June 2005 - Freeradius-Users - lists.freeradius.org

rlm_ldap : user not found
by Nicolas Viers - SCI 13 Jun '05

13 Jun '05

Hello, i had a problem with freeradius and rlm_ldap module sometimes and i don' know why users couldn't authenticate on ldap server. I had this message in radius.log: Auth: Login incorrect (rlm_ldap: User not found): [dupont] and few seconds later the authentification is ok with the same user: Auth: Login OK: [dupont] Maybe a timeout problem with ldap ? Should i modify timeout parameters on radiusd.conf or in slapd.conf ? Maybe a nb of connections ? Sould i increase "ldap_connections_number =" parameters ? Thanks a lot -- ____________________________________________________________ Nicolas Viers | Service Commun Informatique Mél: nicolas.viers(a)unilim.fr | 123, avenue Albert Thomas | 87060 Limoges cedex Tel: 05-55-45-77-09 | Fax: 05-55-45-75-95 http://www.unilim.fr/sci ____________________________________________________________

2 1

Re: eDirectory backend with FreeRadius
by Sayantan Bhowmick 12 Jun '05

12 Jun '05

Hi, To be able to read Universal Password from eDirectory you will HAVE TO have a secure connection between FreeRADIUS and eDirectory. That willtake care of the "rlm_ldap: Error reading Universal Password.Return Code = 80" problem. So you have to setup up the TLS certificates properly in the ldap section of radiusd.conf. Get back to me in case you need any further help. -Sayantan >>> fahimdxb(a)gmail.com 06/12/05 2:07 PM >>> Having spent whole last fortnight trying to configure Freeradius module given here with LDAP Agent running on my eDir8.7.3.6 on Netware 5.1, using iManager 2.5, I am almost there but seemingly stuck with something vital. Ihave done everything as mentioned by Novell Admin guide posted on this Forge project here: http://forge.novell.com/modules/xfmod/project/?edirfreeradius My Freeradius is running on SuSe Linux Machine with iManager 2.5 installed for managing Radius users and Universal passwords. I can do an LDAP browse from there and connectivity is OK. Using a third Win2K for testing Radius connectivity. Had some problems configuring TLS/SSL connection to LDAP server so hashed (start_tls=no) in radiusd.conf. I don't mind secure or insecure connection between FreeRadius and LDAP Agent. My main concern is here:(Excerpted from console log) ------------------------------------ rad_recv: Access-Request packet from host 194.170.15.100:1089, id=28, length=46 User-Name = "test04" User-Password = "test04" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "test04", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for test04 radius_xlat: '(uid=test04)' radius_xlat: 'o=euc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=euc, with filter (uid=test04) rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 4 modcall: group authorize returns userlock for request 4 Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 28 to 194.170.15.100:1089 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 28 with timestamp 42aaceb3 Nothing to do. Sleeping until we see a request. ------------------------------------------------------ After hashing access_attribute = 'dialupAccess' ------------------------------------------------------- So, When I restarted the Radius Server: ..... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 194.170.15.100:1091, id=30, length=46 User-Name = "test04" User-Password = "test04" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test04", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for test04 radius_xlat: '(uid=test04)' radius_xlat: 'o=euc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 194.170.15.158:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/cert/EUCCA.b64 rlm_ldap: setting TLS CACert File to /etc/rardb/cert/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as cn=admin,o=euc/college to 194.170.15.158:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=euc, with filter (uid=test04) rlm_ldap: Error reading Universal Password.Return Code = 80 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user test04 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request ---------------------------------------- MY PROBLEM: rlm_ldap: Error reading Universal Password.Return Code = 80 I hope it's not TLS related!!! Consider this an SOS....Please Advise!! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

eDirectory backend with FreeRadius
by Fahim 12 Jun '05

12 Jun '05

Having spent whole last fortnight trying to configure Freeradius module given here with LDAP Agent running on my eDir8.7.3.6 on Netware 5.1, using iManager 2.5, I am almost there but seemingly stuck with something vital. Ihave done everything as mentioned by Novell Admin guide posted on this Forge project here: http://forge.novell.com/modules/xfmod/project/?edirfreeradius My Freeradius is running on SuSe Linux Machine with iManager 2.5 installed for managing Radius users and Universal passwords. I can do an LDAP browse from there and connectivity is OK. Using a third Win2K for testing Radius connectivity. Had some problems configuring TLS/SSL connection to LDAP server so hashed (start_tls=no) in radiusd.conf. I don't mind secure or insecure connection between FreeRadius and LDAP Agent. My main concern is here:(Excerpted from console log) ------------------------------------ rad_recv: Access-Request packet from host 194.170.15.100:1089, id=28, length=46 User-Name = "test04" User-Password = "test04" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "test04", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for test04 radius_xlat: '(uid=test04)' radius_xlat: 'o=euc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=euc, with filter (uid=test04) rlm_ldap: no dialupAccess attribute - access denied by default rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns userlock for request 4 modcall: group authorize returns userlock for request 4 Delaying request 4 for 1 seconds Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 28 to 194.170.15.100:1089 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 28 with timestamp 42aaceb3 Nothing to do. Sleeping until we see a request. ------------------------------------------------------ After hashing access_attribute = 'dialupAccess' ------------------------------------------------------- So, When I restarted the Radius Server: ..... Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 194.170.15.100:1091, id=30, length=46 User-Name = "test04" User-Password = "test04" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test04", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for test04 radius_xlat: '(uid=test04)' radius_xlat: 'o=euc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 194.170.15.158:389, authentication 0 rlm_ldap: setting TLS CACert File to /etc/raddb/cert/EUCCA.b64 rlm_ldap: setting TLS CACert File to /etc/rardb/cert/ rlm_ldap: setting TLS Require Cert to demand rlm_ldap: bind as cn=admin,o=euc/college to 194.170.15.158:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=euc, with filter (uid=test04) rlm_ldap: Error reading Universal Password.Return Code = 80 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user test04 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request ---------------------------------------- MY PROBLEM: rlm_ldap: Error reading Universal Password.Return Code = 80 I hope it's not TLS related!!! Consider this an SOS....Please Advise!!

2 1

Class attribute questions
by Shawn K. O'Shea 12 Jun '05

12 Jun '05

Greetings, I'm trying to look at the Class attribute during proxying. I want to take data stored in the Class attribute and rewrite other attribute(s) based on the contents. I have it working right now but have two questions regarding it. 1) I'm currently using rlm_exec to call a simple perl script that "decodes" the Class attribute value (from accessing %{Class}) from it's hex octet form back to the ASCII inside. I just wanted to make sure that I wasn't missing something, and that there isn't an easier way to get at the ASCII inside the octet stream. 2) The rfc's allow for more than one Class attribute (at least in Accounting-Request packets). How does FreeRADIUS treat references to %{Class} when this happens? i.e. Is there a syntax to refer to each instance of the Class attr or get a count of how many are in the packet? (I'm not currently running into this, but want to keep that base covered in case that situation arises). Thanks, -Shawn ~~~~~~~~~~~~~~~~~~~~~~~~~ Shawn O'Shea Network Engineer Airpath Wireless, Inc. "Clearing the Way" 781-250-3500-office 781-250-3535-direct 781-250-3503-fax shawno(a)airpath.com http://www.airpath.com ~~~~~~~~~~~~~~~~~~~~~~~~~ CONFIDENTIALITY STATEMENT This electronic message contains information from Airpath Wireless, Inc., and may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify the sender immediately by reply e-mail shawno(a)airpath.com or telephone at (781) 250-3500.

2 1

Performance tweaking and testing.
by Arne.Olav.Kjosnes＠pcsupport.no 12 Jun '05

12 Jun '05

Hi all, We have 1500 customers connected to our PPPoE servers, to autenticate we have 2 freeradius servers connected to a mssql server. The radius servers don't autenticate fast enough, our PPPoE server starts to hang when there are to many radius autentications idle/waiting for a answer from the radius server. Does anyone got a tip on how to improve performance on the radius servers? And how to test preformance?

4 7

rlm_sql Info logging noise
by Aaron Paetznick 12 Jun '05

12 Jun '05

The rlm-sql module seems to spew a lot of Info logging messages if you use Simultaneous-Use. Specifically, if I add a Simultaneous-Use attribute to the radcheck or radgroupcheck tables, it starts logging: Sat Jun 11 22:00:26 2005 : Info: rlm_sql (sql): No matching entry in the database for request from user [user] ...for every successful login. I think it's trying to tell me that there were no sessions with AcctStopTime=0 in the database for that user, but that's good news and a little like noise. Would it be possible for FreeRADIUS to support logging levels similar to syslog? For that matter, could syslog become an option? Thanks. --Aaron

2 1

dialup_admin not using $nas_list correctly
by Aaron Paetznick 11 Jun '05

11 Jun '05

I'm using FreeRADIUS v1.0.2 and dialup_admin v1.70. FreeRADIUS and nas_admin.php3 in dialup_admin are using the nas table in the database correctly, but pages like user_finger.php3 user_stats.php3, stats.php3, and filed_logins.php3 are not detecting any NASes in the database. The problem seems to be caused by the $nas_list variable in each of those files being empty. I looked into it a little, and I can't see where $nas_list is even being created, aside from nas_admin.php3. I noticed that the $nas_list variable is a very new addition. I think some code needs to be added to generate $nas_list at the top of each of these files. Thanks. --Aaron

1 0

make install - File format not recognized
by Christopher Cover 11 Jun '05

11 Jun '05

Hi! I've recently downloaded and compiled freeradius-1.0.3 on CentOS release 3.4 on i386 platform. (CentOS is about the same as RedHat and Fedora). My configure command was this: ./configure --localstatedir=/var --sysconfdir=/etc --with-gnu-ld --without-sasl --enable-ucd-snmp-compatibility Here's what I get at the end of 'make install' /usr/local/src/radius/freeradius-1.0.3/install-sh -c -m 755 -s radwho /usr/local/bin strip: /usr/local/bin/#inst.31097#: File format not recognized gmake[4]: *** [install] Error 1 gmake[4]: Leaving directory `/usr/local/src/radius/freeradius-1.0.3/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/radius/freeradius-1.0.3/src' gmake[2]: *** [install] Error 2 gmake[2]: Leaving directory `/usr/local/src/radius/freeradius-1.0.3/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/radius/freeradius-1.0.3' make: *** [install] Error 2 Does anyone have a clue about this? Thanks! Chris

2 1

Netscreen authentication on freeradius
by Shrikant Agashe 11 Jun '05

11 Jun '05

Hi Radius ppls I'm trying to use free radius for Netscreen authentication I'm using FreeRADIUS Version 0.8.1. Can some pl help on this. Here is output on radius console ------------------------------------------------------------------------------ rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:2269, id=0, length=50 User-Name = "test" User-Password = "test" NAS-IP-Address = XXX.XXX.XXX.XXX modcall: entering group authorize modcall[authorize]: module "preprocess" returns ok rlm_chap: Could not find proper Chap-Password attribute in request modcall[authorize]: module "chap" returns noop modcall[authorize]: module "mschap" returns notfound rlm_realm: No '@' in User-Name = "usr4", looking up realm NULL rlm_realm: No such realm NULL modcall[authorize]: module "suffix" returns noop users: Matched usr4 at 83 modcall[authorize]: module "files" returns ok modcall: group authorize returns ok rad_check_password: Found Auth-Type System auth: type "System" modcall: entering group authenticate modcall[authenticate]: module "unix" returns ok modcall: group authenticate returns ok Sending Access-Accept of id 0 to XXX.XXX.XXX.XXX:2269 Finished request 0 Going to the next request --- Walking the entire request list --- ------------------------------------------------------------------------------ cheers Shrikant __________________________________ Discover Yahoo! Have fun online with music videos, cool games, IM and more. Check it out! http://discover.yahoo.com/online.html

2 1

AW: MAC address authorization
by Andre Herkenrath 11 Jun '05

11 Jun '05

Hi, I´ve done this with access-points from extremenetworks. There it went this way: You have to create users in the usersfile in the folowing way: Username: MAC-Adress Password: Mac-Adress That´s all Maybe Cisco does it the same way (Cisco never had a good idea, only a goog bank account) Regards André ________________________________________ Von: Vince Nguyen [mailto:Vince.Nguyen@quantum.com] Gesendet: Samstag, 11. Juni 2005 01:16 An: freeradius-users(a)lists.freeradius.org Betreff: MAC address authorization Please help, I've installed Freeradius 0.9.3-1.1 to my Redhat Fedora Core 1 box, and would like to use it in conjunction with my Cisco AP1200 to simply allow authorized and registered MAC address to be on the network. Has someone done this and could show the way? Thanks, Vince __________________________________ Vince T Nguyen Systems Administrator www.quantum.com mailto:vince.nguyen@quantum.com 949/856.7809 (direct) 949/856.7799 (fax)

1 0