- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Devel Digest, Vol 89, Issue 5
by Swaraj 06 Sep '12

06 Sep '12

On 09/06/2012 03:53 PM, freeradius-devel-request(a)lists.freeradius.org wrote: > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. Re: Freeradius 2.1.12 with EAP-FAST compilation issues (Swaraj) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 06 Sep 2012 15:53:26 +0530 > From: Swaraj<swaraj.vutturi(a)redpinesignals.com> > To: freeradius-devel(a)lists.freeradius.org > Subject: Re: Freeradius 2.1.12 with EAP-FAST compilation issues > Message-ID:<5048799E.8030704(a)redpinesignals.com> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > > > On 09/05/2012 03:30 PM, freeradius-devel-request(a)lists.freeradius.org > wrote: >> Send Freeradius-Devel mailing list submissions to >> freeradius-devel(a)lists.freeradius.org >> >> To subscribe or unsubscribe via the World Wide Web, visit >> http://lists.freeradius.org/mailman/listinfo/freeradius-devel >> or, via email, send a message with subject or body 'help' to >> freeradius-devel-request(a)lists.freeradius.org >> >> You can reach the person managing the list at >> freeradius-devel-owner(a)lists.freeradius.org >> >> When replying, please edit your Subject line so it is more specific >> than "Re: Contents of Freeradius-Devel digest..." >> >> >> Today's Topics: >> >> 1. Re: Freeradius 2.1.12 with EAP-FAST compilation issues (Swaraj) >> 2. Re: Freeradius 2.1.12 with EAP-FAST compilation issues >> (Alan DeKok) >> >> >> ---------------------------------------------------------------------- >> >> Message: 1 >> Date: Wed, 05 Sep 2012 11:31:52 +0530 >> From: Swaraj<swaraj.vutturi(a)redpinesignals.com> >> To:freeradius-devel@lists.freeradius.org >> Cc: Swaraj<swaraj.vutturi(a)redpinesignals.com> >> Subject: Re: Freeradius 2.1.12 with EAP-FAST compilation issues >> Message-ID:<5046EAD0.9060108(a)redpinesignals.com> >> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" >> >> >> Hi All, >> >> I was using freeradius-server 2.1.12 without any issues till now, but >> now i wanted to use EAP-FAST in freeradius server. So i started >> compiling rlm_eap2 module, but i got lot of errors releated to >> libeap.so. Some how i fixed all issues related to liaeap.so with >> hostapd. Currently i'm stuck with these kind of errors am unable to >> proceed further. I require some help to resolve these. >> >> I used >> ./configure --with-experimental-modules --with-rlm_eap2 LIBS="-ldl" >> make >> >> I get the following error message: >> ---------------------------------------------- >> gmake[6]: Leaving directory >> `/backup/freeradius-server-2.1.12/src/modules/rlm_eap' >> Making all in rlm_eap2... >> /usr/bin/gmake -w -C rlm_eap2 all >> gmake[6]: Entering directory >> `/backup/freeradius-server-2.1.12/src/modules/rlm_eap2' >> /backup/freeradius-server-2.1.12/libtool --mode=compile gcc -g -O2 >> -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG >> -I/backup/freeradius-server-2.1.12/src >> -I/backup/freeradius-server-2.1.12/libltdl >> -I/backup/freeradius-server-2.1.12/libltdl >> -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common >> -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server >> -I/home/livecd/Downloads/hostapd-0.7.3/src >> -I/home/livecd/Downloads/hostapd-0.7.3/src/common >> -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c >> gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS >> -DNDEBUG -I/backup/freeradius-server-2.1.12/src >> -I/backup/freeradius-server-2.1.12/libltdl >> -I/backup/freeradius-server-2.1.12/libltdl >> -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common >> -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server >> -I/home/livecd/Downloads/hostapd-0.7.3/src >> -I/home/livecd/Downloads/hostapd-0.7.3/src/common >> -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c -fPIC >> -DPIC -o .libs/rlm_eap2.o >> rlm_eap2.c: In function 'eap_instantiate': >> rlm_eap2.c:622:2: warning: implicit declaration of function >> 'eap_server_register_methods' >> rlm_eap2.c: In function 'eap_authenticate': >> rlm_eap2.c:962:41: warning: pointer targets in assignment differ in >> signedness >> rlm_eap2.c:963:35: warning: pointer targets in assignment differ in >> signedness >> gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS >> -DNDEBUG -I/backup/freeradius-server-2.1.12/src >> -I/backup/freeradius-server-2.1.12/libltdl >> -I/backup/freeradius-server-2.1.12/libltdl >> -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common >> -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server >> -I/home/livecd/Downloads/hostapd-0.7.3/src >> -I/home/livecd/Downloads/hostapd-0.7.3/src/common >> -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c -o >> rlm_eap2.o>/dev/null 2>&1 >> /backup/freeradius-server-2.1.12/libtool --mode=link gcc -release 2.1.12 \ >> -module -export-dynamic -o rlm_eap2 \ >> -rpath /usr/local/lib rlm_eap2.lo rlm_eap2.c >> /backup/freeradius-server-2.1.12/src/lib/libfreeradius-radius.la >> /home/livecd/Downloads/hostapd-0.7.3/eap_example/libeap.so -lnsl >> -lresolv -ldl -lpthread >> libtool: link: warning: `-release' is ignored for programs >> gcc -o .libs/rlm_eap2 .libs/rlm_eap2.o rlm_eap2.c >> /home/livecd/Downloads/hostapd-0.7.3/eap_example/libeap.so >> -Wl,--export-dynamic >> /backup/freeradius-server-2.1.12/src/lib/.libs/libfreeradius-radius.so >> -lnsl -lresolv -ldl -lpthread -Wl,--rpath -Wl,/usr/local/lib >> /tmp/cchrL0fh.o:(.data+0x0): multiple definition of `debug_flag' >> .libs/rlm_eap2.o:(.data+0x0): first defined here >> /tmp/cchrL0fh.o:(.bss+0x0): multiple definition of `request_log_file' >> .libs/rlm_eap2.o:/backup/freeradius-server-2.1.12/src/modules/rlm_eap2/rlm_eap2.c:465: >> first defined here >> /tmp/cchrL0fh.o:(.bss+0x4): multiple definition of `debug_log_file' >> .libs/rlm_eap2.o:/backup/freeradius-server-2.1.12/src/modules/rlm_eap2/rlm_eap2.c:467: >> first defined here >> /tmp/cchrL0fh.o:(.data+0x160): multiple definition of `rlm_eap2' >> .libs/rlm_eap2.o:(.data.rel.local+0x0): first defined here >> /usr/lib/gcc/i686-redhat-linux/4.5.1/../../../crt1.o: In function `_start': >> (.text+0x18): undefined reference to `main' >> .libs/rlm_eap2.o: In function `eap_authenticate': >> rlm_eap2.c:(.text+0x21a): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x230): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x4a9): undefined reference to `radius_pairmake' >> rlm_eap2.c:(.text+0x526): undefined reference to `radius_pairmake' >> rlm_eap2.c:(.text+0xa26): undefined reference to `log_debug' >> rlm_eap2.c:(.text+0xa4b): undefined reference to `log_debug' >> rlm_eap2.c:(.text+0xa6a): undefined reference to `log_debug' >> rlm_eap2.c:(.text+0xab0): undefined reference to `radlog' >> rlm_eap2.c:(.text+0xcfb): undefined reference to `radlog' >> rlm_eap2.c:(.text+0xd16): undefined reference to `radlog' >> rlm_eap2.c:(.text+0xe1a): undefined reference to `radlog' >> rlm_eap2.c:(.text+0xe60): undefined reference to `radlog' >> .libs/rlm_eap2.o: In function `eap_instantiate': >> rlm_eap2.c:(.text+0x1065): undefined reference to `cf_section_parse' >> rlm_eap2.c:(.text+0x10ce): undefined reference to >> `eap_server_register_methods' >> rlm_eap2.c:(.text+0x10f1): undefined reference to `cf_subsection_find_next' >> rlm_eap2.c:(.text+0x1143): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x115d): undefined reference to `cf_subsection_find_next' >> rlm_eap2.c:(.text+0x1173): undefined reference to `cf_section_name1' >> rlm_eap2.c:(.text+0x12df): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x12f5): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x1362): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x13ac): undefined reference to `radlog' >> /tmp/cchrL0fh.o: In function `eaplist_add': >> rlm_eap2.c:(.text+0xfb): undefined reference to `rad_assert_fail' >> rlm_eap2.c:(.text+0x121): undefined reference to `rad_assert_fail' >> rlm_eap2.c:(.text+0x2de): undefined reference to `radlog' >> /tmp/cchrL0fh.o: In function `eaplist_find': >> rlm_eap2.c:(.text+0x417): undefined reference to `rad_assert_fail' >> rlm_eap2.c:(.text+0x599): undefined reference to `radlog' >> /tmp/cchrL0fh.o: In function `eap_example_server_init_tls': >> rlm_eap2.c:(.text+0x895): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x8cd): undefined reference to `radlog' >> /tmp/cchrL0fh.o: In function `eap_instantiate': >> rlm_eap2.c:(.text+0x935): undefined reference to `cf_section_parse' >> rlm_eap2.c:(.text+0x9cc): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x9e6): undefined reference to >> `eap_server_register_methods' >> rlm_eap2.c:(.text+0xa2e): undefined reference to `cf_subsection_find_next' >> rlm_eap2.c:(.text+0xa41): undefined reference to `cf_section_name1' >> rlm_eap2.c:(.text+0xa6f): undefined reference to `radlog' >> rlm_eap2.c:(.text+0xb3d): undefined reference to `radlog' >> rlm_eap2.c:(.text+0xbac): undefined reference to `cf_subsection_find_next' >> rlm_eap2.c:(.text+0xbe5): undefined reference to `radlog' >> rlm_eap2.c:(.text+0xc20): undefined reference to `radlog' >> /tmp/cchrL0fh.o: In function `eap_example_server_step': >> rlm_eap2.c:(.text+0xdbf): undefined reference to `log_debug' >> rlm_eap2.c:(.text+0xdff): undefined reference to `log_debug' >> rlm_eap2.c:(.text+0xe7f): undefined reference to `radius_pairmake' >> rlm_eap2.c:(.text+0xee6): undefined reference to `radius_pairmake' >> rlm_eap2.c:(.text+0xf47): undefined reference to `log_debug' >> /tmp/cchrL0fh.o: In function `eap_vp2data': >> rlm_eap2.c:(.text+0xfc4): undefined reference to `radlog' >> rlm_eap2.c:(.text+0xfed): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x1048): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x1090): undefined reference to `radlog' >> rlm_eap2.c:(.text+0x10d9): undefined reference to `radlog' >> /tmp/cchrL0fh.o:rlm_eap2.c:(.text+0x1116): more undefined references to >> `radlog' follow >> /tmp/cchrL0fh.o: In function `eap_authenticate': >> rlm_eap2.c:(.text+0x165b): undefined reference to `rad_assert_fail' >> collect2: ld returned 1 exit status >> gmake[6]: *** [rlm_eap2] Error 1 >> gmake[6]: Leaving directory >> `/backup/freeradius-server-2.1.12/src/modules/rlm_eap2' >> gmake[5]: *** [rlm_eap2] Error 2 >> gmake[5]: Leaving directory `/backup/freeradius-server-2.1.12/src/modules' >> gmake[4]: *** [all] Error 2 >> gmake[4]: Leaving directory `/backup/freeradius-server-2.1.12/src/modules' >> gmake[3]: *** [modules] Error 2 >> gmake[3]: Leaving directory `/backup/freeradius-server-2.1.12/src' >> gmake[2]: *** [all] Error 2 >> gmake[2]: Leaving directory `/backup/freeradius-server-2.1.12/src' >> gmake[1]: *** [src] Error 2 >> gmake[1]: Leaving directory `/backup/freeradius-server-2.1.12' >> make: *** [all] Error 2 >> >> >> >> Please help me. >> >> If you have some easy procedure for compiling freeradius for EAP-FAST, >> then please tell me the procedure. >> >> -- Regards, Swaraj -------------- next part -------------- An HTML >> attachment was scrubbed... URL: >> <http://lists.freeradius.org/pipermail/freeradius-devel/attachments/20120905…> >> ------------------------------ Message: 2 Date: Wed, 05 Sep 2012 >> 08:57:31 +0200 From: Alan DeKok<aland(a)deployingradius.com> To: >> FreeRadius developers mailing list >> <freeradius-devel(a)lists.freeradius.org> Subject: Re: Freeradius 2.1.12 >> with EAP-FAST compilation issues Message-ID: >> <5046F7DB.4040303(a)deployingradius.com> Content-Type: text/plain; >> charset=ISO-8859-1 Swaraj wrote: >>>> I was using freeradius-server 2.1.12 without any issues till now, but >>>> now i wanted to use EAP-FAST in freeradius server. So i started >>>> compiling rlm_eap2 module, but i got lot of errors releated to >>>> libeap.so. Some how i fixed all issues related to liaeap.so with >>>> hostapd. Currently i'm stuck with these kind of errors am unable to >>>> proceed further. I require some help to resolve these. >>>> >>>> I used >>>> ./configure --with-experimental-modules --with-rlm_eap2 LIBS="-ldl" >>>> make >> The module doesn't use configure. You need to edit the >> rlm_eap2/Makefile to get it to build. >> >> So... what did you do? >> >>>> gcc -o .libs/rlm_eap2 .libs/rlm_eap2.o rlm_eap2.c >> That's wrong. Something screwed up the build. >> >> So... what did you change in the Makefile? >> >> Alan DeKok. >> >> >> ------------------------------ >> >> - >> List info/subscribe/unsubscribe? Seehttp://www.freeradius.org/list/devel.html >> >> >> End of Freeradius-Devel Digest, Vol 89, Issue 4 >> *********************************************** >> >> > Hi Alan, > > Thanks for the response. > I dint make any changes in rlm_eap2/Makefile, but just changed hostapd > path. > It looks like this > ********************************* > #HOSTAP = /backup/hostapd/b > HOSTAP = /home/livecd/Downloads/hostapd-0.7.3 > #HOSTAP = /home/livecd/Downloads/hostapd-1.0 > #HOSTAP = /path/to/hostap > > TARGET = rlm_eap2 > SRCS = rlm_eap2.c > HEADERS = > RLM_CFLAGS = $(INCLTDL) -I$(HOSTAP)/src/eap_common \ > -I$(HOSTAP)/src/eap_server -I$(HOSTAP)/src \ > -I$(HOSTAP)/src/common -I$(HOSTAP)/src/utils > RLM_LIBS = $(HOSTAP)/eap_example/libeap.so > > ## this uses the RLM_CFLAGS and RLM_LIBS and SRCS defs to make TARGET. > include ../rules.mak > ******************************** > > I'm compiling hostapd to generate "libeap.so" with hostapd1.0, > hostapd.0.6.x and finally with hostapd.0.7.3.. I faced lot issues while > compiling hostapd and finally when i generated libeap.so, rlm_eap2 > module compilation gave me tons of errors. The ./configure command is given at root directory, but not at rlm_eap2 directory. I used following command to make entire freeradius. ./configure --with-experimental-modules --with-rlm_eap2 LIBS="-ldl" > > -- > Regards, > Swaraj >

1 0

freeradius, Calling-Station-Id
by ZZ Wave 06 Sep '12

06 Sep '12

Help me please. Can't figure out how to authenticate my PBX calls only by Calling-Station-Id attribute, without username. /etc/raddb/users is useless here, right? Here's "radiusd -X > debug.txt" output: http://pastebin.com/LfB9NZvf

4 3

simple question about auth-type PAP
by opensource＠tigusoft.pl 05 Sep '12

05 Sep '12

Hello we use radius, with chilli hotspot for login but the password is not working: users can not log in, from radius logs it would appear as if chilli login form for the user sends the password in some encrypted format (eap?) while Radius only wants to use it as cleartext (despite configuration "authorize{...}" section allowing other types, as it is default). The radius secret is the same in radius and chilli. What can be wrong? How to make radius understand this encrypted password? As a backup plan, how to make both radius and chilli (if any of you happen to know / if this is radius settings related) use simple PAP... Radius logs show: root@hotspot:/etc/freeradius# freeradius -X FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 (...) ++[sql] returns ok [expiration] Checking Expiration time: '7 Sep 2012 19:00' ++[expiration] returns ok ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "?�?�??s?�B??xڧ4" [pap] Using clear text password "2i" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. expand: LOGIN ERROR -> LOGIN ERROR Login incorrect (rlm_pap: CLEAR TEXT password check failed): [ddjz/\222�?�? \207s\231\264B\030\006xڧ4] (from client localhost port 1 cli 00-16-E6-35- FB-04) LOGIN ERROR WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject ( Full boring log with initialization debug is available as needed ) Why Auth-Type was found to be PAP, is it said in the RADIUS packet? Or configured wrongly in Radius or maybe in the database? Radius config (and accounts, radius groups etc) are in database in postgresql. Configuration reads: # egrep -v " *#" /etc/freeradius/clients.conf | egrep -v "^ *$" client localhost { ipaddr = 127.0.0.1 secret = testing123 require_message_authenticator = no } # egrep -v " *#" /etc/freeradius/sites-enabled/default | egrep -v "^ *$" authorize { preprocess chap mschap digest suffix eap { ok = return } files sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp sql exec attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } Other files are at defaults (from debian stable).

4 4

configure challenge..
by Rod Luzic 05 Sep '12

05 Sep '12

any example on how to configure the server to send A-C? of course I did see arrogant and disgusting thread here: http://freeradius.1045715.n5.nabble.com/Access-Challenge-with-FreeRadius-td… This bloke alan dekok seems to think he is some kind of linus torvald just by writing this mediocre patchy radius code.

5 12

Freeradius 2.1.12 with EAP-FAST compilation issues
by Swaraj 05 Sep '12

05 Sep '12

Hi All, I was using freeradius-server 2.1.12 without any issues till now, but now i wanted to use EAP-FAST in freeradius server. So i started compiling rlm_eap2 module, but i got lot of errors releated to libeap.so. Some how i fixed all issues related to liaeap.so with hostapd. Currently i'm stuck with these kind of errors am unable to proceed further. I require some help to resolve these. I used ./configure --with-experimental-modules --with-rlm_eap2 LIBS="-ldl" make I get the following error message: ---------------------------------------------- gmake[6]: Leaving directory `/backup/freeradius-server-2.1.12/src/modules/rlm_eap' Making all in rlm_eap2... /usr/bin/gmake -w -C rlm_eap2 all gmake[6]: Entering directory `/backup/freeradius-server-2.1.12/src/modules/rlm_eap2' /backup/freeradius-server-2.1.12/libtool --mode=compile gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/backup/freeradius-server-2.1.12/src -I/backup/freeradius-server-2.1.12/libltdl -I/backup/freeradius-server-2.1.12/libltdl -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server -I/home/livecd/Downloads/hostapd-0.7.3/src -I/home/livecd/Downloads/hostapd-0.7.3/src/common -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/backup/freeradius-server-2.1.12/src -I/backup/freeradius-server-2.1.12/libltdl -I/backup/freeradius-server-2.1.12/libltdl -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server -I/home/livecd/Downloads/hostapd-0.7.3/src -I/home/livecd/Downloads/hostapd-0.7.3/src/common -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c -fPIC -DPIC -o .libs/rlm_eap2.o rlm_eap2.c: In function 'eap_instantiate': rlm_eap2.c:622:2: warning: implicit declaration of function 'eap_server_register_methods' rlm_eap2.c: In function 'eap_authenticate': rlm_eap2.c:962:41: warning: pointer targets in assignment differ in signedness rlm_eap2.c:963:35: warning: pointer targets in assignment differ in signedness gcc -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/backup/freeradius-server-2.1.12/src -I/backup/freeradius-server-2.1.12/libltdl -I/backup/freeradius-server-2.1.12/libltdl -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_common -I/home/livecd/Downloads/hostapd-0.7.3/src/eap_server -I/home/livecd/Downloads/hostapd-0.7.3/src -I/home/livecd/Downloads/hostapd-0.7.3/src/common -I/home/livecd/Downloads/hostapd-0.7.3/src/utils -c rlm_eap2.c -o rlm_eap2.o >/dev/null 2>&1 /backup/freeradius-server-2.1.12/libtool --mode=link gcc -release 2.1.12 \ -module -export-dynamic -o rlm_eap2 \ -rpath /usr/local/lib rlm_eap2.lo rlm_eap2.c /backup/freeradius-server-2.1.12/src/lib/libfreeradius-radius.la /home/livecd/Downloads/hostapd-0.7.3/eap_example/libeap.so -lnsl -lresolv -ldl -lpthread libtool: link: warning: `-release' is ignored for programs gcc -o .libs/rlm_eap2 .libs/rlm_eap2.o rlm_eap2.c /home/livecd/Downloads/hostapd-0.7.3/eap_example/libeap.so -Wl,--export-dynamic /backup/freeradius-server-2.1.12/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -ldl -lpthread -Wl,--rpath -Wl,/usr/local/lib /tmp/cchrL0fh.o:(.data+0x0): multiple definition of `debug_flag' .libs/rlm_eap2.o:(.data+0x0): first defined here /tmp/cchrL0fh.o:(.bss+0x0): multiple definition of `request_log_file' .libs/rlm_eap2.o:/backup/freeradius-server-2.1.12/src/modules/rlm_eap2/rlm_eap2.c:465: first defined here /tmp/cchrL0fh.o:(.bss+0x4): multiple definition of `debug_log_file' .libs/rlm_eap2.o:/backup/freeradius-server-2.1.12/src/modules/rlm_eap2/rlm_eap2.c:467: first defined here /tmp/cchrL0fh.o:(.data+0x160): multiple definition of `rlm_eap2' .libs/rlm_eap2.o:(.data.rel.local+0x0): first defined here /usr/lib/gcc/i686-redhat-linux/4.5.1/../../../crt1.o: In function `_start': (.text+0x18): undefined reference to `main' .libs/rlm_eap2.o: In function `eap_authenticate': rlm_eap2.c:(.text+0x21a): undefined reference to `radlog' rlm_eap2.c:(.text+0x230): undefined reference to `radlog' rlm_eap2.c:(.text+0x4a9): undefined reference to `radius_pairmake' rlm_eap2.c:(.text+0x526): undefined reference to `radius_pairmake' rlm_eap2.c:(.text+0xa26): undefined reference to `log_debug' rlm_eap2.c:(.text+0xa4b): undefined reference to `log_debug' rlm_eap2.c:(.text+0xa6a): undefined reference to `log_debug' rlm_eap2.c:(.text+0xab0): undefined reference to `radlog' rlm_eap2.c:(.text+0xcfb): undefined reference to `radlog' rlm_eap2.c:(.text+0xd16): undefined reference to `radlog' rlm_eap2.c:(.text+0xe1a): undefined reference to `radlog' rlm_eap2.c:(.text+0xe60): undefined reference to `radlog' .libs/rlm_eap2.o: In function `eap_instantiate': rlm_eap2.c:(.text+0x1065): undefined reference to `cf_section_parse' rlm_eap2.c:(.text+0x10ce): undefined reference to `eap_server_register_methods' rlm_eap2.c:(.text+0x10f1): undefined reference to `cf_subsection_find_next' rlm_eap2.c:(.text+0x1143): undefined reference to `radlog' rlm_eap2.c:(.text+0x115d): undefined reference to `cf_subsection_find_next' rlm_eap2.c:(.text+0x1173): undefined reference to `cf_section_name1' rlm_eap2.c:(.text+0x12df): undefined reference to `radlog' rlm_eap2.c:(.text+0x12f5): undefined reference to `radlog' rlm_eap2.c:(.text+0x1362): undefined reference to `radlog' rlm_eap2.c:(.text+0x13ac): undefined reference to `radlog' /tmp/cchrL0fh.o: In function `eaplist_add': rlm_eap2.c:(.text+0xfb): undefined reference to `rad_assert_fail' rlm_eap2.c:(.text+0x121): undefined reference to `rad_assert_fail' rlm_eap2.c:(.text+0x2de): undefined reference to `radlog' /tmp/cchrL0fh.o: In function `eaplist_find': rlm_eap2.c:(.text+0x417): undefined reference to `rad_assert_fail' rlm_eap2.c:(.text+0x599): undefined reference to `radlog' /tmp/cchrL0fh.o: In function `eap_example_server_init_tls': rlm_eap2.c:(.text+0x895): undefined reference to `radlog' rlm_eap2.c:(.text+0x8cd): undefined reference to `radlog' /tmp/cchrL0fh.o: In function `eap_instantiate': rlm_eap2.c:(.text+0x935): undefined reference to `cf_section_parse' rlm_eap2.c:(.text+0x9cc): undefined reference to `radlog' rlm_eap2.c:(.text+0x9e6): undefined reference to `eap_server_register_methods' rlm_eap2.c:(.text+0xa2e): undefined reference to `cf_subsection_find_next' rlm_eap2.c:(.text+0xa41): undefined reference to `cf_section_name1' rlm_eap2.c:(.text+0xa6f): undefined reference to `radlog' rlm_eap2.c:(.text+0xb3d): undefined reference to `radlog' rlm_eap2.c:(.text+0xbac): undefined reference to `cf_subsection_find_next' rlm_eap2.c:(.text+0xbe5): undefined reference to `radlog' rlm_eap2.c:(.text+0xc20): undefined reference to `radlog' /tmp/cchrL0fh.o: In function `eap_example_server_step': rlm_eap2.c:(.text+0xdbf): undefined reference to `log_debug' rlm_eap2.c:(.text+0xdff): undefined reference to `log_debug' rlm_eap2.c:(.text+0xe7f): undefined reference to `radius_pairmake' rlm_eap2.c:(.text+0xee6): undefined reference to `radius_pairmake' rlm_eap2.c:(.text+0xf47): undefined reference to `log_debug' /tmp/cchrL0fh.o: In function `eap_vp2data': rlm_eap2.c:(.text+0xfc4): undefined reference to `radlog' rlm_eap2.c:(.text+0xfed): undefined reference to `radlog' rlm_eap2.c:(.text+0x1048): undefined reference to `radlog' rlm_eap2.c:(.text+0x1090): undefined reference to `radlog' rlm_eap2.c:(.text+0x10d9): undefined reference to `radlog' /tmp/cchrL0fh.o:rlm_eap2.c:(.text+0x1116): more undefined references to `radlog' follow /tmp/cchrL0fh.o: In function `eap_authenticate': rlm_eap2.c:(.text+0x165b): undefined reference to `rad_assert_fail' collect2: ld returned 1 exit status gmake[6]: *** [rlm_eap2] Error 1 gmake[6]: Leaving directory `/backup/freeradius-server-2.1.12/src/modules/rlm_eap2' gmake[5]: *** [rlm_eap2] Error 2 gmake[5]: Leaving directory `/backup/freeradius-server-2.1.12/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/backup/freeradius-server-2.1.12/src/modules' gmake[3]: *** [modules] Error 2 gmake[3]: Leaving directory `/backup/freeradius-server-2.1.12/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/backup/freeradius-server-2.1.12/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/backup/freeradius-server-2.1.12' make: *** [all] Error 2 Please help me. If you have some easy procedure for compiling freeradius for EAP-FAST, then please tell me the procedure. -- Regards, Swaraj

1 0

rlm_smsotpd entry from wiki gone
by Thomas Glanzmann 04 Sep '12

04 Sep '12

Hello, I just noticed that the rlm_smsotpd website I wrote in the wiki is gone. Was that on purpose or an error that happened when the wiki was updated? I pulled a version out of google cache so that I still have the few words I have written there. Cheers, Thomas

2 2

freeradius, memory consumption
by Miha 04 Sep '12

04 Sep '12

Hi, I am using Freeradius for authorization with mysql. In my sql I have about 15k user entries and there si about 50 active calls all the time (just for information about traffic). Now Freeradius is in production for abot 4 months and I did not noticed any problems (works perfect). Today I noticed that it is using around 77% of memory. Is this normal? Thanks! Miha root 27533 0.0 77.4 13524108 9500600 ? Ssl Mar26 29:51 radiusd

6 7

PEAP access-reject problem
by Ana Gallardo Gómez 04 Sep '12

04 Sep '12

Hello, I'm using FreeRADIUS version 2.1.10 I would like to return diferent values of a personal atribute (Codigo-Reject) in a Access-Reject. I would like to do this in PEAPv0, EAP-TTLS-PAP and EAP-TTLS-MsCHAPv2 With my configuration I can return Codigo-Reject in EAP-TTLS-PAP and EAP-TTLS-MsCHAPv2 but I can't in PEAP. My config: cat /etc/freeradius/users ... DEFAULT Intentos-Reject > 10, Auth-Type := Reject Reply-Message += "NUMERO DE INTENTOS FALLIDOS (%{Intentos-Reject}) EXCEDIDO PARA %{%{Stripped-User-Name}:-%{ User-Name}}", Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject, Fall-Through = yes ... cat /etc/freeradius/sites-enabled/e server e { authorize { auth_log suffix files eap { ok = return } } authenticate { eap } post-auth { ... Post-Auth-Type REJECT { update reply { Codigo-Reject = Credenciales-Erroneas } sql{ fail=1 } if (fail) { ... } } #server e cat /etc/freeradius/sites-enabled/inner-tunnel server inner-tunnel { authorize { update outer.request { User-Name := "%u" } mschap auth_log suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } if ("%{Realm}"=='test.es'){ update request { Intentos-Reject = "%{sql:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'}" Intentos-Reject += "%{sqlradiusba:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'}" } } files if ("%{control:Auth-Type}" == 'Reject') { update outer.reply { Codigo-Reject = "%{reply:Codigo-Reject}" } reject } ... pap } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } post-auth { sql{ fail=1 } if (fail) { ... } reply_log } } # -inner-tunnel server block LOG EAP-TTLS-PAP: Fri Aug 24 13:37:07 2012 : Info: [ttls] Got tunneled request User-Name = "prueba(a)test.es" User-Password = "530" FreeRADIUS-Proxied-To = 127.0.0.1 Fri Aug 24 13:37:07 2012 : Info: [ttls] Sending tunneled request User-Name = "prueba(a)test.es" User-Password = "530" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02:00:00:00:00:01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { Fri Aug 24 13:37:07 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel Fri Aug 24 13:37:07 2012 : Info: +- entering group authorize {...} Fri Aug 24 13:37:07 2012 : Info: expand: %u -> prueba(a)test.es Fri Aug 24 13:37:07 2012 : Info: ++[outer.request] returns notfound Fri Aug 24 13:37:07 2012 : Info: ++[mschap] returns noop Fri Aug 24 13:37:07 2012 : Info: [auth_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/08/24/1.2.3.4-auth-detail-20120824 Fri Aug 24 13:37:07 2012 : Info: [auth_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/08/24/1.2.3.4-auth-detail-20120824 Fri Aug 24 13:37:07 2012 : Info: [auth_log] expand: %t -> Fri Aug 24 13:37:07 2012 Fri Aug 24 13:37:07 2012 : Info: ++[auth_log] returns ok Fri Aug 24 13:37:07 2012 : Info: [suffix] Looking up realm "test.es" for User-Name = "prueba(a)test.es" Fri Aug 24 13:37:07 2012 : Info: [suffix] Found realm "test.es" Fri Aug 24 13:37:07 2012 : Info: [suffix] Adding Stripped-User-Name = "prueba" Fri Aug 24 13:37:07 2012 : Info: [suffix] Adding Realm = "test.es" Fri Aug 24 13:37:07 2012 : Info: [suffix] Authentication realm is LOCAL. Fri Aug 24 13:37:07 2012 : Info: ++[suffix] returns ok Fri Aug 24 13:37:07 2012 : Info: ++[control] returns ok Fri Aug 24 13:37:07 2012 : Info: [eap] No EAP-Message, not doing EAP Fri Aug 24 13:37:07 2012 : Info: ++[eap] returns noop Fri Aug 24 13:37:07 2012 : Info: ++? if ("%{Realm}"=='test.es') Fri Aug 24 13:37:07 2012 : Info: expand: %{Realm} -> test.es Fri Aug 24 13:37:07 2012 : Info: ?? Evaluating ("%{Realm}"=='test.es') -> TRUE Fri Aug 24 13:37:07 2012 : Info: ++? if ("%{Realm}"=='test.es') -> TRUE Fri Aug 24 13:37:07 2012 : Info: ++- entering if ("%{Realm}"=='test.es') {...} Fri Aug 24 13:37:07 2012 : Info: sql_xlat Fri Aug 24 13:37:07 2012 : Info: expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:37:07 2012 : Info: expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:37:07 2012 : Info: sql_set_user escaped user --> 'prueba' Fri Aug 24 13:37:07 2012 : Info: expand: SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject' -> SELECT COUNT(*) from radpostauth WHERE username = 'prueba(a)test.es' AND authdate > CURRENT_DATE and reply = 'Access-Reject' Fri Aug 24 13:37:07 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Fri Aug 24 13:37:07 2012 : Info: sql_xlat finished Fri Aug 24 13:37:07 2012 : Debug: rlm_sql (sql): Released sql socket id: 3 Fri Aug 24 13:37:07 2012 : Info: expand: %{sql:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'} -> 26 Fri Aug 24 13:37:07 2012 : Info: sql_xlat Fri Aug 24 13:37:07 2012 : Info: expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:37:07 2012 : Info: expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:37:07 2012 : Info: sql_set_user escaped user --> 'prueba' Fri Aug 24 13:37:07 2012 : Info: expand: SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject' -> SELECT COUNT(*) from radpostauth WHERE username = 'prueba(a)test.es' AND authdate > CURRENT_DATE and reply = 'Access-Reject' Fri Aug 24 13:37:07 2012 : Debug: rlm_sql (sqlradiusba): Reserving sql socket id: 4 Fri Aug 24 13:37:08 2012 : Info: sql_xlat finished Fri Aug 24 13:37:08 2012 : Debug: rlm_sql (sqlradiusba): Released sql socket id: 4 Fri Aug 24 13:37:08 2012 : Info: expand: %{sqlradiusba:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'} -> 0 Fri Aug 24 13:37:08 2012 : Info: +++[request] returns noop Fri Aug 24 13:37:08 2012 : Info: ++- if ("%{Realm}"=='test.es') returns noop Fri Aug 24 13:37:08 2012 : Info: [files] users: Matched entry DEFAULT at line 29 Fri Aug 24 13:37:08 2012 : Info: [files] expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:37:08 2012 : Info: [files] expand: NUMERO DE INTENTOS FALLIDOS (%{Intentos-Reject}) EXCEDIDO PARA %{%{Stripped-User-Name}:-%{User-Name}} -> NUMERO DE INTENTOS FALLIDOS (26) EXCEDIDO PARA prueba Fri Aug 24 13:37:08 2012 : Info: [files] users: Matched entry DEFAULT at line 36 Fri Aug 24 13:37:08 2012 : Info: ++[files] returns ok Fri Aug 24 13:37:08 2012 : Info: ++? if ("%{control:Auth-Type}" == 'Reject') Fri Aug 24 13:37:08 2012 : Info: expand: %{control:Auth-Type} -> Reject Fri Aug 24 13:37:08 2012 : Info: ? Evaluating ("%{control:Auth-Type}" == 'Reject') -> TRUE Fri Aug 24 13:37:08 2012 : Info: ++? if ("%{control:Auth-Type}" == 'Reject') -> TRUE Fri Aug 24 13:37:08 2012 : Info: ++- entering if ("%{control:Auth-Type}" == 'Reject') {...} Fri Aug 24 13:37:08 2012 : Info: expand: %{reply:Codigo-Reject} -> Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:37:08 2012 : Info: +++[outer.reply] returns ok Fri Aug 24 13:37:08 2012 : Info: +++[reject] returns reject Fri Aug 24 13:37:08 2012 : Info: ++- if ("%{control:Auth-Type}" == 'Reject') returns reject } # server inner-tunnel Fri Aug 24 13:37:08 2012 : Info: [ttls] Got tunneled reply code 3 Reply-Message += "NUMERO DE INTENTOS FALLIDOS (26) EXCEDIDO PARA prueba" Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:37:08 2012 : Info: [ttls] Got tunneled Access-Reject Fri Aug 24 13:37:08 2012 : Info: [eap] Handler failed in EAP/ttls Fri Aug 24 13:37:08 2012 : Info: [eap] Failed in EAP select Fri Aug 24 13:37:08 2012 : Info: ++[eap] returns invalid Fri Aug 24 13:37:08 2012 : Info: Failed to authenticate the user. Fri Aug 24 13:37:08 2012 : Info: } # server Fri Aug 24 13:37:08 2012 : Info: Using Post-Auth-Type Reject Fri Aug 24 13:37:08 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/ Fri Aug 24 13:37:08 2012 : Info: +- entering group REJECT {...} Fri Aug 24 13:37:08 2012 : Info: ++[reply] returns noop Fri Aug 24 13:37:08 2012 : Info: [sql] expand: %{Stripped-User-Name} -> Fri Aug 24 13:37:08 2012 : Info: [sql] ... expanding second conditional Fri Aug 24 13:37:08 2012 : Info: [sql] expand: %{User-Name} -> prueba(a)test.es Fri Aug 24 13:37:08 2012 : Info: [sql] expand: %{%{User-Name}:-DEFAULT} -> prueba(a)test.es Fri Aug 24 13:37:08 2012 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba(a)test.es Fri Aug 24 13:37:08 2012 : Info: [sql] sql_set_user escaped user --> ' prueba(a)test.es' Fri Aug 24 13:37:08 2012 : Info: [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radiuscc') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('prueba(a)test.es'), LOWER('02:00:00:00:00:01'), 'CAU1', 'Access-Reject', NOW(), 'Cuenta-Bloqueada-Intentos-Reject','radiuscc') Fri Aug 24 13:37:08 2012 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('prueba(a)test.es'), LOWER('02:00:00:00:00:01'), 'CAU1', 'Access-Reject', NOW(), 'Cuenta-Bloqueada-Intentos-Reject','radiuscc') Fri Aug 24 13:37:08 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Fri Aug 24 13:37:08 2012 : Debug: rlm_sql (sql): Released sql socket id: 2 Fri Aug 24 13:37:08 2012 : Info: ++[sql] returns ok Fri Aug 24 13:37:08 2012 : Info: ++? if (fail) Fri Aug 24 13:37:08 2012 : Info: ? Evaluating (fail) -> FALSE Fri Aug 24 13:37:08 2012 : Info: ++? if (fail) -> FALSE Sending Access-Reject of id 8 to 1.2.3.4 port 53575 Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 LOG PEAP: Fri Aug 24 13:20:41 2012 : Debug: PEAP: Setting User-Name to prueba(a)test.es Sending tunneled request EAP-Message = 0x0208001501303237343736333240756e65782e6573 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "prueba(a)test.es" NAS-IP-Address = 2.2.2.2 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Framed-MTU = 1400 Calling-Station-Id = "C4:46:19:75:7B:B1" Called-Station-Id = "00-18-6E-D0-EC-04" NAS-Identifier = "Enterprise Wireless AP" server inner-tunnel { Fri Aug 24 13:20:41 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel Fri Aug 24 13:20:41 2012 : Info: +- entering group authorize {...} Fri Aug 24 13:20:41 2012 : Info: expand: %u -> prueba(a)test.es Fri Aug 24 13:20:41 2012 : Info: ++[outer.request] returns notfound Fri Aug 24 13:20:41 2012 : Info: ++[mschap] returns noop Fri Aug 24 13:20:41 2012 : Info: [auth_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/08/24/2.2.2.2-auth-detail-20120824 Fri Aug 24 13:20:41 2012 : Info: [auth_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/08/24/2.2.2.2-auth-detail-20120824 Fri Aug 24 13:20:41 2012 : Info: [auth_log] expand: %t -> Fri Aug 24 13:20:41 2012 Fri Aug 24 13:20:41 2012 : Info: ++[auth_log] returns ok Fri Aug 24 13:20:41 2012 : Info: [suffix] Looking up realm "test.es" for User-Name = "prueba(a)test.es" Fri Aug 24 13:20:41 2012 : Info: [suffix] Found realm "test.es" Fri Aug 24 13:20:41 2012 : Info: [suffix] Adding Stripped-User-Name = "prueba" Fri Aug 24 13:20:41 2012 : Info: [suffix] Adding Realm = "test.es" Fri Aug 24 13:20:41 2012 : Info: [suffix] Authentication realm is LOCAL. Fri Aug 24 13:20:41 2012 : Info: ++[suffix] returns ok Fri Aug 24 13:20:41 2012 : Info: ++[control] returns ok Fri Aug 24 13:20:41 2012 : Info: [eap] EAP packet type response id 8 length 21 Fri Aug 24 13:20:41 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Fri Aug 24 13:20:41 2012 : Info: ++[eap] returns updated Fri Aug 24 13:20:41 2012 : Info: ++? if ("%{Realm}"=='test.es') Fri Aug 24 13:20:41 2012 : Info: expand: %{Realm} -> test.es Fri Aug 24 13:20:41 2012 : Info: ?? Evaluating ("%{Realm}"=='test.es') -> TRUE Fri Aug 24 13:20:41 2012 : Info: ++? if ("%{Realm}"=='test.es') -> TRUE Fri Aug 24 13:20:41 2012 : Info: ++- entering if ("%{Realm}"=='test.es') {...} Fri Aug 24 13:20:41 2012 : Info: sql_xlat Fri Aug 24 13:20:41 2012 : Info: expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:20:41 2012 : Info: expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:20:41 2012 : Info: sql_set_user escaped user --> 'prueba' Fri Aug 24 13:20:41 2012 : Info: expand: SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject' -> SELECT COUNT(*) from radpostauth WHERE username = 'prueba(a)test.es' AND authdate > CURRENT_DATE and reply = 'Access-Reject' Fri Aug 24 13:20:41 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Fri Aug 24 13:20:42 2012 : Info: sql_xlat finished Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sql): Released sql socket id: 3 Fri Aug 24 13:20:42 2012 : Info: expand: %{sql:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'} -> 7 Fri Aug 24 13:20:42 2012 : Info: sql_xlat Fri Aug 24 13:20:42 2012 : Info: expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:20:42 2012 : Info: expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:20:42 2012 : Info: sql_set_user escaped user --> 'prueba' Fri Aug 24 13:20:42 2012 : Info: expand: SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject' -> SELECT COUNT(*) from radpostauth WHERE username = 'prueba(a)test.es' AND authdate > CURRENT_DATE and reply = 'Access-Reject' Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sqlradiusba): Reserving sql socket id: 4 Fri Aug 24 13:20:42 2012 : Info: sql_xlat finished Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sqlradiusba): Released sql socket id: 4 Fri Aug 24 13:20:42 2012 : Info: expand: %{sqlradiusba:SELECT COUNT(*) from radpostauth WHERE username = '%{User-Name}' AND authdate > CURRENT_DATE and reply = 'Access-Reject'} -> 0 Fri Aug 24 13:20:42 2012 : Info: +++[request] returns updated Fri Aug 24 13:20:42 2012 : Info: ++- if ("%{Realm}"=='test.es') returns updated Fri Aug 24 13:20:42 2012 : Info: [files] users: Matched entry DEFAULT at line 29 Fri Aug 24 13:20:42 2012 : Info: [files] expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:20:42 2012 : Info: [files] expand: NUMERO DE INTENTOS FALLIDOS (%{Intentos-Reject}) EXCEDIDO PARA %{%{Stripped-User-Name}:-%{User-Name}} -> NUMERO DE INTENTOS FALLIDOS (7) EXCEDIDO PARA prueba Fri Aug 24 13:20:42 2012 : Info: [files] users: Matched entry DEFAULT at line 36 Fri Aug 24 13:20:42 2012 : Info: ++[files] returns ok Fri Aug 24 13:20:42 2012 : Info: ++? if ("%{control:Auth-Type}" == 'Reject') Fri Aug 24 13:20:42 2012 : Info: expand: %{control:Auth-Type} -> Reject Fri Aug 24 13:20:42 2012 : Info: ? Evaluating ("%{control:Auth-Type}" == 'Reject') -> TRUE Fri Aug 24 13:20:42 2012 : Info: ++? if ("%{control:Auth-Type}" == 'Reject') -> TRUE Fri Aug 24 13:20:42 2012 : Info: ++- entering if ("%{control:Auth-Type}" == 'Reject') {...} Fri Aug 24 13:20:42 2012 : Info: expand: %{reply:Codigo-Reject} -> Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:20:42 2012 : Info: +++[outer.reply] returns ok Fri Aug 24 13:20:42 2012 : Info: +++[reject] returns reject Fri Aug 24 13:20:42 2012 : Info: ++- if ("%{control:Auth-Type}" == 'Reject') returns reject } # server inner-tunnel Fri Aug 24 13:20:42 2012 : Info: [peap] Got tunneled reply code 3 Reply-Message += "NUMERO DE INTENTOS FALLIDOS (7) EXCEDIDO PARA prueba" Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:20:42 2012 : Info: [peap] Got tunneled reply RADIUS code 3 Reply-Message += "NUMERO DE INTENTOS FALLIDOS (7) EXCEDIDO PARA prueba" Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject Fri Aug 24 13:20:42 2012 : Info: [peap] Tunneled authentication was rejected. Fri Aug 24 13:20:42 2012 : Info: [peap] FAILURE Fri Aug 24 13:20:42 2012 : Info: ++[eap] returns handled Fri Aug 24 13:20:42 2012 : Info: } # server Sending Access-Challenge of id 32 to 2.2.2.2 port 1500 Codigo-Reject = Cuenta-Bloqueada-Intentos-Reject EAP-Message = 0x0109002b190017030100205f329253b5d9c4913c1f8f6f154f9d8771fa5a48be2993d753c9848b55710216 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcbd9304bccd029a9cfcde266d7e75d03 Fri Aug 24 13:20:42 2012 : Info: Finished request 7. Fri Aug 24 13:20:42 2012 : Debug: Going to the next request Fri Aug 24 13:20:42 2012 : Debug: Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 2.2.2.2 port 1501, id=33, length=205 NAS-IP-Address = 2.2.2.2 NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Framed-MTU = 1400 User-Name = "prueba(a)test.es" Calling-Station-Id = "C4-46-19-75-7B-B1" Called-Station-Id = "00-18-6E-D0-EC-04" NAS-Identifier = "Enterprise Wireless AP" State = 0xcbd9304bccd029a9cfcde266d7e75d03 EAP-Message = 0x0209002b19001703010020d99c0d3ff24027b3d2f3d9ff6b999c50343b16224b5ea431c4f061165e9d7bbd Message-Authenticator = 0x9ea3d3262c5cf1762dfcc08226e0ff14 Fri Aug 24 13:20:42 2012 : Info: server { Fri Aug 24 13:20:42 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/ Fri Aug 24 13:20:42 2012 : Info: +- entering group authorize {...} Fri Aug 24 13:20:42 2012 : Info: ++? if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) Fri Aug 24 13:20:42 2012 : Info: expand: %{request:Calling-Station-Id} -> C4-46-19-75-7B-B1 Fri Aug 24 13:20:42 2012 : Info: ? Evaluating ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i) -> TRUE Fri Aug 24 13:20:42 2012 : Info: ++? if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) -> TRUE Fri Aug 24 13:20:42 2012 : Info: ++- entering if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) {...} Fri Aug 24 13:20:42 2012 : Info: expand: %{1}:%{2}:%{3}:%{4}:%{5}:%{6} -> C4:46:19:75:7B:B1 Fri Aug 24 13:20:42 2012 : Info: +++[request] returns notfound Fri Aug 24 13:20:42 2012 : Info: ++- if ("%{request:Calling-Station-Id}" =~ /^([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2}).?([0-9a-f]{2})$/i ) returns notfound Fri Aug 24 13:20:42 2012 : Info: [auth_log] expand: /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/2012/08/24/2.2.2.2-auth-detail-20120824 Fri Aug 24 13:20:42 2012 : Info: [auth_log] /var/log/freeradius/radacct/%Y/%m/%d/%{Client-IP-Address}-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/2012/08/24/2.2.2.2-auth-detail-20120824 Fri Aug 24 13:20:42 2012 : Info: [auth_log] expand: %t -> Fri Aug 24 13:20:42 2012 Fri Aug 24 13:20:42 2012 : Info: ++[auth_log] returns ok Fri Aug 24 13:20:42 2012 : Info: [suffix] Looking up realm "test.es" for User-Name = "prueba(a)test.es" Fri Aug 24 13:20:42 2012 : Info: [suffix] Found realm "test.es" Fri Aug 24 13:20:42 2012 : Info: [suffix] Adding Stripped-User-Name = "prueba" Fri Aug 24 13:20:42 2012 : Info: [suffix] Adding Realm = "test.es" Fri Aug 24 13:20:42 2012 : Info: [suffix] Authentication realm is LOCAL. Fri Aug 24 13:20:42 2012 : Info: ++[suffix] returns ok Fri Aug 24 13:20:42 2012 : Info: [files] users: Matched entry DEFAULT at line 36 Fri Aug 24 13:20:42 2012 : Info: ++[files] returns ok Fri Aug 24 13:20:42 2012 : Info: [eap] EAP packet type response id 9 length 43 Fri Aug 24 13:20:42 2012 : Info: [eap] Continuing tunnel setup. Fri Aug 24 13:20:42 2012 : Info: ++[eap] returns ok Fri Aug 24 13:20:42 2012 : Info: Found Auth-Type = eap Fri Aug 24 13:20:42 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/ Fri Aug 24 13:20:42 2012 : Info: +- entering group authenticate {...} Fri Aug 24 13:20:42 2012 : Info: [eap] Request found, released from the list Fri Aug 24 13:20:42 2012 : Info: [eap] EAP/peap Fri Aug 24 13:20:42 2012 : Info: [eap] processing type peap Fri Aug 24 13:20:42 2012 : Info: [peap] processing EAP-TLS Fri Aug 24 13:20:42 2012 : Info: [peap] eaptls_verify returned 7 Fri Aug 24 13:20:42 2012 : Info: [peap] Done initial handshake Fri Aug 24 13:20:42 2012 : Info: [peap] eaptls_process returned 7 Fri Aug 24 13:20:42 2012 : Info: [peap] EAPTLS_OK Fri Aug 24 13:20:42 2012 : Info: [peap] Session established. Decoding tunneled attributes. Fri Aug 24 13:20:42 2012 : Info: [peap] Peap state send tlv failure Fri Aug 24 13:20:42 2012 : Info: [peap] Received EAP-TLV response. Fri Aug 24 13:20:42 2012 : Info: [peap] The users session was previously rejected: returning reject (again.) Fri Aug 24 13:20:42 2012 : Info: [peap] *** This means you need to read the PREVIOUS messages in the debug output Fri Aug 24 13:20:42 2012 : Info: [peap] *** to find out the reason why the user was rejected. Fri Aug 24 13:20:42 2012 : Info: [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. Fri Aug 24 13:20:42 2012 : Info: [peap] *** what went wrong, and how to fix the problem. Fri Aug 24 13:20:42 2012 : Info: [eap] Handler failed in EAP/peap Fri Aug 24 13:20:42 2012 : Info: [eap] Failed in EAP select Fri Aug 24 13:20:42 2012 : Info: ++[eap] returns invalid Fri Aug 24 13:20:42 2012 : Info: Failed to authenticate the user. Fri Aug 24 13:20:42 2012 : Info: } # server Fri Aug 24 13:20:42 2012 : Info: Using Post-Auth-Type Reject Fri Aug 24 13:20:42 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/ Fri Aug 24 13:20:42 2012 : Info: +- entering group REJECT {...} Fri Aug 24 13:20:42 2012 : Info: ++[reply] returns noop Fri Aug 24 13:20:42 2012 : Info: [sql] expand: %{Stripped-User-Name} -> prueba Fri Aug 24 13:20:42 2012 : Info: [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> prueba Fri Aug 24 13:20:42 2012 : Info: [sql] sql_set_user escaped user --> 'prueba' Fri Aug 24 13:20:42 2012 : Info: [sql] expand: INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('%{User-Name}'), LOWER('%i'), '%C', '%{reply:Packet-Type}', NOW(), '%{reply:Codigo-Reject}','radiuscc') -> INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('prueba(a)test.es'), LOWER('C4:46:19:75:7B:B1'), 'PACCIPV601I', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radiuscc') Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, mac, client, reply, authdate,codreject,radauth) VALUES ( LOWER('prueba(a)test.es'), LOWER('C4:46:19:75:7B:B1'), 'PACCIPV601I', 'Access-Reject', NOW(), 'Credenciales-Erroneas','radiuscc') Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Fri Aug 24 13:20:42 2012 : Debug: rlm_sql (sql): Released sql socket id: 2 Fri Aug 24 13:20:42 2012 : Info: ++[sql] returns ok Fri Aug 24 13:20:42 2012 : Info: ++? if (fail) Fri Aug 24 13:20:42 2012 : Info: ? Evaluating (fail) -> FALSE Fri Aug 24 13:20:42 2012 : Info: ++? if (fail) -> FALSE Fri Aug 24 13:20:42 2012 : Info: Delaying reject of request 8 for 1 seconds Fri Aug 24 13:20:42 2012 : Debug: Going to the next request Fri Aug 24 13:20:42 2012 : Debug: Waking up in 0.9 seconds. Fri Aug 24 13:20:43 2012 : Info: Sending delayed reject for request 8 Sending Access-Reject of id 33 to 2.2.2.2 port 1501 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Codigo-Reject = Credenciales-Erroneas Any ideas about how can I do that? Thank you very much and sorry for my english -- :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

2 2

Re: PAP and A-C
by Thomas Glanzmann 04 Sep '12

04 Sep '12

Hello Rod, > I think the A-C is supported with EAP type authentication? not the PAP. it is supported with both types. However in EAP it is used for something entirely different. With PAP it is used with a challenge. Maybe this thread brings you up to speed. But please use the rlm_perl implementation I send you and _not_ the smsotpd because the perl implementation is much easier to setup, more reliable, less complexity and less moving parts. http://thread.gmane.org/gmane.comp.dial-up.freeradius.user/86365 Cheers, Thomas

1 0

Re: PAP and A-C
by Thomas Glanzmann 04 Sep '12

04 Sep '12

Hello, > can you not configure RADIUS server to do PAP + Challenge so that it > asks for username/password followed by one or more Access-Challenge? > If yes, how would you configure freeradius server to throw > Access-Challenge to radius client? yes, you can. The easiest way is to grab: http://thomas.glanzmann.de/smsotpd.2012-08-16.tar.bz2 and follow the README in rlm_perl. Please also note that the test client that comes with radius does not support access challenges, maybe I'll write a patch for it but not right now. That is why I wrote my own test client in perl which is also included. Tell me if you need help, maybe I'll update the video on my website to include the rlm_perl implementation which is my favourite because it doesn't require a seperate daemon and works with most distros out of the box. Cheers, Thomas

1 0