- Freeradius-Devel - lists.freeradius.org

freeradius-users is down... is this?
by Alan DeKok 19 Sep '11

19 Sep '11

2 1

asynchronous nature of eap_sim_db functionality inside eap2 module
by Ming-Ching Tiew 14 Sep '11

14 Sep '11

While trying out the eap_sim_db functionality of eap2 module, for the purpose of retrieving authentication information from external sources, I found that the it works in a somewhat asynchronous manner, specifically when a call to eap_sim_db_get_gsm_triplet() is made via eap2 module, the functions returns PENDING to the caller. And this is in the code :- /* ..... * When using an external server for GSM triplets, this function can always * start a request and return EAP_SIM_DB_PENDING immediately if authentication * triplets are not available. Once the triplets are received, callback * function registered with eap_sim_db_init() is called to notify EAP state * machine to reprocess the message. This eap_sim_db_get_gsm_triplets() * function will then be called again and the newly received triplets will then * be given to the caller. When hard-coding the data to return immediately, I notice that the authentication from radius client will succeed. But when using this asynchronous behaviour, authentication will not succeed. By the way, I am using eapol_test for the testing. Should I just make it synchronous ( ie block until the gsm data comes back ) or there is a way to accomodate this inside freeradius ? Best regards.

2 1

FreeRADIUS can't make progress under certain load
by rihad 12 Sep '11

12 Sep '11

Hi, sometimes when a NAS with many users reboots FreeRADIUS is unable to cope with the number of incoming requests: Sat Sep 10 13:23:16 2011 : Auth: Login OK: [5702018] (from client 10.10.70.100 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.98 port 1645 - ID: 131 due to unfinished request 2814. Giving up on old request. Sat Sep 10 13:23:16 2011 : Auth: Login OK: [5026706] (from client 10.10.70.38 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.93 port 1646 - ID: 117 due to unfinished request 1036. Giving up on old request. Sat Sep 10 13:23:16 2011 : Auth: Login OK: [4925140] (from client 10.10.70.93 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.60 port 1645 - ID: 109 due to unfinished request 3370. Giving up on old request. Sat Sep 10 13:23:16 2011 : Auth: Login OK: [4977364] (from client 10.10.70.38 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.93 port 1646 - ID: 118 due to unfinished request 1040. Giving up on old request. Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.60 port 1645 - ID: 110 due to unfinished request 3373. Giving up on old request. Sat Sep 10 13:23:16 2011 : Auth: Login OK: [4529464] (from client 10.10.70.28 port 0) Sat Sep 10 13:23:16 2011 : Error: Received conflicting packet from client 10.10.70.98 port 1645 - ID: 132 due to unfinished request 2829. Giving up on old request. and ad infinitum. The duplicate requests come from PPPoE clients after they fail to receive a response within 5 seconds or so. The problem can then be solved by restarting the daemon once or twice and watching the errors go away. The fact that dropping all current work helped gave me this idea: wouldn't it be nice if FreeRADIUS dropped both the old _and_ the new request at the time it logged that "giving up" message? That would at least allow it to make progress. BTW, I'm not sure why, but under comparable workloads openradius does not exhibit this problem. I looked in the code, namely in src/main/event.c /* * FUTURE: Add checks for system load. If the system is * busy, start dropping requests... * * We can probably keep some statistics ourselves... if * there are more requests coming in than we can handle, * start dropping some. */ Sure the time has come for us :) Here's my try to drop them both when receiving a dupe: --- freeradius-server-2.1.11/src/main/event.c 2011-06-20 19:57:14.000000000 +0500 +++ event.c 2011-09-10 20:44:34.000000000 +0500 @@ -2894,7 +2894,7 @@ received_conflicting_request(request, client); request = NULL; - break; + return 0; case REQUEST_REJECT_DELAY: case REQUEST_CLEANUP_DELAY: Any thoughts?

5 31

Bug in function sql_oracle.c - sql_init_socket - OCILogon
by Angelo Compagnucci 11 Sep '11

11 Sep '11

Hi List, I wrote for this bug some months ago, but I had no replies. I opened the bug number 172. http://bugs.freeradius.org/bugzilla/show_bug.cgi?id=172 The bug persists on the last trunk version on github. Can you confirm and eventually solve it? Thank you!

2 4

playing with eap2 - access-challenge instead of access-accept
by Ming-Ching Tiew 10 Sep '11

10 Sep '11

I am playing with eap2 module using libeap.so from the hostapd 0.7.3 stable ( plus Makefile modifications ). I have got it to a stage where it can be instantiated - despite a few other off topic issues. But when I put that 'eap2' in place of 'eap' in the authentication section, nothing happens, eap2 module is not invoked. So I changed it to :- Auth-Type eap { eap2 } The module is then invoked. But I am still not coming close to being able get it to authenticate, because when I tested the simplest case of eap md5, this is what I got from radius debug :- Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group eap {...} CTRL-EVENT-EAP-STARTED 00:00:00:00:00:00 CTRL-EVENT-EAP-PROPOSED-METHOD method=1 CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25 ==> Request ++[eap2] returns handled Sending Access-Challenge of id 250 to 127.0.0.1 port 52414 EAP-Message = 0x01d300061920 State = 0xe3c425eb267c641f82d999e1c9808ce1 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 0. Verses this is what I get if I use 'eap' module :- [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 160 to 127.0.0.1 port 50702 EAP-Message = 0x03d30004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "eapmd5" Finished request 1. Seems eap2 is always returning access-challenge while eap is able to complete with access-accept. Is it that the rlm_eap2.c source needs further modifications ? Best regards.

2 2

RADIUS client configuratio-1.1.6n steps
by vikraman.p36＠wipro.com 08 Sep '11

08 Sep '11

Hi , I have downloaded and installed RADIUS server -2.1.11 and RADIUS client-1.1.6. To run the server I used the command radiusd -X. Please let me know the configuration part for RADIUS client , run RADIUS client, in which file I need to specify the username ,password and secret password. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0

How to make sure that there is no undefined references to a module
by Ming-Ching Tiew 07 Sep '11

07 Sep '11

I am trying to develope a little module of my own, the modules compiles fine. But to make sure that my modules has no undefined references, I added this to the Makefile :- RLM_LDFLAGS = -Wl,--no-undefined I tried the idea on one of the simplest module which comes with the sources, rlm_exec, but after that the module then failed to compile, having lots of undefined references. eg :- :273: undefined reference to `radlog' :442: undefined reference to `radius_exec_program' Any advise how should I go about fixing this problem ?

3 2

RADIUS Disconnect request support in free radius client -1.1.6
by vikraman.p36＠wipro.com 07 Sep '11

07 Sep '11

Hi , I am looking into Free radius client (freeradius-client-1.1.6) library code for using in our project. Please let me know if the Free radius client supports processing of the disconnect request message from RADIUS server which is defined in the RFC 5176. Thanks, Vikraman Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1

How to send Permanent ID request in EAP-SIM method?
by lambertdev 06 Sep '11

06 Sep '11

Hello, As we know,EAP-SIM specifacation defines three kinds of identity.But when I read the source code of "rlm_eap_sim.c",freeradius only sends FULL_AUTH_ID_REQUEST. i.e.In function "eap_sim_sendstart",there is newvp = paircreate(ATTRIBUTE_EAP_SIM_BASE+PW_EAP_SIM_FULLAUTH_ID_REQ, PW_TYPE_OCTETS); For sending eap permanent id request to peer,I tried to modify this sentence to: newvp = paircreate(ATTRIBUTE_EAP_SIM_BASE+PW_EAP_SIM_PERMANENT_ID_REQ, PW_TYPE_OCTETS); and compiled it successfully. But when I tried to test the server,with the command below: radeapclient -x localhost auth testing123 <eapsim-in.txt the server will return: rad_recv: Access-Request packet from host 127.0.0.1 port 57914, id=86, length=89 User-Name = "232420100000015" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0x745c37803f66ee28ae1e5de97b4dbafc NAS-Port = 0 EAP-Message = 0x0255001401323332343230313030303030303135 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "232420100000015", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 85 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry 232420100000015 at line 93 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 230 ++[eap] returns handled Sending Access-Challenge of id 86 to 127.0.0.1 port 57914 EAP-Message = 0x01e60014120a00000f020002000100000d010000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6548900d65ae82b9c8a9eb100d26724a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 57914, id=87, length=85 User-Name = "232420100000015" NAS-IP-Address = 209.87.252.247 Message-Authenticator = 0x9a0e653561af56be21543aec5da35963 NAS-Port = 0 State = 0x6548900d65ae82b9c8a9eb100d26724a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "232420100000015", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry 232420100000015 at line 93 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] ERROR: You set 'Auth-Type = EAP' for a request that does not contain an EAP-Message attribute! ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 232420100000015 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated I wonder why did this happen?How should I do if I want send a PERMANENT_ID request to the server？Thank you！！ -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-send-Permanent-ID-request-in… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

1 0

Module exec and documentation not found or example
by dragoalato1988 02 Sep '11

02 Sep '11

hello, good day, I'm desperately trying to create my own authentication and Autorization. I realized that the module can be integrated rlm_exec scripts in which to place procedures. the problem is that I can find detailed documentation and some examples that I can afford to create my own scripts. some of you might be kind enough to give me a hand? thank you maurizio -- View this message in context: http://freeradius.1045715.n5.nabble.com/Module-exec-and-documentation-not-f… Sent from the FreeRadius - Dev mailing list archive at Nabble.com.

3 4