August 2005 - Freeradius-Users - lists.freeradius.org

Re: freeradius proxy question
by freeradius＠reshetar.us 20 Aug '05

20 Aug '05

Greetings. I am using freeradius and want to do the following: 1. proxy authentication to a secondary server for two-factor authentication 2. if the user is authenticated via the home server, add attributes via definitions from the local freeradius server from a sql database I can do either 1 or 2, but have not figured out how to get both to work. Can someone point me in the right direction? Sorry if this is a noob question and I am missing the obvious

2 2

How does FreeRADIUS compare? See HP.
by Alan DeKok 20 Aug '05

20 Aug '05

http://www.hp.com/rnd/pdf_html/access_control_security_brief.htm It's interesting to note that the RADIUS servers they list are Microsoft IAS, Funk, and FreeRADIUS. This is happening more and more. Many of the smaller commercial vendors just can't compete with FreeRADIUS. Alan DeKok.

1 0

Howto make eap-peap accounting
by freeradius＠zoftdev.com 19 Aug '05

19 Aug '05

Hello all How to make freeradius support eap-peap accounting Thanks you.

1 0

Bug #256 should go into 1.0.5
by Thor Spruyt 19 Aug '05

19 Aug '05

http://bugs.freeradius.org/show_bug.cgi?id=256 It's a really big mistake and only a 1-line change! -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be

2 1

FR suddenly doesn't respond any more and eats all cpu
by Benedikt Panzer 19 Aug '05

19 Aug '05

Hello everyone, I've configured here a FreeRADIUS 1.0.4 and I'm running it now to handle test requests. First, everything looked ok. FR responded all requests correctly. But suddenly it didn't respond any more to RADIUS requests and I saw it used 1 of my 2 cpus completly. Before it took between 1-2 percent of the cpu. FreeRADIUS even could not be killed by a normal kill, I needed kill -9 to terminate it. It's very strange to me that happend after half an hour normal behavior. Then I started FreeRADIUS in debugging mode (-X) but then the error didn't occur until I stopped it 1 day later. Just now I ran it again in not-debugging mode and again after about half an hour the same strange error: processor load about 99% and no responses to any requests. And at the moment there are really few RADIUS requests. As I wrote, I don't have any debugging output before the error occured. The error doesn't occur when running in debugging mode. It doesn't want to be caught ;-) Nevertheless, has anyone yet seen such a behavior or has an idea where to look or a guest for the reason? Thanks a lot, Benedikt -- Benedikt Panzer Abteilung Ausbildung Rechenzentrum Universität Stuttgart Allmandring 30 70550 Stuttgart www.rus.uni-stuttgart.de

4 7

Release date for 1.1.0/CVS?
by Wesley Spadola 19 Aug '05

19 Aug '05

Is there any news of a approximate release date for the 1.1.0 line of FreeRADIUS? Which bugs are currently showstoppers for this line to be released as "stable"? Thanks, Wes

3 3

EAP OTP
by Juan Daniel Moreno 19 Aug '05

19 Aug '05

Hello everyone, I am interested in EAP protocols with OTP (one time password). I would like to configure my freeradius 1.0.4 to be able to authenticate passwords which has been created with Shawan's method and an external key. Can anybody help me? Thank you, Juan Daniel MORENO

2 1

FR with MySQL. Proxying and repeated entries
by Paolo Rotela 19 Aug '05

19 Aug '05

Hi. Sorry if this is a dumb thing, but I've searched a lot and din't find any solution to this problem. I'm using freeradius (versions 0.9.3, 1.0.0 and 1.0.4) with MySQL 3.23 and 4.1.7 (different mappings between FR and My) I have some clients to wich I'm proxying requests to some realms. All works OK but there is one client wich is using Cisco Secure ACS, wich is giving me some headaches. With this one, Access-* packets go OK, but when the NAS (Cisco AS5300) sends an Accounting-Request to that realm and I proxy it to the home server, it sends me an Accounting-Response with an (I think) irregular attribute: Message-Authenticator (Ext. Attr. 80), wich I think is not permitted in the RFC for accounting packets. So, my FR, discards it as supposed thus leading my NAS to re-send accounting request a lot of times until it gives up. This leads me to three main questions: 1) Am I reading OK the RFC? I mean ¿Is it right that Attribute 80 is NOT permitted in Accounting-* packets? 2) Each time the NAS re-sends packets, FR handles it as it were a new packet, for a new call/connection. This way, I have each call for this specific realm n times, with n being the times I configure the NAS to re-send the packet. Every time the NAS re-sends an Accounting-start, the SQL query in sql.conf says "INSERT blah blah blah", wich leads to a new record be inserted into the database, and every time the NAS re-sends an Accounting-stop, the SQL query says "UPDATE blah blah blah", so it leads to calls being recorded many times. The question is ¿is there any way to solve this through configuration, and I didn't find it because I'm a dumb? ¿Or I have to "touch" the code for the radius to verify if the packet is a repeated one or not? 3) Is there any known bug or propietary feature from Cisco wich causes this incompatibility thing? I've searched about it and didn't find anything. I know that "3" is not at all about freeradius, but perhaps some of you came accross this at any time. Any help will be very appreciated.

2 1

Issues authenticating vs 2003 AD
by Tim P 19 Aug '05

19 Aug '05

I am handing off a qurest from pppd to radius and am failing with a valid user in the domain. Here is the output of radiusd -X -A Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=39, length=72 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "ppptest" CHAP-Password = 0xa3de2596eae8f89f46e35d612d8858ac55 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ppptest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ppptest radius_xlat: '(sAMAccountName=ppptest)' radius_xlat: 'dc=company,dc=org' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to domcon.company.org:389, authentication 0 rlm_ldap: bind as cn=administrator,cn=Users,dc=company,dc=org/password to domcon.company.org:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=company,dc=org, with filter (sAMAccountName=ppptest) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ppptest authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "ppptest" with CHAP password rlm_chap: Could not find clear text password for user ppptest modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 39 to 127.0.0.1:32769 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 39 with timestamp 4303762d Nothing to do. Sleeping until we see a request. Any ideas? Both mschap and chap are enabled in the radiusd.conf

2 11

freeradius 1.0.4 and Cisco WLSE
by jck-freeradius＠southwestern.edu 19 Aug '05

19 Aug '05

I am trying to speak between my Freeradius server and a Cisco WLSE. I am seeing EAP timeouts while WLSE is trying to authenticate through Freeradius. I have setup the AAA details (server,port,username,password,eap protocol) in the WLSE, and enabled fault tracking, so that polling is able to take place. The WDS Master router has no problems authenticating, it is the WLSE that I am having problems getting authenticated. AP-70#show wlccp wnm status WNM IP Address : 192.168.254.5 Status : NOT AUTHENTICATED AP-70#show wlccp wds MAC: 0014.6a77.1604, IP-ADDR: 192.168.254.70 , Priority: 254 Interface BVI1, State: Administratively StandAlone - ACTIVE AP Count: 43 , MN Count: 9 == The WLSE is speaking with freeradius: (output from tcpdump) 17:40:36.415982 IP wlse.southwestern.edu.32815 > radius.southwestern.edu.radius: rad-access-req 132 [id 3] Attr[ User{wlseacct} NAS_ipaddr{wlse.southwestern.edu} Called_station{ABBAABBAABBA} [|radius] 17:40:36.422513 IP radius.southwestern.edu.radius > wlse.southwestern.edu.32815: rad-access-cha 92 [id 3] Attr[ [|radius] 17:40:36.423393 IP wlse.southwestern.edu.32815 > radius.southwestern.edu.radius: rad-access-req 125 [id 3] Attr[ User{wlseacct} NAS_ipaddr{wlse.southwestern.edu} Called_station{ABBAABBAABBA} [|radius] 17:40:42.433507 IP radius.southwestern.edu.radius > wlse.southwestern.edu.32815: rad-access-reject 20 [id 3] == == ...and the output from Freeradius rad_recv: Access-Request packet from host 192.168.254.10:32815, id=3, length=132 User-Name = "wlseacct" NAS-IP-Address = 192.168.254.10 Called-Station-Id = "ABBAABBAABBA" Calling-Station-Id = "ABBAABBAABBA" NAS-Identifier = "Cisco Secure II" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d01776c736561636374 Message-Authenticator = 0x586aa1b877caeafd3956095cf718be31 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 180 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 180 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 180 modcall: group authorize returns updated for request 180 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 180 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 180 modcall: group authenticate returns handled for request 180 Sending Access-Challenge of id 3 to 192.168.254.10:32815 EAP-Message = 0x010100221a0101001d10b063da2c8f5c52273cd537b0c09d69e5776c736561636374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8c90735921dd51b22bc8ef97379845b8 Finished request 180 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.254.10:32815, id=3, length=125 User-Name = "wlseacct" NAS-IP-Address = 192.168.254.10 Called-Station-Id = "ABBAABBAABBA" Calling-Station-Id = "ABBAABBAABBA" NAS-Identifier = "Cisco Secure II" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060311 Message-Authenticator = 0x070f8a208866000f797e64be5bd48f48 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 181 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 181 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 181 modcall: group authorize returns updated for request 181 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 181 rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 181 modcall: group authenticate returns invalid for request 181 auth: Failed to validate the user. rad_lowerpair: User-Name now 'wlseacct' rad_rmspace_pair: User-Name now 'wlseacct' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 181 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 181 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 181 modcall: group authorize returns updated for request 181 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 181 rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 181 modcall: group authenticate returns invalid for request 181 auth: Failed to validate the user. Delaying request 181 for 1 seconds Finished request 181 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 3 to 192.168.254.10:32815 Cleaning up request 181 ID 3 with timestamp 42fa8264 Nothing to do. Sleeping until we see a request. == I have read in places that there are patches, that may fix my issue. Are these patches my solution, and where can I get the most recent version? --johnk

2 3