- Freeradius-Users - lists.freeradius.org

ippool
by Miguel Sennoun 16 Jun '05

16 Jun '05

Hi, Has anyone an idea on the best solution to run two freeradius on the same machine. I tried with one installation that uses different conf and log directories but I wonder if all works well with the second instance. For example the radwho has no parameters to indicate which instance to consider. Perhaps ther is other problems I didn't noticed. Perhaps the best solution is to make two different install. Any advices? Thanks

3 3

Re: problem with freeradius and ldaps (Active Directory) (2)
by Roberto S. G. 16 Jun '05

16 Jun '05

Hi, no, in normal mode, radiusd actually really crashes: the daemon gets killed and I've to restart it again (no id with "ps aux"... and script doesn't stop it 'cause it's not started...). That log line is the only trace it gives before crash. But when I run radiusd with "-X" option, it doesn't crash... (???) and gives this lines (I've cut data): rlm_ldap: - authorize rlm_ldap: performing user authorization for XXXXXX radius_xlat: '(cn=XXXXXX)' radius_xlat: 'ou=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldaps://XXXXXXXXXXXXXXXXXX, authentication 0 rlm_ldap: setting TLS Require Cert to never rlm_ldap: setting TLS Cert File to ./certs/XXXXXXcacert.pem rlm_ldap: bind as XXXXXXXXXXXXXXXXXXXXXXXX/XXXXXX to ldaps://XXXXXXXXXXXXXXXXXX rlm_ldap: cn=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX bind to ldaps://XXXXXXXXXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 5 modcall: group authorize returns fail for request 5 Finished request 5 The same configuration of user, proxy ldap user (bind as...), and server runs smoothly, the only differences are: server = "ldaps://XXXXXXXXXXXXXXX" (I tried to use this instead of port=636, but the result is the same) tls_certfile = ./certs/XXXXXcacert.pem tls_require_cert = "never" I left the rest unchanged. (Maybe some of these "*time*" options in ldap section are important?). The test was made with "echo "User-Name = XXXXX" | radclient localhost auth XXXXX". If I make a "telnet XXXXXXXXXXXXXXX 636", the connection isn't refused, so the port is open, as it's also 389. I haven't an ldapclient in that machine, but I've sucessfully contacted this LDAPS server from another machine with ldapbrowser or softerra clients. I've checked config log written when I compiled radius, in order to see if it found ldap and openssl sources correctly, and all options I've seen for them are passed with "yes", and the "make" didn't complain... Are my options for LDAPS against ActiveDirectory correct? thank you very much for your time. >Message: 5 >Date: Wed, 15 Jun 2005 12:54:42 -0400 >From: "Alan DeKok" <aland(a)ox.org> >Subject: Re: problem with freeradius and ldaps (Active Directory) >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <20050615165442.6E00F16D00(a)mail.nitros9.org> > >"Roberto S. G." <roberto.santos(a)unileon.es> wrote: > >>> But I'm not able to obtain any response. In fact, the freeradius crashes >>> with just a: >>> >>> rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:1074, id=88, >>> length=29 >>> Discarding duplicate request from client localhost:1074 - ID: 88 > > > It's not a crash. It's telling you that it's still processing the >previous request. > > >>> Has anyone sucessfully configured freeradius against an Active Directory >>> with LDAPS? > > > Yes. > > Run the server in debugging mode to see where it hangs. > > Alan DeKok.

2 1

Expiration Module
by Jaco van Tonder 16 Jun '05

16 Jun '05

I have downloaded the latest CVS snapshot (the 12th of June) and am running it on Redhat 9 with Postgresql. I have configured the expiration module and added an entry in the radgroupcheck table. If I send a radius request to my server for a valid user and the expiration date is set to later than now() - the server issues an access-accept but if the expiration date/time has been reached - the server traps this - but NO reply message is sent. Is there something I am missing? Attached the part of the debug log showing what happens: rlm_expiration: Checking Expiration time: '13 Jun 2005' rlm_expiration: Account has expired radius_xlat: 'Your account has expired, jacotest ' modcall[authorize]: module "expiration" returns userlock for request 1 modcall: leaving group authorize (returns userlock) for request 1 Invalid user (Account has expired [Expiration 13 Jun 2005]): [jacotest/jjtest] (from client localhost port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Any help will be appreciated Jaco van Tonder

2 5

monitoring active threads via snmp
by Tariq Rashid 16 Jun '05

16 Jun '05

hi - is it possible to minitor the "active" threads via snmp? this is different from the pool allocated threads - most of which can be asleep / not awaiting a response. tariq

2 1

Freeradius make install error
by synackrst 16 Jun '05

16 Jun '05

Hello, Any solution for this: #make install ... .... /usr/local/src/freeradius-1.0.3/install-sh -c -m 755 -s .libs/radiusd /usr/local/sbin/radiusd /usr/local/src/freeradius-1.0.3/install-sh -c -m 755 -s radwho /usr/local/bin strip: /usr/local/bin/#inst.420#: File format not recognized make[4]: *** [install] Error 1 make[4]: Leaving directory `/usr/local/src/freeradius-1.0.3/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/usr/local/src/freeradius-1.0.3/src' make[2]: *** [install] Error 2 make[2]: Leaving directory `/usr/local/src/freeradius-1.0.3/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/usr/local/src/freeradius-1.0.3' make: *** [install] Error 2 #

3 3

Undefined symbol with eaptls / freeradius 1.0.3 (debian)
by Antonio-Blasco Bonito 16 Jun '05

16 Jun '05

I compiled and installed freeradius-1.0.3 on debian sarge. It runs. But when using rlm_eap_ttls-1.0.3.so I'm having the same problem described six months ago by Julien (see below). Then I tried the latest freeradius-snapshot-20050615 but I get errors in the install phase: *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** rlm_eap_tls.so is not portable! *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** libeap.so is not portable! gcc -shared .libs/rlm_eap_peap.o .libs/peap.o -Wl,--rpath -Wl,/usr/local/lib -L/usr/local/lib -lradius -lrlm_eap_tls -L/usr/local/src/freeradius-snapshot-20050615/src/modules/rlm_eap/libeap -leap -lssl -lnsl -lresolv -lpthread -lcrypto -Wl,-soname -Wl,rlm_eap_peap-1.1.0-pre0.so -o .libs/rlm_eap_peap-1.1.0-pre0.so /usr/bin/ld: cannot find -lrlm_eap_tls collect2: ld returned 1 exit status libtool: install: error: relink `rlm_eap_peap.la' with the above command before installing it make[11]: *** [install] Error 1 Cna somebody give me any hints how to get out of this problem? On Tue, Dec 07, 2004 at 03:16:47PM +0100, Julien CABESSUT wrote: > I'm trying to set up a freeradius server on a debian box to authenticate > wireless users. The current debian (sid) package for 1.0.1 doesn't > include eap_tls, eap_ttls, nor eap_peap due to licensing issues - yet I > needed them. So I downloaded the source package, removed the three lines > in debian/rules which were preventing the compilation of those modules, > built a brand new package, and installed it. Now I have an error which > makes the server crash when someone tries to authenticate : > freeradius: relocation error: /usr/lib/freeradius/rlm_eap_peap-1.0.1.so: > undefined symbol: eaptls_process > Any suggestion on what could cause this problem ? Yes. The libltdl in Debian includes a patch from the CVS version of libtool, which breaks the linkage used by rlm_eap_ttls and rlm_eap_peap into rlm_eap_tls. Try 1.1.0, which should work with the libltdl in Debian/sarge or Debian/sid. -- Paul "TBBle" Hampson, on an alternate email client. -- Antonio-Blasco Bonito Phone: +39 050 315-2958 E-mail: blasco.bonito(a)isti.cnr.it Istituto di Scienza e Tecnologie dell'Informazione "A. Faedo" CNR Area della Ricerca di Pisa Via G. Moruzzi 1 56124 Pisa Italy

2 1

problem with freeradius and ldaps (Active Directory)
by Roberto S. G. 16 Jun '05

16 Jun '05

Hi, I'm trying to configure freeradius (1.0.1) to use an ldaps server (without start_tls, it's an Active Directory). But I'm not able to obtain any response. In fact, the freeradius crashes with just a: rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:1074, id=88, length=29 Discarding duplicate request from client localhost:1074 - ID: 88 (client is localhost because I was using radclient, but remote attempts show the same behaviour). Normal ldap against the same server is correct. For the ldaps configuration I've added just: port = 636 tls_require_cert = "never" though even with the server certificate: tls_certfile = ./certs/xxxx_cacert.pem the result is the same. I don't know which is the problem exactly... Has anyone sucessfully configured freeradius against an Active Directory with LDAPS? Any ideas are apreciated. thanks.

3 2

How can I using postgres NAS table
by Алексей В. Лабута 16 Jun '05

16 Jun '05

Hi All! How can I using postgres NAS table? I not found info about this :( My ware is: ibm x335 suse 9.3 freeradius 1.0.2 postgres 8.0.3

2 1

freeradius 1.0.4
by Andrew Thompson 16 Jun '05

16 Jun '05

Hi, I maintain the FreeRADIUS port for FreeBSD and am holding off upgrading from 1.0.2 due to the imminent release of 1.0.4 (06 June). There doesn't seem to be any discussion on the mailing lists, is 1.0.4 due soon or should I upgrade to 1.0.3 in the interim? cheers, Andrew

4 4

rlm_sql_mysql.la
by yuniva wati 15 Jun '05

15 Jun '05

hello, can any one help me for this problem? when I install freeradius ./configure and make the freeradius modules there is gmake[10]: nothing to be done for static. why can be like that? because I need rlm_sql_mysql.la and rlm_sql_mysql.a thanks for your attention listing: `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_iodbc' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making static in rlm_sql_mysql... gmake[10]: Entering directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_mysql' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_mysql' Making static in rlm_sql_postgresql... gmake[10]: Entering directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_postgresql' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_postgresql' Making static in rlm_sql_oracle... gmake[10]: Entering directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_oracle' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_oracle' Making static in rlm_sql_unixodbc... gmake[10]: Entering directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_unixodbc' gmake[10]: Nothing to be done for `static'. gmake[10]: Leaving directory `/usr/freeradius-1.0.0-pre3/src/modules/rlm_sql/drivers/rlm_sql_unixodbc' __________________________________ Yahoo! Mail Stay connected, organized, and protected. Take the tour: http://tour.mail.yahoo.com/mailtour.html

3 4