblock' undeclared (first use in this function) rlm_krb5.c:64: error: syntax error before "packet" rlm_krb5.c:72: error: `instance' undeclared (first use in this function) rlm_krb5.c:87: error: `packet' undeclared (first use in this function) rlm_krb5.c:88: warning: implicit declaration of function `krb5_sname_to_principal' rlm_krb5.c:88: error: `context' undeclared (first use in this function) rlm_krb5.c:89: error: `KRB5_NT_SRV_HST' undeclared (first use in this function) rlm_krb5.c:89: error: `princ' undeclared (first use in this function) rlm_krb5.c:92: error: `user' undeclared (first use in this function) rlm_krb5.c:96: warning: implicit declaration of function `krb5_princ_component' rlm_krb5.c:96: error: `c' undeclared (first use in this function) rlm_krb5.c:96: error: invalid type argument of `->' rlm_krb5.c:104: warning: implicit declaration of function `krb5_kt_read_service_key' rlm_krb5.c:105: error: `ENCTYPE_DES_CBC_MD5' undeclared (first use in this function) rlm_krb5.c:113: warning: implicit declaration of function `krb5_free_keyblock' rlm_krb5.c:116: warning: implicit declaration of function `krb5_mk_req' rlm_krb5.c:116: error: `auth_context' undeclared (first use in this function) rlm_krb5.c:117: error: `ccache' undeclared (first use in this function) rlm_krb5.c:119: warning: implicit declaration of function `krb5_auth_con_free' rlm_krb5.c:131: warning: implicit declaration of function `krb5_kt_resolve' rlm_krb5.c:131: error: `keytab' undeclared (first use in this function) rlm_krb5.c:135: warning: implicit declaration of function `krb5_kt_default' rlm_krb5.c:147: warning: implicit declaration of function `krb5_rd_req' rlm_krb5.c:150: warning: redundant redeclaration of `krb5_auth_con_free' in same scope rlm_krb5.c:119: warning: previous declaration of `krb5_auth_con_free' rlm_krb5.c:152: warning: implicit declaration of function `krb5_kt_close' rlm_krb5.c:164: warning: implicit declaration of function `krb5_free_data_contents' rlm_krb5.c: In function `krb5_instantiate': rlm_krb5.c:174: error: `krb5_context' undeclared (first use in this function) rlm_krb5.c:174: error: `context' undeclared (first use in this function) rlm_krb5.c:185: error: structure has no member named `context' rlm_krb5.c:187: warning: implicit declaration of function `krb5_init_context' rlm_krb5.c: In function `krb5_detach': rlm_krb5.c:203: error: structure has no member named `context' rlm_krb5.c: In function `krb5_auth': rlm_krb5.c:215: error: syntax error before "tgtname" rlm_krb5.c:213: warning: unused variable `r' rlm_krb5.c:211: warning: unused parameter `instance' rlm_krb5.c:211: warning: unused parameter `request' rlm_krb5.c: At top level: rlm_krb5.c:220: error: syntax error before "kcreds" rlm_krb5.c:220: warning: type defaults to `int' in declaration of `kcreds' rlm_krb5.c:220: warning: data definition has no type or storage class rlm_krb5.c:221: error: syntax error before "ccache" rlm_krb5.c:221: warning: type defaults to `int' in declaration of `ccache' rlm_krb5.c:221: error: `ccache' used prior to declaration rlm_krb5.c:221: warning: data definition has no type or storage class rlm_krb5.c:224: error: syntax error before "context" rlm_krb5.c:224: warning: type defaults to `int' in declaration of `context' rlm_krb5.c:224: error: `context' used prior to declaration rlm_krb5.c:224: error: `instance' undeclared here (not in a function) rlm_krb5.c:224: warning: data definition has no type or storage class rlm_krb5.c:225: error: `user' used prior to declaration rlm_krb5.c:231: error: syntax error before "if" rlm_krb5.c:59: warning: `verify_krb5_tgt' defined but not used rlm_krb5.c:171: warning: `krb5_instantiate' defined but not used rlm_krb5.c:202: warning: `krb5_detach' defined but not used rlm_krb5.c:212: warning: `krb5_auth' defined but not used rlm_krb5.c:210:1: unterminated #ifndef gmake[5]: *** [rlm_krb5.o] Error 1 gmake[5]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules/rlm_krb5' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/home/lou/freeradius-1.0.5/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/home/lou/freeradius-1.0.5/src' gmake: *** [common] Error 2 *** Error code 2

2 1

radutmp
by TK Lew 26 Sep '05

26 Sep '05

hi :: Is radutmp attributes can added ? What I need to do if I want "called-station-id" attribute to be display when run "radwho -R" ? Thank for any reply. Regards

2 1

Forcing authorization access-reject depending on attribute
by Mike Chamberlain 26 Sep '05

26 Sep '05

Hi there. I am using freeradius to authenticate users to a ChilliSpot wireless hotspot. It's backended by a SQL database and communicating using stored procedures. My problem is as follows. On authentication, the user enters their username and password. This calls a stored procedure which returns the correct password, leaving it up to the gateway to determine if the password they entered is correct. This is all no problem. The problem arises on the authorization. Even though the user may have supplied the correct username and password, they may not have enough credit to use the service. The problem is that there is no radius attribute that I can pass back to the ChilliSpot gateway to indicate that the user should not be allowed service. No matter what attributes I add, the radius message is always an Access-Accept. (For VoIP people, what I really want is the equivalent of the h323-return-code attribute, but sadly there doesn't appear to be anything like this in the WISPr specification.) I have been advised that it might be possible to return an arbitrary Access-Reject if I use scripting. I was thinking that perhaps it would be possible for freeradius to examine a particular attribute in the authorization response, and depending on the value change the message to be an Access-Reject. However, I am kind of stuck with this as I am new to freeradius and have no idea where to start. Does anyone know whether this would be the correct approach? If so, are there any sites or examples to get me started on this? If not, can anyone think of a better way to accomplish what I am trying? Thanks in advance for your help, Mike

3 2

RE: Wrong sequence of packets during re-authentication
by Bilal Shahid 26 Sep '05

26 Sep '05

Hello again, Can someone please help me this? I am clueless as how to solve this problem. Thanks, Bilal -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Bilal Shahid Sent: Friday, September 23, 2005 4:00 PM To: freeradius-users(a)lists.freeradius.org Subject: Wrong sequence of packets during re-authentication Hello all, During my 802.1X Supplicant's re-authentication (using EAP-TTLS) with FreeRADIUS using DLINK switch, I face the following scenario: Sometimes "during re-authentication", one of the FreeRADIUS's replies does not reach the DLINK switch. When DLINK's RADIUS timer expires, it re-starts the re-authentication by sending the Supplicant's identity to FreeRADIUS. At this time, an initial couple of packets are exchanges correctly, however then it seems that FreeRADIUS wants to skip some of the packets and complete the authentication whereas my Supplicant wants to re-do everything. For example, during a 'correct re-authentication", FreeRADIUS sends the following packet: TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0067], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05ca], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A However, during the "incorrect" re-authentication cycle, which has been started due to a packet loss in the middle as explained above, FreeRADIUS send the following packet: TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0067], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read finished A Note that this time FreeRADIUS has sent ChangeCipherSpec and Finished instead of Certificate and ServerHelloDone. Is this the normal and correct behavior? My Supplicant's response to this packet is then liked by the FreeRADIUS and its sends an alert. Could someone please help me understanding this problem. Thanks, Bilal _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

RE: Maximum size Input-Octets/Output-Octets
by Jonathan De Graeve 26 Sep '05

26 Sep '05

2147483647 it is :))) -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Jonathan De Graeve Verzonden: maandag 26 september 2005 17:49 Aan: FreeRadius users mailing list Onderwerp: RE: Maximum size Input-Octets/Output-Octets So is it 2147483648 or 2147483647? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Guy Fraser Verzonden: maandag 26 september 2005 17:45 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: RE: Maximum size Input-Octets/Output-Octets On Fri, 2005-23-09 at 19:42 +0200, Jonathan De Graeve wrote: > > What "radacct" are you talking about? The Acct-Input-Octets stops > >at 2G because the RFC dictates that it's a 32-bit integer. That's why > >the Acct-Input-Gigawords attribute was defined. It goes past 2G. > > I'm talking about the detail file from freeradius. > > This is what I found in RFC2869 > > 5.1. Acct-Input-Gigawords > > Description > > This attribute indicates how many times the Acct-Input-Octets > counter has wrapped around 2^32 over the course of this service > being provided, and can only be present in Accounting-Request > records where the Acct-Status-Type is set to Stop or Interim- > Update. > > So I assumed that the wrapping went @ 4GB instead of 2GB > > >From RFC2866: > > Value > > The Value field is four octets. > > Also: > > integer 32 bit unsigned value, most significant octet first. > > So its 32bit. (4GB right??) > > I will use 2147483647 for now. But I can't find the definition which > says that it should be 2GB so I need to be sure. > > J. What is right and what is in common use may be two different things. In my experience, some NAS vendors generate negative numbers when the Octet Value is greater than 2^31. By the way a GigaWord is 2147483648 bytes since a Word = 2 Bytes and Giga = 1024*1024*1024 = 1073741824. It would therefore make sense to use a modulo of 2147483648 for the Octet value which holds the "remainder" of the full byte count. Just in case you were wondering what a TeraQuad was after watching a Star Trek NG episode it is 4398046511104 Bytes. ;^) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0