Yes I did install it, first thing i did... -----Original Message----- From: freeradius-users-bounces+bashir.jahed=nha.co.za@lists.freeradius.org [mailto:freeradius-users-bounces+bashir.jahed=nha.co.za@lists.freeradius org] On Behalf Of Jos Vos Sent: 27 November 2008 11:10 To: FreeRadius users mailing list Subject: Re: Centos 5.2 How To On Thu, Nov 27, 2008 at 10:50:45AM +0200, Bashir Jahed wrote:

I have been struggling for days trying to get freeradius installed on Centos 5.2 i386, I get basic pap authentication working but when i try and use authentication with mysql as the db i get errors saying "can't find module sql" when running "radiusd -X" As soon as i uncomment "sql" in "/etc/radddb/sites-enabled/default" file it starts up with no problems.

Did you install "freeradius-mysql"? The MySQL module is in an additional package (at least on RHEL/CentOS/Fedora). -- -- Jos Vos <jos@xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

I installed from rpm, rpmbuild against kernel from the src file. Installed all modules put out by build as well as all modules for freeradius via yum. What is the best way to install freeradius, via source/yum or rpm? -----Original Message----- From: freeradius-users-bounces+bashir.jahed=nha.co.za@lists.freeradius.org [mailto:freeradius-users-bounces+bashir.jahed=nha.co.za@lists.freeradius org] On Behalf Of A.L.M.Buxey@lboro.ac.uk Sent: 27 November 2008 11:16 To: FreeRadius users mailing list Subject: Re: Centos 5.2 How To Hi,

I have been struggling for days trying to get freeradius installed on Centos 5.2 i386, I get basic pap authentication working but when i try and use authentication with mysql as the db i get errors saying "can't find module sql" when running "radiusd -X" As soon as i uncomment "sql" in "/etc/radddb/sites-enabled/default" file it starts up with no problems.

did you install via rpm or via source code? if you installed via RPM then you need some additional RPMs - freeradius-mysql being one of them - do a 'yum search freeradius' for more info. if you installed via source, then you need to ensure you have the devel RPM packages installed for all bits of freeradius you need eg openssl-devel for SSL stuff (PEAP, TLS), mysql-devel for Mysql support to be built etc. reading of the ./configure output helps in this instance (./configure | grep "WARN") alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Ok, I have re-installed, updated, installed freeradius. Freeradius-mysql, mysql, mysql-devel. Created db, imported tables from examples in /usr.share/doc/freradius/.../...sql as per docs. Created db user, edited sql.conf file to match, uncommented sql in authorize and accounting section of radius.conf, still get the following error: ERROR: Cannot find a configuration entry for module "sql". radiusd.conf[1844] Unknown module "sql". radiusd.conf[1773] Failed to parse authorize section. -----Original Message----- From: freeradius-users-bounces+bashir.jahed=nha.co.za@lists.freeradius.org [mailto:freeradius-users-bounces+bashir.jahed=nha.co.za@lists.freeradius org] On Behalf Of Jos Vos Sent: 27 November 2008 11:30 To: FreeRadius users mailing list Subject: Re: Centos 5.2 How To On Thu, Nov 27, 2008 at 11:19:52AM +0200, Bashir Jahed wrote:

I installed from rpm, rpmbuild against kernel from the src file. Installed all modules put out by build as well as all modules for freeradius via yum. What is the best way to install freeradius, via source/yum or rpm?

Not sure what you did. There are roughly two ways: - Just use the RPMs from CentOS, install via yum, do not build anything yourself. Note that this is an old (1.1.3) version of FreeRADIUS, whicht might or work not ok for you. - Build a newer version. I personally recommend strongly to use a recent Fedora src.rpm for that, as these RPMs are "compatible" (or integrated, or whatever you want to call it) with RHEL/Fedora distros (F9 has 2.0.2, F10 had 2.1.1). After you've build the RPMs, you can still install these with yum (yum --nogpgcheck your.rpm ...) to solve dependencies. -- -- Jos Vos <jos@xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

#yum install mysql-devel mysql (see what is missing and install it with yum) FreeRadius install from tar.gz archive (www.freeradius.org -> Downloads). 2.1.1 works perfectly. # wget ..... # tar -xvzf freeradius....tar.gz # ./configure # make # make install Location is /usr/local/etc/raddb configure is your friend. Read output and install what is needed. On Thu, Nov 27, 2008 at 2:38 PM, Alan DeKok <aland@deployingradius.com>wrote:

Bashir Jahed wrote:

...

Ok,

I have re-installed, updated, installed freeradius. Freeradius-mysql, mysql, mysql-devel. Created db, imported tables from examples in /usr.share/doc/freradius/.../...sql as per docs. Created db user, edited sql.conf file to match, uncommented sql in authorize and accounting section of radius.conf, still get the following error:

ERROR: Cannot find a configuration entry for module "sql".

The "sql.conf" file is included from the default radiusd.conf. The only time you get this error is if you edited the radiusd.conf file, and deleted the line that references sql.conf.

Please START with the default configuration files, and THEN make minor edits to customize it for your system. See "man radiusd" for help.

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Thanks guys, I managed to get it started, When i do a radcheck i now get the following error... rad_recv: Access-Request packet from host 127.0.0.1:38949, id=33, length=58 User-Name = "radius" User-Password = "radpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "radius", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'radius' rlm_sql (sql): sql_set_user escaped user --> 'radius' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'radius' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User radius not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'radius' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: MYSQL check_error: 1146 received rlm_sql_getvpdata: database query error radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'radius' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: MYSQL check_error: 1146 received rlm_sql_getvpdata: database query error rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 33 to 127.0.0.1 port 38949 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 33 with timestamp 492ea321 Nothing to do. Sleeping until we see a request. I have a feeling it is looking for a record in the radgroupcheck table, but this table is empty, should there be anything in it? -----Original Message----- From: freeradius-users-bounces+bashir.jahed=nha.co.za@lists.freeradius.org [mailto:freeradius-users-bounces+bashir.jahed=nha.co.za@lists.freeradius org] On Behalf Of Jos Vos Sent: 27 November 2008 16:25 To: FreeRadius users mailing list Subject: Re: Centos 5.2 How To On Thu, Nov 27, 2008 at 03:16:50PM +0100, Marinko Tarlac wrote:

configure is your friend. Read output and install what is needed.

Just one comment from a system management point of view: if you run CentOS, meant as a stable production OS, you probably wants to care for not screwing up your system. Installing software without an RPM, especially software that already is provided by the distro itself, is the *worst* thing someone can do. For RHEL/CentOS, if you're not happy with the distro version (I had the same problem with CentOS 4), you should carefully backport (often a rebuild is enough) a recent Fedora RPM and install that. -- -- Jos Vos <jos@xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Since I changed to Freeradius 2.1.1 the ippols are not selected successfull. In 2.0.x my config is file: users # default ippools per NAS $INCLUDE users.ippools file: users.ippools # Addresspool for ll-us DEFAULT NAS-IP-Address == "172.16.30.2", Pool-Name := "ll-us_pool" Fall-Through = Yes The authentication is against an oracle database. The debug log shows the difference. The difference is, that the "files"-section returns with (freeradius 2.0.5) Thu Nov 27 18:05:56 2008 : Debug: ++[files] returns ok and the pool will be selected: Thu Nov 27 18:05:56 2008 : Debug: mmodsingle[post-auth]: calling ll-us_pool (rlm_ippool) for request 4 Thu Nov 27 18:05:56 2008 : Debug: expand: %{NAS-IP-Address} %{NAS-Port} %{Calling-Station-Id} -> 172.16.30.2 229 2706868263 Thu Nov 27 18:05:56 2008 : Debug: rlm_ippool: MD5 on 'key' directive maps to: 3a20a68a074b1e406aebcaa5e7e4ce51 Thu Nov 27 18:05:56 2008 : Debug: rlm_ippool: Searching for an entry for key: '3a20a68a074b1e406aebcaa5e7e4ce51' Thu Nov 27 18:05:56 2008 : Debug: rlm_ippool: Allocating ip to key: '3a20a68a074b1e406aebcaa5e7e4ce51' Thu Nov 27 18:05:56 2008 : Debug: rlm_ippool: num: 1 Thu Nov 27 18:05:56 2008 : Debug: rlm_ippool: Allocated ip 192.168.42.39 to client key: 3a20a68a074b1e406aebcaa5e7e4ce51 Thu Nov 27 18:05:56 2008 : Debug: modsingle[post-auth]: returned from ll-us_pool (rlm_ippool) for request 4 Thu Nov 27 18:05:56 2008 : Debug: ++[ll-us_pool] returns ok and with (freeradius 2.1.1) Thu Nov 27 17:50:23 2008 : Info: ++[files] returns noop and pool will not selected Thu Nov 27 17:50:23 2008 : Info: [ll-us_pool] Could not find Pool-Name attribute. Thu Nov 27 17:50:23 2008 : Info: ++[ll-us_pool] returns noop Was was changed between both version, what could causes this behaviour ? www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementärin: BIOTRONIK Mess- und Therapiegeräte GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschäftsführer: Dr. Max Schaldach, Christoph Böhmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately and delete the document.

It doesn't make sense. And ist doesn't work. Hi Alan, do you have an idea ? Thanks for our support. TF From: <tnt@kalik.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Date: 28.11.08 00:11 Subject: Re: ippool per NAS Sent by: freeradius-users-bounces+thoralf.freitag=biotronik.com@lists.freeradius.org

file: users

# default ippools per NAS $INCLUDE users.ippools

It looks like include doesn't work in users (? any more).

file: users.ippools

# Addresspool for ll-us DEFAULT NAS-IP-Address == "172.16.30.2", Pool-Name := "ll-us_pool" Fall-Through = Yes

Just copy the content of users.ippools into the users file in place of the include line. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementärin: BIOTRONIK Mess- und Therapiegeräte GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschäftsführer: Dr. Max Schaldach, Christoph Böhmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately and delete the document.

Hello Alan, thanks for your quick response. As described, all works fine in 2.0.5. Here the Access-Request: rad_recv: Access-Request packet from host 172.16.30.2 port 1645, id=20, length=130 Framed-Protocol = PPP User-Name = "user@domain.com" User-Password = "4711" Calling-Station-Id = "123456789" Called-Station-Id = "987654321" NAS-Port = 270 NAS-Port-Type = Async Service-Type = Framed-User NAS-IP-Address = 172.16.30.2 -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag@biotronik.com From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Date: 28.11.08 09:43 Subject: Re: ippool per NAS Sent by: freeradius-users-bounces+thoralf.freitag=biotronik.com@lists.freeradius.org thoralf.freitag@biotronik.com wrote:

It doesn't make sense. And ist doesn't work. Hi Alan, do you have an idea ? Thanks for our support.

All I can say is that it works for me. What *else* is going on? You haven't posted the contents of the Access-Request packet... maybe they don't match! Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementärin: BIOTRONIK Mess- und Therapiegeräte GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschäftsführer: Dr. Max Schaldach, Christoph Böhmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately and delete the document.

The files readable for the user (and for testing purposes for all). I tried two ways. 1st) I took the working configuration from 2.0.5. 2nd) I build a new configuration with the files comming with 2.1.1 3rd) I put all the information in teh one and only user file. This is used, because static users configured in this file are authenticated. If the authentication comes from the sql modul, it seems all additional Attributes are lost ... ? How can I debug this ? -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag@biotronik.com From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Date: 28.11.08 10:30 Subject: Re: ippool per NAS Sent by: freeradius-users-bounces+thoralf.freitag=biotronik.com@lists.freeradius.org thoralf.freitag@biotronik.com wrote:

thanks for your quick response. As described, all works fine in 2.0.5.

Here the Access-Request:

So far as I can tell, nothing changed from 2.0.5 to 2.1.x that should affect this. Are you sure it's reading the "users" file you're editing? Try also moving that entry to the top of the "users" file to see if it matches. If it doesn't, something is very wrong on your system. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementärin: BIOTRONIK Mess- und Therapiegeräte GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschäftsführer: Dr. Max Schaldach, Christoph Böhmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately and delete the document.

Hi Alan, I don' understand you. Yor first email was:

All I can say is that it works for me.

What *else* is going on? You haven't posted the contents of the Access-Request packet... maybe they don't match!

I sent Packet to the list. Than you asked:

So far as I can tell, nothing changed from 2.0.5 to 2.1.x that should affect this.

Are you sure it's reading the "users" file you're editing? Try also moving that entry to the top of the "users" file to see if it matches. If it doesn't, something is very wrong on your system.

And I wrote:

3rd) I put all the information in teh one and only user file. This is used, because static users configured in this file are authenticated.

Isn't it what you suggested - to put all into the users file ? This I did. Static user entries are used as expected and if the user ist authenticated by database, the defaults (for ippols) are not used . For me it seems, the sql module do anything other than in 2.0.x ? From: Alan DeKok <aland@deployingradius.com> To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Date: 28.11.08 11:42 Subject: Re: ippool per NAS Sent by: freeradius-users-bounces+thoralf.freitag=biotronik.com@lists.freeradius.org thoralf.freitag@biotronik.com wrote:

The files readable for the user (and for testing purposes for all). I tried two ways.

1st) I took the working configuration from 2.0.5. 2nd) I build a new configuration with the files comming with 2.1.1

The configuration from 2.0.5 *should* pretty much work with 2.1.1.

3rd) I put all the information in teh one and only user file. This is used, because static users configured in this file are authenticated. If the authentication comes from the sql modul, it seems all additional Attributes are lost ... ? How can I debug this ?

First, try the suggestion from my previous message. There is a step by step approach to debugging the problem. Changing multiple things at the same time isn't a good approach. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementärin: BIOTRONIK Mess- und Therapiegeräte GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschäftsführer: Dr. Max Schaldach, Christoph Böhmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately and delete the document.

Hi,

Just one comment from a system management point of view: if you run CentOS, meant as a stable production OS, you probably wants to care for not screwing up your system. Installing software without an RPM, especially software that already is provided by the distro itself, is the *worst* thing someone can do.

only for the sake that this mailing list is archived and some PHB will end up reading this and thinking its the truth. rubbish there is nothing wrong with using software from source and then using the system libraries and compiler to make it. if it was bad then the first thing distros in general would do is NOT supply gcc, make, g77 et al.

For RHEL/CentOS, if you're not happy with the distro version (I had the same problem with CentOS 4), you should carefully backport (often a rebuild is enough) a recent Fedora RPM and install that.

and the difference between rpmbuild and ./configure itself is the fact that the package is then treated like other packages. fine. but if all your homebuilt stuff lives out of the system tree - eg in /opt or /usr/local/ then you can delete all the non RPM stuff whenever you like alan

Jos Vos wrote:

On Thu, Nov 27, 2008 at 03:16:50PM +0100, Marinko Tarlac wrote:

...

configure is your friend. Read output and install what is needed.

Just one comment from a system management point of view: if you run CentOS, meant as a stable production OS, you probably wants to care for not screwing up your system. Installing software without an RPM, especially software that already is provided by the distro itself, is the *worst* thing someone can do.

Your opinion is not always good. In this case, you're wrong. CentOS goes with FR 1.1.3 and it is few years behind 2.1.1 Rebuilding Fedora packages is a NO-No for me because Fedora is a test distro and it is good if you need new ideas, packages, test software, etc. ... Using Fedora packages sometimes can produce more pain than any other idea. MT

For RHEL/CentOS, if you're not happy with the distro version (I had the same problem with CentOS 4), you should carefully backport (often a rebuild is enough) a recent Fedora RPM and install that.

Hi,

Or what else? Is just running ./confugure; make; make install (and not using RPMs at all) better than taking a Fedora src.rpm to start with?

for some people, yes (though only so long as all the supporting libraries and dev packages have been installed via RPM first ;-) ) I've gone down the route of using the SPEC file to build the latest release several times - but in most cases its just GIT repository all the time (the main issue with RPMs is they give the idea of stability and often are ancient....if few users are using the latest release then certain issues/bugs are never discovered until some time later - if buggy and RPM then a quick package update release is painless for the vast majority on packages - theres no reason why 1.1.x is still the flavour du jour for distros alan

Hi everyone: Sorry for my english. I don't speak very well. I'm working with ippool in FreeRadius. I have some problems with that, because when FreeRadius assigns all IP available in ippool, ipppool's databases stuck him self. I found this page: http://www.mavetju.org/unix/freeradius-ippool-tool-man.php This tool dumps the contents of the FreeRadius ippool databases for analyses or for removal of active entries (stuck entries?) Do you work with this tool?... Where I can find this tool???... Exist another way to do that?? Thanks... Osvaldo H. Campos Molina Administrador de Red STI - Univ. de Chile