- Freeradius-Users - lists.freeradius.org

RADGROUPREPLY QUERY NOT EXECUTED
by Mada 09 Sep '12

09 Sep '12

Have tried several version builds on Centos 5.x - currently using FR 2.1.12 rlm_mysql stops after the group check query and does not execute the group reply query. 19:00:43 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply Sun Sep 9 19:00:43 2012 : Info: [sql] expand: SELECT groupname FROM usergroup Sun Sep 9 19:00:43 2012 : Info: [sql] expand: SELECT id, groupname, attribute,Value, op FROM radgroupcheck Sun Sep 9 19:00:43 2012 : Debug: rlm_sql (sql): Released sql socket id: 4 Queries are listed during module instantiation and queries work when run manually. Have seen similar unresolved thread. Greatly appreciate any help. Thanks ________________________________________________________________ Message sent using DataCom.MW 1.2.0

4 4

TLS / SSL negotiation fails when behind Cisco IP phone
by Dan Lundström 09 Sep '12

09 Sep '12

Hi! We are using EAP/TLS for wired authentication on our networks, in one of our sites the SSL negotiation fails when the client is connected behind a Cisco 7962 IP phone. We have this same setup working on other sites. The phone model varies between the sites, but I cannot find any information about incompatibilities for the particular phone model saying it should be the phone that is causing the problem. I figured that the problem was caused by fragmentation but after adjusting the fragment_size parameter in eap.conf, according to the comments..; # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. ..without any result, i am not sure anymore. When I connect the client directly to a switch port, without the IP phone in-between, everything works perfect. Here comes the relevant part of RADIUS debug output, first session - Without IP phone, directly connected to the switch [ client -> switch ]; ------------------------------------------------------------------------------ Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0b2e], Certificate [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Root CA [tls] --> subject = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Sub CA [tls] --> subject = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=0, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = US-LAPJAMIESON.us.xxxx.yyy [tls] --> subject = /CN=US-LAPJAMIESON.us.xxxx.yyy [tls] --> issuer = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> verify return:1 [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully SSL Connection Established ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ Second part - With IP phone in-between [ client -> ipphone -> switch ]; ------------------------------------------------------------------------------ Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0b2e], Certificate [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Root CA [tls] --> subject = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Sub CA [tls] --> subject = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 --> verify error:num=7:certificate signature failure [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01 SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/US-LAPJAMIESON.us.xxxx.yyy attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 11 Sending Access-Reject of id 50 to 192.168.207.202 port 1812 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ I am stuck, any suggestions would be much appreciated. Brgds, //Dan

2 4

Re: smsotpd
by Thomas Glanzmann 09 Sep '12

09 Sep '12

Hello Franks, * Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> [2012-09-09 01:19]: > The first thing I'm not clear on is the function of the "users" file > that's related to the Berkeley_db script. I'm not sure I understand why > it's needed. Is this a database of acceptable users that have access to > the OTP function? exactly that function has two purposes: - The list of persons that can authenticate via Kerberos for the first stage of the authentication if you exchange it with somewthing else - The Number lookup > Could this be set during an ldap group lookup perhaps, using an > inbuilt freeradius attribute? Exactly. You could do a ldap lookup in FreeRadius and pass that as variable to the module, so that it could use that. > The module seems to implement its own Kerberos authentication lookup - > is this correct? It's not implementing it's own but using a perl Kerberos library, but you're correct that it does it's own Kerberos authentication and not in FreeRadius. The only reason it does so, is that I can account how many logins went wrong and than block authentication requests to the active directory, because in my case the active directory would lock the account which would make a deny of service attack possible if you know a username. > Would an ntlm lookup also be possible by messing with the perl code > and using the ntlm include instead of authen-krb5? Yes, that is possible, you can exchange it basically with everything you want, you can also do the first stage of the authentication in FreeRadius and use the perl module soley for smsotp. > Do you have any plans to write something more "generic", i.e. without > the hard coded users file or file paths for other functions? At the moment I do not have the intention, however I probably will release a much more generic version without the password locking and that does the first stage of the authentication in FreeRadius > Or is it just a proof of concept? I actually run it in pre production environment for 1500 users. > Also do you plan some in-depth documentation? I also started in the wiki for the C-Implementation, but for anyone who understands PAP and PAP access challenge and Radius it is basically self explenatory, however this process took me almost 5 workdays myself. My FreeRadius knowlegde is limited, I used FreeRadius with eap-tls, 802.1q, 802.1x, Cisco ASA, Cisco 3560G, Cisco 2910, VMware View, Linux embedded devices and Citrix Netscaler. > This module tied to freeradius could be extremely useful to our > organisation but I'm not sure if at this point I understand it well > enough or whether it will be robust in use. In production I had no problems and approx. 285 authentication requests already. I also ran an automated self test against it, both for the C and perl implementation for 24 hours and saw no problems. However in your case I would first to try to make it work, than develop an automated self test and if you feel comfortably enough to use, use it. > I'd like ideally to use freeradius to do an ldap lookup, cross > reference a group of users with access to OTP, bring back an > email/phone number attribute through the ldap module and then use this > in the OTP processing, whilst also doing some mysql / other sql > storage of users' authentication details using OTP to fault find/audit > from. I'll not implement it, but if I would do that, it would take me less than 4 hours. Basically what you need is to modify the rlm_perl implementation to only handle the pap access challenge and pass the information it needs using the already existing interface of rlm_perl (which is super powerful). > Is this the kind of thing you might look at in the future or should I > go and get linotp / rcdevs product? I'm quite busy for the next 5 days, if you want to wait 5 days, I could make something generic available and also document it. Of course, if you don't feel comfortable with it at the moment, go for another solution. Cheers, Thomas

1 0

Recommendations for a GUI front end for FreeRadius
by Ken Morley 07 Sep '12

07 Sep '12

FreeRadius is a great product that works very well, but is difficult for novices to maintain. I don't have any problems using the Linux shell and vi to configure, but I need something more user friendly for others. Can anyone recommend an open-source GUI for FreeRadius - preferably something that runs as an Apache web site under Linux? Thanks for any suggestions! Ken Morley

3 2

Transform reject to accept response with specific attributes
by Kostas Zorbadelos 07 Sep '12

07 Sep '12

Greetings to all, I would like to achieve the following functionality: in case a user's AUTHENTICATION fails, the user should not be rejected but be given an accept response with specific attributes. The reason behind this is to provide a captive portal functionality for users having wrong credentials in their CPEs. Could you provide a few hints for how the config would look like (I am thinking of something in terms of unlang and utilizing virtual servers but I am not sure how it would look like. Regards, Kostas -- Kostas Zorbadelos twitter:@kzorbadelos http://gr.linkedin.com/in/kzorba ---------------------------------------------------------------------------- () www.asciiribbon.org - against HTML e-mail & proprietary attachments /\

3 3

PEAP failure problem
by Ana Gallardo Gómez 07 Sep '12

07 Sep '12

Hello, I'm using FreeRADIUS version 2.1.10 I would like to return diferent values of a personal atribute (Codigo-Reject) in a Access-Reject. I would like to do this in PEAPv0, EAP-TTLS-PAP and EAP-TTLS-MsCHAPv2 With my configuration I can return Codigo-Reject in EAP-TTLS-PAP and EAP-TTLS-MsCHAPv2 but I can't in PEAP. My config: cat /etc/freeradius/users ... DEFAULT Intentos-Reject > 10, Auth-Type := Reject Reply-Message += "NUMERO DE INTENTOS FALLIDOS (%{Intentos-Reject}) EXCEDIDO PARA %{%{Stripped-User-Name}:-%{User-Name}}", Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject, Fall-Through = yes ... cat /etc/freeradius/sites-enabled/e server e { authorize { auth_log suffix files eap { ok = return } } authenticate { eap } post-auth { ... Post-Auth-Type REJECT { update reply { Codigo-Reject = Credenciales-Erroneas } sql{ fail=1 } if (fail) { ... } } #server e cat /etc/freeradius/sites-enabled/inner-tunnel server inner-tunnel { authorize { update outer.request { User-Name := "%u" } mschap auth_log suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } if ("%{Realm}"=='test.es'){ update request { Intentos-Reject = "%{sql:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'}" Intentos-Reject += "%{sqlradiusba:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'}" } } files if ("%{control:Auth-Type}" == 'Reject') { update outer.reply { Codigo-Reject = "%{reply:Codigo-Reject}" } reject } ... pap } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } post-auth { sql{ fail=1 } if (fail) { ... } reply_log } } # -inner-tunnel server block LOG EAP-TTLS-PAP: Fri Aug 24 13:37:07 2012 : Info: [ttls] Got tunneled request User-Name = "prueba(a)test.es" User-Password = "530" FreeRADIUS-Proxied-To = 127.0.0.1 Fri Aug 24 13:37:07 2012 : Info: [ttls] Sending tunneled request User-Name = "prueba(a)test.es" User-Password = "530" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02:00:00:00:00:01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { Fri Aug 24 13:37:07 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel Fri Aug 24 13:37:07 2012 : Info: +- entering group authorize {...} Fri Aug 24 13:37:07 2012 : Info: expand: %u -> prueba(a)test.es Fri Aug 24 13:37:07 2012 : Info: ++[outer.request] returns notfound Fri Aug 24 13:37:07 2012 : Info: ++[mschap] returns noop Fri Aug 24 13:37:07 2012 : Info: [auth_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/08/24/1.2.3.4-auth-detail-20120824 Fri Aug 24 13:37:07 2012 : Info: [auth_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/08/24/1.2.3.4-auth-detail-20120824 Fri Aug 24 13:37:07 2012 : Info: [auth_log] expand: %t -> Fri Aug 24 13:37:07 2012 Fri Aug 24 13:37:07 2012 : Info: ++[auth_log] returns ok Fri Aug 24 13:37:07 2012 : Info: [suffix] Looking up realm "test.es" for User-Name = "prueba(a)test.es" Fri Aug 24 13:37:07 2012 : Info: [suffix] Found realm "test.es" Fri Aug 24 13:37:07 2012 : Info: [suffix] Adding Stripped-User-Name = "prueba" Fri Aug 24 13:37:07 2012 : Info: [suffix] Adding Realm = "test.es" Fri Aug 24 13:37:07 2012 : Info: [suffix] Authentication realm is LOCAL. Fri Aug 24 13:37:07 2012 : Info: ++[suffix] returns ok Fri Aug 24 13:37:07 2012 : Info: ++[control] returns ok Fri Aug 24 13:37:07 2012 : Info: [eap] No EAP-Message, not doing EAP Fri Aug 24 13:37:07 2012 : Info: ++[eap] returns noop Fri Aug 24 13:37:07 2012 : Info: ++? if ("%{Realm}"=='test.es') Fri Aug 24 13:37:07 2012 : Info: expand: %{Realm} -> test.es Fri Aug 24 13:37:07 2012 : Info: ?? Evaluating ("%{Realm}"=='test.es') -> TRUE Fri Aug 24 13:37:07 2012 : Info: ++? if ("%{Realm}"=='test.es') -> TRUE Fri Aug 24 13:37:07 2012 : Info: ++- entering if ("%{Realm}"=='test.es') {...} Fri Aug 24 13:37:07 2012 : Info: sql_xlat Fri Aug 24 13:37:07 2012 : Info: expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:37:07 2012 : Info: expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:37:07 2012 : Info: sql_set_user escaped user --> 'prueba' Fri Aug 24 13:37:07 2012 : Info: expand: SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject' -> SELECT COUNT(*) from radpostauth WHERE username = 'prueba(a)test.es' AND authdate > CURRENT_DATE and reply = 'Access-Reject' Fri Aug 24 13:37:07 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Fri Aug 24 13:37:07 2012 : Info: sql_xlat finished Fri Aug 24 13:37:07 2012 : Debug: rlm_sql (sql): Released sql socket id: 3 Fri Aug 24 13:37:07 2012 : Info: expand: %{sql:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'} -> 26 Fri Aug 24 13:37:07 2012 : Info: sql_xlat Fri Aug 24 13:37:07 2012 : Info: expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:37:07 2012 : Info: expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:37:07 2012 : Info: sql_set_user escaped user --> 'prueba' Fri Aug 24 13:37:07 2012 : Info: expand: SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject' -> SELECT COUNT(*) from radpostauth WHERE username = 'prueba(a)test.es' AND authdate > CURRENT_DATE and reply = 'Access-Reject' Fri Aug 24 13:37:07 2012 : Debug: rlm_sql (sqlradiusba): Reserving sql socket id: 4 Fri Aug 24 13:37:08 2012 : Info: sql_xlat finished Fri Aug 24 13:37:08 2012 : Debug: rlm_sql (sqlradiusba): Released sql socket id: 4 Fri Aug 24 13:37:08 2012 : Info: expand: %{sqlradiusba:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'} -> 0 Fri Aug 24 13:37:08 2012 : Info: +++[request] returns noop Fri Aug 24 13:37:08 2012 : Info: ++- if ("%{Realm}"=='test.es') returns noop Fri Aug 24 13:37:08 2012 : Info: [files] users: Matched entry DEFAULT at line 29 Fri Aug 24 13:37:08 2012 : Info: [files] expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:37:08 2012 : Info: [files] expand: NUMERO DE INTENTOS FALLIDOS (%{Intentos-Reject}) EXCEDIDO PARA %{%{Stripped-User-Name}:-%{User-Name}} -> NUMERO DE INTENTOS FALLIDOS (26) EXCEDIDO PARA prueba Fri Aug 24 13:37:08 2012 : Info: [files] users: Matched entry DEFAULT at line 36 Fri Aug 24 13:37:08 2012 : Info: ++[files] returns ok Fri Aug 24 13:37:08 2012 : Info: ++? if ("%{control:Auth-Type}" == 'Reject') Fri Aug 24 13:37:08 2012 : Info: expand: %{control:Auth-Type} -> Reject Fri Aug 24 13:37:08 2012 : Info: ? Evaluating ("%{control:Auth-Type}" == 'Reject') -> TRUE Fri Aug 24 13:37:08 2012 : Info: ++? if ("%{control:Auth-Type}" == 'Reject') -> TRUE Fri Aug 24 13:37:08 2012 : Info: ++- entering if ("%{control:Auth-Type}" == 'Reject') {...} Fri Aug 24 13:37:08 2012 : Info: expand: %{reply:Codigo-Reject} -> Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:37:08 2012 : Info: +++[outer.reply] returns ok Fri Aug 24 13:37:08 2012 : Info: +++[reject] returns reject Fri Aug 24 13:37:08 2012 : Info: ++- if ("%{control:Auth-Type}" == 'Reject') returns reject } # server inner-tunnel Fri Aug 24 13:37:08 2012 : Info: [ttls] Got tunneled reply code 3 Reply-Message += "NUMERO DE INTENTOS FALLIDOS (26) EXCEDIDO PARA prueba" Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:37:08 2012 : Info: [ttls] Got tunneled Access-Reject Fri Aug 24 13:37:08 2012 : Info: [eap] Handler failed in EAP/ttls Fri Aug 24 13:37:08 2012 : Info: [eap] Failed in EAP select Fri Aug 24 13:37:08 2012 : Info: ++[eap] returns invalid Fri Aug 24 13:37:08 2012 : Info: Failed to authenticate the user. Fri Aug 24 13:37:08 2012 : Info: } # server Fri Aug 24 13:37:08 2012 : Info: Using Post-Auth-Type Reject Fri Aug 24 13:37:08 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/ Fri Aug 24 13:37:08 2012 : Info: +- entering group REJECT {...} Fri Aug 24 13:37:08 2012 : Info: ++[reply] returns noop Fri Aug 24 13:37:08 2012 : Info: [sql] expand: %{Stripped-User-Name} -> Fri Aug 24 13:37:08 2012 : Info: [sql] ... expanding second conditional Fri Aug 24 13:37:08 2012 : Info: [sql] expand: %{User-Name} -> prueba(a)test.es Fri Aug 24 13:37:08 2012 : Info: [sql] expand: %{%{User-Name}:-DEFAULT} -> prueba(a)test.es Fri Aug 24 13:37:08 2012 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba(a)test.es Fri Aug 24 13:37:08 2012 : Info: [sql] sql_set_user escaped user --> ' prueba(a)test.es' Fri Aug 24 13:37:08 2012 : Info: [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radiuscc') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('prueba(a)test.es'), LOWER('02:00:00:00:00:01'), 'CAU1', 'Access-Reject', NOW(), 'Cuenta-Bloqueada-Intentos-Reject','radiuscc') Fri Aug 24 13:37:08 2012 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('prueba(a)test.es'), LOWER('02:00:00:00:00:01'), 'CAU1', 'Access-Reject', NOW(), 'Cuenta-Bloqueada-Intentos-Reject','radiuscc') Fri Aug 24 13:37:08 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Fri Aug 24 13:37:08 2012 : Debug: rlm_sql (sql): Released sql socket id: 2 Fri Aug 24 13:37:08 2012 : Info: ++[sql] returns ok Fri Aug 24 13:37:08 2012 : Info: ++? if (fail) Fri Aug 24 13:37:08 2012 : Info: ? Evaluating (fail) -> FALSE Fri Aug 24 13:37:08 2012 : Info: ++? if (fail) -> FALSE Sending Access-Reject of id 8 to 1.2.3.4 port 53575 Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 LOG PEAP: Fri Aug 24 13:20:41 2012 : Debug: PEAP: Setting User-Name to prueba(a)test.es Sending tunneled request EAP-Message = 0x0208001501303237343736333240756e65782e6573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "prueba(a)test.es" NAS-IP-Address = 2.2.2.2 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Framed-MTU = 1400 Calling-Station-Id = "C4:46:19:75:7B:B1" Called-Station-Id = "00-18-6E-D0-EC-04" NAS-Identifier = "Enterprise Wireless AP" server inner-tunnel { Fri Aug 24 13:20:41 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel Fri Aug 24 13:20:41 2012 : Info: +- entering group authorize {...} Fri Aug 24 13:20:41 2012 : Info: expand: %u -> prueba(a)test.es Fri Aug 24 13:20:41 2012 : Info: ++[outer.request] returns notfound Fri Aug 24 13:20:41 2012 : Info: ++[mschap] returns noop Fri Aug 24 13:20:41 2012 : Info: [auth_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/08/24/2.2.2.2-auth-detail-20120824 Fri Aug 24 13:20:41 2012 : Info: [auth_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/08/24/2.2.2.2-auth-detail-20120824 Fri Aug 24 13:20:41 2012 : Info: [auth_log] expand: %t -> Fri Aug 24 13:20:41 2012 Fri Aug 24 13:20:41 2012 : Info: ++[auth_log] returns ok Fri Aug 24 13:20:41 2012 : Info: [suffix] Looking up realm "test.es" for User-Name = "prueba(a)test.es" Fri Aug 24 13:20:41 2012 : Info: [suffix] Found realm "test.es" Fri Aug 24 13:20:41 2012 : Info: [suffix] Adding Stripped-User-Name = "prueba" Fri Aug 24 13:20:41 2012 : Info: [suffix] Adding Realm = "test.es" Fri Aug 24 13:20:41 2012 : Info: [suffix] Authentication realm is LOCAL. Fri Aug 24 13:20:41 2012 : Info: ++[suffix] returns ok Fri Aug 24 13:20:41 2012 : Info: ++[control] returns ok Fri Aug 24 13:20:41 2012 : Info: [eap] EAP packet type response id 8 length 21 Fri Aug 24 13:20:41 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri Aug 24 13:20:41 2012 : Info: ++[eap] returns updated Fri Aug 24 13:20:41 2012 : Info: ++? if ("%{Realm}"=='test.es') Fri Aug 24 13:20:41 2012 : Info: expand: %{Realm} -> test.es Fri Aug 24 13:20:41 2012 : Info: ?? Evaluating ("%{Realm}"=='test.es') -> TRUE Fri Aug 24 13:20:41 2012 : Info: ++? if ("%{Realm}"=='test.es') -> TRUE Fri Aug 24 13:20:41 2012 : Info: ++- entering if ("%{Realm}"=='test.es') {...} Fri Aug 24 13:20:41 2012 : Info: sql_xlat Fri Aug 24 13:20:41 2012 : Info: expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:20:41 2012 : Info: expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:20:41 2012 : Info: sql_set_user escaped user --> 'prueba' Fri Aug 24 13:20:41 2012 : Info: expand: SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject' -> SELECT COUNT(*) from radpostauth WHERE username = 'prueba(a)test.es' AND authdate > CURRENT_DATE and reply = 'Access-Reject' Fri Aug 24 13:20:41 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Fri Aug 24 13:20:42 2012 : Info: sql_xlat finished Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sql): Released sql socket id: 3 Fri Aug 24 13:20:42 2012 : Info: expand: %{sql:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'} -> 7 Fri Aug 24 13:20:42 2012 : Info: sql_xlat Fri Aug 24 13:20:42 2012 : Info: expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:20:42 2012 : Info: expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:20:42 2012 : Info: sql_set_user escaped user --> 'prueba' Fri Aug 24 13:20:42 2012 : Info: expand: SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject' -> SELECT COUNT(*) from radpostauth WHERE username = 'prueba(a)test.es' AND authdate > CURRENT_DATE and reply = 'Access-Reject' Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sqlradiusba): Reserving sql socket id: 4 Fri Aug 24 13:20:42 2012 : Info: sql_xlat finished Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sqlradiusba): Released sql socket id: 4 Fri Aug 24 13:20:42 2012 : Info: expand: %{sqlradiusba:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'} -> 0 Fri Aug 24 13:20:42 2012 : Info: +++[request] returns updated Fri Aug 24 13:20:42 2012 : Info: ++- if ("%{Realm}"=='test.es') returns updated Fri Aug 24 13:20:42 2012 : Info: [files] users: Matched entry DEFAULT at line 29 Fri Aug 24 13:20:42 2012 : Info: [files] expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:20:42 2012 : Info: [files] expand: NUMERO DE INTENTOS FALLIDOS (%{Intentos-Reject}) EXCEDIDO PARA %{%{Stripped-User-Name}:-%{User-Name}} -> NUMERO DE INTENTOS FALLIDOS (7) EXCEDIDO PARA prueba Fri Aug 24 13:20:42 2012 : Info: [files] users: Matched entry DEFAULT at line 36 Fri Aug 24 13:20:42 2012 : Info: ++[files] returns ok Fri Aug 24 13:20:42 2012 : Info: ++? if ("%{control:Auth-Type}" == 'Reject') Fri Aug 24 13:20:42 2012 : Info: expand: %{control:Auth-Type} -> Reject Fri Aug 24 13:20:42 2012 : Info: ? Evaluating ("%{control:Auth-Type}" == 'Reject') -> TRUE Fri Aug 24 13:20:42 2012 : Info: ++? if ("%{control:Auth-Type}" == 'Reject') -> TRUE Fri Aug 24 13:20:42 2012 : Info: ++- entering if ("%{control:Auth-Type}" == 'Reject') {...} Fri Aug 24 13:20:42 2012 : Info: expand: %{reply:Codigo-Reject} -> Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:20:42 2012 : Info: +++[outer.reply] returns ok Fri Aug 24 13:20:42 2012 : Info: +++[reject] returns reject Fri Aug 24 13:20:42 2012 : Info: ++- if ("%{control:Auth-Type}" == 'Reject') returns reject } # server inner-tunnel Fri Aug 24 13:20:42 2012 : Info: [peap] Got tunneled reply code 3 Reply-Message += "NUMERO DE INTENTOS FALLIDOS (7) EXCEDIDO PARA prueba" Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:20:42 2012 : Info: [peap] Got tunneled reply RADIUS code 3 Reply-Message += "NUMERO DE INTENTOS FALLIDOS (7) EXCEDIDO PARA prueba" Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:20:42 2012 : Info: [peap] Tunneled authentication was rejected. Fri Aug 24 13:20:42 2012 : Info: [peap] FAILURE Fri Aug 24 13:20:42 2012 : Info: ++[eap] returns handled Fri Aug 24 13:20:42 2012 : Info: } # server Sending Access-Challenge of id 32 to 2.2.2.2 port 1500 Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject EAP-Message = 0x0109002b190017030100205f329253b5d9c4913c1f8f6f154f9d8771fa5a48be2993d753c9848b55710216 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcbd9304bccd029a9cfcde266d7e75d03 Fri Aug 24 13:20:42 2012 : Info: Finished request 7. Fri Aug 24 13:20:42 2012 : Debug: Going to the next request Fri Aug 24 13:20:42 2012 : Debug: Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 2.2.2.2 port 1501, id=33, length=205 NAS-IP-Address = 2.2.2.2 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Framed-MTU = 1400 User-Name = "prueba(a)test.es" Calling-Station-Id = "C4-46-19-75-7B-B1" Called-Station-Id = "00-18-6E-D0-EC-04" NAS-Identifier = "Enterprise Wireless AP" State = 0xcbd9304bccd029a9cfcde266d7e75d03 EAP-Message = 0x0209002b19001703010020d99c0d3ff24027b3d2f3d9ff6b999c50343b16224b5ea431c4f061165e9d7bbd Message-Authenticator = 0x9ea3d3262c5cf1762dfcc08226e0ff14 Fri Aug 24 13:20:42 2012 : Info: server { Fri Aug 24 13:20:42 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/ Fri Aug 24 13:20:42 2012 : Info: +- entering group authorize {...} Fri Aug 24 13:20:42 2012 : Info: ++? if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) Fri Aug 24 13:20:42 2012 : Info: expand: %{request:Calling-Station-Id} -> C4-46-19-75-7B-B1 Fri Aug 24 13:20:42 2012 : Info: ? Evaluating ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i) -> TRUE Fri Aug 24 13:20:42 2012 : Info: ++? if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) -> TRUE Fri Aug 24 13:20:42 2012 : Info: ++- entering if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) {...} Fri Aug 24 13:20:42 2012 : Info: expand: %{1}:%{2}:%{3}:%{4}:%{5}:%{6} -> C4:46:19:75:7B:B1 Fri Aug 24 13:20:42 2012 : Info: +++[request] returns notfound Fri Aug 24 13:20:42 2012 : Info: ++- if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) returns notfound Fri Aug 24 13:20:42 2012 : Info: [auth_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/08/24/2.2.2.2-auth-detail-20120824 Fri Aug 24 13:20:42 2012 : Info: [auth_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/08/24/2.2.2.2-auth-detail-20120824 Fri Aug 24 13:20:42 2012 : Info: [auth_log] expand: %t -> Fri Aug 24 13:20:42 2012 Fri Aug 24 13:20:42 2012 : Info: ++[auth_log] returns ok Fri Aug 24 13:20:42 2012 : Info: [suffix] Looking up realm "test.es" for User-Name = "prueba(a)test.es" Fri Aug 24 13:20:42 2012 : Info: [suffix] Found realm "test.es" Fri Aug 24 13:20:42 2012 : Info: [suffix] Adding Stripped-User-Name = "prueba" Fri Aug 24 13:20:42 2012 : Info: [suffix] Adding Realm = "test.es" Fri Aug 24 13:20:42 2012 : Info: [suffix] Authentication realm is LOCAL. Fri Aug 24 13:20:42 2012 : Info: ++[suffix] returns ok Fri Aug 24 13:20:42 2012 : Info: [files] users: Matched entry DEFAULT at line 36 Fri Aug 24 13:20:42 2012 : Info: ++[files] returns ok Fri Aug 24 13:20:42 2012 : Info: [eap] EAP packet type response id 9 length 43 Fri Aug 24 13:20:42 2012 : Info: [eap] Continuing tunnel setup. Fri Aug 24 13:20:42 2012 : Info: ++[eap] returns ok Fri Aug 24 13:20:42 2012 : Info: Found Auth-Type = eap Fri Aug 24 13:20:42 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/ Fri Aug 24 13:20:42 2012 : Info: +- entering group authenticate {...} Fri Aug 24 13:20:42 2012 : Info: [eap] Request found, released from the list Fri Aug 24 13:20:42 2012 : Info: [eap] EAP/peap Fri Aug 24 13:20:42 2012 : Info: [eap] processing type peap Fri Aug 24 13:20:42 2012 : Info: [peap] processing EAP-TLS Fri Aug 24 13:20:42 2012 : Info: [peap] eaptls_verify returned 7 Fri Aug 24 13:20:42 2012 : Info: [peap] Done initial handshake Fri Aug 24 13:20:42 2012 : Info: [peap] eaptls_process returned 7 Fri Aug 24 13:20:42 2012 : Info: [peap] EAPTLS_OK Fri Aug 24 13:20:42 2012 : Info: [peap] Session established. Decoding tunneled attributes. Fri Aug 24 13:20:42 2012 : Info: [peap] Peap state send tlv failure Fri Aug 24 13:20:42 2012 : Info: [peap] Received EAP-TLV response. Fri Aug 24 13:20:42 2012 : Info: [peap] The users session was previously rejected: returning reject (again.) Fri Aug 24 13:20:42 2012 : Info: [peap] *** This means you need to read the PREVIOUS messages in the debug output Fri Aug 24 13:20:42 2012 : Info: [peap] *** to find out the reason why the user was rejected. Fri Aug 24 13:20:42 2012 : Info: [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. Fri Aug 24 13:20:42 2012 : Info: [peap] *** what went wrong, and how to fix the problem. Fri Aug 24 13:20:42 2012 : Info: [eap] Handler failed in EAP/peap Fri Aug 24 13:20:42 2012 : Info: [eap] Failed in EAP select Fri Aug 24 13:20:42 2012 : Info: ++[eap] returns invalid Fri Aug 24 13:20:42 2012 : Info: Failed to authenticate the user. Fri Aug 24 13:20:42 2012 : Info: } # server Fri Aug 24 13:20:42 2012 : Info: Using Post-Auth-Type Reject Fri Aug 24 13:20:42 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/ Fri Aug 24 13:20:42 2012 : Info: +- entering group REJECT {...} Fri Aug 24 13:20:42 2012 : Info: ++[reply] returns noop Fri Aug 24 13:20:42 2012 : Info: [sql] expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:20:42 2012 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:20:42 2012 : Info: [sql] sql_set_user escaped user --> 'prueba' Fri Aug 24 13:20:42 2012 : Info: [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radiuscc') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('prueba(a)test.es'), LOWER('C4:46:19:75:7B:B1'), 'PACCIPV601I', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radiuscc') Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('prueba(a)test.es'), LOWER('C4:46:19:75:7B:B1'), 'PACCIPV601I', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radiuscc') Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sql): Released sql socket id: 2 Fri Aug 24 13:20:42 2012 : Info: ++[sql] returns ok Fri Aug 24 13:20:42 2012 : Info: ++? if (fail) Fri Aug 24 13:20:42 2012 : Info: ? Evaluating (fail) -> FALSE Fri Aug 24 13:20:42 2012 : Info: ++? if (fail) -> FALSE Fri Aug 24 13:20:42 2012 : Info: Delaying reject of request 8 for 1 seconds Fri Aug 24 13:20:42 2012 : Debug: Going to the next request Fri Aug 24 13:20:42 2012 : Debug: Waking up in 0.9 seconds. Fri Aug 24 13:20:43 2012 : Info: Sending delayed reject for request 8 Sending Access-Reject of id 33 to 2.2.2.2 port 1501 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Codigo-Reject = Credenciales-Erroneas Any ideas about how can I do that? Thank you very much and sorry for my english Ana Gallardo

4 6

distinguish between revoked and expired certificates
by Wegener, Norbert 07 Sep '12

07 Sep '12

Is it possible to distinguish between expired and revoked certificates and assign a special vlan in the first case while rejecting the user in the second one? As in both cases the certificate is invalid, I suppose the answer is no. The probably best way would be to organize the the renewal of certificates appropriately. With best regards, ________________________________ Norbert Wegener

3 2

Re: Freeradius 2.1.12 with EAP-FAST compilation issues
by Swaraj 07 Sep '12

07 Sep '12

On 09/06/2012 03:53 PM, freeradius-devel-request(a)lists.freeradius.org wrote: > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. Re: Freeradius 2.1.12 with EAP-FAST compilation issues (Swaraj) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 06 Sep 2012 15:53:26 +0530 > From: Swaraj<swaraj.vutturi(a)redpinesignals.com> > To:freeradius-devel@lists.freeradius.org > Subject: Re: Freeradius 2.1.12 with EAP-FAST compilation issues > Message-ID:<5048799E.8030704(a)redpinesignals.com> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > > > On 09/05/2012 03:30 PM,freeradius-devel-request(a)lists.freeradius.org > wrote: >> > Send Freeradius-Devel mailing list submissions to >> > freeradius-devel(a)lists.freeradius.org >> > >> > To subscribe or unsubscribe via the World Wide Web, visit >> > http://lists.freeradius.org/mailman/listinfo/freeradius-devel >> > or, via email, send a message with subject or body 'help' to >> > freeradius-devel-request(a)lists.freeradius.org >> > >> > You can reach the person managing the list at >> > freeradius-devel-owner(a)lists.freeradius.org >> > >> > When replying, please edit your Subject line so it is more specific >> > than "Re: Contents of Freeradius-Devel digest..." >> > >> > >> > Today's Topics: >> > >> > 1. Re: Freeradius 2.1.12 with EAP-FAST compilation issues (Swaraj) >> > 2. Re: Freeradius 2.1.12 with EAP-FAST compilation issues >> > (Alan DeKok) >> > >> > >> > ---------------------------------------------------------------------- >> > >> > Message: 1 >> > Date: Wed, 05 Sep 2012 11:31:52 +0530 >> > From: Swaraj<swaraj.vutturi(a)redpinesignals.com> >> > To:freeradius-devel@lists.freeradius.org >> > Cc: Swaraj<swaraj.vutturi(a)redpinesignals.com> >> > Subject: Re: Freeradius 2.1.12 with EAP-FAST compilation issues >> > Message-ID:<5046EAD0.9060108(a)redpinesignals.com> >> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" >> > >> > >> > Hi All, >> > >> > I was using freeradius-server 2.1.12 without any issues till now, but >> > now i wanted to use EAP-FAST in freeradius server. So i started >> > compiling rlm_eap2 module, but i got lot of errors releated to >> > libeap.so. Some how i fixed all issues related to liaeap.so with >> > hostapd. Currently i'm stuck with these kind of errors am unable to >> > proceed further. I require some help to resolve these. >> > >> > I used >> > ./configure --with-experimental-modules --with-rlm_eap2 LIBS="-ldl" >> > make >> > >> > I get the following error message: >> > ---------------------------------------------- >> > gmake[6]: Leaving directory >> > `/backup/freeradius-server-2.1.12/src/modules/rlm_eap' >> > Making all in rlm_eap2... >> > /usr/bin/gmake -w -C rlm_eap2 all >> > gmake[6]: Entering directory >> > `/backup/freeradius-server-2.1.12/src/modules/rlm_eap2' >> > /backup/freeradius-server-2.1.12/libtool --mode=compile gcc -g -O2 >> > -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG >> > -I/backup/freeradius-server-2.1.12/src >> > -I/backup/freeradius-server-2.1.12/libltdl >> > -I/backup/freeradius-server-2.1.12/libltdl >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server >> > -I/home/livecd/Downloads/hostapd-0.7.3/src >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/common >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c >> > gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS >> > -DNDEBUG -I/backup/freeradius-server-2.1.12/src >> > -I/backup/freeradius-server-2.1.12/libltdl >> > -I/backup/freeradius-server-2.1.12/libltdl >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server >> > -I/home/livecd/Downloads/hostapd-0.7.3/src >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/common >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c -fPIC >> > -DPIC -o .libs/rlm_eap2.o >> > rlm_eap2.c: In function 'eap_instantiate': >> > rlm_eap2.c:622:2: warning: implicit declaration of function >> > 'eap_server_register_methods' >> > rlm_eap2.c: In function 'eap_authenticate': >> > rlm_eap2.c:962:41: warning: pointer targets in assignment differ in >> > signedness >> > rlm_eap2.c:963:35: warning: pointer targets in assignment differ in >> > signedness >> > gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS >> > -DNDEBUG -I/backup/freeradius-server-2.1.12/src >> > -I/backup/freeradius-server-2.1.12/libltdl >> > -I/backup/freeradius-server-2.1.12/libltdl >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server >> > -I/home/livecd/Downloads/hostapd-0.7.3/src >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/common >> > -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c -o >> > rlm_eap2.o>/dev/null 2>&1 >> > /backup/freeradius-server-2.1.12/libtool --mode=link gcc -release 2.1.12 \ >> > -module -export-dynamic -o rlm_eap2 \ >> > -rpath /usr/local/lib rlm_eap2.lo rlm_eap2.c >> > /backup/freeradius-server-2.1.12/src/lib/libfreeradius-radius.la >> > /home/livecd/Downloads/hostapd-0.7.3/eap_example/libeap.so -lnsl >> > -lresolv -ldl -lpthread >> > libtool: link: warning: `-release' is ignored for programs >> > gcc -o .libs/rlm_eap2 .libs/rlm_eap2.o rlm_eap2.c >> > /home/livecd/Downloads/hostapd-0.7.3/eap_example/libeap.so >> > -Wl,--export-dynamic >> > /backup/freeradius-server-2.1.12/src/lib/.libs/libfreeradius-radius.so >> > -lnsl -lresolv -ldl -lpthread -Wl,--rpath -Wl,/usr/local/lib >> > /tmp/cchrL0fh.o:(.data+0x0): multiple definition of `debug_flag' >> > .libs/rlm_eap2.o:(.data+0x0): first defined here >> > /tmp/cchrL0fh.o:(.bss+0x0): multiple definition of `request_log_file' >> > .libs/rlm_eap2.o:/backup/freeradius-server-2.1.12/src/modules/rlm_eap2/rlm_eap2.c:465: >> > first defined here >> > /tmp/cchrL0fh.o:(.bss+0x4): multiple definition of `debug_log_file' >> > .libs/rlm_eap2.o:/backup/freeradius-server-2.1.12/src/modules/rlm_eap2/rlm_eap2.c:467: >> > first defined here >> > /tmp/cchrL0fh.o:(.data+0x160): multiple definition of `rlm_eap2' >> > .libs/rlm_eap2.o:(.data.rel.local+0x0): first defined here >> > /usr/lib/gcc/i686-redhat-linux/4.5.1/../../../crt1.o: In function `_start': >> > (.text+0x18): undefined reference to `main' >> > .libs/rlm_eap2.o: In function `eap_authenticate': >> > rlm_eap2.c:(.text+0x21a): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x230): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x4a9): undefined reference to `radius_pairmake' >> > rlm_eap2.c:(.text+0x526): undefined reference to `radius_pairmake' >> > rlm_eap2.c:(.text+0xa26): undefined reference to `log_debug' >> > rlm_eap2.c:(.text+0xa4b): undefined reference to `log_debug' >> > rlm_eap2.c:(.text+0xa6a): undefined reference to `log_debug' >> > rlm_eap2.c:(.text+0xab0): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0xcfb): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0xd16): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0xe1a): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0xe60): undefined reference to `radlog' >> > .libs/rlm_eap2.o: In function `eap_instantiate': >> > rlm_eap2.c:(.text+0x1065): undefined reference to `cf_section_parse' >> > rlm_eap2.c:(.text+0x10ce): undefined reference to >> > `eap_server_register_methods' >> > rlm_eap2.c:(.text+0x10f1): undefined reference to `cf_subsection_find_next' >> > rlm_eap2.c:(.text+0x1143): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x115d): undefined reference to `cf_subsection_find_next' >> > rlm_eap2.c:(.text+0x1173): undefined reference to `cf_section_name1' >> > rlm_eap2.c:(.text+0x12df): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x12f5): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x1362): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x13ac): undefined reference to `radlog' >> > /tmp/cchrL0fh.o: In function `eaplist_add': >> > rlm_eap2.c:(.text+0xfb): undefined reference to `rad_assert_fail' >> > rlm_eap2.c:(.text+0x121): undefined reference to `rad_assert_fail' >> > rlm_eap2.c:(.text+0x2de): undefined reference to `radlog' >> > /tmp/cchrL0fh.o: In function `eaplist_find': >> > rlm_eap2.c:(.text+0x417): undefined reference to `rad_assert_fail' >> > rlm_eap2.c:(.text+0x599): undefined reference to `radlog' >> > /tmp/cchrL0fh.o: In function `eap_example_server_init_tls': >> > rlm_eap2.c:(.text+0x895): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x8cd): undefined reference to `radlog' >> > /tmp/cchrL0fh.o: In function `eap_instantiate': >> > rlm_eap2.c:(.text+0x935): undefined reference to `cf_section_parse' >> > rlm_eap2.c:(.text+0x9cc): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x9e6): undefined reference to >> > `eap_server_register_methods' >> > rlm_eap2.c:(.text+0xa2e): undefined reference to `cf_subsection_find_next' >> > rlm_eap2.c:(.text+0xa41): undefined reference to `cf_section_name1' >> > rlm_eap2.c:(.text+0xa6f): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0xb3d): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0xbac): undefined reference to `cf_subsection_find_next' >> > rlm_eap2.c:(.text+0xbe5): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0xc20): undefined reference to `radlog' >> > /tmp/cchrL0fh.o: In function `eap_example_server_step': >> > rlm_eap2.c:(.text+0xdbf): undefined reference to `log_debug' >> > rlm_eap2.c:(.text+0xdff): undefined reference to `log_debug' >> > rlm_eap2.c:(.text+0xe7f): undefined reference to `radius_pairmake' >> > rlm_eap2.c:(.text+0xee6): undefined reference to `radius_pairmake' >> > rlm_eap2.c:(.text+0xf47): undefined reference to `log_debug' >> > /tmp/cchrL0fh.o: In function `eap_vp2data': >> > rlm_eap2.c:(.text+0xfc4): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0xfed): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x1048): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x1090): undefined reference to `radlog' >> > rlm_eap2.c:(.text+0x10d9): undefined reference to `radlog' >> > /tmp/cchrL0fh.o:rlm_eap2.c:(.text+0x1116): more undefined references to >> > `radlog' follow >> > /tmp/cchrL0fh.o: In function `eap_authenticate': >> > rlm_eap2.c:(.text+0x165b): undefined reference to `rad_assert_fail' >> > collect2: ld returned 1 exit status >> > gmake[6]: *** [rlm_eap2] Error 1 >> > gmake[6]: Leaving directory >> > `/backup/freeradius-server-2.1.12/src/modules/rlm_eap2' >> > gmake[5]: *** [rlm_eap2] Error 2 >> > gmake[5]: Leaving directory `/backup/freeradius-server-2.1.12/src/modules' >> > gmake[4]: *** [all] Error 2 >> > gmake[4]: Leaving directory `/backup/freeradius-server-2.1.12/src/modules' >> > gmake[3]: *** [modules] Error 2 >> > gmake[3]: Leaving directory `/backup/freeradius-server-2.1.12/src' >> > gmake[2]: *** [all] Error 2 >> > gmake[2]: Leaving directory `/backup/freeradius-server-2.1.12/src' >> > gmake[1]: *** [src] Error 2 >> > gmake[1]: Leaving directory `/backup/freeradius-server-2.1.12' >> > make: *** [all] Error 2 >> > >> > >> > >> > Please help me. >> > >> > If you have some easy procedure for compiling freeradius for EAP-FAST, >> > then please tell me the procedure. >> > >> > -- Regards, Swaraj -------------- next part -------------- An HTML >> > attachment was scrubbed... URL: >> > <http://lists.freeradius.org/pipermail/freeradius-devel/attachments/20120905…> >> > ------------------------------ Message: 2 Date: Wed, 05 Sep 2012 >> > 08:57:31 +0200 From: Alan DeKok<aland(a)deployingradius.com> To: >> > FreeRadius developers mailing list >> > <freeradius-devel(a)lists.freeradius.org> Subject: Re: Freeradius 2.1.12 >> > with EAP-FAST compilation issues Message-ID: >> > <5046F7DB.4040303(a)deployingradius.com> Content-Type: text/plain; >> > charset=ISO-8859-1 Swaraj wrote: >>>> >> > I was using freeradius-server 2.1.12 without any issues till now, but >>>> >> > now i wanted to use EAP-FAST in freeradius server. So i started >>>> >> > compiling rlm_eap2 module, but i got lot of errors releated to >>>> >> > libeap.so. Some how i fixed all issues related to liaeap.so with >>>> >> > hostapd. Currently i'm stuck with these kind of errors am unable to >>>> >> > proceed further. I require some help to resolve these. >>>> >> > >>>> >> > I used >>>> >> > ./configure --with-experimental-modules --with-rlm_eap2 LIBS="-ldl" >>>> >> > make >> > The module doesn't use configure. You need to edit the >> > rlm_eap2/Makefile to get it to build. >> > >> > So... what did you do? >> > >>>> >> > gcc -o .libs/rlm_eap2 .libs/rlm_eap2.o rlm_eap2.c >> > That's wrong. Something screwed up the build. >> > >> > So... what did you change in the Makefile? >> > >> > Alan DeKok. >> > >> > >> > ------------------------------ >> > >> > - >> > List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/devel.html >> > >> > >> > End of Freeradius-Devel Digest, Vol 89, Issue 4 >> > *********************************************** >> > >> > > Hi Alan, > > Thanks for the response. > I dint make any changes in rlm_eap2/Makefile, but just changed hostapd > path. > It looks like this > ********************************* > #HOSTAP = /backup/hostapd/b > HOSTAP = /home/livecd/Downloads/hostapd-0.7.3 > #HOSTAP = /home/livecd/Downloads/hostapd-1.0 > #HOSTAP = /path/to/hostap > > TARGET = rlm_eap2 > SRCS = rlm_eap2.c > HEADERS = > RLM_CFLAGS = $(INCLTDL) -I$(HOSTAP)/src/eap_common \ > -I$(HOSTAP)/src/eap_server -I$(HOSTAP)/src \ > -I$(HOSTAP)/src/common -I$(HOSTAP)/src/utils > RLM_LIBS = $(HOSTAP)/eap_example/libeap.so > > ## this uses the RLM_CFLAGS and RLM_LIBS and SRCS defs to make TARGET. > include ../rules.mak > ******************************** > > I'm compiling hostapd to generate "libeap.so" with hostapd1.0, > hostapd.0.6.x and finally with hostapd.0.7.3.. I faced lot issues while > compiling hostapd and finally when i generated libeap.so, rlm_eap2 > module compilation gave me tons of errors. > > -- > Regards, > Swaraj >

1 0

Problems loading the replicate module
by Sorrell, Chadwick 06 Sep '12

06 Sep '12

Hello, I just recently upgraded my freeradius install from 2.1.9 to 2.1.12, with the purpose of using the replicate module. I'm adding replicate to my accounting section, and then adding Replicate-To-Realm += test1 to my acct_users. Doesn't seem like I've had a chance to misconfigure it, since when I start radiusd -X, I get: Failed to load module "replicate". There isn't much in the log to tell me what is wrong, and I've checked to make sure the module is in the libdir. Any ideas? The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you receive this in error, please contact the sender and destroy any copies of this document.

3 6

balancing sql servers
by Tony Peña 06 Sep '12

06 Sep '12

hi, i'm trying to balance 2 sql servers into my site-available... and searching in some archives old mails, explain about module instatiate section { sql1 sql2 } but in my freeradius config ... that module not appears... version of freeradius: 2.1.10 i check into modules dir, and not see anything about the example of the wiki redundant-load-balance i try with this into modules/sql sql sql1 { all setup about server sql1 } sql sql2 { all setup about server sql2 } and in the site-available/default into accounting section redundat-load-balance { sql1 sql2 } and have freeradiusd -X output: rlm_sql Creating new attribute sql1-SQL-Group rlm_sql: Registering sql_groupcmp for sql1-SQL-Group .... rlm_sql Creating new attribute sql2-SQL-Group rlm_sql: Registering sql_groupcmp for sql1-SQL-Group but last lines /etc/freeradius/sites-available/infomed[428]: Failed to load module "sql". /etc/freeradius/sites-available/infomed[392]: Errors parsing accounting section. in other archive old mail i see write into authorize section. redundant sql { sql1 sql2 } and same error... any ideas.. thanxs in advance. -- Antonio Peña Secure email with PGP 0x8B021001 available at http://pgp.mit.edu Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001

4 11