- Freeradius-Users - lists.freeradius.org

wlse leap patches
by Marc-Henri Boisis-delavaud 29 Aug '05

29 Aug '05

Hello Were Can I found patches for cisco wlse work ? Marc

4 4

(no subject)
by Matt morris 29 Aug '05

29 Aug '05

Hello List, Thanks for the reply, Thor. So how do I setup freeradius to use rlm_perl then? Some pointers will be greatly appreciated. Thank you. Original Message: =========== >Hello list, > >This has probably been asked a lot times before, but I just couldn't >get the attributes values from accounting request packets with my >perl script. I am trying to do some database queries when I received >stop accounting request packets, here are the relevant sections of my >radiusd.conf and script file: You're mixing up 2 modules: rlm_exec and rlm_perl You configured your radius to use rlm_exec, but you're using a sample script for rlm_perl, which is completely different! There's a sample for rlm_exec at http://www.freeradius.org/cgi-bin/cvsweb.cgi/radiusd/scripts/exec-program-wa it?rev=1.4&content-type=text/x-cvsweb-markup -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt at telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be _________________________________________________________________ Take charge with a pop-up guard built on patented Microsoft® SmartScreen Technology http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*.

2 1

radius LDAP problem ?
by Frank Bonnet 29 Aug '05

29 Aug '05

Hello I use freeradius through chillispot and with a LDAP auth session. I am in trouble with freeradius during the login phase see below the trace of the log. Ready to process requests. rad_recv: Access-Request packet from host 147.215.1.111:32787, id=218, length=57 User-Name = "exam0" User-Password = "xxxxxxxx" --------> intentionnaly hidden NAS-IP-Address = 255.255.255.255 NAS-Port = 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for exam0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to ldap.esiee.fr:389, authentication 0 rlm_ldap: bind as / to ldap.esiee.fr:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 rad_recv: Access-Request packet from host 147.215.1.111:32787, id=218, length=57 Sending Access-Reject of id 218 to 147.215.1.111:32787 rad_recv: Access-Request packet from host 127.0.0.1:32791, id=0, length=197 User-Name = "exam01" User-Password = "xxxxxxxx" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-0E-35-4A-84-94" Called-Station-Id = "00-12-79-90-10-21" NAS-Identifier = "nas01" Acct-Session-Id = "431321c600000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x9d756035da40f907731462aca245f22c WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" rlm_ldap: - authorize rlm_ldap: performing user authorization for exam01 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 rad_recv: Access-Request packet from host 127.0.0.1:32791, id=0, length=197 Sending Access-Reject of id 0 to 127.0.0.1:32791 Thanks for any help -- Cordialement/Regards Frank Bonnet

4 4

help regarding pam_radius agent installation with RSA SecurID Authentication
by mukherji rakesh 29 Aug '05

29 Aug '05

Dear All I am configuring radius_pam agent on redhat linux 9 to integrate it with RSA SecurID Authentication technology.I have enabled radius on my RSA server but while trying to login from my linux client I am not able to enter as it says that access denied.I got a log from the /var/log/messages from the Linux client system like the following... Aug 29 18:00:02 phoebe sshd: pam_radius_auth: RADIUS server 172.16.51.149 failed to respond. Aug 29 18:00:02 phoebe sshd: pam_radius_auth: All RADIUS servers failed to respond. Can anyone please help me out of the situation? I am waiting for your reply / solution. Regards, Rakesh Mukherjee India / Calcutta Send instant messages to your online friends http://in.messenger.yahoo.com

1 0

Freeradius 1.0.4 (rlm_perl enabled) and Debian 3.1 (stable - Sarge)
by Roman Medina-Heigl Hernandez 29 Aug '05

29 Aug '05

Hi, I'm trying to get FR 1.0.4 to work with new Debian stable distro (3.1). I need rlm_perl so I run ./configure with --with-experimental-modules and compiled it from source (latest .tgz downloaded from freeradius.org) # tar zxvf freeradius-1.0.4.tar.gz # chown -R root. freeradius-1.0.4 # cd freeradius-1.0.4 # ./configure --with-experimental-modules --prefix=/usr/local/freeradius # make # make install Compile/build process is ok. Then I configured it to use a perl script and that's what I get when trying to start radiusd: raclde01:/usr/local/freeradius/sbin# ./radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded perl perl: module = "/usr/local/usr/local/freeradius/bin/freeradius_test.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: perl_flags = "(null)" perl: func_start_accounting = "start_accounting" perl: func_stop_accounting = "stop_accounting" ./radiusd: relocation error: /usr/lib/perl/5.8/auto/IO/IO.so: undefined symbol: Perl_Tstack_sp_ptr raclde01:/usr/local/freeradius/sbin# It's strange because I followed the same process with FR 1.0.2 on Debian 3.0 (oldstable - Woody) 1 or 2 months ago and I got success (no problems at all). So I don't know whether I have a problem with Perl / Debian or it is freeradius related. Perhaps am I missing some perl package in my Debian sarge? Has somebody tested FR + rlm_perl on Debian Sarge? Any idea on what's happening? If you need more info, I could provide it. For instance: raclde01:/usr/local/freeradius/sbin# dpkg -l | grep perl ii libdbi-perl 1.46-6 Perl5 database interface by Tim Bunce ii libdigest-perl 1.10-1 generic interface to message digest modules rc libnet-perl 1.09.01-1 Implementation of Internet protocols for Per ii libnet-server- 0.87-3 An extensible, general perl server engine ii libnetserver-g 1.03-7 A perl module for developing internet server ii libperl-dev 5.8.4-8 Perl library: development files ii libperl5.8 5.8.4-8 Shared Perl library ii libperlio-via- 0.11-1 dynamic PerlIO layers ii libplrpc-perl 0.2017-1 Perl extensions for writing PlRPC servers an ii liburi-perl 1.35-1 Manipulates and accesses URI strings ii libwww-perl 5.803-4 WWW client/server library for Perl (aka LWP) ii perl 5.8.4-8 Larry Wall's Practical Extraction and Report ii perl-base 5.8.4-8 The Pathologically Eclectic Rubbish Lister rc perl-doc 5.6.1-8.9 Perl documentation. ii perl-modules 5.8.4-8 Core Perl modules raclde01:/usr/local/freeradius/sbin# perl -V Summary of my perl5 (revision 5 version 8 subversion 4) configuration: Platform: osname=linux, osvers=2.4.27-ti1211, archname=i386-linux-thread-multi uname='linux kosh 2.4.27-ti1211 #1 sun sep 19 18:17:45 est 2004 i686 gnulinux ' config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN -Dcccdlflags=-fPIC -Darchname=i386-linux -Dprefix=/usr -Dprivlib=/usr/share/perl/5.8 -Darchlib=/usr/lib/perl/5.8 -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5 -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl/5.8.4 -Dsitearch=/usr/local/lib/perl/5.8.4 -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Uusesfio -Uusenm -Duseshrplib -Dlibperl=libperl.so.5.8.4 -Dd_dosuid -des' hint=recommended, useposix=true, d_sigaction=define usethreads=define use5005threads=undef useithreads=define usemultiplicity=define useperlio=define d_sfio=undef uselargefiles=define usesocks=undef use64bitint=undef use64bitall=undef uselongdouble=undef usemymalloc=n, bincompat5005=undef Compiler: cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64', optimize='-O2', cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBIAN -fno-strict-aliasing -I/usr/local/include' ccversion='', gccversion='3.3.5 (Debian 1:3.3.5-9)', gccosandvers='' intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234 d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12 ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8 alignbytes=4, prototype=define Linker and Libraries: ld='cc', ldflags =' -L/usr/local/lib' libpth=/usr/local/lib /lib /usr/lib libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt perllibs=-ldl -lm -lpthread -lc -lcrypt libc=/lib/libc-2.3.2.so, so=so, useshrplib=true, libperl=libperl.so.5.8.4 gnulibc_version='2.3.2' Dynamic Linking: dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E' cccdlflags='-fPIC', lddlflags='-shared -L/usr/local/lib' Characteristics of this binary (from libperl): Compile-time options: MULTIPLICITY USE_ITHREADS USE_LARGE_FILES PERL_IMPLICIT_CONTEXT Built under linux Compiled at Mar 8 2005 19:51:48 @INC: /etc/perl /usr/local/lib/perl/5.8.4 /usr/local/share/perl/5.8.4 /usr/lib/perl5 /usr/share/perl5 /usr/lib/perl/5.8 /usr/share/perl/5.8 /usr/local/lib/site_perl . raclde01:/usr/local/freeradius/sbin# Thanks in advance. -Roman PS: I searched the list archive and other sources. I found other similar "symbol problems" but I did some tests (tried proposed solutions, etc) and I didn't got success, so I'm not really sure whether the origin of the problem is the same or not... Your help is appreciated. PS2: I also tried to rebuild FR package for Debian (which is currently 1.0.2 on Sarge), adding rlm_perl support (basically --with-experimental-modules). Build is correct but I have similar problems with symbols :-(

1 2

(no subject)
by Marc-Henri Boisis-delavaud 29 Aug '05

29 Aug '05

Hello Were Can I found patches for cisco wlse work ? Marc

1 0

configure free radius server for accepting accounting request packets
by Geraldin Arthy 29 Aug '05

29 Aug '05

Hello Paul Bender or anyone in the list, I am using free radius server for sending accounting request packets and receive accounting response packets.However it displays shared secret is incorrect.With respect to your mail dated Sun, 16 May 2004 17:13:02 -0700 with the topic Freeradius Segmentation Fault on LDAP Bind i see that the free radius server has received and sent back an accounting response to the client.Could you let me know how you configured the free radius server for radius accounting or anyone in the list any idea??Please let me know.............. Regards, --------------------------------- Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather

1 0

usage of exec to get LDAP value..
by haizam 29 Aug '05

29 Aug '05

Dear all, I've configured my radius to load value of timeout based on NAS-Port-Type.. Using LDAP for user's entry.. In LDAP.. user's entry will have additional 2 attributes TimeoutPSTN: 4000 TimeoutISDN: 1000 then in users file.. using exec to run small script to get correct value of sessiontimeout based on NAS-Port-Type DEFAULT NAS-Port-Type == "Sync", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U ISDN}` DEFAULT NAS-Port-Type == "Async", Autz-Type := DIALUP, Auth-Type := DIALUP Session-Timeout = `%{exec:/usr/local/etc/raddb/timeout.pl %U PSTN}` And its works... But my question is there any better way to do this?? Maybe directly get value from LDAP.... thanks.. --haizam

2 4

rlm_attr_filter for proxied accounting packets
by Thor Spruyt 27 Aug '05

27 Aug '05

Hi, I noticed that rlm_attr_filter.c contains the following in the attr_filter_preproxy function: if (request->packet->code != PW_AUTHENTICATION_REQUEST) { return (RLM_MODULE_NOOP); } This means that accounting packets are not handled by this function. Instead, the accounting packets are handled by the attr_filter_accounting function. I have a problem with this, because I'm rewriting attributes with the preproxy_users file. That module's function will change attributes in both proxied authentication requests and proxied accounting requests. Now, for authentication everything works fine: - I don't do any attribute changing in the "authenticate" stage, so everything stays the same here - then we go to the "pre-proxy" stage, where first I use rlm_files for some changing and then rlm_attr_filter to filter some attributes out For accounting however, the following happens: - in the "accounting" stage, rlm_attr_filter filters some attributes out because I don't want them to be sent to the home radius - in the "pre-proxy" stage, rlm_files wants to change some attribute based on another attribute which was filtered out already by rlm_attr_filter in the "accounting" stage - in the "pre-proxy" stage, rlm_attr_filter returns NOOP, since it's coded not to do anything here for accounting packets. To be clear: I think that the pre-proxy functions should always act on both Access-Request and Account-Request packets, the configuration in radiusd.conf should take care if you want to differentiate between the two. Obviously, for post-proxy this would apply too, but the need is not there, since Accounting-Reply packets generally do not contain any attributes, but even then it would be nice to be able to tell the server to filter them our or not. Since rlm_attr_filter should only be used for proxied packets, the attr_filter_accounting function is obsolete, just like the attr_filter_authenticate function was! If you want, I can supply a patch for rlm_attr_filter.c to also accept accounting packets in the attr_filter_preproxy function, just let me know. -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

1 0

more on server certificates
by Ben Thompson 27 Aug '05

27 Aug '05

Hi Has anybody got a digital certificate (with the extended key usage attributes required for PEAP) installed on their FreeRADIUS box that has been signed by a commercial trusted CA? I have come to suspect that this is impossible due to the fact that Verisign are the only company marketing such a product and it can only be installed on a Windows server (as the online purchase system only works if done from the target machine using Internet Explorer and Xenroll). Thanks Ben

2 2