- Freeradius-Users - lists.freeradius.org

Freeradius Installaion error
by QASIM RAO 12 Nov '12

12 Nov '12

hi, i am installing freeradius and configuring with ./configure --disable-libltdl-install --with-system-libtool while running make command giving following error gcc: md5.lo: No such file or directorygcc: print.lo: No such file or directorygcc: radius.lo: No such file or directorygcc: rbtree.lo: No such file or directorygcc: sha1.lo: No such file or directorygcc: snprintf.lo: No such file or directorygcc: token.lo: No such file or directorygcc: udpfromto.lo: No such file or directorygcc: valuepair.lo: No such file or directorygcc: unrecognized option '-release'gcc: unrecognized option '-rpath'gmake[4]: [libradius.la] Error 1 (ignored)gmake[4]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/lib'Making all in modules...gmake[4]: Entering directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules'gmake[5]: Entering directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules'Making all in rlm_acct_unique...gmake[6]: Entering directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules/rlm_acct_unique'mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/root/radiusd/Radius/iptv-radius/radius-iptv/src/include -c rlm_acct_unique.cmode=link gcc -release 1.1.6 \ -module -export-dynamic -o rlm_acct_unique.la \ -rpath /usr/local/lib rlm_acct_unique.lo rlm_acct_unique.c /root/radiusd/Radius/iptv-radius/radius-iptv/src/lib/libradius.la \ -lnsl -lresolv -lpthreadgcc: 1.1.6: No such file or directorygcc: rlm_acct_unique.lo: No such file or directorygcc: /root/radiusd/Radius/iptv-radius/radius-iptv/src/lib/libradius.la: No such file or directorygcc: unrecognized option '-release'gcc: unrecognized option '-rpath'cc1: error: unrecognized command line option "-module"gmake[6]: [rlm_acct_unique.la] Error 1 (ignored)gmake[6]: *** [build-module] Error 1gmake[6]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules/rlm_acct_unique'gmake[5]: *** [common] Error 2gmake[5]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules'gmake[4]: *** [all] Error 2gmake[4]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src/modules'gmake[3]: *** [common] Error 2gmake[3]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src'gmake[2]: *** [all] Error 2gmake[2]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv/src'gmake[1]: *** [common] Error 2gmake[1]: Leaving directory `/root/radiusd/Radius/iptv-radius/radius-iptv'make: *** [all] Error 2 is this configure error or any other error in radius Regards Qasim Rao

3 2

Best way to capture RADIUS passwords
by Chris Taylor 12 Nov '12

12 Nov '12

I am migrating from one RADIUS setup that checks against a flat file with usernames and passwords inside it . Over to a RADIUS server with and LDAP backend. I have used JTR to crack most of the passwords but I still have some left over that JTR cant crack. I was thinking of trying to run a packet capture to get the remaining usernames and passwords. What would be the best way to do this? Run RADIUS in debug mode Radius -X? Or try to use tcpdump and pick it up that way or is it even possible to do? I have been trolling the internet for a few days and have not come up with a good way to do it. I setup tcpdump to dump to a file (tcpdump -i eth0 -n -s0 port radius -w rad-capture.lpc) , but when I check it out with wireshark I am unable to see the password (just the username). Am I going about this the wrong way? Thanks, Chris

5 5

help with DHCP server functionality
by Duane Cox 12 Nov '12

12 Nov '12

List: Hello. I have been working on this for a few days and have turned here for help. The server is listening on port 67 and when a DHCP packet comes in the server processes it, but in debug mode it give an error "No Pool-Name defined". I have done some reading and I have added the following to the users file (for testing purposes). DEFAULT Pool-Name := main_pool Fall-Through = Yes This doesn't seem to define the Pool-Name nor do I see where the server is processing any sql queries to determine the Pool-Name either. Am I mistaken? I thought that I could get a DHCP packet to be received/processed by the server and hand out a response. Thanks in advance, Duane Cox debug: Received DHCP-Discover of id 9daef956 from 10.11.156.70:68 to 10.12.100.90:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 1 DHCP-Transaction-Id = 2645490006 DHCP-Number-of-Seconds = 56 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 10.11.152.62 DHCP-Client-Hardware-Address = 00:d0:b7:c0:f6:8a DHCP-Message-Type = DHCP-Discover DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Hostname server dhcp { Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} ++[reply] returns noop ++[reply] returns noop [mac2ip] Added DHCP-Your-IP-Address: '10.11.152.1' to reply_items ++[mac2ip] returns ok ++- entering policy dhcp_sqlippool.post-auth {...} expand: DHCP-%{DHCP-Client-Hardware-Address} -> DHCP-00:d0:b7:c0:f6:8a expand: %{DHCP-Client-Hardware-Address} -> 00:d0:b7:c0:f6:8a expand: %{DHCP-Gateway-IP-Address} -> 10.11.152.62 expand: %{%{DHCP-Gateway-IP-Address}:-127.0.0.1} -> 10.11.152.62 +++[request] returns ok [dhcp_sqlippool] No Pool-Name defined. [dhcp_sqlippool] expand: DHCP: No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> DHCP: No Pool-Name defined (did cli 00:d0:b7:c0:f6:8a port user DHCP-00:d0:b7:c0:f6:8a) DHCP: No Pool-Name defined (did cli 00:d0:b7:c0:f6:8a port user DHCP-00:d0:b7:c0:f6:8a) +++[dhcp_sqlippool] returns noop +++? if (ok) ? Evaluating (ok) -> FALSE +++? if (ok) -> FALSE ++- policy dhcp_sqlippool.post-auth returns noop ++[ok] returns ok } # server dhcp DHCP-Subnet-Mask = 255.255.255.192 DHCP-Router-Address = 10.11.152.62 DHCP-Domain-Name-Server = 4.2.2.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.12.100.90 Sending DHCP-Offer of id 9daef956 to 10.11.152.62:68 Finished request 6. Cleaning up request 6 ID -1649477290 with timestamp +219 Going to the next request Ready to process requests.

2 4

Dialup admin lingering sessions
by Serge Paquin 12 Nov '12

12 Nov '12

Hello, I'm having an issue from time to time where a PPPoE session will drop and relogin which is fine but the "Online Users" doesn't seem to clear the old session. I check on the NAS and there is only the 1 session active. Not sure how to properly clear stale sessions. Serge.

1 0

accounting data
by Periko Support 11 Nov '12

11 Nov '12

Hi. Centos 5.x FreeRadius 2.1.1. I'm reading the book freeradius beginners Guide chapter 6: accounting. Page 139. Amount of Time. I have follow the book, would like to setup my freeradius and be able to manage users time per day. Following the book, it say that to test we better setup 3 files: start session stop session Make some changes to freeradius config files. Now, with this things ready, I follow the steps to see how it works: step 7) auth user. step 8)

2 5

Debian 6.0.6 amd64 freeradius + xl2tpd + strongswan ipsec
by Dmitry Korzhevin 11 Nov '12

11 Nov '12

Hello guys, Can you please advice good howto/guide to configure l2tp with radius server? I am already have configured pptp (poptop) and ipsec (strongSwan) on server, getting user logins and passwords from file. Now planning to use freeradius for auth. Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

2 1

ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user
by Shravan S G 11 Nov '12

11 Nov '12

Hi all, I am trying to configure FreeRadius 2.2.0. I am trying to test with the radtest utility. However, when I run radtest, on my radiusd server, I get the following error - "ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user". I know this is some issue with the authentication part. However, I have not been able to pinpoint the problem. Also, I haven't been able to find any relevant solutions on the web. I have just untarred the 2.2.0 tarball, and added just one line the users file: gokul Cleartext-Password:="abcde" Below is the output on the server and the client side: Server: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 47080, id=238, length=75 User-Name = "gokul" User-Password = "abcde" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0xf92ae1fda2ea8f435d95c4a7294e1e55 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "gokul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> gokul attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 238 to 127.0.0.1 port 47080 Waking up in 4.9 seconds. Cleaning up request 0 ID 238 with timestamp +19 Ready to process requests. Client: shravan@ubuntu:~/freeradius-server-2.2.0/raddb$ sudo radtest gokul abcde localhost 0 testing123 [sudo] password for shravan: Sending Access-Request of id 238 to 127.0.0.1 port 1812 User-Name = "gokul" User-Password = "abcde" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=238, length=20 shravan@ubuntu:~/freeradius-server-2.2.0/raddb$ This is m first attempt at using FreeRadius, so please let me know if I have made any rookie mistakes. :) Thanks in advance. Shravan

3 3

Concatenating/inserting strings with backslashes
by Brian Candler 10 Nov '12

10 Nov '12

Here's something weird. I'm trying to concatenate some strings which contain <backslash> <n> (i.e. not a newline). In a normal string literal, I have to enter four backslashes: update reply { Reply-Message := "a\\\\nb" } ("\\n" gives a newline, "\\\n" gives backslash followed by newline) But when I try to insert one string into another it goes completely haywire. update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\nbaz" } This gives me "foo" <newline> "bar" <newline> "baz". That is, even the second \\\\n is being collapsed into a newline! Some more test cases: update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "qux\\\\nbaz" } correctly gives me "qux" <backslash> <n> "baz" update reply { Reply-Message := "foo\\\\nbar" } update reply { Reply-Message := "%{Wibble:-qux}\\\\nbaz" } gives me <newline> "baz". In fact, I need *eight* backslashes to get a literal backslash here: Reply-Message := "%{Wibble:-qux}\\\\\\\\nbaz" So somehow, the presence of a string expansion within a string affects the interpretation of subsequent backslashes within that string. Now, this works: update reply { Reply-Message := "foo\\\\\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\\\\\nbaz" } But then if I do another layer of string insertion they get translated to newlines again. update reply { Reply-Message := "foo\\\\\\\\nbar" } update reply { Reply-Message := "%{reply:Reply-Message}\\\\\\\\nbaz" } update reply { Reply-Message := "%{reply:Reply-Message}" } This seems pretty broken to me, but if someone would care to explain how to deal with it, please do. Or is there another way I can concatenate strings, which doesn't involve expanding them into another string? Thanks, Brian.

4 5

LDAP group child domain
by Menard, Yannick 10 Nov '12

10 Nov '12

Hi, I'm in an active directory domain with child domain, tata as my primary, and toto as my child domain. I'm doing authorization based on LDAP group. My User connect to freeradius using 802.1x and PEAP. Using mschap and ntlm this is working great. Now I want to give users access/or radius attribute based on their active directory group. I was able to do this using the LDAP module and users file. The problem I am have now is; If I have a user group with the same name in my primary domain (tata) and in my child domain (toto.tata), the freeradius does not seems to see the difference (for exemple the domain users group). In user file my LDAP policy look like that: DEFAULT Ldap-Group == "groupname" What I would like to do is write it like that: DEFAULT Ldap-Group == "cn=groupname, ou=OUofGroup, dc=toto, dc=tata" I'm pretty sure I have to work with those config in ldap: groupname_attribute groupmembership_filter groupmembership_attribute right now they are like that: groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf If anyone got some insight on how to solve this problem, I would greatly appreciate. Thank you, Yann ---------------------------------------------------------------------------------------------------------- Ce courriel a �t� filtr� par ModusGate et Webshield afin de le certifier comme l�gitime et exempt de virus.

2 1

Aliased IPs
by James Devine 09 Nov '12

09 Nov '12

I have a freeradius server which has multiple IPs aliased on the same interface. This works if I specify each IP explicitly in its own listen { } section but if I try to listen on * all responses are sent from the same IP regardless of which IP the request was received on.

2 2