- Freeradius-Users - lists.freeradius.org

Error compiling cvs-snapshot on FreeBSD 5.4-RELEASE
by Valeriy V. Peshkoff 24 Aug '05

24 Aug '05

Hi! I'm still unable to compile CVS version of freeradius on Freebsd Configure it like that ./configure --prefix=/usr/local/radius Only this seems bad to me ..... checking net/if.h usability... no checking net/if.h presence... yes configure: WARNING: net/if.h: present but cannot be compiled configure: WARNING: net/if.h: check for missing prerequisite headers? configure: WARNING: net/if.h: see the Autoconf documentation configure: WARNING: net/if.h: section "Present But Cannot Be Compiled" configure: WARNING: net/if.h: proceeding with the preprocessor's result configure: WARNING: net/if.h: in the future, the compiler will take precedence configure: WARNING: ## ------------------------------------------ ## configure: WARNING: ## Report this to the AC_PACKAGE_NAME lists. ## configure: WARNING: ## ------------------------------------------ ## checking for net/if.h... yes ...... radius1[root]:.../freeradius-snapshot-20050823 # gmake all gmake[1]: Entering directory `/root/freeradius-snapshot-20050823' Making all in libltdl... gmake[2]: Entering directory `/root/freeradius-snapshot-20050823/libltdl' /usr/local/bin/gmake all-am gmake[3]: Entering directory `/root/freeradius-snapshot-20050823/libltdl' /usr/local/bin/bash ./libtool --mode=compile --tag=CC gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -c -o ltdl.lo ltdl.c mkdir .libs gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -c ltdl.c -fPIC -DPIC -o .libs/ltdl.o ltdl.c:119:5: warning: "HAVE_ARGZ_H" is not defined ltdl.c:131:5: warning: "WITH_DMALLOC" is not defined ltdl.c:229:5: warning: "WITH_DMALLOC" is not defined ltdl.c:563:7: warning: "HAVE_ARGZ_APPEND" is not defined ltdl.c:605:7: warning: "HAVE_ARGZ_CREATE_SEP" is not defined ltdl.c:668:7: warning: "HAVE_ARGZ_INSERT" is not defined ltdl.c:725:7: warning: "HAVE_ARGZ_NEXT" is not defined ltdl.c: In function `rpl_argz_next': ltdl.c:752: warning: cast discards qualifiers from pointer target type ltdl.c:770:7: warning: "HAVE_ARGZ_STRINGIFY" is not defined ltdl.c:1057:5: warning: "HAVE_SYS_DL_H" is not defined ltdl.c: At top level: ltdl.c:1104: warning: function declaration isn't a prototype ltdl.c:1119: warning: function declaration isn't a prototype ltdl.c:1135: warning: function declaration isn't a prototype ltdl.c:1165:5: warning: "HAVE_SHL_LOAD" is not defined ltdl.c:1519:5: warning: "HAVE_DLD" is not defined ltdl.c:1587:5: warning: "HAVE_DYLD" is not defined ltdl.c:1948: warning: function declaration isn't a prototype ltdl.c:1967: warning: function declaration isn't a prototype ltdl.c:1989: warning: function declaration isn't a prototype ltdl.c:1997: warning: function declaration isn't a prototype ltdl.c:2035: warning: function declaration isn't a prototype ltdl.c: In function `presym_open': ltdl.c:2067: warning: cast discards qualifiers from pointer target type ltdl.c: At top level: ltdl.c:2085: warning: function declaration isn't a prototype ltdl.c:2095: warning: function declaration isn't a prototype ltdl.c:2214:5: warning: "HAVE_SHL_LOAD" is not defined ltdl.c:2223:5: warning: "HAVE_DLD" is not defined ltdl.c:2226:5: warning: "HAVE_DYLD" is not defined ltdl.c:2455: warning: function declaration isn't a prototype ltdl.c: In function `foreach_dirinpath': ltdl.c:2684: warning: comparison between signed and unsigned ltdl.c:2693: warning: comparison between signed and unsigned ltdl.c: In function `try_dlopen': ltdl.c:3137: warning: comparison between signed and unsigned ltdl.c: In function `lt_dlpath_insertdir': ltdl.c:3989: warning: comparison between signed and unsigned ltdl.c: In function `lt_dlinsertsearchdir': ltdl.c:4051: warning: cast discards qualifiers from pointer target type ltdl.c: At top level: ltdl.c:2769: warning: unused parameter 'ignored' ltdl.c:1135: warning: unused parameter 'loader_data' ltdl.c:1119: warning: unused parameter 'loader_data' ltdl.c:1104: warning: unused parameter 'loader_data' ltdl.c:1989: warning: unused parameter 'loader_data' ltdl.c:2095: warning: unused parameter 'loader_data' ltdl.c:2085: warning: unused parameter 'loader_data' ltdl.c:2035: warning: unused parameter 'loader_data' ltdl.c:1948: warning: unused parameter 'loader_data' gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -c ltdl.c -o ltdl.o >/dev/null 2>&1 /usr/local/bin/bash ./libtool --mode=link --tag=CC gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -o libltdl.la -rpath /usr/local/radius//lib -no-undefined -version-info 4:0:1 ltdl.lo -lcrypto -lpthread gcc -shared .libs/ltdl.o -lcrypto -lpthread -Wl,-soname -Wl,libltdl.so.4 -o .libs/libltdl.so.4 (cd .libs && rm -f libltdl.so && ln -s libltdl.so.4 libltdl.so) (cd .libs && rm -f libltdl.so && ln -s libltdl.so.4 libltdl.so) ar cru .libs/libltdl.a ltdl.o ranlib .libs/libltdl.a creating libltdl.la (cd .libs && rm -f libltdl.la && ln -s ../libltdl.la libltdl.la) gmake[3]: Leaving directory `/root/freeradius-snapshot-20050823/libltdl' gmake[2]: Leaving directory `/root/freeradius-snapshot-20050823/libltdl' Making all in src... gmake[2]: Entering directory `/root/freeradius-snapshot-20050823/src' gmake[3]: Entering directory `/root/freeradius-snapshot-20050823/src' Making all in include... gmake[4]: Entering directory `/root/freeradius-snapshot-20050823/src/include' gmake[4]: Цель `all' не требует выполнения команд. gmake[4]: Leaving directory `/root/freeradius-snapshot-20050823/src/include' Making all in lib... gmake[4]: Entering directory `/root/freeradius-snapshot-20050823/src/lib' /root/freeradius-snapshot-20050823/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LIBRADIUS -I../include -DHMAC_SHA1_DATA_PROBLEMS -c dict.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LIBRADIUS -I../include -DHMAC_SHA1_DATA_PROBLEMS -c dict.c -fPIC -DPIC -o .libs/dict.o In file included from ../include/libradius.h:38, from dict.c:42: /usr/include/sys/socket.h:243: error: redefinition of `struct sockaddr_storage' dict.c: In function `dict_stat_free': dict.c:113: warning: passing arg 1 of `free' discards qualifiers from pointer target type dict.c:115: warning: passing arg 1 of `free' discards qualifiers from pointer target type dict.c:125: warning: passing arg 1 of `free' discards qualifiers from pointer target type dict.c: In function `dict_attrbyname': dict.c:1155: warning: comparison between signed and unsigned gmake[4]: *** [dict.lo] Ошибка 1 gmake[4]: Leaving directory `/root/freeradius-snapshot-20050823/src/lib' gmake[3]: *** [common] Ошибка 2 gmake[3]: Leaving directory `/root/freeradius-snapshot-20050823/src' gmake[2]: *** [all] Ошибка 2 gmake[2]: Leaving directory `/root/freeradius-snapshot-20050823/src' gmake[1]: *** [common] Ошибка 2 gmake[1]: Leaving directory `/root/freeradius-snapshot-20050823' gmake: *** [all] Ошибка 2 radius1[root]:.../freeradius-snapshot-20050823 # -- Russia, St. Petersburg Quantum Communications Valeriy V. Peshkov | simps(a)quantum.ru +7 (812) 327-6131 +7 (812) 327-1442

2 4

AW: Mobile phone authentification
by Marc.Schlueter＠comneon.com 24 Aug '05

24 Aug '05

Well, thank you for the correction. Actually a radius server IS involved in authentication process of mobile terminals, no operator could live without it. Nevertheless after further investigation I found out that a radius server wouldn't help me in my scenario without a connection to the operators network (the relevant entity is called GGSN). marc -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Dienstag, 23. August 2005 20:03 An: FreeRadius users mailing list Betreff: Re: Mobile phone authentification <Marc.Schlueter(a)comneon.com> wrote: > I'd like to use FREERADIUS as an authentification method for mobile > phones, but I'm not sure First, it's not "authentification", it's "authentication", without an "f". > Now I was told that RADIUS is the solution. RADIUS is able to detect > the actual sender information and delivers this information to the > proxy/gateway which is then able to insert the missing value into the > sender-header and everybody's happy ;) > > Someone was able to follow my thoughts? Nope. RADIUS doesn't "detect sender information". I'm not sure you understand what RADIUS does. It's just authentication and accounting, for the most part. It doesn't appear to be involved at all in the scenario you described. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Acct-Session-Id too long
by Rohaizam Abu Bakar 24 Aug '05

24 Aug '05

Dear all, FreeRADIUS 1.0.4 I'm using mysql to store accounting...especially to check simultaneous-use.. but one case as below, i received a long "Acct-Session-Id" ... and cannot fit into mysql... and problem to update Stop record... should I change column size from char32 to reasonable value ? pls advise.. thanks.. Acct-Session-Id = "erx atm 2/3.10601218:60.1218:0165889995" +--------------+----------------------------------+------------------+---------------------+-------------+ | nasipaddress | AcctSessionId | AcctUniqueId | acctstoptime | nasporttype | +--------------+----------------------------------+------------------+---------------------+-------------+ | 61.6.191.247 | erx atm 2/3.10601218:60.1218:016 | ebe88dbb3457c826 | 2005-08-22 10:32:52 | xDSL |

4 3

matching accounting packets in the acct_users file
by Tariq Rashid 24 Aug '05

24 Aug '05

i would like to filter off interim accoutning packets from specific domains to a different proxy target - as follows... # interim/status/alive accounting records are actually sent to the processing domain DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Acct-Status-Type == Alive, Proxy-To-Realm := "filterradius" # following is used to map subdomains of *.easynet.co.uk # to be proxied according to the realm easynet.co.uk DEFAULT User-Name =~ "@.*\.abc\.co\.uk$", Proxy-To-Realm := "abc.co.uk" however, the first rule is never matched when i send packets with the following attributes: Attributes: Acct-Status-Type = Alive, User-Name = "test(a)xyz.abc.co.uk" do i have the syntax wrong? tariq

1 0

Re: Windows Client Authentification bevore Domain logon
by Steven Atkinson 24 Aug '05

24 Aug '05

At 12:49 23/08/05, you wrote: >Hi, thanks for your email! > >Ok, i tried it out but i have some problems. If i use the DWORT String you >sent me it has no efekkt. I found an other DWORT Key which Sounds >"AuthMode" and with this DWORT he only tries to authentificate with the >machine account. Maybe you have made a typing mistake in your email?? Whoops - You are right it was a typing mistake, it is AuthMode. >Ok, but my problem ist, that when he tries to authentificate with the >Computer Account i see in the radius debugging modse that he only tried to >use the default entry in the user File and not the "Client3" Entry. It >seems that he does not find the right Computer Certificate or the >Freeradius does not find the Right Entry in his user File??? I am new to freeRADIUS myself in order to get my system working I followed the instructions in these web pages, http://www.linuxjournal.com/article/8017, http://www.linuxjournal.com/article/8095, http://www.linuxjournal.com/article/8151. It does look like a certificates problem, but then I am very new to FreeRADIUS and I spent a considerable amount of time adjusting settings to make it work. >This is the output from Freeradius -X -A when the DWORT "AuthMode" is set >to 2 > > > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file! : /etc/freeradius/proxy.conf >Config: including file: /etc/freeradius/clients.conf >Config: including file: /etc/freeradius/snmp.conf >Config: including file: /etc/freeradius/eap.conf >Config: including file: /etc/freeradius/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/freeradius" > main: libdir = "/usr/lib/freeradius" > main: radacctdir = "/var/log/freeradius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/freeradius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/! run/freeradius/freeradius.pid" > main: user = "freerad" >&nbs >p;main: group = "freerad" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library ! search path is /usr/lib/freeradius >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > ! ;unix: shadow = "/etc/shadow" > unix: group = "(null)" > ;unix: radwtmp = "/var/log/freeradius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/ssl/certs/8021x-server.pem" > tls: certificate_file = "/etc/ssl/certs/8021x-server.pem" > tls: CA_file = "/etc/ssl/certs/root.pem" > tls: private_key_pa! ssword = "whatever" > tls: dh_file = "/etc/ssl/certs/dh" > tls: random_file = "/etc/ssl/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" >rlm_eap: Loaded and initialized type tls > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess > preprocess: huntgroups = "/etc/freeradius/huntgroups" > preprocess: hints = "/etc/freeradius/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no realm: ignore_null = no >Module: Instantiated realm (suffix ) >Module: Loaded files > files: usersfile = "/etc/freeradius/users" > files: acctusersfile = "/etc/freeradius/acct_users" > files: preproxy_usersfile = "/etc/freeradius/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = > "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/var/log/freeradius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: ca! llerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Listening on proxy *:1814 >Ready to process requests. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=103, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0x8e013b02cf39c8b291f8a9d790f3bd6a > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x02ff001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > &nbs! >p; rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Cli ent3", looking >up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 255 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 0 >modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: ! Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 >modcall: group authenticate returns handled for request 0 >Sending Access-Challenge of id 103 to 10.40.0.254:1024 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > EAP-Message = 0x010000060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x1814a65439afaa74487aa379af48ead9 >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 6 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 103 with timestamp 430b0c7e >Nothing to do. Sleeping until we see a request. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=104, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0xe3868d2! de84c592e7e54eb355b23752f > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x0201001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Client3", looking > up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry DEFAULT at li! ne 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 1 >modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 1 > > Fallibroome High School Priory Lane Macclesfield Cheshire SK10 4AF

1 0

freeradius + MySQL not working after upgrade from 1.0.1
by marc-ml＠neoharmonix.net 24 Aug '05

24 Aug '05

Hello. I have encountered a problem upon upgrading from freeradius version 1.0.1. I'm using the sql module (rlm_sql_mysql) for authorization and accounting of dialup users (reselling dialup from several networks). After upgrading to 1.0.2 with the same configuration, it no longer works. >From the logs I see that authorization works: Login OK: [xxxx(a)xxxxx.com] (from client xxxxxxxx port 15) and it sends "Access-Accept" but the connecting dialup user can't connect. I now have two servers with the same freeradius configuration (minus minor changes from the upgrade) and the same MySQL database with one running version 1.0.1 (which works) and the other running 1.0.4 (which does not work). Comparing the logs produced by "radiusd -X", I see that the only substantial difference is the X-Ascend-Data-Filter Attributes which look something like this: WORKING VERSION 1.0.1: Sending Access-Accept of id 158 to 216.126.136.243:1814 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 Filter-Id = "data6330_1" Proxy-State = 0x3532 X-Ascend-Data-Filter += "ip in forward tcp est" X-Ascend-Data-Filter += "ip in forward dstip 200.100.100.10/32 0" X-Ascend-Data-Filter += "ip in forward dstip 66.55.44.0/24 0" X-Ascend-Data-Filter += "ip in forward dstip 66.44.55.0/24 0" X-Ascend-Data-Filter += "ip in drop tcp dstport = 25" X-Ascend-Data-Filter += "ip in forward 0" Finished request 0 Going to the next request NON-WORKING VERSION 1.0.4: Sending Access-Accept of id 154 to 216.126.136.243:1814 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Port-Limit = 1 Idle-Timeout = 600 Session-Timeout = 28800 X-Ascend-Data-Filter += 0x697020696e20666f72776172642074637020657374 X-Ascend-Data-Filter += 0x697020696e20666f7277617264206473746970203230392e3130322e3130372e37372f33322030 X-Ascend-Data-Filter += 0x697020696e20666f72776172642064737469702036342e32342e33352e302f32342030 X-Ascend-Data-Filter += 0x697020696e20666f72776172642064737469702036362e34352e3234332e302f32342030 X-Ascend-Data-Filter += 0x697020696e2064726f702074637020647374706f7274203d203235 X-Ascend-Data-Filter += 0x697020696e20666f72776172642030 Filter-Id = "data6330_1" Proxy-State = 0x3234 Finished request 3 Going to the next request The working version proceeds to do accounting sometime after sending that while the other version stops there. I suspect those long strings are the culprit since everything else in the logs looks the same. The attributes come from the database and they look fine there. Any ideas how I can get the previous behavior or get the newer versions to work? Or maybe the problem is something else? Thanks, Marc

4 6

freeradius.net problem with reathentication
by Liaqat, Touseef 24 Aug '05

24 Aug '05

Hi All, I am using freeradius.net-1.0.2-r0.0.8.exe for windows which I downloaded from freeradius.net. I apologize if this distribution is not relevant to this mailing list. when testing I am getting some problem with authentication. Server authenticate the client but after one successful re-authentication it is denying next two re-authentications and then after those two , it is accepting two re-authentications and goes on with this pattern. I hope you understand what I am talking. This problem is very different then any other problem we faced related to radius server and we have never encountered this problem with freeradius with BSD. I have attached the debug log output of freeradius server for you comments. Please help me solving this problem. Thanks, Touseef Liaqat

1 0

Example of Mac OS X EAP-TLS process?
by Landon Cox 23 Aug '05

23 Aug '05

I've got a good, working FreeRadius running EAP-TLS on a SuSE 9.2 box. I've had good luck with WPA supplicants for XP SP2 and several vendor PCMCIA card supplicants - all on XP SP2. I've been trying to get an OS X (Tiger) machine up with the same type of setup, but each time I set the 802.1x "TLS" check box, I always get an error stating that there is no valid certificate available on the machine. I've imported both the client and root CA certs into the Mac OS X Keychain (the root CA imported into X509 anchors category and the client cert into 'logins'.) I've generated the Mac client cert in the same way as I do the XP client cert except without the xpextensions ASN.1 options on openSSL. I realize this isn't a FreeRadius question per-se but was hoping that someone else in FR land has done an 802.1x EAP-TLS setup on OS X w/FR and had success. Thank you, Landon

1 0

Mobile phone authentification
by Marc.Schlueter＠comneon.com 23 Aug '05

23 Aug '05

Hi all, I'd like to use FREERADIUS as an authentification method for mobile phones, but I'm not sure A) if this is possible and B) how to configure as I'm a newbie. Please find following scenario: A mobile phone user would like to access my server behind the proxy/gateway by using a gprs connection of an official provider (e.g. vodafone). Currently the mobile phone builds up a gprs connection to the providers network and send a get.request to the server through the proxy/gateway. My proxy/gateway simply forwards the request to the server but can not authentificate it. Especially authentification gets important for the application called "MMS-Multimedia Messaging Service". In this case the client POSTs a message, but leaves the sender-header in the message empty (=asks the network to insert the proper information). Then my proxy/gateway can not insert the proper information, but the server which has to process this request requires the sender-header to perform billing actions for example. Now I was told that RADIUS is the solution. RADIUS is able to detect the actual sender information and delivers this information to the proxy/gateway which is then able to insert the missing value into the sender-header and everybody's happy ;) Someone was able to follow my thoughts? What's currently available? A proxy/gateway, mobile-phones, GPRS-connectivity and a RedHat machine for freeradius. What's needed? Some support in configurating freeradius. Comments are really welcome, Rgds. Marc

2 1

ldap_connections_number
by Benedikt Panzer 23 Aug '05

23 Aug '05

Hello, it seems to me the FR doesn't open as many connections as in ldap_connections_number specified. Even tough there are many RADIUS requests in the queue (they have to be) and I allowed 50 connections to the ldap server FR opens justs 1 or 2. Why? That wouldn't bother me usually. But my ldap server delays responses when the password was wrong. And because FR uses only so few parallel connections also those requests with correct passwords are affected and delayed. That's why I'd really apreciate if FR used more connections. Is there a chance? Thanks a lot, Benedikt -- Benedikt Panzer Rechenzentrum Universität Stuttgart

2 1