- Freeradius-Users - lists.freeradius.org

Debian and 'module "eap" returns noop for request'
by Kris Benson 22 Jul '05

22 Jul '05

Hi all, I'm currently in the process of trying to get a D-Link DWL-2100AP and a DWL-7000AP to authenticate off FreeRadius, but FreeRadius doesn't seem to be too keen on talking EAP to them. I have self-compiled the EAP module on Debian due to the binary distribution restrictions, and the error I'm getting is: module "eap" returns noop for request [number] for every time a Windows XP SP2 client tries to connect. The Windows Hotfix is now only available by request, so I haven't been able to try that to see if it solves the problem. If someone has it, please e-mail it to me! :-) I'm not sure if this is a Windows issue or a FreeRadius issue at this point -- the "noop" seems odd, but perhaps it's what is being sent that is causing it. If someone could offer some suggestions, it would be greatly appreciated. Kindest regards, -kb -- Kris Benson, CCP, I.S.P. Technical Analyst, District Projects School District #57 (Prince George)

2 4

LDAP and FreeRadius Authentication - One user, multiple groups
by Mark Litchfield 22 Jul '05

22 Jul '05

Using: FreeRadius 1.0.4 OpenLDAP 2.2.27 FreeBSD 5.4 We are trying to get FreeBSD to allow a user to be a member in multiple groups. Here's roughly the way we have the tree laid out. dc: treeroot |_ou: accounts | |_ou: domain1 | | |_uid: joe | | mail: joe@domain1 | |_ou: domain2 | |_uid: joe | mail: joe@domain2 |_ou: groups |_cn: group1 | uniqueMember: uid=joe,ou=domain1,ou=accounts,dc=treeroot |_cn: group2 | uniqueMember: uid=joe,ou=domain2,ou=accounts,dc=treeroot |_cn: group3 | uniqueMember: uid=joe,ou=domain1,ou=accounts,dc=treeroot |_uniqueMember: uid=joe,ou=domain2,ou=accounts,dc=treeroot I have freeradius and LDAP authenticating nicely. The problem I am running into is that when I id a user, it only shows the primary group that user is a member of. How can I get FreeRadius to report the other groups that the user belongs to? Mark Litchfield

2 1

IPPools + Proxies
by Joshua Coombs 22 Jul '05

22 Jul '05

I'm trying to use ippools defined within radius for users in a specific domain that I proxy auth for. On the main radius server I have: --- radiusd.conf: modules { ippool pool1 { name = pool1 range-start = 192.168.1.64 range-stop = 192.168.1.67 netmask = 255.255.255.255 cache-size = 4 session-db = ${raddbdir}/pool1.ippool ip-index = ${raddbdir}/pool1.ipindex override = yes } } accounting { detail pool1 } post-auth { pool1 } --- attrs: test.net Pool-Name := pool1, Fall-Through := No --- proxy.conf: realm test.net { type = radius authhost = radius1.test.net:1812 accthost = radius1.test.net:1813 secret = 321contact nostrip } The remote radius server is running FreeRadius as well, and just doing simple unix passwd backed auth. So far, I can't get the local server to apply the pool definition for this realm. What am I forgetting? Joshua Coombs

2 1

AW: freeRadius CVS make install problem
by Metz, Frederic 22 Jul '05

22 Jul '05

Hi, I tried it but there's another problem when I run make after "configure --disable-shared": (It's an actual CVS up from this morning 9am) extracting global C symbols from `../modules/rlm_eap/types/rlm_eap_peap/.libs/rlm_eap_peap.a' extracting global C symbols from `../modules/rlm_eap/types/rlm_eap_mschapv2/.libs/rlm_eap_mschapv2.a' extracting global C symbols from `../modules/rlm_eap/types/rlm_eap_gtc/.libs/rlm_eap_gtc.a' extracting global C symbols from `../modules/rlm_sql/drivers/rlm_sql_mysql/.libs/rlm_sql_mysql.a' (cd .libs && gcc -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../include -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"1.1.0-pre0\" -o radiusd radiusd.o files.o util.o acct.o nas.o log.o valuepair.o version.o proxy.o exec.o auth.o conffile.o modules.o modcall.o session.o xlat.o threads.o smux.o radius_snmp.o client.o request_list.o mainconfig.o listen.o request_process.o -Wl,--export-dynamic ../modules/rlm_acct_unique/.libs/rlm_acct_unique.a ../modules/rlm_always/.libs/rlm_always.a ../modules/rlm_attr_filter/.libs/rlm_attr_filter.a ../modules/rlm_attr_rewrite/.libs/rlm_attr_rewrite.a ../modules/rlm_chap/.libs/rlm_chap.a ../modules/rlm_checkval/.libs/rlm_checkval.a ../modules/rlm_copy_packet/.libs/rlm_copy_packet.a ../modules/rlm_detail/.l! ibs/rlm_detail.a ../modules/rlm_digest/.libs/rlm_digest.a ../modules/rlm_eap/.libs/rlm_eap.a ../modules/rlm_exec/.libs/rlm_exec.a ../modules/rlm_expiration/.libs/rlm_expiration.a ../modules/rlm_expr/.libs/rlm_expr.a ../modules/rlm_fastusers/.libs/rlm_fastusers.a ../modules/rlm_files/.libs/rlm_files.a ../modules/rlm_logintime/.libs/rlm_logintime.a ../modules/rlm_mschap/.libs/rlm_mschap.a ../modules/rlm_ns_mta_md5/.libs/rlm_ns_mta_md5.a ../modules/rlm_otp/.libs/rlm_otp.a ../modules/rlm_pap/.libs/rlm_pap.a ../modules/rlm_passwd/.libs/rlm_passwd.a ../modules/rlm_preprocess/.libs/rlm_preprocess.a ../modules/rlm_radutmp/.libs/rlm_radutmp.a ../modules/rlm_realm/.libs/rlm_realm.a ../modules/rlm_sql/.libs/rlm_sql.a ../modules/rlm_sql_log/.libs/rlm_sql_log.a -lc ../modules/rlm_unix/.libs/rlm_unix.a ../modules/rlm_eap/types/rlm_eap_md5/.libs/rlm_eap_md5.a ../modules/rlm_eap/types/rlm_eap_leap/.libs/rlm_eap_leap.a ../modules/rlm_eap/types/rlm_eap_tls/.libs/rlm_eap_tls.a ../modules/rlm_! eap/types/rlm_eap_ttls/.libs/rlm_eap_ttls.a -L/home/fmetz/freeradius/s rc/modules/rlm_eap/libeap ../modules/rlm_eap/types/rlm_eap_sim/.libs/rlm_eap_sim.a ../modules/rlm_eap/types/rlm_eap_peap/.libs/rlm_eap_peap.a /home/fmetz/freeradius/src/modules/rlm_eap/types/rlm_eap_tls/.libs/rlm_eap_tls.a /home/fmetz/freeradius/src/modules/rlm_eap/libeap/.libs/libeap.a ../modules/rlm_eap/types/rlm_eap_mschapv2/.libs/rlm_eap_mschapv2.a ../modules/rlm_eap/types/rlm_eap_gtc/.libs/rlm_eap_gtc.a ../modules/rlm_sql/drivers/rlm_sql_mysql/.libs/rlm_sql_mysql.a -L/usr/lib /usr/lib/libmysqlclient.a -lz -lm -L/home/fmetz/freeradius/src/lib /home/fmetz/freeradius/src/lib/.libs/libradius.a /home/fmetz/freeradius/libltdl/.libs/libltdl.a -ldl -lnsl -lresolv -lpthread -lcrypt -lssl -lcrypto mainconfig.o(.text+0x630): In function `switch_users': /home/fmetz/freeradius/src/main/mainconfig.c:541: warning: Using 'initgroups' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking mainconfig.o(.text+0x597):/home/fmetz/freeradius/src/main/mainconfig.c:507: warning: Using 'getgrnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking mainconfig.o(.text+0x54b): In function `radlogdir_iswritable': /home/fmetz/freeradius/src/main/mainconfig.c:486: warning: Using 'getpwnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking listen.o(.text+0x1e0f): In function `listen_bind': /home/fmetz/freeradius/src/main/listen.c:1536: warning: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /home/fmetz/freeradius/libltdl/.libs/libltdl.a(ltdl.o)(.text+0x3a9): In function `sys_dl_open': /home/fmetz/freeradius/libltdl/ltdl.c:1107: warning: Using 'dlopen' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/libpthread.a(lockfile.o)(.text+0x0): In function `__flockfile': /home/drow/debian-glibc/glibc-2.3.2.ds1/build-tree/glibc-2.3.2/linuxthreads/lockfile.c:28: multiple definition of `__flockfile' /usr/lib/libc.a(flockfile.o)(.text+0x0): first defined here /usr/bin/ld: Warning: size of symbol `__flockfile' changed from 34 in /usr/lib/libc.a(flockfile.o) to 18 in /usr/lib/libc.a(flockfile.o) /usr/lib/libpthread.a(lockfile.o)(.text+0x0): In function `__flockfile': /home/drow/debian-glibc/glibc-2.3.2.ds1/build-tree/glibc-2.3.2/linuxthreads/lockfile.c:28: multiple definition of `_IO_flockfile' /usr/lib/libc.a(flockfile.o)(.text+0x0): first defined here /usr/bin/ld: Warning: size of symbol `_IO_flockfile' changed from 34 in /usr/lib/libc.a(flockfile.o) to 18 in /usr/lib/libc.a(flockfile.o) /usr/lib/libpthread.a(lockfile.o)(.text+0x20): In function `__funlockfile': /home/drow/debian-glibc/glibc-2.3.2.ds1/build-tree/glibc-2.3.2/linuxthreads/lockfile.c:38: multiple definition of `__funlockfile' /usr/lib/libc.a(funlockfile.o)(.text+0x0): first defined here /usr/bin/ld: Warning: size of symbol `__funlockfile' changed from 34 in /usr/lib/libc.a(funlockfile.o) to 18 in /usr/lib/libc.a(funlockfile.o) /usr/lib/libpthread.a(lockfile.o)(.text+0x20): In function `__funlockfile': /home/drow/debian-glibc/glibc-2.3.2.ds1/build-tree/glibc-2.3.2/linuxthreads/lockfile.c:38: multiple definition of `_IO_funlockfile' /usr/lib/libc.a(funlockfile.o)(.text+0x0): first defined here /usr/bin/ld: Warning: size of symbol `_IO_funlockfile' changed from 34 in /usr/lib/libc.a(funlockfile.o) to 18 in /usr/lib/libc.a(funlockfile.o) /usr/lib/libmysqlclient.a(libmysql.o)(.text+0x2a8f): In function `read_user_name': : warning: Using 'getpwuid' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/libmysqlclient.a(mf_pack.o)(.text+0x848): In function `expand_tilde': : warning: Using 'endpwent' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /home/fmetz/freeradius/src/lib/.libs/libradius.a(misc.o)(.text+0x50f): In function `ip_hton': /home/fmetz/freeradius/src/lib/misc.c:578: warning: Using 'getaddrinfo' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking ../modules/rlm_unix/.libs/rlm_unix.a(rlm_unix.o)(.text+0x26f): In function `unix_getpw': /home/fmetz/freeradius/src/modules/rlm_unix/rlm_unix.c:254: warning: Using 'getspnam' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /home/fmetz/freeradius/src/lib/.libs/libradius.a(misc.o)(.text+0x6b): In function `ip_hostname': /home/fmetz/freeradius/src/lib/misc.c:75: warning: Using 'gethostbyaddr_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /usr/lib/libmysqlclient.a(my_gethostbyname.o)(.text+0x30): In function `my_gethostbyname_r': : warning: Using 'gethostbyname_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Fehler 1 make[4]: Leaving directory `/home/fmetz/freeradius/src/main' make[3]: *** [common] Fehler 2 make[3]: Leaving directory `/home/fmetz/freeradius/src' make[2]: *** [all] Fehler 2 make[2]: Leaving directory `/home/fmetz/freeradius/src' make[1]: *** [common] Fehler 2 make[1]: Leaving directory `/home/fmetz/freeradius' make: *** [all] Fehler 2 Sorry for so much context and for the german "Fehler" which means "error", I'm sure you know. Thanks in advance. Frederic -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Donnerstag, 21. Juli 2005 19:20 An: FreeRadius users mailing list Betreff: Re: freeRadius CVS make install problem "Metz, Frederic" <Frederic.Metz(a)t-com.net> wrote: > sorry for that but I have a simple question about the make > install. It throws an error in linking or s.th. like that, see > below. I am not familiar with building shared object files so could > you please help me. $ configure --disable-shared $ make $ make install Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Possible? Same client with separate secrets for service separatio n?
by Burrill, Jim 22 Jul '05

22 Jul '05

We have a large number of users in an ldap database and we have successfully connected freeradius with it. We have also been able to connect a specific client ip address to a specific LDAP group to allow or disallow access to a specific device based on group membership. What we have found is that in the case of PIX it tends to be all or nothing. If one can authenticate thru the firewall for vpn purposes, they can also authenticate by ssh for admin purposes. Is it possible to configure a cisco Pix with separate radius definitions and auth against Freeradius using separate secrets so you can separate to specific groups? We've attempted it and it seems to find the first client on the list and ignores the second. Any Ideas? The PIX unfortunalty does not give any indication of type of connection thru NAS-Port (on pix this is just a session number). Only hope of separation it appears is thru calling-station-id, but that appears to be a real messy way. Below is a sample of what we've be attempting to do. Thanks for any assistance! Cisco Pix 6.3 Firewall ------------------ Pertinent pix configuration items ------------------ aaa-server RADIUS protocol radius aaa-server RADIUS (inside) host 192.168.1.10 secret1 timeout 10 aaa-server RADIUSVPN protocol radius aaa-server RADIUSVPN (inside) host 192.168.1.10 secret2 timeout 10 aaa authentication ssh console RADIUS LOCAL crypto map outside_map client authentication RADIUSVPN ------------------ clients.conf ------------------ client 192.168.1.20 { secret = secret1 shortname = pixssh nastype = Cisco } client 192.168.1.20 { secret = secret2 shortname = pixvpn nastype = Cisco }

2 1

Re: Multiple Root Contexts
by Mearl Danner 22 Jul '05

22 Jul '05

Might try downloading this and reading. It's very helpful. http://www.novell.com/documentation/edir_radius/pdfdoc/radadmin/radadmin.pdf If that's 3 separate "o=" at the root of the tree, the this from the above document. Example for Creating Multiple Instances of LDAP Module If you want multiple search bases, you can create multiple LDAP modules, by using the following syntax in the module section of the radiusd.conf. modules { ........... ........... ldap ldap1 { attribute = value attribute = value ............... ............... } ldap ldap2 { attribute = value attribute = value ............... ............... } ldap ldap3 { attribute = value attribute = value ............... ............... } } You can use the configured modules in authorize, authenticate and post-authenticate sections by specifying the module name and instance name. For example: authorize{ ..... ..... ldap ldap1 ldap ldap2 ..... ..... } >>> <jp(a)joshmp.com> 7/20/2005 9:51 AM >>> Here is my setup: FreeBSD 4.11 server with FreeRADIUS 1.0.4 authorizing/authenticating users in an eDirectory Tree on a NetWare 6.5 server. My issue: There are three root contexts in the tree. If I set the basedn to context1, I can successfully authorize/authenticate users in context1, but I need FreeRADIUS to search all three contexts for users, and I can't figure out a way to add all three as a basedn at the same time. Thanks in advance, Josh

2 1

RE: Life Connect time
by Abdul Lateef 22 Jul '05

22 Jul '05

Hi, Thank you for ur all replies. I contacted my nas producer and found that they have some account intrem update, which solved our problem. Thank You Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Digest
by Hassan Wahid 21 Jul '05

21 Jul '05

Hello I am trying to have users authenticate using Digest. I have the following in my users file cxc1 Auth-Type := Digest, User-Password = "test" Reply-Message = "Digest test, name 'digest', password 'digest'" but when I run the radius server, it doesnt run. I started it in debug mode and I get the error: /etc/raddb/users[95]: Parse error (check) for entry cxc1: Unknown value Digest for attribute Auth-Type Errors reading /etc/raddb/users radiusd.conf[921]: files: Module instantiation failed. I am using version 1.0.4. Any help would be greatly appreciated Thanks Hassan Here is the complete run from debug mode: hwahid-sipp03:/radius/freeradius-1.0.4/raddb # radiusd -X & [1] 29934 Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary hwahid-sipp03:/radius/freeradius-1.0.4/raddb # read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 rlm_eap: Loaded and initialized the type md5 rlm_eap: Loaded and initialized the type leap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" /etc/raddb/users[95]: Parse error (check) for entry cxc1: Unknown value Digest for attribute Auth-Type Errors reading /etc/raddb/users radiusd.conf[921]: files: Module instantiation failed. [1]+ Exit 1 radiusd -X hwahid-sipp03:/radius/freeradius-1.0.4/raddb #

2 1

Please Help- FreeRADIUS1.0.1 sending Access-Reject/no EAP-Message attribute
by Preethi Mohan 21 Jul '05

21 Jul '05

Dear all, I'm using a FreeRADIUS1.0.1 with hostap source code+xsupplicant.When I use EAP/TLS authentication,after running for 24-26 hours , authentication fails.In hostap, I'm getting a RADIUS packet with Access-Reject/no EAP-Message attribute.When I surfed the net I saw that RADIUS should not sent such a message combination. Reference:http://www.drizzle.com/~aboba/AAA/issues3.html Then why is it happening .Is it a bug of FreeRadius1.0.1.Can anyone please help me. Thanks in advance Regards Preethi

2 1

FreeRadius 1.0.4 - FreeBSD - Syslog not working
by Daniel Richardson 21 Jul '05

21 Jul '05

Hi there, I've succesfully installed (from the ports collection) FreeRadius (1.0.4) using Secure LDAP to Active Directory (horray!) - however, I can't seem to get it to log authentication attempts (much less anything) to syslog, this is my final stumbling block, and I really need some help here. I've spent hours scouring the mailing lists seeing many people with similar problems, and I've tried many of the supposed solutions without success. There seems to be some mention that information was included in the documentation at some point, however I've download the latest source code and grep'ed the documentation for anything containing 'syslog' and turned up empty (even browsed seemingly relevant docs manually). My syslogging is syslog-ng and works fine logging for several network devices. Syslog is installed on the same machine as freeradius. The source code seem to indicate syslogging is compiled / enabled by default - so presumably the port includes this as I see no options 'disabling' it. Things I've tried, with no success include: * From the radiusd help, I've included command line options. -l log_dir Log messages to 'log_dir'. Special values are: stdout == log all messages to standard output. syslog == log all messages to the system logger. user@domain$ radiusd -l syslog * Edit the radiusd.conf file to include: log_destination = syslog log { syslog_facility = daemon } * Edit the radiusd.conf file to include (which results in radiusd: Couldn't open syslog/radius.log for logging: No such file or directory - fairly obvious its not doing interpretting this differently) logdir = syslog Has anyone got this working succesfully? With this version of FreeRadius? How did you do it? Does anyone know troubleshooting methods I can use (radiusd -X will not log to syslog since its redirecting to stdout). Any answers or suggestions would be much appreciated! Thanks, Dan

3 2