December 2010 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

detail auth_log question
by ziyen 30 Dec '10

30 Dec '10

Hi Happy new year :) to day i get git last version and run /tmp/radius.log file contain some gabage date like below whats wring? ========== Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 Calling-Station-Id = "02-00-00-00-00-01" Tq?9 Message-Authenticator = 0xfc6df77c404b6b26285398a3934fe79f User-Name = "test01" = 0xfc6df77c404b6b26285398a3934fe79f EAP-Message = 0x0200000b01746573743031 b26285398a3934fe79f Connect-Info = "CONNECT 11Mbps 802.11b" 26285398a3934fe79f NAS-IP-Address = 127.0.0.1 bps 802.11b" 26285398a3934fe79f Framed-MTU = 1400 27.0.0.1 bps 802.11b" 26285398a3934fe79f Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f5925130f212f609555b234f Tq뷣 Calling-Station-Id = "02-00-00-00-00-01" f Tq뷣 Message-Authenticator = 0xe0b618c927062d4e55a64806d9c33db9 User-Name = "test01" = 0xe0b618c927062d4e55a64806d9c33db9 EAP-Message = 0x02010064150016030100590100005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Connect-Info = "CONNECT 11Mbps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M NAS-IP-Address = 127.0.0.1 bps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Framed-MTU = 1400 27.0.0.1 bps 802.11b" 00005503014d1ccf2975184de2555be74ca41d651a8df642cc193bcb876f876cb5b691030600002800390038003500160013000a00330032002f000700050004001500120009001400110008000600030100000400230000 M Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f4915130f212f609555b234f Tq?d Calling-Station-Id = "02-00-00-00-00-01" f Tq?d Message-Authenticator = 0xd39e6b915c0352029f43706a4afc102f User-Name = "test01" = 0xd39e6b915c0352029f43706a4afc102f EAP-Message = 0x020200061500 e6b915c0352029f43706a4afc102f Connect-Info = "CONNECT 11Mbps 802.11b" 029f43706a4afc102f NAS-IP-Address = 127.0.0.1 bps 802.11b" 029f43706a4afc102f Framed-MTU = 1400 27.0.0.1 bps 802.11b" 029f43706a4afc102f Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f7905130f212f609555b234f Tqphx Calling-Station-Id = "02-00-00-00-00-01" f Tqphx Message-Authenticator = 0x92f8db888a344fcc73d13ac23d0b75e4 User-Name = "test01" = 0x92f8db888a344fcc73d13ac23d0b75e4 EAP-Message = 0x020300061500 8db888a344fcc73d13ac23d0b75e4 Connect-Info = "CONNECT 11Mbps 802.11b" cc73d13ac23d0b75e4 NAS-IP-Address = 127.0.0.1 bps 802.11b" cc73d13ac23d0b75e4 Framed-MTU = 1400 27.0.0.1 bps 802.11b" cc73d13ac23d0b75e4 Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 촷 State = 0xf5934438f6975130f212f609555b234f Tqh죱 Calling-Station-Id = "02-00-00-00-00-01" f Tqh죱 Message-Authenticator = 0xcb39b9ef7678c743e0467a6d637db2aa User-Name = "test01" = 0xcb39b9ef7678c743e0467a6d637db2aa EAP-Message = 0x020400cc150016030100861000008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Connect-Info = "CONNECT 11Mbps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? NAS-IP-Address = 127.0.0.1 bps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Framed-MTU = 1400 27.0.0.1 bps 802.11b" 00008200804296652b1c3ef12966336f93effb4cb91415cf6820d0b4b52547bf9e61d3d48d1cc71e4498cfa3166f2ea1195e168ed1a9cde1ea17cf9c5a1bde6fe2d46493ca57d8987e1e15d3c155c2878f059dd6609730d78e2f7fe435343708139d2a3bec872795e6a62127ee34e747a683f280c0cc56095230667e86494390b702e10f001403010001011603010030ccc0d662159050b0b51158f9c65d962e43eeb3c955297bef0b3c8fa72345e9868e66fcf3be6ee970dbe74ba92f6117a0 ? Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request NAS-Port-Type = Wireless-802.11 02.11b" 26285398a3934fe79f State = 0xf5934438f1965130f212f609555b234f 85398a3934fe79f Calling-Station-Id = "02-00-00-00-00-01" f 85398a3934fe79f Message-Authenticator = 0xeee6ca5f69b02354bc56bd8d29b0ab63 User-Name = "test01" = 0xeee6ca5f69b02354bc56bd8d29b0ab63 EAP-Message = 0x0205009015001703010020579ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Connect-Info = "CONNECT 11Mbps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t NAS-IP-Address = 127.0.0.1 bps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Framed-MTU = 1400 27.0.0.1 bps 802.11b" 9ac548b5aab262d621797a22d14fd073277aefae3c77b41795634213f7c772170301006002914906108ccd6c950c5a99387363dc413e91156bf6a5812a83093981815a704a9ea231b2af151101f539600fed22c21c3802be92e4355a1a78f83df14e08b337614395f42d0c5aa4c5abdf55db5bf5e09bfd2deda1a8cfdb280507bb09b375 t Thu Dec 30 18:27:53 2010 Packet-Type = Access-Request CHAP-Password = 0x060bb5ca76578168f759811c519a20e4ce 퇼㎌델??x ?CHAP-Challenge = 0xb561a6ab4003cb2378b5e8cede5d15ce 퇼㎌델??x ?User-Name = "test01" 61a6ab4003cb2378b5e8cede5d15ce 퇼㎌델??x ?NAS-IP-Address = 127.0.0.1 4003cb2378b5e8cede5d15ce 퇼㎌델??x ?

2 1

How the freeradius server can repeat eap-start when receive EAP-FAILURE?
by zhangyan 30 Dec '10

30 Dec '10

hello, Now, the freeradius server version I used is 2.1.6, and I want to the freeradius repeat eap-start when EAP-FAILURE received in my testing, How to configure the freeradius server? Thanks, Yan -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-the-freeradius-server-can-repea… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 2

eap-aka patch for freeradius 1.1.4
by zhangyan 28 Dec '10

28 Dec '10

Hello, I want to know if the eap-aka patch for freeradius 1.1.4 has been verified or not, I setup the freeradius with the eap-aka patch, the following log is display in server. rlm_eap: EAP Identity rlm_eap: processing type aka eap-aka can not find EAP-Sim-RAND can not initiate aka, missing attributes rlm_eap: Default EAP type aka failed in initiate rlm_eap: Failed in EAP select Can anyone give help for me? thanks Regards, Yan -- View this message in context: http://freeradius.1045715.n5.nabble.com/eap-aka-patch-for-freeradius-1-1-4-… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

2 1

CoA trigger support in freeRadius 2.1.10
by Rajkumar R 27 Dec '10

27 Dec '10

Hi All, I'm a starter to freeRadius and i would like to know if freeRadius 2.1.10 supports sending CoA msg? Also please let me know how to achieve that with configuration setup, if any. Appreciate your inputs. thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Re: Multiple Radius clients from the same host IP supported?
by Brian Candler 24 Dec '10

24 Dec '10

On Thu, Dec 23, 2010 at 07:51:22PM +0200, Murat Öztürk wrote: > Can multiple radius clients on the same server send request to > Freeradius? I ask this question because they may be producing the same > UniqueId in the packages. But they will bind to different UDP sockets, and so will send packets with a different UDP source port. Hence the combination [source address, source port, identifier] uniquely identifies the request, and will set the [dest address, dest port, identifier] in the reply. Regards, Brian.

1 0

Re: Multiple Radius clients from the same host IP supported?
by Alan DeKok 24 Dec '10

24 Dec '10

Murat Öztürk wrote: > Thanks Alan, > Our requirement is mainly "radius client need to send more than 256 IDs > concurrently from single IP, different ports." Then you need to say that. > If we develop such > application, will freeradius support that. Yes. Alan DeKok.

1 0

Re: Multiple Radius clients from the same host IP supported?
by Alan DeKok 24 Dec '10

24 Dec '10

Murat Öztürk wrote: > Can multiple radius clients on the same server send request to > Freeradius? I ask this question because they may be producing the same > /UniqueId/ in the packages. The RADIUS clients are determined by source IP address. I have no idea what a "UniqueId" is. > I believe that, if freeradius use check ip+unique id combination to > identify packages from specific BRAS, it will cause problem. Othwise, > there should not be any issue. Please read the RADIUS specifications which describe how RADIUS works. Alan DeKok.

2 1

Performance issue with Freeradius (2.1.7) running Veriwave
by Verma Anurag-VNF673 23 Dec '10

23 Dec '10

Hi, I am running freeradius version 2.1.7. I am seeing some performance issue when I ran Veriwave AAA test with 15 clients connecting at the rate of 15 client/sec. The auth type is PEAP-MSCHAPv2 and using the local database (i.e. not radius). It is using the file as a db store which in our system is mapped to a ramdisk. The test runs for 30 sec. The auth rate was 9 auth/sec. The same test when ran against Microsoft AAA server gives 25 auth/sec. With Freeradius, out of 450 attempted authentications, 209 was successful and 241 was failed. For single client the authentication time is around 110 ms. Is this the expected number? From the mailing list, it seems 150 msec is what has been observed. The RSA key generation on the server is offloaded to the hardware. Without it the auth rate was only 3 auth/sec. Initially, I had threading option turned off and then later turned it on, but the numbers did not change much. I have tried various suggestion put forward in the mailing list including radius file access during authentication by moving file section from authorize section to authenticate section etc., but not much improvement. I also see something similar query raised, but did not find any satisfactory reply. http://freeradius.1045715.n5.nabble.com/Performance-with-Freeradius-1-1- 4-td2760808.html Any help on this will be appreciated. Thanks, Anurag ________________________________ From: Verma Anurag-VNF673 Sent: Wednesday, December 15, 2010 11:37 AM To: 'freeradius-devel(a)lists.freeradius.org' Subject: building freeradius statically Hi, I am trying to build static version of freeradius by passing --enable-static --enable-shared=no to configure. However, I get an error related to static link of dynamic object libltdl.so. In the make output I can see it is explicitly referring to this shared library. How can I tell it to link with libltdl.a (which is already existing) instead? Thanks, Anurag

5 7

Donation of free OATH Feitian OTP c200
by Jean-Michel Pouré - GOOZE 22 Dec '10

22 Dec '10

Dear Friends, In order to foster Free Software development, GOOZE is happy to donate free Feitian OTP c200 to the FreeRadius project. Technical details: * Compliant with OATH TOTP algorithm. * 6 Character LCD Screen * Water Resistance Certificate IP68 * Seed code sent by postal mail. To apply for a free OTP c200, visit this page: http://www.gooze.eu/feitian-otp-c200-for-free-software-development We only ship to Europe, Canada and the US. Merry Christmas and Happy new year. Kind regards, -- Jean-Michel Pouré - Gooze - http://www.gooze.eu

1 0

patch for src/main/xlat.c
by Gabriel Blanchard 19 Dec '10

19 Dec '10

the exact same as %S but prefers to use the Event-Timestamp VP if it's available. I found that when I use a detail file to decouple accounting the timestamp gets skewed if there is any kind of delay to relay the logs. This way the original timestamp of the event is used which I believe is more accurate. --- freeradius-server-2.1.10/src/main/xlat.c 2010-09-28 07:03:56.000000000 -0400 +++ freeradius/src/main/xlat.c 2010-12-17 14:42:31.000000000 -0500 @@ -1166,6 +1166,27 @@ } p++; break; + case 'E': /* Event-Timestamp (Original Timestamp from the NAS) + * falls back to local timestamp if the vp isn't in the packet + */ + tmp = pairfind(request->packet->vps,PW_EVENT_TIMESTAMP); + if (tmp) { + TM = localtime_r(&tmp->vp_date, &s_TM); + len = strftime(tmpdt, sizeof(tmpdt), "%Y-%m-%d %H:%M:%S", TM); + if (len > 0) { + strlcpy(q, tmpdt, freespace); + q += strlen(q); + } + } else { + TM = localtime_r(&request->timestamp, &s_TM); + len = strftime(tmpdt, sizeof(tmpdt), "%Y-%m-%d %H:%M:%S", TM); + if (len > 0) { + strlcpy(q, tmpdt, freespace); + q += strlen(q); + } + } + p++; + break; case 'H': /* request hour */ TM = localtime_r(&request->timestamp, &s_TM); len = strftime(tmpdt, sizeof(tmpdt), "%H", TM);

2 1

radutmp
by Gabriel Blanchard 16 Dec '10

16 Dec '10

any reason why the session_id is limited to only 8 bytes in radutmp? It's truncating my session_ids by 2 bytes and caused me a lot of headaches :P Would it break anything if I'd just increase it to 32 bytes? While we're at it, why not change the login to 64 bytes as well? I can implement it and submit a patch...just thought I'd email the list first to make sure I'm not doing anything stupid. include/radutmp.h struct radutmp { char login[32]; /* Loginname */ /* FIXME: extend to 48 or 64 bytes */ unsigned int nas_port; /* Port on the terminal server (32 bits). */ char session_id[8]; /* Radius session ID (first 8 bytes at least)*/ /* FIXME: extend to 16 or 32 bytes */ -Gabe

2 2

building freeradius statically
by Verma Anurag-VNF673 15 Dec '10

15 Dec '10

Hi, I am trying to build static version of freeradius by passing --enable-static --enable-shared=no to configure. However, I get an error related to static link of dynamic object libltdl.so. In the make output I can see it is explicitly referring to this shared library. How can I tell it to link with libltdl.a (which is already existing) instead? Thanks, Anurag

2 1

IPV6_PKTINFO/recvfromto
by Alexander Clouter 15 Dec '10

15 Dec '10

Hi, Whilst rolling out our new FreeRADIUS infrastructure I stumbled on a Linux bug where for IPv6 clients the reply source IP address from the server does not necessary match the request's destination address; as a result the client ignores the reply packet. I use OSPF to anycast our RADIUS servers and so have to bind to '::', the box as a result is obviously multi-homed too. I am guessing this is why I am seeing the bug whilst most other (in)?sane sysadmin's bind to the EUI64 address and so do not see this problem. Turns out 'struct in6_pktinfo' is a GNU extension[1] and so you need to define _GNU_SOURCE when ./configure is running otherwise you get HAVE_IN6_PKTINFO is undefined. I just gave it a whirl, config.cache shows 'yes' now for the presence of ipi6_pktinfo: ---- ac56@domokun:/usr/src/deb-src/freeradius/freeradius-2.1.10+dfsg$ grep pktinfo config.cache ac_cv_type_struct_in6_pktinfo_has_ipi6_addr=${ac_cv_type_struct_in6_pktinfo_has_ipi6_addr=yes} ac_cv_type_struct_in_pktinfo_has_ipi_addr=${ac_cv_type_struct_in_pktinfo_has_ipi_addr=yes} ---- Until I forced _GNU_SOURCE into CFLAGS I was seeing '${ac_cv_type_struct_in6_pktinfo_has_ipi6_addr=}', note the lack of a 'yes' on the end there, which would explain why things were not behaving. Once this was enabled, I noticed that someone thinks IPv6 addresses are integers, so I have provided a patch to fix that. I noticed someone has disabled udpfromto.c being used for IPv6 sockets altogether...this is also fixed in the patch :) I would provide a patch for the autoconf bit but I have no idea how to persuade autoconf to do what I want...from what I have heard I do not want to either :) Anyway, with the following, my IPv6 client support works once again, although someone with Clue(tm) probably should look over it to make sure all is well with it :) Cheers [1] http://linux.derkeiler.com/Mailing-Lists/Fedora/2009-02/msg00318.html --- freeradius-2.1.10+dfsg.orig/src/lib/udpfromto.c 2010-09-28 11:03:56.000000000 +0000 +++ freeradius-2.1.10+dfsg/src/lib/udpfromto.c 2010-12-13 19:12:40.000000000 +0000 @@ -87,7 +87,7 @@ * This should actually be standard IPv6 */ proto = IPPROTO_IPV6; - flag = IPV6_PKTINFO; + flag = IPV6_RECVPKTINFO; #endif #endif } else { @@ -172,7 +172,7 @@ return -1; } *tolen = sizeof(*dst); - *dst = *src; + memcpy(dst, src, sizeof(*dst)); #if !defined(HAVE_IN6_PKTINFO) /* @@ -240,7 +240,7 @@ (cmsg->cmsg_type == IPV6_PKTINFO)) { struct in6_pktinfo *i = (struct in6_pktinfo *) CMSG_DATA(cmsg); - ((struct sockaddr_in6 *)to)->sin6_addr = i->ipi6_addr; + memcpy(&((struct sockaddr_in6 *) to)->sin6_addr, &i->ipi6_addr, sizeof(struct in6_addr)); *tolen = sizeof(struct sockaddr_in6); break; } @@ -335,7 +335,7 @@ pkt = (struct in6_pktinfo *) CMSG_DATA(cmsg); memset(pkt, 0, sizeof(*pkt)); - pkt->ipi6_addr = s6->sin6_addr; + memcpy(&pkt->ipi6_addr, &s6->sin6_addr, sizeof(struct in6_addr)); #endif } #endif --- freeradius-2.1.10+dfsg.orig/src/lib/radius.c 2010-09-28 11:03:56.000000000 +0000 +++ freeradius-2.1.10+dfsg/src/lib/radius.c 2010-12-13 19:11:34.000000000 +0000 @@ -228,13 +228,11 @@ #ifdef WITH_UDPFROMTO /* - * Only IPv4 is supported for udpfromto. - * * And if they don't specify a source IP address, don't * use udpfromto. */ - if ((dst_ipaddr->af == AF_INET) && - (src_ipaddr->af != AF_UNSPEC)) { + if ((dst_ipaddr->af == AF_INET || dst_ipaddr->af == AF_INET6) + && (src_ipaddr->af != AF_UNSPEC)) { return sendfromto(sockfd, data, data_len, flags, (struct sockaddr *)&src, sizeof_src, (struct sockaddr *)&dst, sizeof_dst); @@ -244,7 +242,7 @@ #endif /* - * No udpfromto, OR an IPv6 socket, fail gracefully. + * No udpfromto so fail gracefully. */ return sendto(sockfd, data, data_len, flags, (struct sockaddr *) &dst, sizeof_dst); @@ -415,14 +413,14 @@ * packet after "len" bytes. */ #ifdef WITH_UDPFROMTO - if (dst.ss_family == AF_INET) { + if (dst.ss_family == AF_INET || dst.ss_family == AF_INET6) { data_len = recvfromto(sockfd, buf, len, flags, (struct sockaddr *)&src, &sizeof_src, (struct sockaddr *)&dst, &sizeof_dst); } else #endif /* - * No udpfromto, OR an IPv6 socket. Fail gracefully. + * No udpfromto so fail gracefully. */ data_len = recvfrom(sockfd, buf, len, flags, (struct sockaddr *)&src, &sizeof_src);

2 5

LDAP + 802.1x + windows
by Nabawia Khalil 07 Dec '10

07 Dec '10

Dear All, I configured my freeradius to authenticate 802.1x from the ldap server. To authenticate the windows mschap2 I have to install securew2 client. It is hard to install securew2 on all university pcs because it needs a license per PC. Is it possible to modify the freeradius configuration to convert the MSCHAP2 password to PAP before sending it to the ldap server or doing conversion from PAP to MSCHAP2 thanks Nabawia

3 2

robust-proxy-accounting issue
by Paul Sherratt 06 Dec '10

06 Dec '10

I've just installed latest fr2.1.10 stable, and testing the stock robust-proxy-accounting. It looks as if when all home servers are down, the detail file is continuously replayed over itself, causing new attributes to be appended on each poll and rapidly increasing the size of the detail log, and other obscurities like Packet-Transmit-Counter being re-set as it thinks each re-play is a new proxied packet. In rlm_detail.c:479 if (request->listener->type == RAD_LISTEN_DETAIL && strcmp(((struct detail_instance *)instance)->detailfile, ((listen_detail_t *)request->listener->data)->filename) == 0) { RDEBUG("Suppressing writes to detail file as the request was just read from a detail file."); return RLM_MODULE_NOOP; } It looks like in the example config, detail-%Y%m%d:%H is used on the detail writer, and detail-*:* is used on the detail listener, which wont match above? So short-term workaround is to just use a single detail file. Rgds Paul --8<---------------- Going to the next request Detail listener /var/log/freeradius/radacct/detail.example.com/detail-*:* state replied signalled 0 waiting 0.005643 sec Detail - unlinking /var/log/freeradius/radacct/detail.example.com/detail.work Detail listener /var/log/freeradius/radacct/detail.example.com/detail-*:* state unopened signalled 0 waiting 1.035186 sec Waking up in 1.0 seconds. Polling for detail file /var/log/freeradius/radacct/detail.example.com/detail-*:* Detail - Renaming /var/log/freeradius/radacct/detail.example.com/detail-20101203:15 -> /var/log/freeradius/radacct/detail.example.com/detail.work detail_recv: Read packet from /var/log/freeradius/radacct/detail.example.com/detail.work Acct-Status-Type = Interim-Update NAS-IP-Address = 192.0.2.1 Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.20 Packet-Original-Timestamp = "Dec 3 2010 15:14:32 GMT" Acct-Delay-Time = 21 Packet-Transmit-Counter = 1 Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.10 Packet-Original-Timestamp = "Dec 3 2010 15:14:39 GMT" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.10 Packet-Original-Timestamp = "Dec 3 2010 15:14:46 GMT" server home.example.com { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/freeradius/sites-enabled/test +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { WARNING: Empty pre-proxy section. Using default return values. } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { WARNING: Empty preacct section. Using default return values. # Executing section accounting from file /etc/freeradius/sites-enabled/test +- entering group accounting {...} [detail.example.com] expand: /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H -> /var/log/freeradius/radacct/detail.example.com/detail-20101203:15 [detail.example.com] /var/log/freeradius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /var/log/freeradius/radacct/detail.example.com/detail-20101203:15 [detail.example.com] expand: %t -> Fri Dec 3 15:14:56 2010 ++[detail.example.com] returns ok } # server acct_detail.example.com Going to the next request <<< Received proxied response code 5 from internal virtual server. server home.example.com { WARNING: Empty post-proxy section. Using default return values. # Executing section post-proxy from file /etc/freeradius/sites-enabled/test } server home.example.com { } # server home.example.com Finished request 5. ... Cleaning up request 7 ID 25567 with timestamp +37 Going to the next request Detail listener /var/log/freeradius/radacct/detail.example.com/detail-*:* state replied signalled 0 waiting 0.002655 sec Detail - unlinking /var/log/freeradius/radacct/detail.example.com/detail.work Detail listener /var/log/freeradius/radacct/detail.example.com/detail-*:* state unopened signalled 0 waiting 1.146660 sec Waking up in 1.1 seconds. Polling for detail file /var/log/freeradius/radacct/detail.example.com/detail-*:* Detail - Renaming /var/log/freeradius/radacct/detail.example.com/detail-20101203:15 -> /var/log/freeradius/radacct/detail.example.com/detail.work detail_recv: Read packet from /var/log/freeradius/radacct/detail.example.com/detail.work Acct-Status-Type = Interim-Update NAS-IP-Address = 192.0.2.1 Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.20 Packet-Original-Timestamp = "Dec 3 2010 15:14:32 GMT" Acct-Delay-Time = 25 Packet-Transmit-Counter = 1 Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.10 Packet-Original-Timestamp = "Dec 3 2010 15:14:39 GMT" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 192.0.2.10 Packet-Original-Timestamp = "Dec 3 2010 15:14:46 GMT" Proxy-State = 0x3239373330 Packet-Original-Timestamp = "Dec 3 2010 15:14:53 GMT" Proxy-State = 0x3237313737 Packet-Original-Timestamp = "Dec 3 2010 15:14:55 GMT" Proxy-State = 0x3235353637 Packet-Original-Timestamp = "Dec 3 2010 15:14:56 GMT"

2 2