October 2005 - Freeradius-Users - lists.freeradius.org

RE: FreeRadius with NTLM
by Jaygopal Upadhyay 26 Oct '05

26 Oct '05

Hello, I feel my samba configuration is fine as I am able to use ntlm_auth --username=username --domain=domainname and get it authenticated. But through radius I am not able to get authenticated. Below is the log when a request is received by the radius server. Can anyone guide me correct the problem? Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.159.186:1031, id=8, length=260 Message-Authenticator = 0x13b3b93f61a42974560bd934ea94ed07 Service-Type = Framed-User User-Name = "DOMAINNAME\\username" Framed-MTU = 1488 State = 0xf4e76dd53f28774073c9ffd19f060b3d Called-Station-Id = "00-13-46-70-50-54:SierraAtlantic" Calling-Station-Id = "00-13-CE-24-AB-DC" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020800261900170301001b5521adc1357e0251337f314c5568e0fe5404c4fc59106c977397 80 NAS-IP-Address = 192.168.159.186 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 26 modcall[authorize]: module "preprocess" returns ok for request 26 modcall[authorize]: module "chap" returns noop for request 26 modcall[authorize]: module "mschap" returns noop for request 26 rlm_realm: No '@' in User-Name = "DOMAINNAME\username", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 26 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 26 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 26 modcall: group authorize returns updated for request 26 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 26 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 26 modcall: group authenticate returns invalid for request 26 auth: Failed to validate the user. Delaying request 26 for 1 seconds Finished request 26 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.159.186:1031, id=8, length=260Sending Access-Reject of id 8 to 192.168.159.186:1031 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Regards, Jaygopal. -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Tuesday, October 25, 2005 10:20 PM To: FreeRadius users mailing list Subject: Re: FreeRadius with NTLM Jaygopal Upadhyay <Jaygopal.Upadhyay(a)sierraatlantic.com> wrote: > Can anyone provide me with steps on how to configure FreeRadius to use samba > and allow access to WI-FI to valid domain users? Read radiusd.conf. Look for "ntlm_ath". Read samba's documentation to see how to configure it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html "The information contained in this message and the attachments (if any) may be privileged and confidential and protected from disclosure. You are hereby notified that any unauthorized use, dissemination, distribution or copying of this communication, review, retransmission, or taking of any action based upon this information, by persons or entities other than the intended recipient, is strictly prohibited. If you are not the intended recipient or an employee or agent responsible for delivering this message, and have received this communication in error, please notify us immediately by replying to the message and kindly delete the original message, attachments, if any, and all its copies from your computer system. Thank you for your cooperation."

2 1

Cisco and No NAS-Port seen (checkrad)
by Miguel 26 Oct '05

26 Oct '05

Hi, im having problems implementing simultaneous-use on a cisco AS5400, is the same problem addresses in this thread http://lists.cistron.nl/pipermail/freeradius-users/2005-March/041894.html Ok, i know what the problem is, but how can i instruct the cisco that it must send the NAS-Port attribute?, is this even posible? thanks

3 3

Problems Installation Debian
by awaradius＠myawa.com 26 Oct '05

26 Oct '05

Hello everydoy, I am installing the last version of freeradius, but I have a bit problem in the installation. I work with debian. First of all, I download the software from freeradius´ web: radiusnoc:/# wget ftp://ftp.freeradius.org/pub/freeradius-1.0.5.tar.gz The next step: radiusnoc:/#tar zxvf freeradius-1.0.5.tar.gz After, I change to the directory: radiusnoc:/#cd freeradius-1.0.5 Now, I must do this steps: ./configure make make install But, it is here where I have some problems: radiusnoc:/freeradius-1.0.5# ./configure creating ./config.status creating Makefile creating config.h config.h is unchanged radiusnoc:/freeradius-1.0.5# make x99_rlm.c:492: error: `user_info' undeclared (first use in this function) make[6]: *** [x99_rlm.o] Error 1 make[6]: Leaving directory `/freeradius-1.0.5/src/modules/rlm_x99_token' make[5]: *** [common] Error 2 make[5]: Leaving directory `/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/freeradius-1.0.5' make: *** [all] Error 2 radiusnoc:/freeradius-1.0.5# make install make[4]: Leaving directory `/freeradius-1.0.5/src/modules' Making install in main... make[4]: Entering directory `/freeradius-1.0.5/src/main' /freeradius-1.0.5/libtool --mode=install /freeradius-1.0.5/install-sh -c -m 755 radiusd /usr/local/sbin /freeradius-1.0.5/install-sh -c -m 755 radiusd /usr/local/sbin/radiusd install: radiusd does not exist make[4]: *** [install] Error 1 make[4]: Leaving directory `/freeradius-1.0.5/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/freeradius-1.0.5/src' make[2]: *** [install] Error 2 make[2]: Leaving directory `/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/freeradius-1.0.5' make: *** [install] Error 2 somebody can help me? somebody knows these errors? Thanks!!!

2 1

reject reply
by hannibal 26 Oct '05

26 Oct '05

hi, everyone, i got these logs: ---------------------------------------------------------------------------------------------- modcall: group authorize returns reject for request 37 Delaying request 37 for 1 seconds Finished request 37 // why finished request, but not send reply to client?? Going to the next request Thread 6 waiting to be assigned a request --- Walking the entire request list --- Sending Access-Reject of id 1 to 127.0.0.1:32874 // Sending this message, i think is because of process time out. Cleaning up request 37 ID 1 with timestamp 435cf28f --------------------------------------------------------------------------------------------- what happened behind? i'm a completely newbie. can someone tell me? thank you!!

3 2

Freeradius and Hardware Tokens
by michel APPLAINCOURT 26 Oct '05

26 Oct '05

Hi all, I am currently looking for a replacement solution for centralized authentication for one customer. They want openness and standards. Freeradius seems a very good solution, but they also want a solution that permits use of hardware tokens. I looked that FreeRadius support X9.9, so I have a simple question : Which are the hardware tokens that can be used surely with FreeRadius (fully supported)? I saw that cryptocards are fully supported, but references are often dated of 2002. Today, are cryptocards still usable? If yes what is possible and what is not. For example how can we manage tokens, is there an open source tool? How can we reset a blocked token (too much pin errors)? do we need initializer? but then do we need also cryptocard server? and if yes how muche licenses do we need and what is the advantage of using freeradius with it? Are there other tokens than cryptocards fully or well supported? I am actually blocked by these questions and can't find any answers, even in the mailing list. Thanks for a quick response, as I have to give answer to my customer in 2 days (sic). =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Michel APPLAINCOURT | E-mail : michel.applaincourt(a)it-optics.com Managing Director | Phone : +32 65 321573 ext 6001 IT-OPTICS s.a | Fax : +32 65 321574 [The boy that you love is the man that you fear] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

1 0

Authentication problems between Cisco Aironet 1100 and freeradius
by Torkel Mathisen 26 Oct '05

26 Oct '05

Hi I got some problems getting EAP to work with Cisco Aironet 1100 and Freeradius. I've gotten freeradius to work I think and I have configured Cisco Aironet 1100 AP according to Cisco. (http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configu ration_example09186a00801bd035.shtml) (http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configu ration_example09186a00801c40b6.shtml#NetEAP) When I try to connect too my WLAN with my testuser. (User: testuser, Password: Secret149) it won't authenticate. I've configured freeradius to use PEAP-MSCHAPv2. Anyone able to help me out? Regards, Torkel This is the log I get when i run radiusd -X: rad_recv: Access-Request packet from host 10.0.0.1:21645, id=65, length=133 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0011.0a80.41d1" Message-Authenticator = 0x194f32c82aa7088f53cdfc8ac8a36151 EAP-Message = 0x0202000d017465737475736572 NAS-Port-Type = Wireless-802.11 NAS-Port = 478 Service-Type = Framed-User NAS-IP-Address = 10.0.0.1 NAS-Identifier = "testAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 63 modcall[authorize]: module "preprocess" returns ok for request 63 modcall[authorize]: module "chap" returns noop for request 63 modcall[authorize]: module "mschap" returns noop for request 63 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 63 rlm_eap: EAP packet type response id 2 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 63 users: Matched entry testuser at line 90 modcall[authorize]: module "files" returns ok for request 63 modcall: group authorize returns updated for request 63 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 63 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 63 modcall: group authenticate returns handled for request 63 Sending Access-Challenge of id 65 to 10.0.0.1:21645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x67a4b4a551592fcc14469ef9c70a4601 Finished request 63 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.1:21645, id=66, length=218 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0011.0a80.41d1" Message-Authenticator = 0xd5957923efcbfe4c3ee547a066e21d0a EAP-Message = 0x0203005019800000004616030100410100003d0301435f8f34c71e673ecee95256802f 571c6bfa86eaa89728f7d7f782809ef0f82600001600040005000a000900640062000300 060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 478 State = 0x67a4b4a551592fcc14469ef9c70a4601 Service-Type = Framed-User NAS-IP-Address = 10.0.0.1 NAS-Identifier = "testAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 64 modcall[authorize]: module "preprocess" returns ok for request 64 modcall[authorize]: module "chap" returns noop for request 64 modcall[authorize]: module "mschap" returns noop for request 64 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 64 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 64 users: Matched entry testuser at line 90 modcall[authorize]: module "files" returns ok for request 64 modcall: group authorize returns updated for request 64 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 64 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0654], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 64 modcall: group authenticate returns handled for request 64 Sending Access-Challenge of id 66 to 10.0.0.1:21645 EAP-Message = 0x0104040a19c0000006b1160301004a020000460301435f8f1b11c01e5389f06ab78215 4f3759e70cc9bb2b320d320ab9c656d33f6e205816b685a712ff840d91baa1dbf8b9c0ec 209492aecf22425643fafe1541596d00040016030106540b00065000064d0002b3308202 af30820218a003020102020900b646b246bff02a86300d06092a864886f70d0101040500 30818d310b3009060355040613024e4f310d300b060355040813044f534c4f310d300b06 0355040713044f534c4f310f300d060355040a130642425320415331133011060355040b 130a66726565726164697573311b301906035504031312436c69656e7420636572746966 6963 EAP-Message = 0x617465311d301b06092a864886f70d010901160e726f6f74406c6f63616c686f737430 1e170d3035313032363132333432385a170d3036313032363132333432385a30818b310b 3009060355040613024e4f310d300b060355040813044f534c4f310d300b060355040713 044f534c4f310f300d060355040a130642425320415331133011060355040b130a667265 657261646975733119301706035504031310526f6f74206365727469666963617465311d 301b06092a864886f70d010901160e726f6f74406c6f63616c686f737430819f300d0609 2a864886f70d010101050003818d0030818902818100eead5285b5e9f7b939a2dfc1b7fe f60a EAP-Message = 0xbd055de0ba27b2ef81244e0eabad60241727ff5fc724f36147d08ea5f9e3f0110dfb5a 2397c3906a00ab8eb28509e4a672b2c948c0b8007785f550b3908c2f49d7a113d6e7198d 9606e567fc38be816fb2acf60f18bfe56d0617ff7e651439ce9c8ed40363b5b1e4d0d96f 59a468a6650203010001a317301530130603551d25040c300a06082b0601050507030130 0d06092a864886f70d01010405000381810050aa5f1713a5025d21f128094104579eb85a 9ded57072baf72b2c0e3fbea766eb53c62e9bc2a5d1bc22f2615cc1fe88487e2d0b7e5ea a045a8ae1734a85f28e6cd70d3340c2a51bfe7b974c13b9a1a4abebe373312d1d4b987e3 2368 EAP-Message = 0x1edad7e4a54456fd7989e901485e9f2fcf7e8ed8e57fae97fb2fdd1fba5a50c683b7da 7f00039430820390308202f9a003020102020900b646b246bff02a84300d06092a864886 f70d010104050030818d310b3009060355040613024e4f310d300b060355040813044f53 4c4f310d300b060355040713044f534c4f310f300d060355040a13064242532041533113 3011060355040b130a66726565726164697573311b301906035504031312436c69656e74 206365727469666963617465311d301b06092a864886f70d010901160e726f6f74406c6f 63616c686f7374301e170d3035313032363132333432335a170d30373130323631323334 3233 EAP-Message = 0x5a30818d310b3009060355040613024e4f310d300b06 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd8223ab2cc29f1f3ad13843d71797409 Finished request 64 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.1:21645, id=67, length=144 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0011.0a80.41d1" Message-Authenticator = 0xcc2b18df4d9f3ad232f1d712d0fefa45 EAP-Message = 0x020400061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 478 State = 0xd8223ab2cc29f1f3ad13843d71797409 Service-Type = Framed-User NAS-IP-Address = 10.0.0.1 NAS-Identifier = "testAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 65 modcall[authorize]: module "preprocess" returns ok for request 65 modcall[authorize]: module "chap" returns noop for request 65 modcall[authorize]: module "mschap" returns noop for request 65 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 65 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 65 users: Matched entry testuser at line 90 modcall[authorize]: module "files" returns ok for request 65 modcall: group authorize returns updated for request 65 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 65 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 65 modcall: group authenticate returns handled for request 65 Sending Access-Challenge of id 67 to 10.0.0.1:21645 EAP-Message = 0x010502b719000355040813044f534c4f310d300b060355040713044f534c4f310f300d 060355040a130642425320415331133011060355040b130a66726565726164697573311b 301906035504031312436c69656e74206365727469666963617465311d301b06092a8648 86f70d010901160e726f6f74406c6f63616c686f737430819f300d06092a864886f70d01 0101050003818d0030818902818100bb9dc7f9a6b879ddde091ded35f3137693d1a9fa9d 2e2f1e20e1e49c9daf077fd1c4066e8e409eda68baac046ff390baedad93e603fdde7304 6df106c9c3775eb0e024a2682faf6469e778758b9c782a11ad0dcc25edca8f9efdee96cc c1bc EAP-Message = 0x84850d853d4435da9ab22ec6c3dc4e6d9137e0ec36d705c923055aa8b900d833350203 010001a381f53081f2301d0603551d0e04160414227f0709429785a3169b9817627cd456 d617f2283081c20603551d230481ba3081b78014227f0709429785a3169b9817627cd456 d617f228a18193a4819030818d310b3009060355040613024e4f310d300b060355040813 044f534c4f310d300b060355040713044f534c4f310f300d060355040a13064242532041 5331133011060355040b130a66726565726164697573311b301906035504031312436c69 656e74206365727469666963617465311d301b06092a864886f70d010901160e726f6f74 406c EAP-Message = 0x6f63616c686f7374820900b646b246bff02a84300c0603551d13040530030101ff300d 06092a864886f70d0101040500038181001fb7ec3488fd3b6349d6cc33b5c6451ce1c2e8 ef8db6f4818cd017991f9649141c1767553c20303e262fec4bb351cda19b403bab78aa37 236ffc78dace1a39089ff037eb911a5133bc6b1f0275cc9e68bc4c8f487a4d2cdc8e7061 34e512d7e715ca81c5a7bb6cc668ca8181e898befeab40773de8f3eb6629ecd2c79d5f74 f116030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6a28407c14613e4bb49a5c41aab60bfd Finished request 65 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.0.1:21645, id=68, length=144 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "000e.8401.cd50" Calling-Station-Id = "0011.0a80.41d1" Message-Authenticator = 0x9a39ada2dab238ef570b8dc1dd3f3b6c EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 478 State = 0x6a28407c14613e4bb49a5c41aab60bfd Service-Type = Framed-User NAS-IP-Address = 10.0.0.1 NAS-Identifier = "testAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 66 modcall[authorize]: module "preprocess" returns ok for request 66 modcall[authorize]: module "chap" returns noop for request 66 modcall[authorize]: module "mschap" returns noop for request 66 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 66 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 66 users: Matched entry testuser at line 90 modcall[authorize]: module "files" returns ok for request 66 modcall: group authorize returns updated for request 66 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 66 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 66 modcall: group authenticate returns handled for request 66 Sending Access-Challenge of id 68 to 10.0.0.1:21645 EAP-Message = 0x010600061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x029cb84784a586178ecaa439ab2c98ab Finished request 66 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 63 ID 65 with timestamp 435f8f1b Cleaning up request 64 ID 66 with timestamp 435f8f1b Cleaning up request 65 ID 67 with timestamp 435f8f1b Cleaning up request 66 ID 68 with timestamp 435f8f1b Nothing to do. Sleeping until we see a request.

1 0

SV: Freeradius stops authenticating
by Svein Hansen 26 Oct '05

26 Oct '05

Update: Some error's in log today..(needed a restart): # less /var/log/radius/radius.log ..... Wed Oct 26 12:50:34 2005 : Error: Discarding duplicate request from client c3:1560 - ID: 206 due to unfinished request 5410 ......... Wed Oct 26 13:26:21 2005 : Error: Assertion failed in modcall.c, line 68 ........ Avarage authentications: 2000 a day (08:00 - 17:00). Svein >>> Svein.Hansen(a)hive.no 19.10.2005 10:11 >>> I have a Cisco VPN 3000 Concentrator and a Trapeze Wireless Mobility Exchange(MX-400) that authenticate users in Freeradius by using MSChapV2 and smbpasswd. My radius stops authenticating approx. 2 times a day(not during the weekends..). The pid usually dies, but sometimes it lives (but not authenticating). I followed the instructions on the BUG page, and got a core dump: (gdb) bt #0 0x0017f7a2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2 #1 0x0040e7d5 in raise () from /lib/tls/libc.so.6 #2 0x00410149 in abort () from /lib/tls/libc.so.6 #3 0x0044227a in __libc_message () from /lib/tls/libc.so.6 #4 0x00448abf in _int_free () from /lib/tls/libc.so.6 #5 0x00448e3a in free () from /lib/tls/libc.so.6 #6 0x00439366 in fclose@@GLIBC_2.1 () from /lib/tls/libc.so.6 #7 0x00f24de1 in get_next (name=0x9d69ffc "tonemere", ht=0x9d65e70) at rlm_passwd.c:280 #8 0x00f25c21 in passwd_authorize (instance=0x9d65db0, request=0xb7e00858) at rlm_passwd.c:540 #9 0x003d7c54 in modcall (component=1, c=0x9d65030, request=0xb7e00858) at modcall.c:219 #10 0x003d7ee1 in modcall (component=1, c=0x9d642e8, request=0xb7e00858) at modcall.c:252 #11 0x003d7126 in indexed_modcall (comp=1, idx=6, request=0x0) at modules.c:473 #12 0x003d3ef3 in rad_authenticate (request=0xb7e00858) at auth.c:592 #13 0x003cd04c in rad_respond (request=0xb7e00858, fun=0x3d3e57 <rad_authenticate>) at radiusd.c:1642 #14 0x003da481 in request_handler_thread (arg=0x9d68728) at threads.c:517 #15 0x0095e341 in start_thread () from /lib/tls/libpthread.so.0 #16 0x004adfee in clone () from /lib/tls/libc.so.6 (gdb) As I understand of this printout, it's glibc that faults.. I suspected that there had to be a module in freeradius that makes glibc fault, so I tried to run freeradius in Valgrind: [root@eva etc]# valgrind -v --tool=memcheck radiusd -yf ==5070== Memcheck, a memory error detector for x86-linux. ==5070== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al. ==5070== Using valgrind-2.2.0, a program supervision framework for x86-linux. ==5070== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al. ==5070== Valgrind library directory: /usr/lib/valgrind ==5070== Command line ==5070== radiusd ==5070== -yf ==5070== Startup, with flags: ==5070== -v ==5070== --tool=memcheck ==5070== Contents of /proc/version: ==5070== Linux version 2.6.9-11.ELsmp (bhcompile(a)decompose.build.redhat.com) (gcc version 3.4.3 20050227 (Red Hat 3.4.3-18:26:27 EDT 2005 ==5070== Reading syms from /usr/sbin/radiusd (0x0) ==5070== object doesn't have a symbol table ==5070== Reading syms from /lib/ld-2.3.4.so (0x1B8E4000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/valgrind/stage2 (0xB0000000) ==5070== Reading syms from /lib/ld-2.3.4.so (0xB1000000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/valgrind/vgskin_memcheck.so (0xB7C8C000) ==5070== Reading syms from /lib/tls/libc-2.3.4.so (0xB7EB5000) ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libdl-2.3.4.so (0xB7FDF000) ==5070== object doesn't have any debug info ==5070== Reading suppressions file: /usr/lib/valgrind/default.supp ==5070== REDIRECT soname:libc.so.6(__GI___errno_location) to soname:libpthread.so.0(__errno_location) ==5070== REDIRECT soname:libc.so.6(__errno_location) to soname:libpthread.so.0(__errno_location) ==5070== REDIRECT soname:libc.so.6(__GI___h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==5070== REDIRECT soname:libc.so.6(__h_errno_location) to soname:libpthread.so.0(__h_errno_location) ==5070== REDIRECT soname:libc.so.6(__GI___res_state) to soname:libpthread.so.0(__res_state) ==5070== REDIRECT soname:libc.so.6(__res_state) to soname:libpthread.so.0(__res_state) ==5070== REDIRECT soname:libc.so.6(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==5070== REDIRECT soname:libc.so.6(strnlen) to *vgpreload_memcheck.so*(strnlen) ==5070== REDIRECT soname:ld-linux.so.2(stpcpy) to *vgpreload_memcheck.so*(stpcpy) ==5070== REDIRECT soname:ld-linux.so.2(strchr) to *vgpreload_memcheck.so*(strchr) ==5070== ==5070== Reading syms from /usr/lib/valgrind/vg_inject.so (0x1B8FC000) ==5070== Reading syms from /usr/lib/valgrind/vgpreload_memcheck.so (0x1B901000) ==5070== TRANSLATE: 0x1B8F5EE0 redirected to 0x1B904100 ==5070== Reading syms from /lib/libcrypt-2.3.4.so (0x8D2000) ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libssl.so.0.9.7a (0x3AB000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libcrypto.so.0.9.7a (0x644000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libnsl-2.3.4.so (0x8BA000) ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libresolv-2.3.4.so (0xD8F000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/valgrind/libpthread.so (0x1B928000) ==5070== Reading syms from /usr/lib/libradius-1.0.5.so (0x1B957000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/libltdl.so.3.1.0 (0xDA3000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libdl-2.3.4.so (0xBFD000) ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/tls/libc-2.3.4.so (0xAAD000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/libgssapi_krb5.so.2.2 (0x46E000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/libkrb5.so.3.2 (0x304000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /lib/libcom_err.so.2.1 (0x2DC000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/libk5crypto.so.3.0 (0x2E1000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/libz.so.1.2.1.2 (0xC03000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== TRANSLATE: 0xB10E80 redirected to 0x1B9048F8 ==5070== TRANSLATE: 0x1B8E47A0 redirected to 0x52BFF040 ==5070== TRANSLATE: 0xB0EDB0 redirected to 0x1B904E24 ==5070== TRANSLATE: 0xB15D20 redirected to 0x1B9042D0 Thu Oct 6 09:11:38 2005 : Info: Starting - reading configuration files ... ==5070== TRANSLATE: 0xB17090 redirected to 0x1B9046F4 ==5070== TRANSLATE: 0xB10BA0 redirected to 0x1B905274 ==5070== Reading syms from /lib/libnss_files-2.3.4.so (0x1B90C000) ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/rlm_expr-1.0.5.so (0x1B918000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_counter-1.0.5.so (0x1B91B000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/libgdbm.so.2.0.0 (0xBD8000) ==5070== object doesn't have a symbol table ==5070== object doesn't have any debug info ==5070== Reading syms from /usr/lib/rlm_mschap-1.0.5.so (0x1CF87000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_preprocess-1.0.5.so (0x1B921000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_realm-1.0.5.so (0x1CF8E000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_files-1.0.5.so (0x1CF92000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_passwd-1.0.5.so (0x1CF96000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_acct_unique-1.0.5.so (0x1CF9B000) ==5070== object doesn't have a symbol table ==5070== Reading syms from /usr/lib/rlm_detail-1.0.5.so (0x1CF9E000) ==5070== object doesn't have a symbol table ==5070== TRANSLATE: 0xB114C0 redirected to 0x1B905326 ==5070== Reading syms from /usr/lib/rlm_radutmp-1.0.5.so (0x1CFA2000) ==5070== object doesn't have a symbol table ==5070== TRANSLATE: 0xB11160 redirected to 0x1B905413 ==5070== warning: Valgrind's pthread_attr_destroy does nothing ==5070== your program may misbehave as a result ==5070== warning: Valgrind's pthread_attr_destroy does nothing ==5070== your program may misbehave as a result ==5070== warning: Valgrind's pthread_attr_destroy does nothing ==5070== your program may misbehave as a result ==5070== Thread 8: ==5070== Invalid read of size 4 ==5070== at 0xAFF2E8: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF97CC0: ??? (rlm_passwd.c:303) ==5070== by 0xFC53: modcall (modcall.c:219) ==5070== by 0xFEE0: modcall (modcall.c:252) ==5070== Address 0x20C29C6C is 92 bytes inside a block of size 352 free'd ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF96DE0: ??? (rlm_passwd.c:280) ==5070== by 0x1CF97C20: ??? (rlm_passwd.c:540) ==5070== ==5070== Thread 8: ==5070== Invalid read of size 4 ==5070== at 0xAFF403: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF97CC0: ??? (rlm_passwd.c:303) ==5070== by 0xFC53: modcall (modcall.c:219) ==5070== by 0xFEE0: modcall (modcall.c:252) ==5070== Address 0x20C29C34 is 36 bytes inside a block of size 352 free'd ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF96DE0: ??? (rlm_passwd.c:280) ==5070== by 0x1CF97C20: ??? (rlm_passwd.c:540) ==5070== ==5070== Thread 8: ==5070== Invalid write of size 4 ==5070== at 0xAFF358: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF97CC0: ??? (rlm_passwd.c:303) ==5070== by 0xFC53: modcall (modcall.c:219) ==5070== by 0xFEE0: modcall (modcall.c:252) ==5070== Address 0x20C29C10 is 0 bytes inside a block of size 352 free'd ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF96DE0: ??? (rlm_passwd.c:280) ==5070== by 0x1CF97C20: ??? (rlm_passwd.c:540) ==5070== ==5070== Thread 8: ==5070== Invalid free() / delete / delete[] ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF97CC0: ??? (rlm_passwd.c:303) ==5070== by 0xFC53: modcall (modcall.c:219) ==5070== Address 0x20C29C10 is 0 bytes inside a block of size 352 free'd ==5070== at 0x1B904EA5: free (vg_replace_malloc.c:153) ==5070== by 0xAFF365: _IO_fclose@@GLIBC_2.1 (in /lib/tls/libc-2.3.4.so) ==5070== by 0x1CF96DE0: ??? (rlm_passwd.c:280) ==5070== by 0x1CF97C20: ??? (rlm_passwd.c:540) I'm not a programmer, but can it be that radius tries a double-close or a double-free? I have had the same problem on Freeradius 1.0.1, 1.0.4 and 1.0.5. My current conf: rhel 4 Kernel: 2.6.9-22.ELsmp radiusd: FreeRADIUS Version 1.0.5, for host , built on Sep 28 2005 at 09:42:46 glibc-2.3.4-2.13 (Sorry for my bad english..) Svein Hansen - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

SUSPENSION OF ACCOUNT
by maruna 26 Oct '05

26 Oct '05

Thank you all, I use FreeRadius v 1.0.5 with postgresql 7.3.4 on redhat Linux ES3 and its been working well. However, I want to create accounts where these accounts will be suspended after let say a month and this suspension continue until the account is renewed manually. Can someone give me idea of how this could be achieved? Thank you, goksie

3 3

freeradius and mysql - no matching entry in db
by Luqman H 26 Oct '05

26 Oct '05

i have fedora core 4 and freeradius-1.0.5 and this is what i do... # radtest luqe mypassword localhost 1812 testing123 Sending Access-Request of id 24 to 127.0.0.1:1812 User-Name = "luqe" User-Password = "mypassword" NAS-IP-Address = dns.mammiri.net NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=24, length=20 * On radius log: radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'luqe' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'luqe' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'luqe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'luqe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'luqe' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'luqe' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'luqe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'luqe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): No matching entry in the database for request from user [luqe] rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 2 modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. No matching entry in the database for request from user [luqe] but if i'm quering manually on mysql: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'luqe' ORDER BY id; +-----+----------+---------------+----------+----+ | id | UserName | Attribute | Value | op | +-----+----------+---------------+----------+----+ | 553 | luqe | User-Password | mypassword | == | +-----+----------+---------------+----------+----+ 1 row in set (0.00 sec) mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'luqe' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+------------------+-------+----+ | 3 | dial-up | Auth-Type | Local | := | | 4 | dial-up | Simultaneous-Use | 1 | == | +----+-----------+------------------+-------+----+ 2 rows in set (0.00 sec) mysql> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'luqe' ORDER BY id; +-----+----------+-------------------+-------------+----+ | id | UserName | Attribute | Value | op | +-----+----------+-------------------+-------------+----+ | 553 | luqe | User-Password | mypassword | := | | 554 | luqe | Framed-IP-Address | 192.168.1.2 | := | | 558 | luqe | Simultaneous-Use | 2 | = | +-----+----------+-------------------+-------------+----+ 3 rows in set (0.00 sec) mysql> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'luqe' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; +----+-----------+--------------------+---------------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+--------------------+---------------------+----+ | 4 | dial-up | Service-Type | Framed-User | := | | 5 | dial-up | Framed-Protocol | PPP | := | | 7 | dial-up | Framed-Compression | Van-Jacobson-TCP-IP | := | +----+-----------+--------------------+---------------------+----+ 3 rows in set (0.02 sec)

3 4

Changes to the current CVS snapshot
by Alan DeKok 25 Oct '05

25 Oct '05

This doesn't apply to 1.0.x, but I've just made some changes to the current CVS to add the following features: - updated ERX dictionary (bug #284) - encrypt IP address data types (bug #283) - decrypt IP address data types (new code) - Support for Starent's 16/16-bit attributes As a nice side-effect, the new code allows any attributes, including IPV6 addresses, to be encrypted and sent over the wire. Alan DeKok.

1 0