October 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

ip assigning module
by Konstantin Chekushin 25 Nov '10

25 Nov '10

Good afternoon. We have developed a new module assigning IP-addresses for our users. It uses a mysql database as IP source. We cannot use default rlm_sqlippool module, because of some additional logic. Major differences between our module and rlm_sqlippool are: * available IP address space is divided into IP ranges * each user belongs to some group (data plan) * on incoming radius auth packet the module searches data plan (by username) * the module takes some IP from IP range attached to this data plan. More detailed flow diagram is attached. We are ready to adopt this module to your requirements and support it in a future. Is it possible to add it to freeradius project?

3 2

Module-Failure-Message creation in rlm_mschap
by Garber, Neal 08 Nov '10

08 Nov '10

The rlm_mschap change to create the Module-Failure-Message attribute creates it on the request chain. I notice that the original commit on 2010-09-10 (35ee205d4e2dcb4fe5e3<http://github.com/alandekok/freeradius-server/commit/35ee205d4e2dcb4fe5e341…>) had it in the reply. Then, a subsequent commit intentionally changed it to the request (401dcce982f9a9972bc7<http://github.com/alandekok/freeradius-server/commit/401dcce982f9a9972bc7bb…>). Would you be opposed to putting it back on the reply chain? I ask because of the pending change to save the reply attributes upon failure to survive the final eap round trip. If it's not in the reply chain, then it gets lost. If you're opposed to this, should the request chain be saved as well (or perhaps just save Module-Failure-Message if it exists)?

2 4

[PATCH] check rlm_detail writes
by John Morrissey 03 Nov '10

03 Nov '10

I've modified rlm_detail to check its writes and return RLM_MODULE_FAIL on short writes. I believe this should cause FreeRADIUS to avoid sending an Accounting-Response to the NAS, so the NAS will retry on disk-full/error situations. A while ago, I noticed rlm_detail writes were unchecked[1], causing FreeRADIUS to exit on an assertion in the detail reader due to the partial detail entries. Alan kindly fixed the detail reader's behavior in this situation[2], and I also wanted to have the detail writer check its writes. Truncating the detail file on error to remove the partial detail entry isn't strictly necessary, but it seems like good form and is straightforward. I haven't yet gotten rid of the vp_print() calls (its write is unchecked, too) and this patch is untested (though it compiles), but I wanted to get feedback and see if it's worthwhile for me to finish and test it. john [1] https://lists.freeradius.org/pipermail/freeradius-devel/2010-May/013826.html [2] http://github.com/alandekok/freeradius-server/commit/73fe4311083eb684b3d7f8… -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

2 2

Segmentation fault on very first accounting request
by Gyanendra Kumar 29 Oct '10

29 Oct '10

Hi All: My authentication requests work fine but just on one accounting request the free-radius (version 2.1.9) gives segmentation fault. Look forward to your near response. The free-radius was running in proxy mode and here are the details: Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/expr Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/digest Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/etc_group Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/attr_filter Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/exec Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/chap Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/pam Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/unix Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/files Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/krb5 Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/mschap Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/always Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/wimax Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/perl Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/otp Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/ippool Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/ldap Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/mac2ip Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/sql_log Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/acct_unique Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/preprocess Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/detail Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/counter Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/echo Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/realm Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/expiration Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/pap Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/policy Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/cui Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/linelog Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/logintime Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/radutmp Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/sradutmp Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/checkval Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/passwd Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/smsotp Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/modules/detail.log Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/eap.conf Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/policy.conf Fri Oct 29 15:49:03 2010 : Debug: including files in directory /etc/freeradius/sites-enabled/ Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/default Fri Oct 29 15:49:03 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Fri Oct 29 15:49:03 2010 : Debug: main { Fri Oct 29 15:49:03 2010 : Debug: user = "freerad" Fri Oct 29 15:49:03 2010 : Debug: group = "freerad" Fri Oct 29 15:49:03 2010 : Debug: allow_core_dumps = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: including dictionary file /etc/freeradius/dictionary Fri Oct 29 15:49:03 2010 : Debug: main { Fri Oct 29 15:49:03 2010 : Debug: prefix = "/usr" Fri Oct 29 15:49:03 2010 : Debug: localstatedir = "/var" Fri Oct 29 15:49:03 2010 : Debug: logdir = "/var/log/freeradius" Fri Oct 29 15:49:03 2010 : Debug: libdir = "/usr/lib/freeradius" Fri Oct 29 15:49:03 2010 : Debug: radacctdir = "/var/log/freeradius/radacct" Fri Oct 29 15:49:03 2010 : Debug: hostname_lookups = no Fri Oct 29 15:49:03 2010 : Debug: max_request_time = 30 Fri Oct 29 15:49:03 2010 : Debug: cleanup_delay = 5 Fri Oct 29 15:49:03 2010 : Debug: max_requests = 1024 Fri Oct 29 15:49:03 2010 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Fri Oct 29 15:49:03 2010 : Debug: checkrad = "/usr/sbin/checkrad" Fri Oct 29 15:49:03 2010 : Debug: debug_level = 0 Fri Oct 29 15:49:03 2010 : Debug: proxy_requests = yes Fri Oct 29 15:49:03 2010 : Debug: log { Fri Oct 29 15:49:03 2010 : Debug: stripped_names = no Fri Oct 29 15:49:03 2010 : Debug: auth = no Fri Oct 29 15:49:03 2010 : Debug: auth_badpass = no Fri Oct 29 15:49:03 2010 : Debug: auth_goodpass = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: security { Fri Oct 29 15:49:03 2010 : Debug: max_attributes = 200 Fri Oct 29 15:49:03 2010 : Debug: reject_delay = 1 Fri Oct 29 15:49:03 2010 : Debug: status_server = yes Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Fri Oct 29 15:49:03 2010 : Debug: proxy server { Fri Oct 29 15:49:03 2010 : Debug: retry_delay = 5 Fri Oct 29 15:49:03 2010 : Debug: retry_count = 3 Fri Oct 29 15:49:03 2010 : Debug: default_fallback = no Fri Oct 29 15:49:03 2010 : Debug: dead_time = 120 Fri Oct 29 15:49:03 2010 : Debug: wake_all_if_all_dead = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: home_server localhost2 { Fri Oct 29 15:49:03 2010 : Debug: ipaddr = 127.0.0.1 Fri Oct 29 15:49:03 2010 : Debug: port = 1812 Fri Oct 29 15:49:03 2010 : Debug: type = "auth" Fri Oct 29 15:49:03 2010 : Debug: secret = "testing123" Fri Oct 29 15:49:03 2010 : Debug: response_window = 20 Fri Oct 29 15:49:03 2010 : Debug: max_outstanding = 65536 Fri Oct 29 15:49:03 2010 : Debug: require_message_authenticator = no Fri Oct 29 15:49:03 2010 : Debug: zombie_period = 40 Fri Oct 29 15:49:03 2010 : Debug: status_check = "status-server" Fri Oct 29 15:49:03 2010 : Debug: ping_interval = 30 Fri Oct 29 15:49:03 2010 : Debug: check_interval = 30 Fri Oct 29 15:49:03 2010 : Debug: num_answers_to_alive = 3 Fri Oct 29 15:49:03 2010 : Debug: num_pings_to_alive = 3 Fri Oct 29 15:49:03 2010 : Debug: revive_interval = 120 Fri Oct 29 15:49:03 2010 : Debug: status_check_timeout = 4 Fri Oct 29 15:49:03 2010 : Debug: irt = 2 Fri Oct 29 15:49:03 2010 : Debug: mrt = 16 Fri Oct 29 15:49:03 2010 : Debug: mrc = 5 Fri Oct 29 15:49:03 2010 : Debug: mrd = 30 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: home_server_pool my_auth_failover { Fri Oct 29 15:49:03 2010 : Debug: type = fail-over Fri Oct 29 15:49:03 2010 : Debug: home_server = localhost2 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: realm example.com { Fri Oct 29 15:49:03 2010 : Debug: auth_pool = my_auth_failover Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: realm NULL { Fri Oct 29 15:49:03 2010 : Debug: authhost = 192.168.20.83:1812 Fri Oct 29 15:49:03 2010 : Debug: accthost = 192.168.20.83:1813 Fri Oct 29 15:49:03 2010 : Debug: secret = testing123 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: realm NewRadius { Fri Oct 29 15:49:03 2010 : Debug: authhost = 192.168.20.83:1812 Fri Oct 29 15:49:03 2010 : Debug: accthost = 192.168.20.83:1813 Fri Oct 29 15:49:03 2010 : Debug: secret = testing123 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: realm ruckuswireless.com { Fri Oct 29 15:49:03 2010 : Debug: authhost = 192.168.20.83:1812 Fri Oct 29 15:49:03 2010 : Debug: accthost = 192.168.20.83:1813 Fri Oct 29 15:49:03 2010 : Debug: secret = testing123 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Loading Clients #### Fri Oct 29 15:49:03 2010 : Debug: client localhost { Fri Oct 29 15:49:03 2010 : Debug: ipaddr = 127.0.0.1 Fri Oct 29 15:49:03 2010 : Debug: require_message_authenticator = no Fri Oct 29 15:49:03 2010 : Debug: secret = "testing123" Fri Oct 29 15:49:03 2010 : Debug: nastype = "other" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: client 192.168.20.0/24 { Fri Oct 29 15:49:03 2010 : Debug: require_message_authenticator = no Fri Oct 29 15:49:03 2010 : Debug: secret = "testing123" Fri Oct 29 15:49:03 2010 : Debug: shortname = "Gyan-test-network-1" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Instantiating modules #### Fri Oct 29 15:49:03 2010 : Debug: instantiate { Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_exec Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating exec Fri Oct 29 15:49:03 2010 : Debug: exec { Fri Oct 29 15:49:03 2010 : Debug: wait = no Fri Oct 29 15:49:03 2010 : Debug: input_pairs = "request" Fri Oct 29 15:49:03 2010 : Debug: shell_escape = yes Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_expr Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating expr Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_expiration Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating expiration Fri Oct 29 15:49:03 2010 : Debug: expiration { Fri Oct 29 15:49:03 2010 : Debug: reply-message = "Password Has Expired " Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_logintime Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating logintime Fri Oct 29 15:49:03 2010 : Debug: logintime { Fri Oct 29 15:49:03 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Fri Oct 29 15:49:03 2010 : Debug: minimum-timeout = 60 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Loading Virtual Servers #### Fri Oct 29 15:49:03 2010 : Debug: server inner-tunnel { Fri Oct 29 15:49:03 2010 : Debug: modules { Fri Oct 29 15:49:03 2010 : Debug: Module: Checking authenticate {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_pap, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_pap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating pap Fri Oct 29 15:49:03 2010 : Debug: pap { Fri Oct 29 15:49:03 2010 : Debug: encryption_scheme = "auto" Fri Oct 29 15:49:03 2010 : Debug: auto_header = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_chap, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_chap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating chap Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_mschap, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_mschap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating mschap Fri Oct 29 15:49:03 2010 : Debug: mschap { Fri Oct 29 15:49:03 2010 : Debug: use_mppe = yes Fri Oct 29 15:49:03 2010 : Debug: require_encryption = no Fri Oct 29 15:49:03 2010 : Debug: require_strong = no Fri Oct 29 15:49:03 2010 : Debug: with_ntdomain_hack = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_unix, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_unix Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating unix Fri Oct 29 15:49:03 2010 : Debug: unix { Fri Oct 29 15:49:03 2010 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_eap, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_eap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap Fri Oct 29 15:49:03 2010 : Debug: eap { Fri Oct 29 15:49:03 2010 : Debug: default_eap_type = "md5" Fri Oct 29 15:49:03 2010 : Debug: timer_expire = 60 Fri Oct 29 15:49:03 2010 : Debug: ignore_unknown_eap_types = no Fri Oct 29 15:49:03 2010 : Debug: cisco_accounting_username_bug = no Fri Oct 29 15:49:03 2010 : Debug: max_sessions = 4096 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_md5 Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-md5 Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_leap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-leap Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_gtc Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-gtc Fri Oct 29 15:49:03 2010 : Debug: gtc { Fri Oct 29 15:49:03 2010 : Debug: challenge = "Password: " Fri Oct 29 15:49:03 2010 : Debug: auth_type = "PAP" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_tls Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-tls Fri Oct 29 15:49:03 2010 : Debug: tls { Fri Oct 29 15:49:03 2010 : Debug: rsa_key_exchange = no Fri Oct 29 15:49:03 2010 : Debug: dh_key_exchange = yes Fri Oct 29 15:49:03 2010 : Debug: rsa_key_length = 512 Fri Oct 29 15:49:03 2010 : Debug: dh_key_length = 512 Fri Oct 29 15:49:03 2010 : Debug: verify_depth = 0 Fri Oct 29 15:49:03 2010 : Debug: pem_file_type = yes Fri Oct 29 15:49:03 2010 : Debug: private_key_file = "/etc/freeradius/certs/server.key" Fri Oct 29 15:49:03 2010 : Debug: certificate_file = "/etc/freeradius/certs/server.pem" Fri Oct 29 15:49:03 2010 : Debug: CA_file = "/etc/freeradius/certs/ca.pem" Fri Oct 29 15:49:03 2010 : Debug: private_key_password = "whatever" Fri Oct 29 15:49:03 2010 : Debug: dh_file = "/etc/freeradius/certs/dh" Fri Oct 29 15:49:03 2010 : Debug: random_file = "/etc/freeradius/certs/random" Fri Oct 29 15:49:03 2010 : Debug: fragment_size = 1024 Fri Oct 29 15:49:03 2010 : Debug: include_length = yes Fri Oct 29 15:49:03 2010 : Debug: check_crl = no Fri Oct 29 15:49:03 2010 : Debug: cipher_list = "DEFAULT" Fri Oct 29 15:49:03 2010 : Debug: make_cert_command = "/etc/freeradius/certs/bootstrap" Fri Oct 29 15:49:03 2010 : Debug: cache { Fri Oct 29 15:49:03 2010 : Debug: enable = no Fri Oct 29 15:49:03 2010 : Debug: lifetime = 24 Fri Oct 29 15:49:03 2010 : Debug: max_entries = 255 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_ttls Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-ttls Fri Oct 29 15:49:03 2010 : Debug: ttls { Fri Oct 29 15:49:03 2010 : Debug: default_eap_type = "md5" Fri Oct 29 15:49:03 2010 : Debug: copy_request_to_tunnel = no Fri Oct 29 15:49:03 2010 : Debug: use_tunneled_reply = no Fri Oct 29 15:49:03 2010 : Debug: virtual_server = "inner-tunnel" Fri Oct 29 15:49:03 2010 : Debug: include_length = yes Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_peap Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-peap Fri Oct 29 15:49:03 2010 : Debug: peap { Fri Oct 29 15:49:03 2010 : Debug: default_eap_type = "mschapv2" Fri Oct 29 15:49:03 2010 : Debug: copy_request_to_tunnel = no Fri Oct 29 15:49:03 2010 : Debug: use_tunneled_reply = no Fri Oct 29 15:49:03 2010 : Debug: proxy_tunneled_request_as_eap = yes Fri Oct 29 15:49:03 2010 : Debug: virtual_server = "inner-tunnel" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating eap-mschapv2 Fri Oct 29 15:49:03 2010 : Debug: mschapv2 { Fri Oct 29 15:49:03 2010 : Debug: with_ntdomain_hack = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking authorize {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_realm, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_realm Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating suffix Fri Oct 29 15:49:03 2010 : Debug: realm suffix { Fri Oct 29 15:49:03 2010 : Debug: format = "suffix" Fri Oct 29 15:49:03 2010 : Debug: delimiter = "@" Fri Oct 29 15:49:03 2010 : Debug: ignore_default = no Fri Oct 29 15:49:03 2010 : Debug: ignore_null = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_files, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_files Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating files Fri Oct 29 15:49:03 2010 : Debug: files { Fri Oct 29 15:49:03 2010 : Debug: usersfile = "/etc/freeradius/users" Fri Oct 29 15:49:03 2010 : Debug: acctusersfile = "/etc/freeradius/acct_users" Fri Oct 29 15:49:03 2010 : Debug: preproxy_usersfile = "/etc/freeradius/preproxy_users" Fri Oct 29 15:49:03 2010 : Debug: compat = "no" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking session {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_radutmp, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_radutmp Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating radutmp Fri Oct 29 15:49:03 2010 : Debug: radutmp { Fri Oct 29 15:49:03 2010 : Debug: filename = "/var/log/freeradius/radutmp" Fri Oct 29 15:49:03 2010 : Debug: username = "%{User-Name}" Fri Oct 29 15:49:03 2010 : Debug: case_sensitive = yes Fri Oct 29 15:49:03 2010 : Debug: check_with_nas = yes Fri Oct 29 15:49:03 2010 : Debug: perm = 384 Fri Oct 29 15:49:03 2010 : Debug: callerid = yes Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: Module: Checking post-auth {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_attr_filter Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating attr_filter.access_reject Fri Oct 29 15:49:03 2010 : Debug: attr_filter attr_filter.access_reject { Fri Oct 29 15:49:03 2010 : Debug: attrsfile = "/etc/freeradius/attrs.access_reject" Fri Oct 29 15:49:03 2010 : Debug: key = "%{User-Name}" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: } # modules Fri Oct 29 15:49:03 2010 : Debug: } # server Fri Oct 29 15:49:03 2010 : Debug: server { Fri Oct 29 15:49:03 2010 : Debug: modules { Fri Oct 29 15:49:03 2010 : Debug: Module: Checking authenticate {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: Module: Checking authorize {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_preprocess, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_preprocess Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating preprocess Fri Oct 29 15:49:03 2010 : Debug: preprocess { Fri Oct 29 15:49:03 2010 : Debug: huntgroups = "/etc/freeradius/huntgroups" Fri Oct 29 15:49:03 2010 : Debug: hints = "/etc/freeradius/hints" Fri Oct 29 15:49:03 2010 : Debug: with_ascend_hack = no Fri Oct 29 15:49:03 2010 : Debug: ascend_channels_per_line = 23 Fri Oct 29 15:49:03 2010 : Debug: with_ntdomain_hack = no Fri Oct 29 15:49:03 2010 : Debug: with_specialix_jetstream_hack = no Fri Oct 29 15:49:03 2010 : Debug: with_cisco_vsa_hack = no Fri Oct 29 15:49:03 2010 : Debug: with_alvarion_vsa_hack = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking preacct {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_acct_unique Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating acct_unique Fri Oct 29 15:49:03 2010 : Debug: acct_unique { Fri Oct 29 15:49:03 2010 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking accounting {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_always, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_always Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating ok Fri Oct 29 15:49:03 2010 : Debug: always ok { Fri Oct 29 15:49:03 2010 : Debug: rcode = "ok" Fri Oct 29 15:49:03 2010 : Debug: simulcount = 0 Fri Oct 29 15:49:03 2010 : Debug: mpp = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: (Loaded rlm_detail, checking if it's valid) Fri Oct 29 15:49:03 2010 : Debug: Module: Linked to module rlm_detail Fri Oct 29 15:49:03 2010 : Debug: Module: Instantiating detail Fri Oct 29 15:49:03 2010 : Debug: 12. In Detail Accounting Fri Oct 29 15:49:03 2010 : Debug: detail { Fri Oct 29 15:49:03 2010 : Debug: detailfile = "%A/%{Client-IP-Address}/detail" Fri Oct 29 15:49:03 2010 : Debug: header = "%t" Fri Oct 29 15:49:03 2010 : Debug: detailperm = 384 Fri Oct 29 15:49:03 2010 : Debug: dirperm = 493 Fri Oct 29 15:49:03 2010 : Debug: locking = no Fri Oct 29 15:49:03 2010 : Debug: log_packet_header = no Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Module: Checking session {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: Module: Checking post-proxy {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: Module: Checking post-auth {...} for more modules to load Fri Oct 29 15:49:03 2010 : Debug: } # modules Fri Oct 29 15:49:03 2010 : Debug: } # server Fri Oct 29 15:49:03 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Fri Oct 29 15:49:03 2010 : Debug: listen { Fri Oct 29 15:49:03 2010 : Debug: type = "acct" Fri Oct 29 15:49:03 2010 : Debug: ipaddr = 192.168.20.113 Fri Oct 29 15:49:03 2010 : Debug: port = 0 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: listen { Fri Oct 29 15:49:03 2010 : Debug: type = "auth" Fri Oct 29 15:49:03 2010 : Debug: ipaddr = * Fri Oct 29 15:49:03 2010 : Debug: port = 0 Fri Oct 29 15:49:03 2010 : Debug: } Fri Oct 29 15:49:03 2010 : Debug: Listening on accounting address 192.168.20.113 port 1813 Fri Oct 29 15:49:03 2010 : Debug: Listening on authentication address * port 1812 Fri Oct 29 15:49:03 2010 : Debug: Listening on proxy address * port 1814 Fri Oct 29 15:49:03 2010 : Info: Ready to process requests. In Rad Recv CALLING ATTRDB FROM RAD_RECV rad_recv: Accounting-Request packet from host 192.168.20.135 port 2775, id=164, length=101 User-Name = "testing2" Acct-Session-Id = "1288392617O99rsg" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "Localhost" NAS-Port = 0 Calling-Station-Id = "1115551212" Acct-Status-Type = Stop Acct-Session-Time = 180 Acct-Delay-Time = 2 2. In rad decode CALLING ATTRDB from RADRECV End of radius decode Fri Oct 29 15:49:07 2010 : Info: +- entering group preacct {...} Fri Oct 29 15:49:07 2010 : Info: [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = 192.168.20.135,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "1288392617O99rsg",User-Name = "testing2"' Fri Oct 29 15:49:07 2010 : Info: [acct_unique] Acct-Unique-Session-ID = "d7b6690b26a345b1". Fri Oct 29 15:49:07 2010 : Info: ++[acct_unique] returns ok Fri Oct 29 15:49:07 2010 : Info: [suffix] No '@' in User-Name = "testing2", looking up realm NULL Fri Oct 29 15:49:07 2010 : Info: [suffix] Found realm "NULL" Fri Oct 29 15:49:07 2010 : Info: [suffix] Adding Stripped-User-Name = "testing2" Fri Oct 29 15:49:07 2010 : Info: [suffix] Adding Realm = "NULL" Fri Oct 29 15:49:07 2010 : Info: [suffix] Proxying request from user testing2 to realm NULL Fri Oct 29 15:49:07 2010 : Info: [suffix] Preparing to proxy accounting request to realm "NULL" Fri Oct 29 15:49:07 2010 : Info: ++[suffix] returns updated Fri Oct 29 15:49:07 2010 : Info: ++[files] returns noop Fri Oct 29 15:49:07 2010 : Info: +- entering group accounting {...} Fri Oct 29 15:49:07 2010 : Info: ++[ok] returns ok Fri Oct 29 15:49:07 2010 : Debug: 1. In Detail Accounting Fri Oct 29 15:49:07 2010 : Debug: 14. In Detail Accounting Fri Oct 29 15:49:07 2010 : Info: [detail] expand: %A/%{Client-IP-Address}/detail -> /var/log/freeradius/radacct/ 192.168.20.135/detail Fri Oct 29 15:49:07 2010 : Info: [detail] %A/%{Client-IP-Address}/detail expands to /var/log/freeradius/radacct/192.168.20.135/detail Fri Oct 29 15:49:07 2010 : Debug: 20 In rlm_detail Fri Oct 29 15:49:07 2010 : Info: [detail] expand: %t -> Fri Oct 29 15:49:07 2010 Fri Oct 29 15:49:07 2010 : Debug: 21 In rlm_detail Fri Oct 29 15:49:07 2010 : Info: ++[detail] returns ok Segmentation fault Best Regards -GK

2 1

Freeradius + Active Directory
by Rashard Roberts 20 Oct '10

20 Oct '10

Hello I am trying to get Freeradius to authenticate end-user using Active Directory. The end-user will be using be there AD username and password to login to network devices. Would some please help me? I have embedded a copy of the debug log from the radius server. rad_recv: Access-Request packet from host 192.168.168.252:1645, id=94, length=92 User-Name = "svc-ldap-01@corp-test" User-Password = "WindowsXP!" Service-Type = NAS-Prompt-User NAS-IP-Address = 192.168.168.252 NAS-Port = 10 Calling-Station-Id = "192.168.168.194" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "corp-test" for User-Name = "svc-ldap-01@corp-test" rlm_realm: No such realm "corp-test" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 94 to 192.168.168.252 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 94 with timestamp 4cbf5aee Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.168.252:1645, id=95, length=104 User-Name = "svc-ldap-01(a)corp-test.weather.com" User-Password = "WindowsXP!" Service-Type = NAS-Prompt-User NAS-IP-Address = 192.168.168.252 NAS-Port = 10 Calling-Station-Id = "192.168.168.194" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "corp-test.weather.com" for User-Name = " svc-ldap-01(a)corp-test.weather.com" rlm_realm: No such realm "corp-test.weather.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 95 to 192.168.168.252 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 95 with timestamp 4cbf5b25 Nothing to do. Sleeping until we see a request.

2 1

Re: Freeradius-Devel Digest, Vol 66, Issue 6
by Gyanendra Kumar 18 Oct '10

18 Oct '10

Hi Neal: Thanks for the response. authorize { if ("%{NAS-Port-Type}" =~ /^Wireless/){ if ("%{NAS-Identifier}" =~ /^gktest-nas-id/){ if ("%{Called-Station-Id}" =~ /(.*):(.*)/){ update control { %{Called-Station-SSId} = "%{2}" If I do anything like above try and use any new variable for example here, %{Called-Station-SSId} I get this error when starting radius deamon. Sun Oct 17 18:19:02 2010 : Error: /etc/freeradius/sites-enabled/default[71]: Invalid expansion: "%{2}" Look forward to your comments. Best Regards -Gyan It happens both in update request and update control On Fri, Oct 15, 2010 at 3:00 AM, < freeradius-devel-request(a)lists.freeradius.org> wrote: > Send Freeradius-Devel mailing list submissions to > freeradius-devel(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-devel > or, via email, send a message with subject or body 'help' to > freeradius-devel-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-devel-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Devel digest..." > > > Today's Topics: > > 1. RE: Upgrading Free Radius Proxy functionality (Garber, Neal) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 14 Oct 2010 09:42:59 -0400 > From: "Garber, Neal" <Neal.Garber(a)iberdrolausa.com> > Subject: RE: Upgrading Free Radius Proxy functionality > To: "'FreeRadius developers mailing list'" > <freeradius-devel(a)lists.freeradius.org> > Message-ID: > < > 3FF48394E621F14F97A9117CF92D138E5863CDAE1D(a)EEROCH1CMS1.Energyeast.net> > > Content-Type: text/plain; charset="us-ascii" > > > SSID based forwarding takes precedence over realm and default forwarding. > > > Please give comments or pointers about how to include this functionality > to enhance forwarding and to change order. > > Use unlang. We use Cisco APs which pass the SSID in a Cisco-AVPair > attribute. So, perhaps you could use something similar to the following in > the authorize section of sites-enabled/default: > > # Adjust below to capture the SSID from the request > # If you're not sure what attr. has SSID, look at your debug output > # If it's not in any request attr, consult your NAS documentation on > how to make it pass it > if (Cisco-AVPair =~ /ssid=(.*)/) { > update request { > SSID-Name = "%{1}" > } > } > > # Adjust SSID and Realm names below > # Ensure you create the realms in proxy.conf > if (SSID-Name) { > if (SSID-Name == "SSID1") { > update control { > Proxy-To-Realm = "Realm1" > } > } > elseif (SSID-Name == "SSID2") { > update control { > Proxy-To-Realm = "Realm2" > } > } > } > > Also, you'll need to add SSID-Name to the dictionary file as a local > attribute. Something like the following: > > ATTRIBUTE SSID-Name 3012 string >

1 0

Upgrading Free Radius Proxy functionality
by Gyanendra Kumar 14 Oct '10

14 Oct '10

Hi All: I have to enhance free-radius for Wireless domain. For this purpose I need to include SSIS (Wireless domain)..... based proxying. This functionality is to be included in Free Radius used as proxy. SSID based forwarding takes precedence over realm and default forwarding. Please give comments or pointers about how to include this functionality to enhance forwarding and to change order. Best Regards -Gyanendra

2 1

Logging Access-Request and Access-Accept Pairs
by Gyanendra Kumar 07 Oct '10

07 Oct '10

Hi List: I need to log successful access-request and access-accept radius pairs. This is 2.1.9 version of free radius. This is working as proxy and here I am logging. I have all the logging code and everything the only thing is when there is access-challenge there are multiple access-request which I want to avoid logging. Is there way using functions in packet.c or radius.c to log things only once for successfull access-request and access-accept pairs. Thanks in advance. -Gyanendra

1 0