- Freeradius-Users - lists.freeradius.org

Trying other authentication methods when the first is invalid
by Meyers, Dan 11 Jan '13

11 Jan '13

Sorry for the wall of tet, I'd rather give too much info than not enough. Our FreeRADIUS server (version 2.1.8 running on Ubuntu 10.04 LTS x64, installed from packages) currently does mac-based authentication of hosts onto edge switches using perl scripts (rlm_perl) talking to the API for our network access control system. I would like to extend this to also be able to support 802.1x based authentication, but only for certain specific networks (ones with access to more important servers or similar. For example the finance network should need 802.1x to auth, but our student residence network shouldn't as then no games consoles and the like would work). The initial method I had set up was to look for the presence of an EAP-Message in the request in the authorize section, and call the eap module if EAP-Message was present to set Auth-Type to EAP and then do authentication using eap (tls or peap) (and then expect to hand off to perl in post_auth just for the VLAN assignment) or to call the perl module to set Auth-Type as Perl if there was no EAP-Message, and handle it in authenticate as a simple MAC auth using perl. (The reason for not just calling eap then perl all the time is that the rlm_perl module, despite my authorize subroutine containing simply "$RAD_CHECK{'Auth-Type'} = 'Perl'; return RLM_MODULE_OK;", seems to alter the value of User-Name such that calling eap in authenticate *always* fails with the error "Identity does not match User-Name, setting from EAP Identity." and rejects the user if perl has been called in authorize, even if it is called after eap and the eap stanza reads "eap { ok = return }"). This worked fine on our HP Procurve switches. Anyway, we have got some Juniper EX2200 switches. The problem with these is that they do mac-auth as a 'fake' 802.1x auth. The request has the User-Name attribute set to the MAC address correctly, but also has an EAP-Message present, it just doesn't contain anything we want to have to care about (It actually contains, once the eap header has been decoded, the md5 of the mac-address). This causes the eap module, if called in authorize, to think the request should be handled by itself and set Auth-Type to EAP and expect to do eap-md5 (even if the default-auth-type in eap.conf is set to something else, like peap). However, as we do not actually want to do an eap-md5 auth we have no Cleartext-Password anywhere for the tens of thousands of MAC addresses (with new ones every day, which we auth onto a special 'unregistered' network with limited access instead of rejecting) on our network. The eap module in this case returns 'invalid' in authentication, rather than 'reject'. I was hoping I could detect this and tell it to move on to perl if this happened. I can't seem to make that work. As soon as eap returns invalid, all further processing is halted for that request and FreeRADIUS jumps straight to the Post-Auth REJECT section. Can anyone suggest a way around this? I was originally thinking that I could use the perl module after eap in authorize to check if the decoded eap data was simply an md5 hash of the MAC, and set Auth-Type to Perl even though there was an EAP-Message in that case, but of course if I ever then do that check on a valid 802.1x auth EAP breaks (as I mentioned above). Thanks for any help anyone can offer -- Dan Meyers Lancaster University

3 2

Compilling error
by Черкендов Александр Арма исович 11 Jan '13

11 Jan '13

Cann’t compile for CYGWIN version 2.2.1 & 2.2.0(stable) gcc -I/cygdrive/d/fr/freeradius-server-2.2.1 -I/cygdrive/d/fr/freeradius-server-2.2.1/src -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/cygdrive/d/fr/freeradius-server-2.2.1/libltdl -I/cygdrive/d/fr/freeradius-server-2.2.1/src -I/cygdrive/d/fr/freeradius-server-2.2.1/libltdl radeapclient.c -o radeapclient radeapclient.c:40:23: фатальная ошибка: eap_types.h: No such file or directory Компиляция прервана. <builtin>: recipe for target `radeapclient' failed make[6]: *** [radeapclient] Error 1 File eap_types.h is situated in src/modules/rlm_eap/lib_eap dir. If I launch gcc -I lib_eap, I get: ... /tmp/ccD7XqGk.o: In function `debug_packet': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:182: undefined reference to `_fr_packet_codes' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:195: undefined reference to `_vp_prints' /tmp/ccD7XqGk.o: In function `send_packet': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:212: undefined reference to `_rad_send' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:268: undefined reference to `_rad_verify' /tmp/ccD7XqGk.o: In function `process_eap_challenge': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:502: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:503: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:521: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:522: undefined reference to `_pairfind' ... As I found_pairfind is defined in xlat.c. How can I compile it?

1 0

Multithreaded krb5
by Arran Cudbard-Bell 11 Jan '13

11 Jan '13

A while back there was some discussion about the current krb5 module in FreeRADIUS being single threaded, and that it may no longer be necessary for it to be single threaded. It transpires that both MIT and Heimdal libraries are now thread safe, MIT since either 1.4.x or 1.4.4 (unsure) and Heimdal since around 0.7 (documentation is fuzzy). I can't test beyond compiling the code against the kerberos library, and maybe setting up a test KDC/TGS. But for this to be put into the stable branch it really needs to be tested under load, against a range of keberos implementations. Were looking for volunteers, preferably a mix of deployments using either MIT or Heimdal. The new module should just drop in for any v2.1.x deployment once compiled, as it doesn't use any new core API functions. Change list: * Both - Check that krb5 library was compiled with threading support on startup. * Both - Clone context on each request to ensure thread safety. * Both - Move service principal parsing so it's done at intialisation only (instead of on every request). * Both - Improved return codes, will now reflect revoked access/password expiry (USERLOCK), Uknown client principal (NOTFOUND), as well as bad password (REJECT), and other errors (FAIL). Before the module returned REJECT for almost everything. * Both - Mark module as thread safe, config check safe (will be validated on -C), and hup safe (config will be reloaded on SIGHUP) * Both - Switch more messages to use RDEBUG so they'll be printed in conditional debug (useful for production servers with radmin enabled). * MIT - Move service principal string to service principal conversion so that it's done at initialisation only (instead of on every request). * MIT - Move options configuration so they're done at initialisation only (instead of on every request). * MIT - Switch to using krb5_get_init_creds_password and krb5_verify_init_creds to validate TGT instead of old twisty logic. * MIT - Cache option removed as krb5_verify_init_creds disables the replay cache on its own. For those wanting to test: git clone git@github.com:arr2036/freeradius-server.git cd freeradius-server git checkout threaded_krb5 Report issues on: http://bugs.freeradius.org, and send feedback to either the list or me directly. -Arran

1 0

AD Authentication Permissions
by Tyler Brady 10 Jan '13

10 Jan '13

Hello, I apologize if these questions have already been answered. I have scoured the internet for help, but have been unable to find what I'm looking for. Keep in mind this was the first time I have ever used linux so at the beginning of this project I was beyond newb. I am setting up a freeRADIUS (2.1.10) server for my network. I have everything working how I want it to except for some of the permission settings. For example, when users log in to Motorola radios in my network via freeRADIUS they only receive read-only permissions. Or when a Cisco user logs in I would like for them to receive automatic #privilege level 15. I need for users to receive admin privileges. How do I accomplish this? NOTE: I'm authenticating against active directory. So where can I configure things like "cisco-avpair = shell:priv-lvl=15, or Motorola-WIBB-Auth-Role = system-admin-role?" I understand how to configure permissions when you have individual users configured in users.conf. file. How do you configure permissions when you don't have any local users configured, but are using Active Directory? Right now I use only one Active Directory group "Radius-Users" for authentication. If a user is part of the Radius-Users group on the AD server, then they get access. This is fine for now, but in the future I would like to set up more granular access control. I have seen a lot of talk about LDAP groups, but have not been able to find decent information on it. Ideally I would like for there to be several different user groups set up with different permissions for each. How do you accomplish this with freeRADIUS + Active Directory? Any help would be much appreciated. Thank you, TBrady

5 11

FreeRadius (version 2.1.12) + ntlm_auth (AD) authentication + LDAP authorization
by Matthew Ceroni 10 Jan '13

10 Jan '13

Hi: I am running FreeRadius version 2.1.12 on a CentOS 6 machine. For authentication I am using AD (ntlm_auth) and this works create. In the the request the username is sent as just the plain username (ie: mceroni) and the NT-domain (ie: DOMAIN1). And it authenticates fine. My problem is on the authorization side in which I am using LDAP to grab the groups a user is in. In order to authentication against ldap my bind DN has to be DOMAIN\username (ie: DOMAIN1\mceroni). I am wondering how I modify the User-Name or Stripped user name just for the LDAP authorization part so make it DOMAIN\username but keep it as is for the authentication part. Everything I have done so far ends up changing it for both authentication and authorization. (In /etc/raddb/sites-enabled/inner and default in the authorize section I have a update request Stripped-User-Name section. Since authorize runs before authenticate it modifies the user name for the authentications) Thanks

2 4

Active Directory + LDAP + groups for dynamic VLAN assignment
by Matthew Ceroni 10 Jan '13

10 Jan '13

Hi: I am using FreeRadius version 2.1.12 on CentOS6. I am authenticating against Active Directory (that works). And authorizing against LDAP (that works as well). I am trying to return attributes, used for VLAN assignment, based on the usersDN. In my /etc/raddb/sites-enabled/default (and inner-tunnel) I have the following # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap if (control:Ldap-UserDn =~ /OU=QA/) { update reply { Tunnel-Type:1 := 13 Tunnel-Medium-Type:1 := 6 Tunnel-Private-Group-Id:1 := 7 } } elsif (control:Ldap-UserDn =~ /OU=IT/) { update reply { Tunnel-Type:1 := 13 Tunnel-Medium-Type:1 := 6 Tunnel-Private-Group-Id:1 := 2 } } else { update reply { Tunnel-Type:1 := 13 Tunnel-Medium-Type:1 := 6 Tunnel-Private-Group-Id:1 := 21 } } In the authorize section. That works, when authorize is done it queries LDAP successfully. Looking through the radius debug I see the IF statements processing: rad_recv: Access-Request packet from host 127.0.0.1 port 48400, id=0, length=122 User-Name = "mceroni" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c016d6365726f6e69 Message-Authenticator = 0xc429bf6a61dfc3cf27f1b6dc84f4e558 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mceroni", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "mceroni", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for mceroni [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> mceroni [ldap] expand: (samAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (samAccountName=mceroni) [ldap] expand: ou=Clairmail OU,dc=clairmail,dc=local -> ou=Clairmail OU,dc=clairmail,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to cmad01.clairmail.local:389, authentication 0 [ldap] bind as svnadmin(a)clairmail.local/iBis93sLit+ to cmad01.clairmail.local:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=Clairmail OU,dc=clairmail,dc=local, with filter (samAccountName=mceroni) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user mceroni authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (control:Ldap-UserDn =~ /OU=QA/) ? Evaluating (control:Ldap-UserDn =~ /OU=QA/) -> FALSE ++? if (control:Ldap-UserDn =~ /OU=QA/) -> FALSE ++? elsif (control:Ldap-UserDn =~ /OU=IT/) ? Evaluating (control:Ldap-UserDn =~ /OU=IT/) -> TRUE ++? elsif (control:Ldap-UserDn =~ /OU=IT/) -> TRUE ++- entering elsif (control:Ldap-UserDn =~ /OU=IT/) {...} +++[reply] returns ok And it appears to set the attributes: +[pap] returns noop ++? if ("%{request:User-Name}" =~ /^host\/(.*).clairmail.local$/) expand: %{request:User-Name} -> mceroni ? Evaluating ("%{request:User-Name}" =~ /^host\/(.*).clairmail.local$/) -> FALSE ++? if ("%{request:User-Name}" =~ /^host\/(.*).clairmail.local$/) -> FALSE Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 48400 Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "2" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2a1689d42a17904c9b87561fac99b7b3 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 48400, id=1, length=250 User-Name = "mceroni" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201007a198000000070160301006b01000067030150ee101279602ec4eddc8d6cfc926da85eee0e034a2c20ea6abd4fd75e1ea55500003a00390038008800870035008400160013000a00330032009a009900450044002f00960041000500040015001200090014001100080006000300ff0100000400230000 State = 0x2a1689d42a17904c9b87561fac99b7b3 Message-Authenticator = 0x0a3e365c6cd7a8ae795def8cb962360e But in the final response those attributes are not there. Sending Access-Accept of id 9 to 127.0.0.1 port 48400 MS-MPPE-Recv-Key = 0xf318d3dd21910be1544fd848af03baebe4f23ae85b786100b02b967d4cc1761e MS-MPPE-Send-Key = 0xa01a409bf3f54388c69613c576e657605022285909917ddbee9e52e776c3b0e1 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mceroni" Any help would be appreciated. Thanks

2 1

Instantiation failed for module "sql" Errors initializing modules
by Elizabeth Fife 09 Jan '13

09 Jan '13

Hi I am using MAC OSX server. I was checking out the inbuilt freeradius. I have not altered files related to this service and simply tried radiusd -X The following error was received FreeRADIUS Version 2.1.3, for host i386-apple-darwin10.0, built on Apr 11 2011 at 17:19:07 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /private/etc/raddb/radiusd.conf including configuration file /private/etc/raddb/proxy.conf including configuration file /private/etc/raddb/clients.conf including files in directory /private/etc/raddb/modules/ including configuration file /private/etc/raddb/modules/acct_unique including configuration file /private/etc/raddb/modules/always including configuration file /private/etc/raddb/modules/attr_filter including configuration file /private/etc/raddb/modules/attr_rewrite including configuration file /private/etc/raddb/modules/chap including configuration file /private/etc/raddb/modules/checkval including configuration file /private/etc/raddb/modules/counter including configuration file /private/etc/raddb/modules/detail including configuration file /private/etc/raddb/modules/detail.example.com including configuration file /private/etc/raddb/modules/detail.log including configuration file /private/etc/raddb/modules/digest including configuration file /private/etc/raddb/modules/echo including configuration file /private/etc/raddb/modules/etc_group including configuration file /private/etc/raddb/modules/exec including configuration file /private/etc/raddb/modules/expiration including configuration file /private/etc/raddb/modules/expr including configuration file /private/etc/raddb/modules/files including configuration file /private/etc/raddb/modules/inner-eap including configuration file /private/etc/raddb/modules/ippool including configuration file /private/etc/raddb/modules/krb5 including configuration file /private/etc/raddb/modules/ldap including configuration file /private/etc/raddb/modules/linelog including configuration file /private/etc/raddb/modules/logintime including configuration file /private/etc/raddb/modules/mac2ip including configuration file /private/etc/raddb/modules/mac2vlan including configuration file /private/etc/raddb/modules/mschap including configuration file /private/etc/raddb/modules/opendirectory including configuration file /private/etc/raddb/modules/pam including configuration file /private/etc/raddb/modules/pap including configuration file /private/etc/raddb/modules/passwd including configuration file /private/etc/raddb/modules/perl including configuration file /private/etc/raddb/modules/policy including configuration file /private/etc/raddb/modules/preprocess including configuration file /private/etc/raddb/modules/radutmp including configuration file /private/etc/raddb/modules/realm including configuration file /private/etc/raddb/modules/smbpasswd including configuration file /private/etc/raddb/modules/sql_log including configuration file /private/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /private/etc/raddb/modules/sradutmp including configuration file /private/etc/raddb/modules/unix including configuration file /private/etc/raddb/modules/wimax including configuration file /private/etc/raddb/eap.conf including configuration file /private/etc/raddb/sql.conf including configuration file /private/etc/raddb/sql/sqlite/dialup.conf including configuration file /private/etc/raddb/sql/mysql/counter.conf including configuration file /private/etc/raddb/policy.conf including files in directory /private/etc/raddb/sites-enabled/ including configuration file /private/etc/raddb/sites-enabled/default including configuration file /private/etc/raddb/sites-enabled/inner-tunnel including dictionary file /private/etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/private/var" logdir = "/private/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/private/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/private/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_sqlite" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/private/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #0 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #1 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #2 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #3 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_sqlite: sqlite3_prepare() = 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database /private/etc/raddb/sqlite_radius_client_database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql_sqlite: sqlite3_prepare() = 1 rlm_sql (sql): failed after re-connect rlm_sql (sql): database query error, SELECT id,nasname,shortname,type,secret FROM nas: (null) rlm_sql (sql): Released sql socket id: 4 Failed to load clients from SQL. rlm_sql (sql): Closing sqlsocket 4 rlm_sql_sqlite: sql_destroy_socket noop. rlm_sql (sql): Closing sqlsocket 3 rlm_sql_sqlite: sql_destroy_socket noop. rlm_sql (sql): Closing sqlsocket 2 rlm_sql_sqlite: sql_destroy_socket noop. rlm_sql (sql): Closing sqlsocket 1 rlm_sql_sqlite: sql_destroy_socket noop. rlm_sql (sql): Closing sqlsocket 0 rlm_sql_sqlite: sql_destroy_socket noop. /private/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" Errors initializing modules Never having used the service before I am surprised. Is there something I should do first to prepare before running radius -X Thanks

3 3

Different BaseDN for User/Group Objects in rlm_ldap
by Rudolph Bott 09 Jan '13

09 Jan '13

Hi List, we are currently using rlm_ldap to check against a LDAP backend, which works fine so far. rlm_ldap is configured to use a BaseDN of "ou=poeple,dc=example,dc=org". We have also specified a group membership filter and are trying to enforce group memberships via the combination of huntgroups-file and Ldap-Group-Settings in the users file. According to debug output, this seems to work (since freeradius is trying to find the groups specified in the users file). However, our groups are stored underneath "ou=groups,dc=example,dc=org" - so rlm_ldap is not able to find them with the basedn shown above. We are also not able to change the basedn to something else, since there is a different user-tree underneath dc=example,dc=org which should not be taken into account by freeradius. Is there is possibility to set a different basedn for group lookups OR another feasable solution (e.g. modify the filter...?). Filter and groupmembership_filter are currently set to: filter = "(uid=%{Stripped-User-Name:-%{mschap:User-Name}})" groupname_attribute = cn groupmembership_filter = "(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{mschap:User-Name}})" Debug output states this: rlm_ldap: performing search in ou=poeple,dc=example,dc=org, with filter (&(cn=GROUP-NAME-FROM-USERS-FILE)(objectClass=posixGroup)(memberUid=LOGIN-USER)) Thanks in advance for your help! -- Mit freundlichen Grüßen / with kind regards Rudolph Bott

4 7

Re: Instantiation failed for module "sql" Errors initializing modules
by Alan Buxey 09 Jan '13

09 Jan '13

Hi, Are you running as root? alan

1 0

Re: Failure with "TLS authentication" and "Freeradius on Fefora-17"
by Alan Buxey 09 Jan '13

09 Jan '13

The certs resulting from a make install and initial run of 'radiusd -X' are valid and will work. alan

1 0