Install mysql (client or server) first.. then recompile the freeradius.... it will build with mysql module.. --haizam ----- Original Message ----- From: "Bill Neely" <ceo@novatrope.com> To: <freeradius-users@lists.freeradius.org> Sent: Sunday, September 25, 2005 00:31 Subject: Re: Installing FR 1.05

In the modules directory, there is a sub directory called rlm_sql. Does that mean that the module got built? -- 1-888-217-5498

Quoting Duane Cox <duanec@mail.illicom.net>:

...

During the configure/make process, was the module actually built? If not, then you are missing the mysql driver stuff.

----- Original Message ----- From: Bill Neely To: freeradius-users@lists.freeradius.org Sent: Friday, September 23, 2005 7:28 PM Subject: Installing FR 1.05

Am installing Free Radius 1.0.5 on Free BSD 5.4 OS

Installation went alright, but when I fire it up, it fails to load the sql module.

Here is the radiusd -x string:

radiusd -x Starting - reading configuration files ... Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests.

In radiusd.conf, I have

$INCLUDE ${confdir}/sql.conf

What else do I need to do?

Bill

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

---------------------------------------------------------------- This message was sent using http://newwebmail.gct21.net

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Hi, I still haven't figured this one out, and would really appreciate some help. I've tried playing around with the DEFAULT profile in the users file, giving it Auth-Type: Reject, but certificates with CN not in the database are still authenticated. How do I get freeradius to check for the username in mysql with EAP-TLS? Cheers, Ben Ben Dowling wrote:

Hi,

I have freeradius-1.04 configured with MySQL using EAP-TLS and PEAP for authentication. I wish to reject users whose common name (CN) is not included in the MySQL database. I have read the thread regarding this exact problem at:

http://lists.cistron.nl/pipermail/freeradius-users/2004-May/032110.html

and it seems I need to set the DEFAULT profile to reject. I don't quite understand the thread though, is this the DEFAULT profile in the users file, or can I configure this in MySQL. Either way, could someone please provide me with an example of what the DEFAULT profile entry should look like in order to achieve this?

Thanks for the help,

Ben Dowling - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Sorry I was referring to the username, the CN in the certificate gets sent as the username. My problem is how to reject users with valid certificates, but no entry in the database? Cheers, Ben On Tue, 2005-09-27 at 14:01 -0400, Alan DeKok wrote:

Ben Dowling <bendowling@lineone.net> wrote:

...

I still haven't figured this one out, and would really appreciate some help. I've tried playing around with the DEFAULT profile in the users file, giving it Auth-Type: Reject, but certificates with CN not in the database are still authenticated. How do I get freeradius to check for the username in mysql with EAP-TLS?

I don't recall if you can get at the CN from the certificate. Maybe try keying off of the User-Name?

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Brilliant, that does the trick. Thanks a lot, Ben On Tue, 2005-09-27 at 16:05 -0400, Alan DeKok wrote:

Ben Dowling <bendowling@lineone.net> wrote:

...

Sorry I was referring to the username, the CN in the certificate gets sent as the username. My problem is how to reject users with valid certificates, but no entry in the database?

doc/configurable_failover

configure a module "always reject" (see radiusd.conf)

In "authorize", do:

... group { sql { notfound = 1 ok = return fail = return everything_else = return } reject }

That says "if the user isn't found in SQL, reject"

Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html