- Freeradius-Users - lists.freeradius.org

IPTABLES - continued
by Shaun Rossi 23 Jul '05

23 Jul '05

After posting, I realized I should have elaborated more. I would like to have this FreeRadius box on the Internet so a few of my NAS devices can access it no matter where they are. I understand port 1812 and 1813 udp must be opened. I am looking for some example IPTABLES (fedora core) entries that would enable UDP access to FreeRadius. Thanks again, -Shaun

3 2

freeradius and MySQL 4.1.12-1
by d.wintgens＠sita.be 23 Jul '05

23 Jul '05

Hi, I have a Suse 9.2 server with the 64-bits 4.1.12-1 MySQL version (I need the MySQL 4.1 database for another applications). I want to have a radius server on this server. The freeradius-1.0.0-5.5.x86_64.rpm package is installed and the radius database is created and filled correctly. The radius configuration files are OK to ask sql before files. The database server/login/password/radius_db are set in the sql.conf file. When I make a test with radtest, I can see in the radius log : Wed Jul 20 16:25:37 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Jul 20 16:25:37 2005 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Jul 20 16:25:37 2005 : Info: rlm_sql (sql): Attempting to connect to root@localhost:/radius Wed Jul 20 16:25:37 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Jul 20 16:25:37 2005 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius Wed Jul 20 16:25:37 2005 : Error: rlm_sql_mysql: Mysql error 'Client does not support authentication protocol requested by server; consider upgrading MySQL client' Wed Jul 20 16:25:37 2005 : Error: rlm_sql (sql): Failed to connect DB handle #0 Wed Jul 20 16:25:37 2005 : Info: Ready to process requests. I think that's typically the error occured if a 4.0.x client try to connect a 4.1.x database with the 4.0 protocol. My question : How update the MySQL client version of freeradius to 4.1 protocol ? Thanks in advance, Didier Wintgens E-mail : d.wintgens(a)sita.be

3 2

multiple peap authentication source?
by tbsky＠annsky.us 23 Jul '05

23 Jul '05

hi: i try to setup wireless wpa + freeradius. i use eap-peap-mschapv2, and it was success. i can authenticate users via "users" file and i can authenticate users via winbind+windows 2000 ad server. the next step i want to do is mix both "users" and "windows 2000 ad" as authentication source, but i don't know how to do it. i try to create two "mschap" modules, "mschap-1" and "mschap-2". but i found that the "mschapv2" module internally look at the module named "mschap", so the two modules i create are useless. can i creat a redundant moudle name "mschap" which include two mschap modules? or is there better way doing this? thanks for help!!! Best Regards, tbsky

3 7

IPTABLES
by Shaun Rossi 23 Jul '05

23 Jul '05

Hello everyone, I'm new to FreeRadius, and I've been 'playing' with it for a few days. I am wondering what most people are using for the configuration of IPTABLES in etc/sysconfig/iptables using Fedora Core 3. I will likely post a few more items I am experiencing difficulty with separately shortly. Thank you for any help you can offer. -Shaun Rossi

1 0

Debian and 'module "eap" returns noop for request'
by Kris Benson 22 Jul '05

22 Jul '05

Hi all, I'm currently in the process of trying to get a D-Link DWL-2100AP and a DWL-7000AP to authenticate off FreeRadius, but FreeRadius doesn't seem to be too keen on talking EAP to them. I have self-compiled the EAP module on Debian due to the binary distribution restrictions, and the error I'm getting is: module "eap" returns noop for request [number] for every time a Windows XP SP2 client tries to connect. The Windows Hotfix is now only available by request, so I haven't been able to try that to see if it solves the problem. If someone has it, please e-mail it to me! :-) I'm not sure if this is a Windows issue or a FreeRadius issue at this point -- the "noop" seems odd, but perhaps it's what is being sent that is causing it. If someone could offer some suggestions, it would be greatly appreciated. Kindest regards, -kb -- Kris Benson, CCP, I.S.P. Technical Analyst, District Projects School District #57 (Prince George)

2 4

LDAP and FreeRadius Authentication - One user, multiple groups
by Mark Litchfield 22 Jul '05

22 Jul '05

Using: FreeRadius 1.0.4 OpenLDAP 2.2.27 FreeBSD 5.4 We are trying to get FreeBSD to allow a user to be a member in multiple groups. Here's roughly the way we have the tree laid out. dc: treeroot |_ou: accounts | |_ou: domain1 | | |_uid: joe | | mail: joe@domain1 | |_ou: domain2 | |_uid: joe | mail: joe@domain2 |_ou: groups |_cn: group1 | uniqueMember: uid=joe,ou=domain1,ou=accounts,dc=treeroot |_cn: group2 | uniqueMember: uid=joe,ou=domain2,ou=accounts,dc=treeroot |_cn: group3 | uniqueMember: uid=joe,ou=domain1,ou=accounts,dc=treeroot |_uniqueMember: uid=joe,ou=domain2,ou=accounts,dc=treeroot I have freeradius and LDAP authenticating nicely. The problem I am running into is that when I id a user, it only shows the primary group that user is a member of. How can I get FreeRadius to report the other groups that the user belongs to? Mark Litchfield

2 1

IPPools + Proxies
by Joshua Coombs 22 Jul '05

22 Jul '05

I'm trying to use ippools defined within radius for users in a specific domain that I proxy auth for. On the main radius server I have: --- radiusd.conf: modules { ippool pool1 { name = pool1 range-start = 192.168.1.64 range-stop = 192.168.1.67 netmask = 255.255.255.255 cache-size = 4 session-db = ${raddbdir}/pool1.ippool ip-index = ${raddbdir}/pool1.ipindex override = yes } } accounting { detail pool1 } post-auth { pool1 } --- attrs: test.net Pool-Name := pool1, Fall-Through := No --- proxy.conf: realm test.net { type = radius authhost = radius1.test.net:1812 accthost = radius1.test.net:1813 secret = 321contact nostrip } The remote radius server is running FreeRadius as well, and just doing simple unix passwd backed auth. So far, I can't get the local server to apply the pool definition for this realm. What am I forgetting? Joshua Coombs

2 1

AW: freeRadius CVS make install problem
by Metz, Frederic 22 Jul '05

22 Jul '05

Hi, I tried it but there's another problem when I run make after "configure --disable-shared": (It's an actual CVS up from this morning 9am) extracting global C symbols from `../modules/rlm_eap/types/rlm_eap_peap/.libs/rlm_eap_peap.a' extracting global C symbols from `../modules/rlm_eap/types/rlm_eap_mschapv2/.libs/rlm_eap_mschapv2.a' extracting global C symbols from `../modules/rlm_eap/types/rlm_eap_gtc/.libs/rlm_eap_gtc.a' extracting global C symbols from `../modules/rlm_sql/drivers/rlm_sql_mysql/.libs/rlm_sql_mysql.a' (cd .libs && gcc -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../include -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"1.1.0-pre0\" -o radiusd radiusd.o files.o util.o acct.o nas.o log.o valuepair.o version.o proxy.o exec.o auth.o conffile.o modules.o modcall.o session.o xlat.o threads.o smux.o radius_snmp.o client.o request_list.o mainconfig.o listen.o request_process.o -Wl,--export-dynamic ../modules/rlm_acct_unique/.libs/rlm_acct_unique.a ../modules/rlm_always/.libs/rlm_always.a ../modules/rlm_attr_filter/.libs/rlm_attr_filter.a ../modules/rlm_attr_rewrite/.libs/rlm_attr_rewrite.a ../modules/rlm_chap/.libs/rlm_chap.a ../modules/rlm_checkval/.libs/rlm_checkval.a ../modules/rlm_copy_packet/.libs/rlm_copy_packet.a ../modules/rlm_detail/.l! ibs/rlm_detail.a ../modules/rlm_digest/.libs/rlm_digest.a ../modules/rlm_eap/.libs/rlm_eap.a ../modules/rlm_exec/.libs/rlm_exec.a ../modules/rlm_expiration/.libs/rlm_expiration.a ../modules/rlm_expr/.libs/rlm_expr.a ../modules/rlm_fastusers/.libs/rlm_fastusers.a ../modules/rlm_files/.libs/rlm_files.a ../modules/rlm_logintime/.libs/rlm_logintime.a ../modules/rlm_mschap/.libs/rlm_mschap.a ../modules/rlm_ns_mta_md5/.libs/rlm_ns_mta_md5.a ../modules/rlm_otp/.libs/rlm_otp.a ../modules/rlm_pap/.libs/rlm_pap.a ../modules/rlm_passwd/.libs/rlm_passwd.a ../modules/rlm_preprocess/.libs/rlm_preprocess.a ../modules/rlm_radutmp/.libs/rlm_radutmp.a ../modules/rlm_realm/.libs/rlm_realm.a ../modules/rlm_sql/.libs/rlm_sql.a ../modules/rlm_sql_log/.libs/rlm_sql_log.a -lc ../modules/rlm_unix/.libs/rlm_unix.a ../modules/rlm_eap/types/rlm_eap_md5/.libs/rlm_eap_md5.a ../modules/rlm_eap/types/rlm_eap_leap/.libs/rlm_eap_leap.a ../modules/rlm_eap/types/rlm_eap_tls/.libs/rlm_eap_tls.a ../modules/rlm_! eap/types/rlm_eap_ttls/.libs/rlm_eap_ttls.a -L/home/fmetz/freeradius/s rc/modules/rlm_eap/libeap ../modules/rlm_eap/types/rlm_eap_sim/.libs/rlm_eap_sim.a ../modules/rlm_eap/types/rlm_eap_peap/.libs/rlm_eap_peap.a /home/fmetz/freeradius/src/modules/rlm_eap/types/rlm_eap_tls/.libs/rlm_eap_tls.a /home/fmetz/freeradius/src/modules/rlm_eap/libeap/.libs/libeap.a ../modules/rlm_eap/types/rlm_eap_mschapv2/.libs/rlm_eap_mschapv2.a ../modules/rlm_eap/types/rlm_eap_gtc/.libs/rlm_eap_gtc.a ../modules/rlm_sql/drivers/rlm_sql_mysql/.libs/rlm_sql_mysql.a -L/usr/lib /usr/lib/libmysqlclient.a -lz -lm -L/home/fmetz/freeradius/src/lib /home/fmetz/freeradius/src/lib/.libs/libradius.a /home/fmetz/freeradius/libltdl/.libs/libltdl.a -ldl -lnsl -lresolv -lpthread -lcrypt -lssl -lcrypto mainconfig.o(.text+0x630): In function `switch_users': /home/fmetz/freeradius/src/main/mainconfig.c:541: warning: Using 'initgroups' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking mainconfig.o(.text+0x597):/home/fmetz/freeradius/src/main/mainconfig.c:507: warning: Using 'getgrnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking mainconfig.o(.text+0x54b): In function `radlogdir_iswritable': /home/fmetz/freeradius/src/main/mainconfig.c:486: warning: Using 'getpwnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking listen.o(.text+0x1e0f): In function `listen_bind': /home/fmetz/freeradius/src/main/listen.c:1536: warning: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /home/fmetz/freeradius/libltdl/.libs/libltdl.a(ltdl.o)(.text+0x3a9): In function `sys_dl_open': /home/fmetz/freeradius/libltdl/ltdl.c:1107: warning: Using 'dlopen' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/libpthread.a(lockfile.o)(.text+0x0): In function `__flockfile': /home/drow/debian-glibc/glibc-2.3.2.ds1/build-tree/glibc-2.3.2/linuxthreads/lockfile.c:28: multiple definition of `__flockfile' /usr/lib/libc.a(flockfile.o)(.text+0x0): first defined here /usr/bin/ld: Warning: size of symbol `__flockfile' changed from 34 in /usr/lib/libc.a(flockfile.o) to 18 in /usr/lib/libc.a(flockfile.o) /usr/lib/libpthread.a(lockfile.o)(.text+0x0): In function `__flockfile': /home/drow/debian-glibc/glibc-2.3.2.ds1/build-tree/glibc-2.3.2/linuxthreads/lockfile.c:28: multiple definition of `_IO_flockfile' /usr/lib/libc.a(flockfile.o)(.text+0x0): first defined here /usr/bin/ld: Warning: size of symbol `_IO_flockfile' changed from 34 in /usr/lib/libc.a(flockfile.o) to 18 in /usr/lib/libc.a(flockfile.o) /usr/lib/libpthread.a(lockfile.o)(.text+0x20): In function `__funlockfile': /home/drow/debian-glibc/glibc-2.3.2.ds1/build-tree/glibc-2.3.2/linuxthreads/lockfile.c:38: multiple definition of `__funlockfile' /usr/lib/libc.a(funlockfile.o)(.text+0x0): first defined here /usr/bin/ld: Warning: size of symbol `__funlockfile' changed from 34 in /usr/lib/libc.a(funlockfile.o) to 18 in /usr/lib/libc.a(funlockfile.o) /usr/lib/libpthread.a(lockfile.o)(.text+0x20): In function `__funlockfile': /home/drow/debian-glibc/glibc-2.3.2.ds1/build-tree/glibc-2.3.2/linuxthreads/lockfile.c:38: multiple definition of `_IO_funlockfile' /usr/lib/libc.a(funlockfile.o)(.text+0x0): first defined here /usr/bin/ld: Warning: size of symbol `_IO_funlockfile' changed from 34 in /usr/lib/libc.a(funlockfile.o) to 18 in /usr/lib/libc.a(funlockfile.o) /usr/lib/libmysqlclient.a(libmysql.o)(.text+0x2a8f): In function `read_user_name': : warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/libmysqlclient.a(mf_pack.o)(.text+0x848): In function `expand_tilde': : warning: Using 'endpwent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /home/fmetz/freeradius/src/lib/.libs/libradius.a(misc.o)(.text+0x50f): In function `ip_hton': /home/fmetz/freeradius/src/lib/misc.c:578: warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking ../modules/rlm_unix/.libs/rlm_unix.a(rlm_unix.o)(.text+0x26f): In function `unix_getpw': /home/fmetz/freeradius/src/modules/rlm_unix/rlm_unix.c:254: warning: Using 'getspnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /home/fmetz/freeradius/src/lib/.libs/libradius.a(misc.o)(.text+0x6b): In function `ip_hostname': /home/fmetz/freeradius/src/lib/misc.c:75: warning: Using 'gethostbyaddr_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/libmysqlclient.a(my_gethostbyname.o)(.text+0x30): In function `my_gethostbyname_r': : warning: Using 'gethostbyname_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Fehler 1 make[4]: Leaving directory `/home/fmetz/freeradius/src/main' make[3]: *** [common] Fehler 2 make[3]: Leaving directory `/home/fmetz/freeradius/src' make[2]: *** [all] Fehler 2 make[2]: Leaving directory `/home/fmetz/freeradius/src' make[1]: *** [common] Fehler 2 make[1]: Leaving directory `/home/fmetz/freeradius' make: *** [all] Fehler 2 Sorry for so much context and for the german "Fehler" which means "error", I'm sure you know. Thanks in advance. Frederic -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Donnerstag, 21. Juli 2005 19:20 An: FreeRadius users mailing list Betreff: Re: freeRadius CVS make install problem "Metz, Frederic" <Frederic.Metz(a)t-com.net> wrote: > sorry for that but I have a simple question about the make > install. It throws an error in linking or s.th. like that, see > below. I am not familiar with building shared object files so could > you please help me. $ configure --disable-shared $ make $ make install Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Possible? Same client with separate secrets for service separatio n?
by Burrill, Jim 22 Jul '05

22 Jul '05

We have a large number of users in an ldap database and we have successfully connected freeradius with it. We have also been able to connect a specific client ip address to a specific LDAP group to allow or disallow access to a specific device based on group membership. What we have found is that in the case of PIX it tends to be all or nothing. If one can authenticate thru the firewall for vpn purposes, they can also authenticate by ssh for admin purposes. Is it possible to configure a cisco Pix with separate radius definitions and auth against Freeradius using separate secrets so you can separate to specific groups? We've attempted it and it seems to find the first client on the list and ignores the second. Any Ideas? The PIX unfortunalty does not give any indication of type of connection thru NAS-Port (on pix this is just a session number). Only hope of separation it appears is thru calling-station-id, but that appears to be a real messy way. Below is a sample of what we've be attempting to do. Thanks for any assistance! Cisco Pix 6.3 Firewall ------------------ Pertinent pix configuration items ------------------ aaa-server RADIUS protocol radius aaa-server RADIUS (inside) host 192.168.1.10 secret1 timeout 10 aaa-server RADIUSVPN protocol radius aaa-server RADIUSVPN (inside) host 192.168.1.10 secret2 timeout 10 aaa authentication ssh console RADIUS LOCAL crypto map outside_map client authentication RADIUSVPN ------------------ clients.conf ------------------ client 192.168.1.20 { secret = secret1 shortname = pixssh nastype = Cisco } client 192.168.1.20 { secret = secret2 shortname = pixvpn nastype = Cisco }

2 1

Re: Multiple Root Contexts
by Mearl Danner 22 Jul '05

22 Jul '05

Might try downloading this and reading. It's very helpful. http://www.novell.com/documentation/edir_radius/pdfdoc/radadmin/radadmin.pdf If that's 3 separate "o=" at the root of the tree, the this from the above document. Example for Creating Multiple Instances of LDAP Module If you want multiple search bases, you can create multiple LDAP modules, by using the following syntax in the module section of the radiusd.conf. modules { ........... ........... ldap ldap1 { attribute = value attribute = value ............... ............... } ldap ldap2 { attribute = value attribute = value ............... ............... } ldap ldap3 { attribute = value attribute = value ............... ............... } } You can use the configured modules in authorize, authenticate and post-authenticate sections by specifying the module name and instance name. For example: authorize{ ..... ..... ldap ldap1 ldap ldap2 ..... ..... } >>> <jp(a)joshmp.com> 7/20/2005 9:51 AM >>> Here is my setup: FreeBSD 4.11 server with FreeRADIUS 1.0.4 authorizing/authenticating users in an eDirectory Tree on a NetWare 6.5 server. My issue: There are three root contexts in the tree. If I set the basedn to context1, I can successfully authorize/authenticate users in context1, but I need FreeRADIUS to search all three contexts for users, and I can't figure out a way to add all three as a basedn at the same time. Thanks in advance, Josh

2 1