September 2005 - Freeradius-Users - lists.freeradius.org

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

no DB handles
by Lucas Aimaretto 31 Oct '07

31 Oct '07

Hi all, I've seen many of these messages in the radius.log ... Wed Jun 15 15:10:23 2005 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 What does it mean ? How to solve this ? Best regards, Lucas -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.323 / Virus Database: 267.7.3/15 - Release Date: 14/06/2005

11 23

Segmentation Fault
by Linda Pagillo 08 Nov '05

08 Nov '05

I just installed the newest version of Freeradius (1.0.5) on my Linux Redhat 9 server. All went well except this... when i start the radius in debug mode.. all starts fine, but when the first user tries to authenticate, i get a Segmentation Fault and the radius stops. Any ideas? Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

10 27

Re: clients.conf problem
by dev_null 15 Oct '05

15 Oct '05

Strange, I don't know why it won't work to me. Ok. Never mind. Thanks ----- Original Message Follows ----- > I've tested that config, and ones with 500K clients. They all work > for me. > > Alan DeKok. > -- Naručite svoj XXLadsl - instalacija i modem i dalje za samo 1 kn! Postanite i vi korisnik ultra brzog Interneta! http://www.iskon.biz/xxladsl

3 2

Setup questions- client & user secrets
by Padmanabhan Ramaswamy 06 Oct '05

06 Oct '05

Hi. I'm fairly new to the RADIUS stuff. I'm trying to setup FreeRadius 1.0.1 as a failover (secondary) server on a remote network. I've RadTest-ed and NTRadPing-ed the basic installation and it seems to work fine. My current RADIUS server is a commercial product running on a Win 2k machine (local network). Exporting the clients & users data from this server for use in the FreeRadius server gave me encrypted secrets for both clients & users. The secret strings I get are all 264 characters long. I tried using these as-is in 'clients.conf' and the 'users' files. FreeRadius won't even start with these. Should I be using these encrypted secrets in the clients.conf & users files at all or should I ask for the cleartext secrets from the NAS clients and use those instead? I'm using plain PPP (NAS clients' requirement). Does that mean I can use PAP and CHAP authentication or PAP only? Thanks.

2 1

Crashes with 1.0.4/1.0.5, perhaps connected with slow LDAP backend?
by Martin Pauly 05 Oct '05

05 Oct '05

Hi, we seem to have a stability issue with freeradius 1.0.4/1.0.5: 1.0.4 crashed in short sequence on both of my redundant servers during my vacation -- not much of a trace in the logfiles. On Monday, I upgraded to 1.0.5 with everything looking fine for almost 2 days. Yesterday, we started polling the servers regularly from a NAGIOS system, using the check_rad NAGIOS plugin. On server (the one processing the highest number of requests) crashed twice yesterday; this time it complained about "Unresponsive child" processes in close temporal correlation. We do have perfomance problems with our LDAP backend, so this sound reasonable, but could this cause the server to crash? During testing, I also encountered a situation where the freeradius process lived on, but became comletely unresponsive; I had to to kill -9 What should I do to track down these issues? Does running in full debug mode for days make sense? Thanks, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 6

freeradius and MS SQL -- anyone got it working?
by Arne Götje (高盛華) 04 Oct '05

04 Oct '05

Hi list, What is the status of MS SQL support for freeradius? Did anyone get it working? And if yes, which version do you use and what is required to get it work? I'm currently using freeradius 1.0.2 on Debian Sarge and I didn't manage to get it connect to the MS SQL server. As the rlm_sql_freetds module states that it is under development ans so, not enabled by default, I was wondering, if the iODBC or the unixodbc modules would work and if yes, how to set this up (aside from freeradius.. seems the 'drivers' are missing, whatever this means). Need some help here. Anyone? Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

4 7

Postgresql+freeradius configuration
by msah＠otitelecom.bj 04 Oct '05

04 Oct '05

Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. Please help me.

4 3

Please helpme is Urgent
by alfonso celestino 30 Sep '05

30 Sep '05

Hi! I find this problem, freeradius was working perfectly whith EAP-PEAP, but suddenly wireless users could not access to wireless network. The log from NAS when the access is success: Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> station up <00:0e:9b:d3:71:b1> update station bssid to 00:0b:86:a5:d5:a0 (#users 1) Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> setting the encryption key type <00:0e:9b:d3:71:b1> Set the UKey type to Dyanmic TKIP Sep 30 12:44:26 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <INFO> selected server moctezuma2 for method=802.1x; user=academico1, essid=RIU, domain=<> when the problem happened was: Sep 30 12:40:10 xxx.xxx.xxx.xxx 2005 [xxx.xxx.yyy.yyy] authmgr[436]: <WARN> RADIUS server moctezuma2-zzz.zzz.zzz.zzz-1812 timeout for client=00:04:23:99:bb:09 auth=802.1x also I attach de radius.log file. The radiusd process always was up. When I restarted the radiusd process, the access to wireless network started to work perfectly again. What was the problem? Thanks in advance Alfonso Celestino ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Authentication fails every once and awhile and CRL question
by Jason Carr 30 Sep '05

30 Sep '05

This only happens every once and awhile, not sure why. Here's a log file of the authentication. Not one specific supplicant fails, but this one happens to be OS X 10.3. Others include SP2. Any reason or should I blame this on the client? Also I'm reloading radiusd with kill -HUP pid every 15 minutes to load a CRL, is that really required or can I get away with not reloading it? Here's an auth fail. Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Length Included Fri Sep 30 11:57:04 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: Received EAP-TLS First Fragment of the message Fri Sep 30 11:57:04 2005 : Info: rlm_eap_tls: More fragments to follow Fri Sep 30 11:57:04 2005 : Info: (other): SSL negotiation finished successfully Fri Sep 30 11:57:35 2005 : Info: rlm_eap_tls: Length Included Fri Sep 30 11:57:35 2005 : Error: TLS_accept:error in SSLv3 read client hello C Fri Sep 30 11:57:35 2005 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Fri Sep 30 11:57:35 2005 : Error: rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. Fri Sep 30 11:57:35 2005 : Auth: Login incorrect: [wpa-tester.wv.cc.cmu.edu/<no User-Password attribute>] (from client access-points port 360 cli xxxx.xxxx.xxxx

1 0