- Freeradius-Users - lists.freeradius.org

Debian build the freeradius package with unixodbc support
by Dominick Rivard 23 Nov '12

23 Nov '12

Hi, Here is what I am trying to achieve, we want to install freeradius using a Microsoft SQL backend. I read on the internet that we need to achieve this goal using the unixodbc driver. I am able to set up the unixodbc driver from apt-get and if I configure Freetds to use it. After the installation and configs I can run the test command: isql -v DVSQLServer USERNAME PASSWORD +---------------------------------------+ | Connected! | | sql-statement | help [tablename] | quit | +---------------------------------------+ This is actually working. But I found out downloading the freeradius tarbal that it can't use the rlm_sql_unixodbc driver, because in the debian/rules file they compile it using the flag: --without-rlm_sql_unixodbc I thought it would be easy to remove the flag from debian/rules and just build my own package using the command line: fakeroot dpkg-buildpackage -b -uc But it is failing with error: checking for SQLConnect in -lodbc... no checking for sql.h... yes configure: error: set --without-rlm_sql_unixodbc to disable it explicitly. configure: error: ./configure failed for ./drivers/rlm_sql_unixodbc configure: error: ./configure failed for src/modules/rlm_sql make: *** [config.status] Error 1 dpkg-buildpackage: error: debian/rules build gave error exit status 2 Do you have any idea of what I am missing to compile it successfully? I can also tell you that I ran these apt-get command to make sure I was having all the dependencies. apt-get build-dep -y unixodbc freetds-bin freetds-common freetds-dev tdsodbc freeradius apt-get install -y unixodbc freetds-bin freetds-common freetds-dev tdsodbc libssl-dev dpkg-dev Regards Dominick Dominick Rivard, Solutions Architect 5275 Queen Mary Montréal, Qc H3W 1Y3 Tel: 514-385-4448 ext 126 Fax: 514-385-6660 Notice: This message is confidential and privileged. If you are not the addressee, please inform the sender by return e-mail immediately and delete this message and destroy all copies. Avis : Ce message est confidentiel et protégé par le secret professionnel. Si vous nêtes pas le destinataire, veuillez informer lexpéditeur par courrier électronique immédiatement et effacer ce message et en détruire toute copie.

2 4

problem with test aaa-server in ciscoasa
by studyfordo 23 Nov '12

23 Nov '12

Hi,all I have install freeradius-server-2.2.0, and make test such as ./ratest test test 127.0.0.1 0 testing123. the result is ok. so i ass user tsb to users file as following format. tsb Auth-Type := Local, User-Password == "12345678" and add asa ip to clients. client X.X.X.X{ secret = testvpn shortname =asa5520 } complete this I do testing in asa5520 like this test asa-server authencation RadiusVPN host X.X.X.X username tsb password 12345678 hint Authentication Rejected: AAA failure I debug it. the folloing is details. FO: Attempting Authentication test to IP address <192.168.4.145> (timeout: 12 seconds) radius mkreq: 0xbeaf alloc_rip 0x74e172b4 new request 0xbeaf --> 68 (0x74e172b4) got user 'tsb' got password add_req 0x74e172b4 session 0xbeaf id 68 RADIUS_REQUEST radius.c: rad_mkpkt RADIUS packet decode (authentication request) -------------------------------------- Raw packet data (length = 61)..... 01 44 00 3d 96 17 04 ed 22 b3 70 e9 6e 0f 9c a5 | .D.=....".p.n... 7a 2b 88 21 01 05 74 73 62 02 12 c1 64 1a 52 c7 | z+.!..tsb...d.R. 3f 73 72 16 82 39 8a 0a e0 24 20 04 06 c0 a8 1e | ?sr..9...$ ..... fe 05 06 00 00 00 3c 3d 06 00 00 00 05 | ......<=..... Parsed packet data..... Radius: Code = 1 (0x01) Radius: Identifier = 68 (0x44) Radius: Length = 61 (0x003D) Radius: Vector: 961704ED22B370E96E0F9CA57A2B8821 Radius: Type = 1 (0x01) User-Name Radius: Length = 5 (0x05) Radius: Value (String) = 74 73 62 | tsb Radius: Type = 2 (0x02) User-Password Radius: Length = 18 (0x12) Radius: Value (String) = c1 64 1a 52 c7 3f 73 72 16 82 39 8a 0a e0 24 20 | .d.R.?sr..9...$ Radius: Type = 4 (0x04) NAS-IP-Address Radius: Length = 6 (0x06) Radius: Value (IP Address) = 192.168.30.254 (0xC0A81EFE) Radius: Type = 5 (0x05) NAS-Port Radius: Length = 6 (0x06) Radius: Value (Hex) = 0x3C Radius: Type = 61 (0x3D) NAS-Port-Type Radius: Length = 6 (0x06) Radius: Value (Hex) = 0x5 send pkt 192.168.4.145/1812 rip 0x74e172b4 state 7 id 68 rad_vrfy() : response message verified rip 0x74e172b4 : chall_state '' : state 0x7 : reqauth: 96 17 04 ed 22 b3 70 e9 6e 0f 9c a5 7a 2b 88 21 : info 0x74e173ec session_id 0xbeaf request_id 0x44 user 'tsb' response '***' app 0 reason 0 skey 'testvpn' sip 192.168.4.145 type 1 RADIUS packet decode (response) -------------------------------------- Raw packet data (length = 20)..... 03 44 ERROR: Authentication Rejected: AAA failure TSBA6-5520-Int# 00 14 35 f4 1a 63 3a 45 ca bd 4f 52 85 73 | .D..5..c:E..OR.s 5c e2 f2 22 | \.." Parsed packet data..... Radius: Code = 3 (0x03) Radius: Identifier = 68 (0x44) Radius: Length = 20 (0x0014) Radius: Vector: 35F41A633A45CABD4F5285735CE2F222 rad_procpkt: REJECT RADIUS_DELETE remove_req 0x74e172b4 session 0xbeaf id 68 free_rip 0x74e172b4 radius: send queue empty

3 2

FreeRADIUS and databases
by Yann R. Moupinda 23 Nov '12

23 Nov '12

Hi guys, shortly i realized a successful eap-sim authentication test using a simple flat file 'simtriplets.dat' containing the triplets. Now i want let Freeradius to use a mysql database or in best case a sqlite database if possible. The sqlite3 database containing the sim information (triplets) is located on another linux board. Does anybody have any idea how i can manage it? best regards Yann

3 2

rlm_perl without DynaLoader
by Julius Plenz 22 Nov '12

22 Nov '12

Hi, when using rlm_perl with a very simple Perl script that does *not* use DynaLoader to load some *.so files, upon thread exit, FreeRADIUS (current v2.x.x branch) throws errors: Error: Could not get @DynaLoader::dl_librefs for unloading. The errors originate from rlm_perl_get_handles(), which is invoked via pthread_key_create(key, rlm_destroy_perl): https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm… Adding an (otherwise useless) 'require DynaLoader;' to the Perl script fixes the errors. Why is this an error case, rather than "no libs, no unloading necessary"? Thanks, Julius

2 3

vendor number of dictionary not working
by Meike Stone 22 Nov '12

22 Nov '12

Hello, I try to include a additional dictionary from fdXtended via $INCLUDE /etc/raddb/dictionary.fdXtended in the dirctionary file. I get the error: including dictionary file /etc/raddb/dictionary Errors reading dictionary: dict_init: /etc/raddb/dictionary.fdXtended[1]: dict_init: /etc/raddb/dictionary.fdXtended[1]: dict_init: The file /etc/raddb/dictionary.fdXtended looks like: ======================================== VENDOR fdXtended 34536 BEGIN-VENDOR fdXtended ATTRIBUTE fdXtended-Bandwidth-Up 1 integer ATTRIBUTE fdXtended-Bandwidth-Down 2 integer ATTRIBUTE fdXtended-PostAuthURL 3 string ATTRIBUTE fdXtended-One2onenat-IP 4 string ATTRIBUTE fdXtended-ContentFilter 5 integer ATTRIBUTE fdXtended-NetworkPolicy 6 integer ATTRIBUTE fdXtended-BytesDown 7 integer ATTRIBUTE fdXtended-BytesUp 8 integer ATTRIBUTE fdXtended-Expiration 9 string ATTRIBUTE fdXtended-SessionTimeout 10 integer ATTRIBUTE fdXtended-Wan-Interface 11 string END-VENDOR fdXtended ======================================= The number of the dictionary is reserved by IANA (http://www.iana.org/assignments/enterprise-numbers) and correct. So I tried other numbers and realized, that only numbers are accepted, who are smaller than 2^15. The largest working number is 32766. What is going wrong here? Thanks Meike

2 2

Freeradiux -X tells me it's in use how to get the log back?
by Tzvika Gelber 22 Nov '12

22 Nov '12

I need to see the connection log when users login to the radius i was using freeradius -X and it was working great yesterday it started giving this error : } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to authentication address * port 1812: Address already in use /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 how do i free it so i will get the log again? (I am running in superuser mode.) Thank you -- ____ Sometimes you just glow in the dark...

3 2

Debian (Squeeze) FreeRadius package missing config files
by David Gethings 21 Nov '12

21 Nov '12

Hi All, It appears that the Debian package for freeradius 2.1.10 does not install the configuration files. At least that is what is happening on my system. As I try to resolve this is it possible to get a copy of the config files from some other location? -- Cheers Dg

4 5

Error: [ldap] All ldap connections are in use
by Phil Brown 21 Nov '12

21 Nov '12

We have started seeing problems our radius server with the Error "Error: [ldap] All ldap connections are in use" We have increased the "ldap_connections_number" from 5 to 20 which has largely resolved the issue. we now receive over 100,000 authentications a day, is there any guide to "ldap_connections_number" for the number of authentications or should we just keep increasing the number until the issue goes away

2 1

Reject all calls from one or more Calling Station ID regardless of username or password
by Henrik Karlsson 21 Nov '12

21 Nov '12

Hi guys, I am a quite new user of the Free Radius Server and i have a problem. I have an old Dial In system. I want to reject all calls from one or more Calling Station ID regardless of username or password. I have tried to edit the user file like this USERNAME Calling-Station-Id == 404402704, Auth-Type := Reject The line a bow is based on the username and that is not what I want, I want that all users from Callingstation ID 404402704 shall be rejected. Have you guys got some suggestion how to solve my problem? /Henrik

2 1

EAP-TLS error: RSA_padding_check_PKCS1_type_1:block type is not 01
by Swaraj 21 Nov '12

21 Nov '12

>> I'm using Freeradius server2.1.12 on x86 fedora14. My client is using >> (armel ubuntu 10.04 lucid) IMX53 board. When I try connecting to radius >> server I am receiving the following errors. > The client is broken. It's not doing SSL correctly. > >> Do we require different certificates for arm boards, as I was able to >> run without any issues on x86 with same certificates. > Because it has different software. May I know, what is that different software? >> Tue Nov 20 16:48:05 2012 : Error: TLS Alert write:fatal:decrypt error >> Tue Nov 20 16:48:05 2012 : Error: TLS_accept: failed in SSLv3 read >> certificate verify B >> Tue Nov 20 16:48:05 2012 : Error: rlm_eap: SSL error error:0407006A:rsa >> routines:RSA_padding_check_PKCS1_type_1:block type is not 01 > You CANNOT fix this by poking FreeRADIUS. > >> I created certificates with the following commands: > This is NOT a certificate issue. Notice that the error is NOT > complaining about certificates. > > And why use your own commands to create certs? The scripts in > raddb/certs WORK. > > Alan DeKok. > Regards, Swaraj

1 0