Is it possible to set up an Apache 1.3 server with WebDAV to authenticate to a freeRADIUS? Ideally, I would like to tell the Apache directives to look at freeRADIUS for authentication using the httpd.conf file. Has anyone ever done this or able to point me in a direction? Is it even possible? We're using freeRadius 1.1.0 on OSX.4, successfully authenticatiing off an Active Directory master. Thanks in advance, Michael Check
We're trying to build FreeRADIUS 1.1.3 into a RPM to install on our RedHat ES 4.0 servers. Following the directions in the Wiki http://wiki.freeradius.org/index.php/FreeRADIUS_Wiki:FAQ#How_do_I_build_ a_RPM_package_from_sources.3F I get the following error(s) and I've attached the referenced file below. I'm unsure how to fix this... RedHat and RPM is a new environment for me. (I'm more accustomed to Debian) Executing(%doc): /bin/sh -e /var/tmp/rpm-tmp.49148 + umask 022 + cd /home/mking/rpmbuild/BUILD + cd freeradius-1.1.3 + DOCDIR=/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3 + export DOCDIR + rm -rf /var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3 + /bin/mkdir -p /var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3 + cp -pr suse/README.SuSE /var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3 + cp -pr doc/00-OLD doc/aaa.txt doc/Acct-Type doc/ascend doc/Autz-Type doc/bay doc/bugs doc/ChangeLog doc/cisco doc/coding-methods.txt doc/configurable_failover doc/CYGWIN doc/DIFFS doc/duplicate-users doc/examples doc/ldap_howto.txt doc/load-balance.txt doc/MACOSX doc/Makefile doc/misc-nas doc/module_interface doc/mssql doc/OS2 doc/performance-testing doc/Post-Auth-Type doc/processing_users_file doc/proxy doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema doc/radrelay doc/README doc/release-method.txt doc/rfc doc/rlm_attr_filter doc/rlm_dbm doc/rlm_digest doc/rlm_eap doc/rlm_fastusers doc/rlm_krb5 doc/rlm_ldap doc/rlm_pam doc/rlm_passwd doc/rlm_python doc/rlm_sim_triplets doc/rlm_sql doc/rlm_sqlcounter doc/rlm_sqlippool doc/Session-Type doc/Simultaneous-Use doc/supervise-radiusd.txt doc/tuning_guide doc/variables.txt LICENSE COPYRIGHT CREDITS README /var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3 cp: will not overwrite just-created `/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3/README' with `README' error: Bad exit status from /var/tmp/rpm-tmp.49148 (%doc) Processing files: freeradius-debuginfo-1.1.3-0 Provides: libeap-1.1.3.so.debug libradius-1.1.3.so.debug rlm_acct_unique-1.1.3.so.debug rlm_always-1.1.3.so.debug rlm_attr_filter-1.1.3.so.debug rlm_attr_rewrite-1.1.3.so.debug rlm_chap-1.1.3.so.debug rlm_checkval-1.1.3.so.debug rlm_counter-1.1.3.so.debug rlm_dbm-1.1.3.so.debug rlm_detail-1.1.3.so.debug rlm_digest-1.1.3.so.debug rlm_eap-1.1.3.so.debug rlm_eap_gtc-1.1.3.so.debug rlm_eap_leap-1.1.3.so.debug rlm_eap_md5-1.1.3.so.debug rlm_eap_mschapv2-1.1.3.so.debug rlm_eap_peap-1.1.3.so.debug rlm_eap_sim-1.1.3.so.debug rlm_eap_tls-1.1.3.so.debug rlm_eap_ttls-1.1.3.so.debug rlm_exec-1.1.3.so.debug rlm_expr-1.1.3.so.debug rlm_fastusers-1.1.3.so.debug rlm_files-1.1.3.so.debug rlm_ippool-1.1.3.so.debug rlm_krb5-1.1.3.so.debug rlm_ldap-1.1.3.so.debug rlm_mschap-1.1.3.so.debug rlm_ns_mta_md5-1.1.3.so.debug rlm_otp-1.1.3.so.debug rlm_pam-1.1.3.so.debug rlm_pap-1.1.3.so.debug rlm_passwd-1.1.3.so.debug rlm_perl-1.1.3.so.debug rlm_preprocess-1.1.3.so.debug rlm_radutmp-1.1.3.so.debug rlm_realm-1.1.3.so.debug rlm_sql-1.1.3.so.debug rlm_sql_log-1.1.3.so.debug rlm_sqlcounter-1.1.3.so.debug rlm_unix-1.1.3.so.debug Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 RPM build errors: Bad exit status from /var/tmp/rpm-tmp.49148 (%doc) Here's the contents of that file. [mking@radius2 SPECS]$ more /var/tmp/rpm-tmp.49148 #!/bin/sh RPM_SOURCE_DIR="/home/mking/rpmbuild/SOURCES" RPM_BUILD_DIR="/home/mking/rpmbuild/BUILD" RPM_OPT_FLAGS="-O2 -g -pipe -m32 -march=i386 -mtune=pentium4" RPM_ARCH="i386" RPM_OS="linux" export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_DOC_DIR="/usr/share/doc" export RPM_DOC_DIR RPM_PACKAGE_NAME="freeradius" RPM_PACKAGE_VERSION="1.1.3" RPM_PACKAGE_RELEASE="0" export RPM_PACKAGE_NAME RPM_PACKAGE_VERSION RPM_PACKAGE_RELEASE RPM_BUILD_ROOT="/var/tmp/freeradius-root" export RPM_BUILD_ROOT set -x umask 022 cd /home/mking/rpmbuild/BUILD cd freeradius-1.1.3 DOCDIR=$RPM_BUILD_ROOT/usr/share/doc/freeradius-1.1.3 export DOCDIR rm -rf $DOCDIR /bin/mkdir -p $DOCDIR cp -pr suse/README.SuSE $DOCDIR cp -pr doc/* LICENSE COPYRIGHT CREDITS README $DOCDIR cp -pr doc/examples/* $DOCDIR cp -pr scripts/create-users.pl scripts/CA.* scripts/certs.sh $DOCDIR cp -pr scripts/users2mysql.pl scripts/xpextensions $DOCDIR cp -pr scripts/cryptpasswd scripts/exec-program-wait scripts/radiusd2ldif.pl $DOCDIR exit 0
On Tue, Aug 29, 2006 at 07:32:23PM -0400, King, Michael wrote:
cp: will not overwrite just-created `/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3/README' with `README' error: Bad exit status from /var/tmp/rpm-tmp.49148 (%doc)
I get this error too. It looks like line 102 in the spec file is causing it :- %doc doc/* LICENSE COPYRIGHT CREDITS README Should this line simply be : %doc doc/* This change allows the package to build on my system but when I try to install the rpm I get the following message :- error: Failed dependencies: /usr/local/bin/perl is needed by freeradius-1.1.3-0.i386 -- Ben Thompson University of York
On Wed, Aug 30, 2006 at 08:47:13AM +0100, B Thompson wrote:
On Tue, Aug 29, 2006 at 07:32:23PM -0400, King, Michael wrote:
cp: will not overwrite just-created `/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3/README' with `README' error: Bad exit status from /var/tmp/rpm-tmp.49148 (%doc)
I get this error too. It looks like line 102 in the spec file is causing it :-
%doc doc/* LICENSE COPYRIGHT CREDITS README
Should this line simply be :
%doc doc/*
This change allows the package to build on my system but when I try to install the rpm I get the following message :-
error: Failed dependencies: /usr/local/bin/perl is needed by freeradius-1.1.3-0.i386
Having googled about for this I removed /usr/local/bin from my path and ran rpmbuild again. This time everything worked OK. -- Ben Thompson University of York
I seem to be having the same problem. Editing Line 102 allowed the package to build. Where did you remove /usr/local/bin from your path? Mike
-----Original Message----- From: freeradius-users-bounces+mking=bridgew.edu@lists.freeradius.or g [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer adius.org] On Behalf Of B Thompson Sent: Wednesday, August 30, 2006 6:14 AM To: FreeRadius users mailing list Subject: Re: Building Freeradius RPM on Redhat ES 4.0
On Wed, Aug 30, 2006 at 08:47:13AM +0100, B Thompson wrote:
On Tue, Aug 29, 2006 at 07:32:23PM -0400, King, Michael wrote:
cp: will not overwrite just-created `/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.3/README' with `README' error: Bad exit status from /var/tmp/rpm-tmp.49148 (%doc)
I get this error too. It looks like line 102 in the spec file is causing it :-
%doc doc/* LICENSE COPYRIGHT CREDITS README
Should this line simply be :
%doc doc/*
This change allows the package to build on my system but when I try to install the rpm I get the following message :-
error: Failed dependencies: /usr/local/bin/perl is needed by freeradius-1.1.3-0.i386
Having googled about for this I removed /usr/local/bin from my path and ran rpmbuild again. This time everything worked OK.
--
Ben Thompson University of York - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Wed, Aug 30, 2006 at 06:48:41PM -0400, King, Michael wrote:
I seem to be having the same problem.
Editing Line 102 allowed the package to build.
Where did you remove /usr/local/bin from your path?
It may be that you don't have to remove it at all, and just changing the order so that /usr/bin appears before /usr/local/bin might do the trick. To view your path : # echo $PATH /usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin To change your path : # export PATH="/usr/kerberos/sbin:/usr/kerberos/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin:/root/bin:/usr/local/bin"
Michael Check wrote:
Is it possible to set up an Apache 1.3 server with WebDAV to authenticate to a freeRADIUS?
Ideally, I would like to tell the Apache directives to look at freeRADIUS for authentication using the httpd.conf file.
Has anyone ever done this or able to point me in a direction? Is it even possible?
We're using freeRadius 1.1.0 on OSX.4, successfully authenticatiing off an Active Directory master.
I don't know a lot about WebDAV, but I think that it uses classical Apache authentication mecanism, right ? Then, you could use mod_auth_radius (http://www.freeradius.org/mod_auth_radius), or use a PAM authentication + a PAM radius module (http://www.freeradius.org/pam_radius_auth) -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]
"Michael Check" <michaelr.check@gmail.com> wrote:
Is it possible to set up an Apache 1.3 server with WebDAV to authenticate to a freeRADIUS?
Unless I'm mistaken, webdav uses HTTP digest for authentication. That makes it difficult.
Ideally, I would like to tell the Apache directives to look at freeRADIUS for authentication using the httpd.conf file.
If it's using basic authentication, mod_auth_radius can help.
We're using freeRadius 1.1.0 on OSX.4, successfully authenticatiing off an Active Directory master.
If it's using HTTP digest authentication, then this is impossible. HTTP digest requires the clear-text password, and AD doesn't supply it. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
On 8/30/06, Alan DeKok <aland@deployingradius.com> wrote:
"Michael Check" <michaelr.check@gmail.com> wrote:
Is it possible to set up an Apache 1.3 server with WebDAV to authenticate to a freeRADIUS?
Unless I'm mistaken, webdav uses HTTP digest for authentication. That makes it difficult.
If it's using basic authentication, mod_auth_radius can help.
We're using freeRadius 1.1.0 on OSX.4, successfully authenticatiing off an Active Directory master.
If it's using HTTP digest authentication, then this is impossible. HTTP digest requires the clear-text password, and AD doesn't supply it.
Thanks Alan and Samuel. I d/l the mod-auth_radius and got it installed. I haven't successfully gotten it to work, but I haven't spent enough time yet. Task for today. WebDAV will allow either Basic or Digest (it uses the same HTTP Auth mechanism that Apache provides) so I think it will work. Even with DAV On, you can have AuthType Basic - so my assumption at this point is that it will work. I'll report back to the list. Thanks! Michael Check
On 8/31/06, Michael Check <michaelr.check@gmail.com> wrote:
WebDAV will allow either Basic or Digest (it uses the same HTTP Auth mechanism that Apache provides) so I think it will work. Even with DAV On, you can have AuthType Basic - so my assumption at this point is that it will work. I'll report back to the list.
I'm having difficulty getting Basic authentication done with mod_auth_radius As the docs say, I'm getting an Internal Error 500 with apache when I try to authenticate. The apache error is: [Thu Aug 31 14:28:45 2006] [crit] [client 192.168.2.147] configuration error: couldn't check user. No user file?: / [Thu Aug 31 14:28:45 2006] [crit] [client 192.168.2.147] configuration error: couldn't check user. No user file?: /favicon.ico [Thu Aug 31 14:28:53 2006] [crit] [client 192.168.2.147] configuration error: couldn't check user. No user file?: / Here is the http conf directives used: <IfModule mod_auth_radius.c> AddRadiusAuth 127.0.0.1:1812 testing123 5:3 AddRadiusCookieValid 5 </IfModule> <Location /calendars/> AllowOverride None Options None AuthType Basic AuthName "Calendars" # AuthAuthoritative Off AuthRadiusAuthoritative On AuthRadiusCookieValid 5 AuthRadiusActive On <Limit GET HEAD OPTIONS> require valid-user </Limit> </Location> Running radiusd -X, I do not get any response at the radius server at all when it appears that apache is supposed to send the radius packet. So that leadds me to believe that the apache server does not have an authoritative authentication mechanism like in the docs? Is there something I should be looking for? Any direction you can help with would be great. Thanks! Michael Check
"Michael Check" <michaelr.check@gmail.com> wrote:
[Thu Aug 31 14:28:45 2006] [crit] [client 192.168.2.147] configuration error: couldn't check user. No user file?: /
That's Apache saying it can't authenticate the user, and isn't doing RADIUS.
# AuthAuthoritative Off
I think you have to uncomment that. Apache is a bit magic, to be honest. I was never clear on what it was doing or why. It doesn't have the equivalent to FreeRADIUS's "debugging mode", which means my efforts to get apache to work the way I want are limited to random changes and best wishes. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Michael Check wrote:
On 8/31/06, Michael Check <michaelr.check@gmail.com> wrote:
WebDAV will allow either Basic or Digest (it uses the same HTTP Auth mechanism that Apache provides) so I think it will work. Even with DAV On, you can have AuthType Basic - so my assumption at this point is that it will work. I'll report back to the list.
I'm having difficulty getting Basic authentication done with mod_auth_radius
Here is the http conf directives used:
<IfModule mod_auth_radius.c>
AddRadiusAuth 127.0.0.1:1812 testing123 5:3
AddRadiusCookieValid 5
</IfModule>
<Location /calendars/>
AllowOverride None Options None
AuthType Basic AuthName "Calendars" # AuthAuthoritative Off AuthRadiusAuthoritative On AuthRadiusCookieValid 5 AuthRadiusActive On <Limit GET HEAD OPTIONS> require valid-user </Limit>
</Location>
Our configuration for Apache 1.3 (but it was for https authentication, not for WebDAV...) was AuthAuthoritative on AuthRadiusAuthoritative on As far as I remember the order of module declaration was also important. We had : LoadModule access_module libexec/mod_access.so LoadModule radius_auth_module libexec/mod_auth_radius.so LoadModule auth_module libexec/mod_auth.so Hope it will help you.... -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]
participants (5)
-
Alan DeKok -
B Thompson -
King, Michael -
Michael Check -
Samuel Degrande