- Freeradius-Users - lists.freeradius.org

Freeradius 1.0.4 (rlm_perl enabled) and Debian 3.1 (stable - Sarge)
by Roman Medina-Heigl Hernandez 29 Aug '05

29 Aug '05

Hi, I'm trying to get FR 1.0.4 to work with new Debian stable distro (3.1). I need rlm_perl so I run ./configure with --with-experimental-modules and compiled it from source (latest .tgz downloaded from freeradius.org) # tar zxvf freeradius-1.0.4.tar.gz # chown -R root. freeradius-1.0.4 # cd freeradius-1.0.4 # ./configure --with-experimental-modules --prefix=/usr/local/freeradius # make # make install Compile/build process is ok. Then I configured it to use a perl script and that's what I get when trying to start radiusd: raclde01:/usr/local/freeradius/sbin# ./radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded perl perl: module = "/usr/local/usr/local/freeradius/bin/freeradius_test.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: perl_flags = "(null)" perl: func_start_accounting = "start_accounting" perl: func_stop_accounting = "stop_accounting" ./radiusd: relocation error: /usr/lib/perl/5.8/auto/IO/IO.so: undefined symbol: Perl_Tstack_sp_ptr raclde01:/usr/local/freeradius/sbin# It's strange because I followed the same process with FR 1.0.2 on Debian 3.0 (oldstable - Woody) 1 or 2 months ago and I got success (no problems at all). So I don't know whether I have a problem with Perl / Debian or it is freeradius related. Perhaps am I missing some perl package in my Debian sarge? Has somebody tested FR + rlm_perl on Debian Sarge? Any idea on what's happening? If you need more info, I could provide it. For instance: raclde01:/usr/local/freeradius/sbin# dpkg -l | grep perl ii libdbi-perl 1.46-6 Perl5 database interface by Tim Bunce ii libdigest-perl 1.10-1 generic interface to message digest modules rc libnet-perl 1.09.01-1 Implementation of Internet protocols for Per ii libnet-server- 0.87-3 An extensible, general perl server engine ii libnetserver-g 1.03-7 A perl module for developing internet server ii libperl-dev 5.8.4-8 Perl library: development files ii libperl5.8 5.8.4-8 Shared Perl library ii libperlio-via- 0.11-1 dynamic PerlIO layers ii libplrpc-perl 0.2017-1 Perl extensions for writing PlRPC servers an ii liburi-perl 1.35-1 Manipulates and accesses URI strings ii libwww-perl 5.803-4 WWW client/server library for Perl (aka LWP) ii perl 5.8.4-8 Larry Wall's Practical Extraction and Report ii perl-base 5.8.4-8 The Pathologically Eclectic Rubbish Lister rc perl-doc 5.6.1-8.9 Perl documentation. ii perl-modules 5.8.4-8 Core Perl modules raclde01:/usr/local/freeradius/sbin# perl -V Summary of my perl5 (revision 5 version 8 subversion 4) configuration: Platform: osname=linux, osvers=2.4.27-ti1211, archname=i386-linux-thread-multi uname='linux kosh 2.4.27-ti1211 #1 sun sep 19 18:17:45 est 2004 i686 gnulinux ' config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN -Dcccdlflags=-fPIC -Darchname=i386-linux -Dprefix=/usr -Dprivlib=/usr/share/perl/5.8 -Darchlib=/usr/lib/perl/5.8 -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5 -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl/5.8.4 -Dsitearch=/usr/local/lib/perl/5.8.4 -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Uusesfio -Uusenm -Duseshrplib -Dlibperl=libperl.so.5.8.4 -Dd_dosuid -des' hint=recommended, useposix=true, d_sigaction=define usethreads=define use5005threads=undef useithreads=define usemultiplicity=define useperlio=define d_sfio=undef uselargefiles=define usesocks=undef use64bitint=undef use64bitall=undef uselongdouble=undef usemymalloc=n, bincompat5005=undef Compiler: cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64', optimize='-O2', cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -I/usr/local/include' ccversion='', gccversion='3.3.5 (Debian 1:3.3.5-9)', gccosandvers='' intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234 d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12 ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8 alignbytes=4, prototype=define Linker and Libraries: ld='cc', ldflags =' -L/usr/local/lib' libpth=/usr/local/lib /lib /usr/lib libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt perllibs=-ldl -lm -lpthread -lc -lcrypt libc=/lib/libc-2.3.2.so, so=so, useshrplib=true, libperl=libperl.so.5.8.4 gnulibc_version='2.3.2' Dynamic Linking: dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E' cccdlflags='-fPIC', lddlflags='-shared -L/usr/local/lib' Characteristics of this binary (from libperl): Compile-time options: MULTIPLICITY USE_ITHREADS USE_LARGE_FILES PERL_IMPLICIT_CONTEXT Built under linux Compiled at Mar 8 2005 19:51:48 @INC: /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl . raclde01:/usr/local/freeradius/sbin# Thanks in advance. -Roman PS: I searched the list archive and other sources. I found other similar "symbol problems" but I did some tests (tried proposed solutions, etc) and I didn't got success, so I'm not really sure whether the origin of the problem is the same or not... Your help is appreciated. PS2: I also tried to rebuild FR package for Debian (which is currently 1.0.2 on Sarge), adding rlm_perl support (basically --with-experimental-modules). Build is correct but I have similar problems with symbols :-(

1 2

(no subject)
by Marc-Henri Boisis-delavaud 29 Aug '05

29 Aug '05

Hello Were Can I found patches for cisco wlse work ? Marc

1 0

configure free radius server for accepting accounting request packets
by Geraldin Arthy 29 Aug '05

29 Aug '05

Hello Paul Bender or anyone in the list, I am using free radius server for sending accounting request packets and receive accounting response packets.However it displays shared secret is incorrect.With respect to your mail dated Sun, 16 May 2004 17:13:02 -0700 with the topic Freeradius Segmentation Fault on LDAP Bind i see that the free radius server has received and sent back an accounting response to the client.Could you let me know how you configured the free radius server for radius accounting or anyone in the list any idea??Please let me know.............. Regards, --------------------------------- Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather

1 0

usage of exec to get LDAP value..
by haizam 29 Aug '05

29 Aug '05

Dear all, I've configured my radius to load value of timeout based on NAS-Port-Type.. Using LDAP for user's entry.. In LDAP.. user's entry will have additional 2 attributes TimeoutPSTN: 4000 TimeoutISDN: 1000 then in users file.. using exec to run small script to get correct value of sessiontimeout based on NAS-Port-Type DEFAULT NAS-Port-Type == "Sync", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U ISDN}` DEFAULT NAS-Port-Type == "Async", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U PSTN}` And its works... But my question is there any better way to do this?? Maybe directly get value from LDAP.... thanks.. --haizam

2 4

rlm_attr_filter for proxied accounting packets
by Thor Spruyt 27 Aug '05

27 Aug '05

Hi, I noticed that rlm_attr_filter.c contains the following in the attr_filter_preproxy function: if (request->packet->code != PW_AUTHENTICATION_REQUEST) { return (RLM_MODULE_NOOP); } This means that accounting packets are not handled by this function. Instead, the accounting packets are handled by the attr_filter_accounting function. I have a problem with this, because I'm rewriting attributes with the preproxy_users file. That module's function will change attributes in both proxied authentication requests and proxied accounting requests. Now, for authentication everything works fine: - I don't do any attribute changing in the "authenticate" stage, so everything stays the same here - then we go to the "pre-proxy" stage, where first I use rlm_files for some changing and then rlm_attr_filter to filter some attributes out For accounting however, the following happens: - in the "accounting" stage, rlm_attr_filter filters some attributes out because I don't want them to be sent to the home radius - in the "pre-proxy" stage, rlm_files wants to change some attribute based on another attribute which was filtered out already by rlm_attr_filter in the "accounting" stage - in the "pre-proxy" stage, rlm_attr_filter returns NOOP, since it's coded not to do anything here for accounting packets. To be clear: I think that the pre-proxy functions should always act on both Access-Request and Account-Request packets, the configuration in radiusd.conf should take care if you want to differentiate between the two. Obviously, for post-proxy this would apply too, but the need is not there, since Accounting-Reply packets generally do not contain any attributes, but even then it would be nice to be able to tell the server to filter them our or not. Since rlm_attr_filter should only be used for proxied packets, the attr_filter_accounting function is obsolete, just like the attr_filter_authenticate function was! If you want, I can supply a patch for rlm_attr_filter.c to also accept accounting packets in the attr_filter_preproxy function, just let me know. -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

1 0

more on server certificates
by Ben Thompson 27 Aug '05

27 Aug '05

Hi Has anybody got a digital certificate (with the extended key usage attributes required for PEAP) installed on their FreeRADIUS box that has been signed by a commercial trusted CA? I have come to suspect that this is impossible due to the fact that Verisign are the only company marketing such a product and it can only be installed on a Windows server (as the online purchase system only works if done from the target machine using Internet Explorer and Xenroll). Thanks Ben

2 2

PEAP issues
by allan.borman 26 Aug '05

26 Aug '05

Hi All, Thanks for the previous help that everyone offered, I got the freeradius up and running. I can authenticate using a test account I created in the "users" file, using the radius itself and also using my VPN box. I set this server up originally to authenticate WI-Fi users usign 802.1x and PEAP. This is where it fails. and the result is consistent with two different wireless manifacturer. the debug section is below. I like to thank anyone in advance for any suggestions or help that you may offer. Take Care, allan.borman(a)hccs.edu Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********start********** rad_recv: Access-Request packet from host 172.31.31.31:1517, id=11, length=122 NAS-IP-Address = 172.31.31.31 NAS-Port-Type = Wireless-802.11 NAS-Port = 45 Framed-MTU = 1400 User-Name = "guest" Calling-Station-Id = "0011f5161423" Called-Station-Id = "0001f444a3b4" NAS-Identifier = "HALLWAY4D04" EAP-Message = 0x0201000a016775657374 Message-Authenticator = 0x972393b17e8182216a4fd0dd08622f42 modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok modcall[authorize]: module "chap" returns noop rlm_eap: EAP packet type notification id 1 length 10 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated rlm_realm: No '@' in User-Name = "guest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop users: Matched guest at 85 users: Matched DEFAULT at 165 modcall[authorize]: module "files" returns ok modcall[authorize]: module "mschap" returns noop modcall: group authorize returns updated rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [guest/<no User-Password attribute>] (from client 4-3w3.hccs.edu port 45 cli 0011f5161423) Delaying request 12 for 1 seconds Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 172.31.31.31:1517 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 11 with timestamp 430f42cc Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********end**********

2 1

Re: MySQL radacct not updated
by sean 26 Aug '05

26 Aug '05

Hi Thor, I'm just posting this to thank you for your help and let you know that it was appreciated and also to help anyone else with a similar problem to see the solution. In order to enable the accounting packets between Chilli and Radius I removed all of the pin holes in my ADSL modem and instead set up a NAT default server pointing to my Radius/WEB/Jabber/POP/SMTP/SMPP/Apache server. This allows all of the trafic arriving to the ADSL modem to pass through to the server and solved the problem. I not sure about the security of this fix so I'm setting up a firewall on the server. This will give me better control over the trafic than the ADSL modem did. Anyway once again thanks a million Thor you pointed me in the right direction and saved me another week with no sleep. Regards, Sean Bracken http://freetextworld.com http://topup.ie http://swarmhotspots.com

2 1

RE: PEAP issues
by Bill Carr 26 Aug '05

26 Aug '05

Remove the " Auth-Type Local" >From the guest account. Let freeradius figure out to do EAP on it's own. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of allan.borman Sent: Friday, August 26, 2005 12:32 PM To: FreeRadius users mailing list Subject: PEAP issues Hi All, Thanks for the previous help that everyone offered, I got the freeradius up and running. I can authenticate using a test account I created in the "users" file, using the radius itself and also using my VPN box. I set this server up originally to authenticate WI-Fi users usign 802.1x and PEAP. This is where it fails. and the result is consistent with two different wireless manifacturer. the debug section is below. I like to thank anyone in advance for any suggestions or help that you may offer. Take Care, allan.borman(a)hccs.edu Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********start********** rad_recv: Access-Request packet from host 172.31.31.31:1517, id=11, length=122 NAS-IP-Address = 172.31.31.31 NAS-Port-Type = Wireless-802.11 NAS-Port = 45 Framed-MTU = 1400 User-Name = "guest" Calling-Station-Id = "0011f5161423" Called-Station-Id = "0001f444a3b4" NAS-Identifier = "HALLWAY4D04" EAP-Message = 0x0201000a016775657374 Message-Authenticator = 0x972393b17e8182216a4fd0dd08622f42 modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok modcall[authorize]: module "chap" returns noop rlm_eap: EAP packet type notification id 1 length 10 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated rlm_realm: No '@' in User-Name = "guest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop users: Matched guest at 85 users: Matched DEFAULT at 165 modcall[authorize]: module "files" returns ok modcall[authorize]: module "mschap" returns noop modcall: group authorize returns updated rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [guest/<no User-Password attribute>] (from client 4-3w3.hccs.edu port 45 cli 0011f5161423) Delaying request 12 for 1 seconds Finished request 12 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 172.31.31.31:1517 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 12 ID 11 with timestamp 430f42cc Nothing to do. Sleeping until we see a request. *****************************************************debug section of freeradius***********end********** - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

salt-encrypted VSAs?
by Bjørn Mork 26 Aug '05

26 Aug '05

Hello, I was hoping to send a few salt-encrypted VSAs to an ERX using FreeRADIUS Version 1.0.4, but I can't find any examples of how to do that. Is it possible, and if so, how? The format of the VSAs is documented on http://www.juniper.net/techpubs/software/erx/junose700/swconfig-broadband/h… My initial (far fetched) attempt was to modify dictionary.erx like this: VENDOR ERX 4874 BEGIN-VENDOR ERX ATTRIBUTE ERX-Virtual-Router-Name 1 string [..] ATTRIBUTE ERX-LI-Action 58 integer encrypt=1 ATTRIBUTE ERX-Med-Dev-Handle 59 string encrypt=1 ATTRIBUTE ERX-Med-Ip-Address 60 ipaddr encrypt=1 ATTRIBUTE ERX-Med-Port-Number 61 integer encrypt=1 END-VENDOR ERX [..] VALUE ERX-LI-Action off 0 VALUE ERX-LI-Action on 1 VALUE ERX-LI-Action noop 2 I also tried the other documented encrypt-values, with no success. As probably should be expected? The ERX seems to just ignore Access-Accept packets with any of these attributes. They are not even logged as received. Not much help there. Cisco has a bit better documentation with some examples (but not for FreeRADIUS) here: http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/12… Does anyone have an idea of how to do this with FreeRADIUS? Bjørn

2 3