- Freeradius-Users - lists.freeradius.org

RE: Life Connect time
by Abdul Lateef 22 Jul '05

22 Jul '05

Hi, Thank you for ur all replies. I contacted my nas producer and found that they have some account intrem update, which solved our problem. Thank You Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Digest
by Hassan Wahid 21 Jul '05

21 Jul '05

Hello I am trying to have users authenticate using Digest. I have the following in my users file cxc1 Auth-Type := Digest, User-Password = "test" Reply-Message = "Digest test, name 'digest', password 'digest'" but when I run the radius server, it doesnt run. I started it in debug mode and I get the error: /etc/raddb/users[95]: Parse error (check) for entry cxc1: Unknown value Digest for attribute Auth-Type Errors reading /etc/raddb/users radiusd.conf[921]: files: Module instantiation failed. I am using version 1.0.4. Any help would be greatly appreciated Thanks Hassan Here is the complete run from debug mode: hwahid-sipp03:/radius/freeradius-1.0.4/raddb # radiusd -X & [1] 29934 Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary hwahid-sipp03:/radius/freeradius-1.0.4/raddb # read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 rlm_eap: Loaded and initialized the type md5 rlm_eap: Loaded and initialized the type leap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" /etc/raddb/users[95]: Parse error (check) for entry cxc1: Unknown value Digest for attribute Auth-Type Errors reading /etc/raddb/users radiusd.conf[921]: files: Module instantiation failed. [1]+ Exit 1 radiusd -X hwahid-sipp03:/radius/freeradius-1.0.4/raddb #

2 1

Please Help- FreeRADIUS1.0.1 sending Access-Reject/no EAP-Message attribute
by Preethi Mohan 21 Jul '05

21 Jul '05

Dear all, I'm using a FreeRADIUS1.0.1 with hostap source code+xsupplicant.When I use EAP/TLS authentication,after running for 24-26 hours , authentication fails.In hostap, I'm getting a RADIUS packet with Access-Reject/no EAP-Message attribute.When I surfed the net I saw that RADIUS should not sent such a message combination. Reference:http://www.drizzle.com/~aboba/AAA/issues3.html Then why is it happening .Is it a bug of FreeRadius1.0.1.Can anyone please help me. Thanks in advance Regards Preethi

2 1

FreeRadius 1.0.4 - FreeBSD - Syslog not working
by Daniel Richardson 21 Jul '05

21 Jul '05

Hi there, I've succesfully installed (from the ports collection) FreeRadius (1.0.4) using Secure LDAP to Active Directory (horray!) - however, I can't seem to get it to log authentication attempts (much less anything) to syslog, this is my final stumbling block, and I really need some help here. I've spent hours scouring the mailing lists seeing many people with similar problems, and I've tried many of the supposed solutions without success. There seems to be some mention that information was included in the documentation at some point, however I've download the latest source code and grep'ed the documentation for anything containing 'syslog' and turned up empty (even browsed seemingly relevant docs manually). My syslogging is syslog-ng and works fine logging for several network devices. Syslog is installed on the same machine as freeradius. The source code seem to indicate syslogging is compiled / enabled by default - so presumably the port includes this as I see no options 'disabling' it. Things I've tried, with no success include: * From the radiusd help, I've included command line options. -l log_dir Log messages to 'log_dir'. Special values are: stdout == log all messages to standard output. syslog == log all messages to the system logger. user@domain$ radiusd -l syslog * Edit the radiusd.conf file to include: log_destination = syslog log { syslog_facility = daemon } * Edit the radiusd.conf file to include (which results in radiusd: Couldn't open syslog/radius.log for logging: No such file or directory - fairly obvious its not doing interpretting this differently) logdir = syslog Has anyone got this working succesfully? With this version of FreeRadius? How did you do it? Does anyone know troubleshooting methods I can use (radiusd -X will not log to syslog since its redirecting to stdout). Any answers or suggestions would be much appreciated! Thanks, Dan

3 2

freeRadius CVS make install problem
by Metz, Frederic 21 Jul '05

21 Jul '05

Hi, sorry for that but I have a simple question about the make install. It throws an error in linking or s.th. like that, see below. I am not familiar with building shared object files so could you please help me. Frederic -- Making install in rlm_eap_peap... make[11]: Entering directory `/home/fmetz/freeradius/src/modules/rlm_eap/types/rlm_eap_peap' if [ "xrlm_eap_peap" != "x" ]; then \ /home/fmetz/freeradius/libtool --mode=install /home/fmetz/freeradius/install-sh -c -c \ rlm_eap_peap.la /usr/local/lib/rlm_eap_peap.la || exit ;\ rm -f /usr/local/lib/rlm_eap_peap-1.1.0-pre0.la || exit %?; \ ln -s rlm_eap_peap.la /usr/local/lib/rlm_eap_peap-1.1.0-pre0.la || exit ;\ fi libtool: install: warning: relinking `rlm_eap_peap.la' (cd /home/fmetz/freeradius/src/modules/rlm_eap/types/rlm_eap_peap; /bin/sh /home/fmetz/freeradius/libtool --mode=relink gcc -release 1.1.0-pre0 -module -export-dynamic -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../../../../include -I../.. -I../rlm_eap_tls -DOPENSSL_NO_KRB5 -I./../../libeap -o rlm_eap_peap.la -rpath /usr/local/lib rlm_eap_peap.lo peap.lo ../../../../lib/libradius.la ../rlm_eap_tls/rlm_eap_tls.la -L./../../libeap -leap -lcrypto -lssl -lcrypto -lnsl -lresolv -lpthread -lcrypto ) *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** rlm_eap_tls.so is not portable! *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** libeap.so is not portable! mv: cannot stat `rlm_eap_peap-1.1.0-pre0.so': No such file or directory libtool: install: error: relink `rlm_eap_peap.la' with the above command before installing it

2 1

Life Connect time
by Abdul Lateef 21 Jul '05

21 Jul '05

Hi guys. I have a small question about Life Connect time in START packets. Is there any possibility to get the connect time when the second party pickup the phone. I am doing my VoIP Call Shop application using freeradius i made one counter in my CallShop application when we got the connect time from terminator i means when the second party pikuped the phone the counter should be started. But in START packets i cannot see any life connect time. is it posible with some advance configuration in freeradius? Thank You Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail Stay connected, organized, and protected. Take the tour: http://tour.mail.yahoo.com/mailtour.html

2 1

Re: No communication between FreeRadius and Chilli
by sean 21 Jul '05

21 Jul '05

On Wed, 2005-07-20 at 21:29 +0200, freeradius-users- request(a)lists.freeradius.org wrote: > sean <sean(a)topup.ie> wrote: > > The problem is > > that Chilli can't communicate with my Radius server. Ethereal tells > me > > that the destination is unreachable when replying to the Chilli box. > > It looks like the port isn't open. > > > No. Time Source Destination > Protocol Info > > 540 142.622909 192.168.1.6 82.141.232.132 > RADIUS Access Request(1) (id=0, l=195) > > Ok... > > > The Radius server and the Chilli AP get their IP's from DHCP on a > Caymen > > DSL modem with static IP. The Modem is 82.141.232.132. The Radius > server > > is 192.168.1.2 > > What's the problem? The Ethereal output you showed above disagrees > with your statement about the IP address of the RADIUS server. > > You have the Chilli AP configured to send RADIUS packets to the DSL > modem. The Ethereal output is telling you this. > > Alan DeKok. I have UDP and TCP Pinholes open in the modem for ports 1812, 1813 and 1814 pointing to 192.168.1.2 This should be directing trafic to 82.141.232.132:1812 etc to 192.168.1.2:1812. That is what I had to do for Apache, Jabber and other services. Does Radius use any other ports and should I have any ports opened to 192.168.1.6 Thanks for your help. Regards Sean

2 1

Radius CVS bug
by Dinko Korunic 21 Jul '05

21 Jul '05

I believe that rlm_sql.c in current CVS has got a small typo with mainconfig.client_trees. Trivial fix follows: Index: rlm_sql.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_sql/rlm_sql.c,v retrieving revision 1.145 diff -u -r1.145 rlm_sql.c --- rlm_sql.c 18 Jul 2005 20:26:39 -0000 1.145 +++ rlm_sql.c 21 Jul 2005 14:44:58 -0000 @@ -381,7 +381,7 @@ DEBUG("rlm_sql (%s): Adding client %s (%s) to clients list", inst->config->xlat_name, c->longname,c->shortname); - if (!client_add(mainconfig.client_trees, c)) { + if (!client_add(mainconfig.clients, c)) { client_free(c); return -1; } Cheers, D. -- NAME:Dinko.kreator.Korunic NOTE:Standard.disclaimer.applies URL:kreator.esa.fer.hr IRC:kre ICQ:16965294 PGP:0xea160d0b

2 1

Proxying both EAP and non-EAP requests for the same realm to different servers.
by Erling Paulsen 21 Jul '05

21 Jul '05

Hello. I want to proxy requests to different servers, based on their authentication type - though they belong to the same realm. How do I make EAP request for a realm go to one server and non-EAP requests for the same realm go to another server? I apologize if this is trivial or allready answered! - Erling -- ----------------|sig|--- Erling.Paulsen(a)cc.uit.no Nettseksjonen, ITavd UiT

2 1

clash between group LDAP
by Rohaizam Abu Bakar 21 Jul '05

21 Jul '05

Dear all, I've LDAP tree structure as below, to seperate ADSL & DIALUP. But encounter one problem.. when userA = userB, LDAP will found userA's account although userB that actually login. This maybe due to DEFAULT sequence in users file. Any idea to solve this ? thanks.. ou=AAA | | ---------------------------------- | | ou=ADSL ou=DIALUP dn: uid=userA,ou=ADSL,ou=AAA ... dn: uid=userB,ou=DIALUP,ou=AAA.... serviceflag: ADSL serviceflag: DIALUP Users: ==== DEFAULT ldapadsl-Ldap-Group == "ADSL", Autz-Type := ADSL, Auth-Type := ADSL DEFAULT ldapdialup-Ldap-Group == "DIALUP", Autz-Type := DIALUP, Auth-Type := DIALUP radiusd.conf ======== ldap ldapadsl { basedn = "ou=ADSL,ou=AAA,ou=People,dc=jaring,dc=my" groupname_attribute = serviceflag } ldap ldapdialup { basedn = "ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my" groupname_attribute = serviceflag authorize { Autz-Type ADSL { ldapadsl } Autz-Type DIALUP { ldapdialup } } authenticate { Auth-Type ADSL { ldapadsl } Auth-Type DIALUP { ldapdialup } }

2 1