- Freeradius-Users - lists.freeradius.org

load balancing
by Lucas Aimaretto 16 Jun '05

16 Jun '05

Hi all, Is it possible to have freeradius as a proxy, but also, doing some load-balancing within N other freeradius-servers ? Has anybody done something like this before ? I've seen at freeradius.org that some used LinuxVirtualServer for doing this. But, I believe that, having a freeradius as proxy+load-balancer, it should have a better connection-handling. Am I wrong ? Any suggestion would be appreciated. I'm using freeradius 1.0.2. Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

1 0

Radius attributes necessary for PPP connection into Cisco modem-bank
by Mike Partyka 16 Jun '05

16 Jun '05

I have been asked to setup Radius to authenticate a modem connection by connecting to our Mysql database. I have read the Radius documentation more than once and i attribute my difficulties to a poor understanding of PPP connections on Linux. I just don't understand what are the necessary attributes that Radius has to pass back to the modem in order for the connection to be made. The modem is dialing into a Cisco modem bank here at our office where the Mysql databse is as well. I have been given a query for Radius to do that will get the authentication from Mysql but i am so far from that portion of the setup, i don't know where to look first. >From where i stand it seems like i could keep reading the Radius documentation and still never understand what needs to be done because i am lacking some more fundamental information that is required to put the pieces together. Can anyone point me to some basic documentation that might firm up my understanding of what needs to be done? Thanks, Mike Partyka Jumpnode Systems, LLC Systems Administrator (612)605-5056 Desk (612)605-3510 Fax

2 1

MS-CHAP problems :(
by Alexander Orlov 16 Jun '05

16 Jun '05

Hello! I have this message, when I try to use ms-chap auth: ---------------- Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 ../../sbin/radiusd: error while loading shared libraries: /usr/local/radius/lib/rlm_mschap-1.0.2.so: undefined symbol: md4_calc ------------------ I try to find some in this mail list archive about this bug, and all of I can find was about ver. 0.6-0.8, but I have 1.0.2 free radius. What I can do to resole this porblem? pap, chap auth work fine.

2 1

Undefined symbol with eaptls / freeradius 1.0.3 (debian)
by Antonio-Blasco Bonito 16 Jun '05

16 Jun '05

I compiled and installed freeradius-1.0.3 on debian sarge. It runs. But when using rlm_eap_ttls-1.0.3.so I'm having the same problem described six months ago by Julien (see below). Then I tried the latest freeradius-snapshot-20050615 but I get errors in the install phase: *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** rlm_eap_tls.so is not portable! *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** libeap.so is not portable! gcc -shared .libs/rlm_eap_peap.o .libs/peap.o -Wl,--rpath -Wl,/usr/local/lib -L/usr/local/lib -lradius -lrlm_eap_tls -L/usr/local/src/freeradius-snapshot-20050615/src/modules/rlm_eap/libeap -leap -lssl -lnsl -lresolv -lpthread -lcrypto -Wl,-soname -Wl,rlm_eap_peap-1.1.0-pre0.so -o .libs/rlm_eap_peap-1.1.0-pre0.so /usr/bin/ld: cannot find -lrlm_eap_tls collect2: ld returned 1 exit status libtool: install: error: relink `rlm_eap_peap.la' with the above command before installing it make[11]: *** [install] Error 1 Cna somebody give me any hints how to get out of this problem? On Tue, Dec 07, 2004 at 03:16:47PM +0100, Julien CABESSUT wrote: > I'm trying to set up a freeradius server on a debian box to authenticate > wireless users. The current debian (sid) package for 1.0.1 doesn't > include eap_tls, eap_ttls, nor eap_peap due to licensing issues - yet I > needed them. So I downloaded the source package, removed the three lines > in debian/rules which were preventing the compilation of those modules, > built a brand new package, and installed it. Now I have an error which > makes the server crash when someone tries to authenticate : > freeradius: relocation error: /usr/lib/freeradius/rlm_eap_peap-1.0.1.so: > undefined symbol: eaptls_process > Any suggestion on what could cause this problem ? Yes. The libltdl in Debian includes a patch from the CVS version of libtool, which breaks the linkage used by rlm_eap_ttls and rlm_eap_peap into rlm_eap_tls. Try 1.1.0, which should work with the libltdl in Debian/sarge or Debian/sid. -- Paul "TBBle" Hampson, on an alternate email client. -- Antonio-Blasco Bonito Phone: +39 050 315-2958 E-mail: blasco.bonito(a)isti.cnr.it Istituto di Scienza e Tecnologie dell'Informazione "A. Faedo" CNR Area della Ricerca di Pisa Via G. Moruzzi 1 56124 Pisa Italy

2 1

ippool
by Miguel Sennoun 16 Jun '05

16 Jun '05

Hi, Has anyone an idea on the best solution to run two freeradius on the same machine. I tried with one installation that uses different conf and log directories but I wonder if all works well with the second instance. For example the radwho has no parameters to indicate which instance to consider. Perhaps ther is other problems I didn't noticed. Perhaps the best solution is to make two different install. Any advices? Thanks

3 3

Re: problem with freeradius and ldaps (Active Directory) (2)
by Roberto S. G. 16 Jun '05

16 Jun '05

Hi, no, in normal mode, radiusd actually really crashes: the daemon gets killed and I've to restart it again (no id with "ps aux"... and script doesn't stop it 'cause it's not started...). That log line is the only trace it gives before crash. But when I run radiusd with "-X" option, it doesn't crash... (???) and gives this lines (I've cut data): rlm_ldap: - authorize rlm_ldap: performing user authorization for XXXXXX radius_xlat: '(cn=XXXXXX)' radius_xlat: 'ou=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldaps://XXXXXXXXXXXXXXXXXX, authentication 0 rlm_ldap: setting TLS Require Cert to never rlm_ldap: setting TLS Cert File to ./certs/XXXXXXcacert.pem rlm_ldap: bind as XXXXXXXXXXXXXXXXXXXXXXXX/XXXXXX to ldaps://XXXXXXXXXXXXXXXXXX rlm_ldap: cn=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX bind to ldaps://XXXXXXXXXXXXXXXXXX failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 5 modcall: group authorize returns fail for request 5 Finished request 5 The same configuration of user, proxy ldap user (bind as...), and server runs smoothly, the only differences are: server = "ldaps://XXXXXXXXXXXXXXX" (I tried to use this instead of port=636, but the result is the same) tls_certfile = ./certs/XXXXXcacert.pem tls_require_cert = "never" I left the rest unchanged. (Maybe some of these "*time*" options in ldap section are important?). The test was made with "echo "User-Name = XXXXX" | radclient localhost auth XXXXX". If I make a "telnet XXXXXXXXXXXXXXX 636", the connection isn't refused, so the port is open, as it's also 389. I haven't an ldapclient in that machine, but I've sucessfully contacted this LDAPS server from another machine with ldapbrowser or softerra clients. I've checked config log written when I compiled radius, in order to see if it found ldap and openssl sources correctly, and all options I've seen for them are passed with "yes", and the "make" didn't complain... Are my options for LDAPS against ActiveDirectory correct? thank you very much for your time. >Message: 5 >Date: Wed, 15 Jun 2005 12:54:42 -0400 >From: "Alan DeKok" <aland(a)ox.org> >Subject: Re: problem with freeradius and ldaps (Active Directory) >To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> >Message-ID: <20050615165442.6E00F16D00(a)mail.nitros9.org> > >"Roberto S. G." <roberto.santos(a)unileon.es> wrote: > >>> But I'm not able to obtain any response. In fact, the freeradius crashes >>> with just a: >>> >>> rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:1074, id=88, >>> length=29 >>> Discarding duplicate request from client localhost:1074 - ID: 88 > > > It's not a crash. It's telling you that it's still processing the >previous request. > > >>> Has anyone sucessfully configured freeradius against an Active Directory >>> with LDAPS? > > > Yes. > > Run the server in debugging mode to see where it hangs. > > Alan DeKok.

2 1

Expiration Module
by Jaco van Tonder 16 Jun '05

16 Jun '05

I have downloaded the latest CVS snapshot (the 12th of June) and am running it on Redhat 9 with Postgresql. I have configured the expiration module and added an entry in the radgroupcheck table. If I send a radius request to my server for a valid user and the expiration date is set to later than now() - the server issues an access-accept but if the expiration date/time has been reached - the server traps this - but NO reply message is sent. Is there something I am missing? Attached the part of the debug log showing what happens: rlm_expiration: Checking Expiration time: '13 Jun 2005' rlm_expiration: Account has expired radius_xlat: 'Your account has expired, jacotest ' modcall[authorize]: module "expiration" returns userlock for request 1 modcall: leaving group authorize (returns userlock) for request 1 Invalid user (Account has expired [Expiration 13 Jun 2005]): [jacotest/jjtest] (from client localhost port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Any help will be appreciated Jaco van Tonder

2 5

monitoring active threads via snmp
by Tariq Rashid 16 Jun '05

16 Jun '05

hi - is it possible to minitor the "active" threads via snmp? this is different from the pool allocated threads - most of which can be asleep / not awaiting a response. tariq

2 1

Freeradius make install error
by synackrst 16 Jun '05

16 Jun '05

Hello, Any solution for this: #make install ... .... /usr/local/src/freeradius-1.0.3/install-sh -c -m 755 -s .libs/radiusd /usr/local/sbin/radiusd /usr/local/src/freeradius-1.0.3/install-sh -c -m 755 -s radwho /usr/local/bin strip: /usr/local/bin/#inst.420#: File format not recognized make[4]: *** [install] Error 1 make[4]: Leaving directory `/usr/local/src/freeradius-1.0.3/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/usr/local/src/freeradius-1.0.3/src' make[2]: *** [install] Error 2 make[2]: Leaving directory `/usr/local/src/freeradius-1.0.3/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/usr/local/src/freeradius-1.0.3' make: *** [install] Error 2 #

3 3

Undefined symbol with eaptls / freeradius 1.0.3 (debian)
by Antonio-Blasco Bonito 16 Jun '05

16 Jun '05

I compiled and installed freeradius-1.0.3 on debian sarge. It runs. But when using rlm_eap_ttls-1.0.3.so I'm having the same problem described six months ago by Julien (see below). Then I tried the latest freeradius-snapshot-20050615 but I get errors in the install phase: *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** rlm_eap_tls.so is not portable! *** Warning: Linking the shared library rlm_eap_peap.la against the loadable module *** libeap.so is not portable! gcc -shared .libs/rlm_eap_peap.o .libs/peap.o -Wl,--rpath -Wl,/usr/local/lib -L/usr/local/lib -lradius -lrlm_eap_tls -L/usr/local/src/freeradius-snapshot-20050615/src/modules/rlm_eap/libeap -leap -lssl -lnsl -lresolv -lpthread -lcrypto -Wl,-soname -Wl,rlm_eap_peap-1.1.0-pre0.so -o .libs/rlm_eap_peap-1.1.0-pre0.so /usr/bin/ld: cannot find -lrlm_eap_tls collect2: ld returned 1 exit status libtool: install: error: relink `rlm_eap_peap.la' with the above command before installing it make[11]: *** [install] Error 1 Cna somebody give me any hints how to get out of this problem? On Tue, Dec 07, 2004 at 03:16:47PM +0100, Julien CABESSUT wrote: > I'm trying to set up a freeradius server on a debian box to authenticate > wireless users. The current debian (sid) package for 1.0.1 doesn't > include eap_tls, eap_ttls, nor eap_peap due to licensing issues - yet I > needed them. So I downloaded the source package, removed the three lines > in debian/rules which were preventing the compilation of those modules, > built a brand new package, and installed it. Now I have an error which > makes the server crash when someone tries to authenticate : > freeradius: relocation error: /usr/lib/freeradius/rlm_eap_peap-1.0.1.so: > undefined symbol: eaptls_process > Any suggestion on what could cause this problem ? Yes. The libltdl in Debian includes a patch from the CVS version of libtool, which breaks the linkage used by rlm_eap_ttls and rlm_eap_peap into rlm_eap_tls. Try 1.1.0, which should work with the libltdl in Debian/sarge or Debian/sid. -- Paul "TBBle" Hampson, on an alternate email client. -- Antonio-Blasco Bonito Phone: +39 050 315-2958 E-mail: blasco.bonito(a)isti.cnr.it Istituto di Scienza e Tecnologie dell'Informazione "A. Faedo" CNR Area della Ricerca di Pisa Via G. Moruzzi 1 56124 Pisa Italy

2 1