I've been upgrading a few times.. but this is the one that need cleaning old version before installing new one.. Is there a way to remove all old modules ? or just simply delete the lib files... Do we need to recompile again after cleaning it up... or just make install again..? ----- Original Message ----- From: "Alan DeKok" <aland@ox.org> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Friday, September 30, 2005 04:53 Subject: Re: Segmentation Fault

"Linda Pagillo" <linda@n2thenet.com> wrote:

...

I just installed the newest version of Freeradius (1.0.5) on my Linux Redhat 9 server. All went well except this... when i start the radius in debug mode.. all starts fine, but when the first user tries to authenticate, i get a Segmentation Fault and the radius stops. Any ideas?

See doc/bugs

Also, ensure that you *don't* have an older version of FreeRADIUS installed on the same box. Using old modules with a new server may cause problems.

Alan Dekok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

hello, i've got multiple questions.. 1) I'm running Debian Sarge, currently im using 1.02-4 (stable deb package) I need the sql_counter mod installed , is their anyway of installing it without reinstalling Freerad? I had removed freeradius 1.02-4 and went to install 1.0.5 via source but during make / make install came up with errors (that i cant remember). ( i was using the experimental flag ) 2) Is there a way of setting up some sort of Redundancy i.e. having 2 radius servers if one drops all authentication will go to the next radius server (MySQL backend). I was thinking maybe have a DB server and have the 2 radius servers using that one DB server.. At this point im Not sure which AP's / Router(s) the company is using (wireless enviroment). 3) How would I setup freeradius to have MAC address authentication via SQL if verified they would have inet access if rejected they wouldnt. Im not sure as to what settings are required in the Users table i.e. compression / type of user framed etc or what not or how they would automatically obtain an IP# / internet access via dhcp if / when their authentication was accepted. ( im using dialup admin for entering in nas / user info ) My mind is at a blank atm but im sure ill have many more questions. I've read the documentationa and unfortunatly some of it made lil to no sense to me or the documentation was vague at best. Last radius server i used was a Macintosh based GUI for dialup customers 2 clicks and i was done so to speak :)... 4) what settings if any would i have to enter into a router (yes i know another silly question that i dont know the answer to) Once again Thanks for any and all help/support :) Nick B. Newb to Freeradius / Radius in general. B&C Technologies.

Hi,

Now when a wireless client trys to connect will the NAS sends the mac address and does it append the NAS password or do you supply a specific password for the mac address? when it authenticates the Wireless client will they have internet access (obtained ip/dhcp etc all thru the nas) or Rejected if in the disabled account (no internet access)

the documentation clearly describes such a required setup - but if you run FR is debugging mode - ie radiusd -X - then you will also learn exactly what is being sent from your NAS etc. alan

"Nick B" <freerad@bctechonline.biz> wrote:

Im quite aware of what is being sent and what is shown via debug mode. unfortunatly i dont have access to the specific NAS in question so i cant see what attributes are being sent

Uh, no. Debug mode shows you what attributes are being sent.

My question still exists , does the NAS forward the wireless clients mac address to the radius server

Yes. You can see this for yourself by running the server in debugging mode.

and does the CLIENT or the nas supply a/the password?

The user supplies the password. The NAS doesn't. Alan DeKok.

tnx Edward, i knew the ap-500 did the same so was curious if i could set a specific password per mac address but its looking as if im going to be using one default password for all clients. ----- Original Message ----- From: "Edward Rempala" <radius@rempala.net>

I know with the AP-600 the password is the same as the NAS password.

Edward

Can anybody help me with this? Thanks in advance, Lenir -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Lenir Sent: Friday, October 21, 2005 12:53 AM To: 'FreeRadius users mailing list' Subject: return ALL the AVPs for a username that belongs multiple groups Hello list, I have a user that belongs to multiple groups, lets say in the usergroup table, I have username Paul_S that belongs to Group1, Group2 and Group3 (using a different row for each group membership). In the radgroupreply table, I have multiple different attributes for each group. When I do radius authentication for that username, it only returns the AVPs for the first group match in the radgroupreply table, instead of returning ALL the AVPs that match ALL the groups that the user belongs to. How can I make this happen? Im using freeradius 1.0.5 and using mysql as the database. Thanks Lenir - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Fall-Through ??? Regards, Edvin Seferovic PS: is a user is matched to one group because of his connection-specific attributes, he wont be accepted as a member of another group ( to differentiate between modem and vpn users for example )... -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alex M Sent: Montag, 24. Oktober 2005 04:37 To: 'FreeRadius users mailing list' Subject: RE: return ALL the AVPs for a username that belongs multiple groups In config file there should be a line that will allow you to go to the next parameter despite the fact that it alredy found muching record... that's a theory, that I remember from documentation -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Lenir Sent: Sunday, October 23, 2005 10:14 PM To: 'FreeRadius users mailing list' Subject: RE: return ALL the AVPs for a username that belongs multiple groups Can anybody help me with this? Thanks in advance, Lenir -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Lenir Sent: Friday, October 21, 2005 12:53 AM To: 'FreeRadius users mailing list' Subject: return ALL the AVPs for a username that belongs multiple groups Hello list, I have a user that belongs to multiple groups, lets say in the usergroup table, I have username Paul_S that belongs to Group1, Group2 and Group3 (using a different row for each group membership). In the radgroupreply table, I have multiple different attributes for each group. When I do radius authentication for that username, it only returns the AVPs for the first group match in the radgroupreply table, instead of returning ALL the AVPs that match ALL the groups that the user belongs to. How can I make this happen? Im using freeradius 1.0.5 and using mysql as the database. Thanks Lenir - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Is not Fall-Through, although I do have it set up, Fall-Through is working. This is my current config where I use Fall-Through: DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Call-Check, Auth-Type := None Fall-Through = 1 DEFAULT Service-Type == Group-Check, Auth-Type := None Fall-Through = 1 DEFAULT Service-Type == SIP-Session, Auth-Type := Digest Fall-Through = 1 DEFAULT Service-Type == SIP-Callee-AVPs, Auth-Type := None Fall-Through = 1 DEFAULT Service-Type == SIP-Caller-AVPs, Auth-Type := None Fall-Through = 1 The radius requests are being authenticated fine. The problem is in the radius reply. Radius replies with the AVPs of the first group that it matches that the user belongs to. Instead of returning all the AVPs for all the groups that the user belongs to. So I guess the question is, can a user belong to multiple groups? If so, how can radius reply with all the AVPs that correspond to ALL the groups that the user belongs to? Lenir -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alex M Sent: Sunday, October 23, 2005 11:00 PM To: edvin.seferovic@kolp.at; 'FreeRadius users mailing list' Subject: RE: return ALL the AVPs for a username that belongs multiple groups Probably yes... -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Seferovic Edvin Sent: Sunday, October 23, 2005 10:42 PM To: 'FreeRadius users mailing list' Subject: RE: return ALL the AVPs for a username that belongs multiple groups Fall-Through ??? Regards, Edvin Seferovic PS: is a user is matched to one group because of his connection-specific attributes, he wont be accepted as a member of another group ( to differentiate between modem and vpn users for example )... -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alex M Sent: Montag, 24. Oktober 2005 04:37 To: 'FreeRadius users mailing list' Subject: RE: return ALL the AVPs for a username that belongs multiple groups In config file there should be a line that will allow you to go to the next parameter despite the fact that it alredy found muching record... that's a theory, that I remember from documentation -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Lenir Sent: Sunday, October 23, 2005 10:14 PM To: 'FreeRadius users mailing list' Subject: RE: return ALL the AVPs for a username that belongs multiple groups Can anybody help me with this? Thanks in advance, Lenir -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Lenir Sent: Friday, October 21, 2005 12:53 AM To: 'FreeRadius users mailing list' Subject: return ALL the AVPs for a username that belongs multiple groups Hello list, I have a user that belongs to multiple groups, lets say in the usergroup table, I have username Paul_S that belongs to Group1, Group2 and Group3 (using a different row for each group membership). In the radgroupreply table, I have multiple different attributes for each group. When I do radius authentication for that username, it only returns the AVPs for the first group match in the radgroupreply table, instead of returning ALL the AVPs that match ALL the groups that the user belongs to. How can I make this happen? Im using freeradius 1.0.5 and using mysql as the database. Thanks Lenir - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Here's the rest of my config. Notice, that username 3000 belongs to group Dialin and Dialin2. The user can register fine, however in this case the Access-Accept packet only returns the AVPs related to group Dialin (I'm guessing is because it's the first one that it matches). mysql> select * from radcheck; +----+----------+-----------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+----------+ | 1 | Jhassell | Password | == | changeme | | 2 | Rneis | Password | == | changeme | | 3 | 1000 | Password | == | 1000 | | 4 | 2000 | Password | == | 2000 | | 5 | 3000 | Password | == | 3000 | +----+----------+-----------+----+----------+ 5 rows in set (0.00 sec) mysql> select * from radreply; Empty set (0.00 sec) mysql> select * from usergroup; +----+----------+------------+ | id | UserName | GroupName | +----+----------+------------+ | 1 | Jhassell | Dialin | | 2 | Rneis | Staticdial | | 3 | 1000 | Dialin | | 4 | 2000 | Dialin | | 5 | 3000 | Dialin | | 6 | 3000 | Dialin2 | +----+----------+------------+ 6 rows in set (0.00 sec) mysql> select * from radgroupcheck; Empty set (0.00 sec) mysql> select * from radgroupreply; +----+-----------+---------------+----+----------------------------------+-- ---+ | id | GroupName | Attribute | op | Value | prio | +----+-----------+---------------+----+----------------------------------+-- ----+ | 1 | Dialin | Reply-Message | = | "Authenticated by group Dialin" | 0 | | 2 | Dialin2 | SIP-AVP | = | Cust-AVP:feat_2 | 0 | | 3 | Dialin | SIP-AVP | = | Cust-AVP:feat_1 | 0 | +----+-----------+---------------+----+----------------------------------+-- ----+ 3 rows in set (0.00 sec) mysql> select * from radpostauth; Empty set (0.00 sec) -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, October 28, 2005 1:34 PM To: FreeRadius users mailing list Subject: Re: return ALL the AVPs for a username that belongs multiple groups "Lenir" <lenirsantiago@yahoo.com> wrote:

Radius replies with the AVPs of the first group that it matches that the user belongs to. Instead of returning all the AVPs for all the groups that the user belongs to.

The example you posted didn't include groups or reply AVP's.

So I guess the question is, can a user belong to multiple groups? If so, how can radius reply with all the AVPs that correspond to ALL the groups that the user belongs to?

Yes, and you configure the server to do that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Can anyone please help me with this? Thanks, Lenir -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Lenir Sent: Wednesday, November 02, 2005 7:34 PM To: 'FreeRadius users mailing list' Subject: RE: return ALL the AVPs for a username that belongs multiple groups Here's the rest of my config. Notice, that username 3000 belongs to group Dialin and Dialin2. The user can register fine, however in this case the Access-Accept packet only returns the AVPs related to group Dialin (I'm guessing is because it's the first one that it matches). mysql> select * from radcheck; +----+----------+-----------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+----------+ | 1 | Jhassell | Password | == | changeme | | 2 | Rneis | Password | == | changeme | | 3 | 1000 | Password | == | 1000 | | 4 | 2000 | Password | == | 2000 | | 5 | 3000 | Password | == | 3000 | +----+----------+-----------+----+----------+ 5 rows in set (0.00 sec) mysql> select * from radreply; Empty set (0.00 sec) mysql> select * from usergroup; +----+----------+------------+ | id | UserName | GroupName | +----+----------+------------+ | 1 | Jhassell | Dialin | | 2 | Rneis | Staticdial | | 3 | 1000 | Dialin | | 4 | 2000 | Dialin | | 5 | 3000 | Dialin | | 6 | 3000 | Dialin2 | +----+----------+------------+ 6 rows in set (0.00 sec) mysql> select * from radgroupcheck; Empty set (0.00 sec) mysql> select * from radgroupreply; +----+-----------+---------------+----+----------------------------------+-- ---+ | id | GroupName | Attribute | op | Value | prio | +----+-----------+---------------+----+----------------------------------+-- ----+ | 1 | Dialin | Reply-Message | = | "Authenticated by group Dialin" | 0 | | 2 | Dialin2 | SIP-AVP | = | Cust-AVP:feat_2 | 0 | | 3 | Dialin | SIP-AVP | = | Cust-AVP:feat_1 | 0 | +----+-----------+---------------+----+----------------------------------+-- ----+ 3 rows in set (0.00 sec) mysql> select * from radpostauth; Empty set (0.00 sec) -----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, October 28, 2005 1:34 PM To: FreeRadius users mailing list Subject: Re: return ALL the AVPs for a username that belongs multiple groups "Lenir" <lenirsantiago@yahoo.com> wrote:

Radius replies with the AVPs of the first group that it matches that the user belongs to. Instead of returning all the AVPs for all the groups that the user belongs to.

The example you posted didn't include groups or reply AVP's.

So I guess the question is, can a user belong to multiple groups? If so, how can radius reply with all the AVPs that correspond to ALL the groups that the user belongs to?

Yes, and you configure the server to do that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Lenir wrote:

Can anyone please help me with this?

Thanks,

Lenir

Just a thought. Create a 3rd group with the attributes you need?

-----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Lenir Sent: Wednesday, November 02, 2005 7:34 PM To: 'FreeRadius users mailing list' Subject: RE: return ALL the AVPs for a username that belongs multiple groups

Here's the rest of my config. Notice, that username 3000 belongs to group Dialin and Dialin2. The user can register fine, however in this case the Access-Accept packet only returns the AVPs related to group Dialin (I'm guessing is because it's the first one that it matches).

mysql> select * from radcheck; +----+----------+-----------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+----------+ | 1 | Jhassell | Password | == | changeme | | 2 | Rneis | Password | == | changeme | | 3 | 1000 | Password | == | 1000 | | 4 | 2000 | Password | == | 2000 | | 5 | 3000 | Password | == | 3000 | +----+----------+-----------+----+----------+ 5 rows in set (0.00 sec)

mysql> select * from radreply; Empty set (0.00 sec)

mysql> select * from usergroup; +----+----------+------------+ | id | UserName | GroupName | +----+----------+------------+ | 1 | Jhassell | Dialin | | 2 | Rneis | Staticdial | | 3 | 1000 | Dialin | | 4 | 2000 | Dialin | | 5 | 3000 | Dialin | | 6 | 3000 | Dialin2 | +----+----------+------------+ 6 rows in set (0.00 sec)

mysql> select * from radgroupcheck; Empty set (0.00 sec)

mysql> select * from radgroupreply; +----+-----------+---------------+----+----------------------------------+-- ---+ | id | GroupName | Attribute | op | Value | prio | +----+-----------+---------------+----+----------------------------------+-- ----+ | 1 | Dialin | Reply-Message | = | "Authenticated by group Dialin" | 0 | | 2 | Dialin2 | SIP-AVP | = | Cust-AVP:feat_2 | 0 | | 3 | Dialin | SIP-AVP | = | Cust-AVP:feat_1 | 0 | +----+-----------+---------------+----+----------------------------------+-- ----+ 3 rows in set (0.00 sec)

mysql> select * from radpostauth; Empty set (0.00 sec)

-----Original Message----- From: freeradius-users-bounces@lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Friday, October 28, 2005 1:34 PM To: FreeRadius users mailing list Subject: Re: return ALL the AVPs for a username that belongs multiple groups

"Lenir" <lenirsantiago@yahoo.com> wrote:

...

Radius replies with the AVPs of the first group that it matches that the user belongs to. Instead of returning all the AVPs for

all

...

the groups that the user belongs to.

The example you posted didn't include groups or reply AVP's.

...

So I guess the question is, can a user belong to multiple groups? If so,

how

...

can radius reply with all the AVPs that correspond to ALL the groups that the user belongs to?

Yes, and you configure the server to do that.

Alan DeKok.

"Rohaizam Abu Bakar" <haizam@myjaring.net> wrote:

cleaning up old files... recompile... and still segmentation fault... but worse than before.. since the daemon cannot even up..

seems problem with rlm_ldap...

That's bug #98. Either link statically, or put the libraries rlm_ldap needs in a place where the dynamic linker can find them. Alan DeKok.

Dear all, configure with --disable-shared... cleaned old files... and still core dump.. gdb /usr/local/sbin/radiusd /usr/local/etc/raddb/radiusd.core GNU gdb 4.18 (FreeBSD) Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"...Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 2627 in elfstab_build_psymtabs Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../contrib/gdb/gdb/dbxread.c line 933 in fill_symbuf Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/libssl.so.3...done. Reading symbols from /usr/lib/libcrypto.so.3...done. Reading symbols from /usr/local/lib/libgdbm.so.3...done. Reading symbols from /usr/lib/libpam.so.1...done. Reading symbols from /usr/lib/libcrypt.so.2...done. Reading symbols from /usr/local/lib/mysql/libmysqlclient.so.14...done. Reading symbols from /usr/lib/libm.so.2...done. Reading symbols from /usr/lib/libz.so.2...done. Reading symbols from /usr/lib/libcipher.so.2...done. Reading symbols from /usr/lib/libc_r.so.4...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x808e23e in lt_dlsym (handle=0x812ae40, symbol=0xbfbfe660 "rlm_ldap") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) (gdb) bt #0 0x808e23e in lt_dlsym (handle=0x812ae40, symbol=0xbfbfe660 "rlm_ldap") at ltdl.c:3330 #1 0x8057fd4 in linkto_module (module_name=0xbfbfe7b0 "rlm_ldap", cffilename=0x80932e7 "radiusd.conf", cflineno=732) at modules.c:230 #2 0x805822a in find_module_instance (instname=0x80f31e0 "ldap1") at modules.c:347 #3 0x8059416 in do_compile_modsingle (component=0, ci=0x80f2340, filename=0x80932e7 "radiusd.conf", grouptype=1, modname=0xbfbfe948) at modcall.c:814 #4 0x80595dc in do_compile_modgroup (component=0, cs=0x80f2320, filename=0x80932e7 "radiusd.conf", grouptype=1, parentgrouptype=0) at modcall.c:877 #5 0x80592fe in do_compile_modsingle (component=0, ci=0x80f2320, filename=0x80932e7 "radiusd.conf", grouptype=0, modname=0xbfbfe9fc) at modcall.c:786 #6 0x805956f in do_compile_modgroup (component=0, cs=0x80f2300, filename=0x80932e7 "radiusd.conf", grouptype=0, parentgrouptype=0) at modcall.c:859 #7 0x8059676 in compile_modgroup (component=0, cs=0x80f2300, filename=0x80932e7 "radiusd.conf") at modcall.c:898 #8 0x8058471 in load_subcomponent_section (cs=0x80f2300, comp=0, filename=0x80932e7 "radiusd.conf") at modules.c:483 #9 0x80585f0 in load_component_section (cs=0x80f2200, comp=0, filename=0x80932e7 "radiusd.conf") at modules.c:546 #10 0x8058acd in setup_modules () at modules.c:858 #11 0x8050864 in main (argc=4, argv=0xbfbffc28) at radiusd.c:960 --haizam ----- Original Message ----- From: "Alan DeKok" <aland@ox.org> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Friday, September 30, 2005 23:01 Subject: Re: Segmentation Fault - 1.0.5

"Rohaizam Abu Bakar" <haizam@myjaring.net> wrote:

...

cleaning up old files... recompile... and still segmentation fault... but worse than before.. since the daemon cannot even up..

seems problem with rlm_ldap...

That's bug #98.

Either link statically, or put the libraries rlm_ldap needs in a place where the dynamic linker can find them.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html