September 2005 - Freeradius-Users - lists.freeradius.org

RE: Wrong sequence of packets during re-authentication
by Bilal Shahid 26 Sep '05

26 Sep '05

Hello again, Can someone please help me this? I am clueless as how to solve this problem. Thanks, Bilal -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Bilal Shahid Sent: Friday, September 23, 2005 4:00 PM To: freeradius-users(a)lists.freeradius.org Subject: Wrong sequence of packets during re-authentication Hello all, During my 802.1X Supplicant's re-authentication (using EAP-TTLS) with FreeRADIUS using DLINK switch, I face the following scenario: Sometimes "during re-authentication", one of the FreeRADIUS's replies does not reach the DLINK switch. When DLINK's RADIUS timer expires, it re-starts the re-authentication by sending the Supplicant's identity to FreeRADIUS. At this time, an initial couple of packets are exchanges correctly, however then it seems that FreeRADIUS wants to skip some of the packets and complete the authentication whereas my Supplicant wants to re-do everything. For example, during a 'correct re-authentication", FreeRADIUS sends the following packet: TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0067], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05ca], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A However, during the "incorrect" re-authentication cycle, which has been started due to a packet loss in the middle as explained above, FreeRADIUS send the following packet: TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0067], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read finished A Note that this time FreeRADIUS has sent ChangeCipherSpec and Finished instead of Certificate and ServerHelloDone. Is this the normal and correct behavior? My Supplicant's response to this packet is then liked by the FreeRADIUS and its sends an alert. Could someone please help me understanding this problem. Thanks, Bilal _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

RE: Maximum size Input-Octets/Output-Octets
by Jonathan De Graeve 26 Sep '05

26 Sep '05

2147483647 it is :))) -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Jonathan De Graeve Verzonden: maandag 26 september 2005 17:49 Aan: FreeRadius users mailing list Onderwerp: RE: Maximum size Input-Octets/Output-Octets So is it 2147483648 or 2147483647? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Guy Fraser Verzonden: maandag 26 september 2005 17:45 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: RE: Maximum size Input-Octets/Output-Octets On Fri, 2005-23-09 at 19:42 +0200, Jonathan De Graeve wrote: > > What "radacct" are you talking about? The Acct-Input-Octets stops > >at 2G because the RFC dictates that it's a 32-bit integer. That's why > >the Acct-Input-Gigawords attribute was defined. It goes past 2G. > > I'm talking about the detail file from freeradius. > > This is what I found in RFC2869 > > 5.1. Acct-Input-Gigawords > > Description > > This attribute indicates how many times the Acct-Input-Octets > counter has wrapped around 2^32 over the course of this service > being provided, and can only be present in Accounting-Request > records where the Acct-Status-Type is set to Stop or Interim- > Update. > > So I assumed that the wrapping went @ 4GB instead of 2GB > > >From RFC2866: > > Value > > The Value field is four octets. > > Also: > > integer 32 bit unsigned value, most significant octet first. > > So its 32bit. (4GB right??) > > I will use 2147483647 for now. But I can't find the definition which > says that it should be 2GB so I need to be sure. > > J. What is right and what is in common use may be two different things. In my experience, some NAS vendors generate negative numbers when the Octet Value is greater than 2^31. By the way a GigaWord is 2147483648 bytes since a Word = 2 Bytes and Giga = 1024*1024*1024 = 1073741824. It would therefore make sense to use a modulo of 2147483648 for the Octet value which holds the "remainder" of the full byte count. Just in case you were wondering what a TeraQuad was after watching a Star Trek NG episode it is 4398046511104 Bytes. ;^) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Maximum size Input-Octets/Output-Octets
by Jonathan De Graeve 26 Sep '05

26 Sep '05

> What "radacct" are you talking about? The Acct-Input-Octets stops >at 2G because the RFC dictates that it's a 32-bit integer. That's why >the Acct-Input-Gigawords attribute was defined. It goes past 2G. I'm talking about the detail file from freeradius. This is what I found in RFC2869 5.1. Acct-Input-Gigawords Description This attribute indicates how many times the Acct-Input-Octets counter has wrapped around 2^32 over the course of this service being provided, and can only be present in Accounting-Request records where the Acct-Status-Type is set to Stop or Interim- Update. So I assumed that the wrapping went @ 4GB instead of 2GB >From RFC2866: Value The Value field is four octets. Also: integer 32 bit unsigned value, most significant octet first. So its 32bit. (4GB right??) I will use 2147483647 for now. But I can't find the definition which says that it should be 2GB so I need to be sure. J.

2 1

Freeradius and Postgresql configuration
by msah＠otitelecom.bj 26 Sep '05

26 Sep '05

Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. Please help me.

2 1

How to deal with this ...
by Ezequiel O. Block 26 Sep '05

26 Sep '05

Hi Guys, Using Freeradius for authorization, accounting and ip pools management. By mistake i turned off my NAS, and when this NAS came back online then freeradius began rejecting my users as if they were still connected, should my NAS send some kind of "Accounting restart let's start again" packet to Freeradius in order to let him know that those users are no longer connected? am i right? if not how can i deal with this kind of problems? apart from not being so stupid again to turn off a nas by mistake .... Thanks in advance, Ezequiel.

2 3

fixed - patch included: custom variable in config files
by Tariq Rashid 26 Sep '05

26 Sep '05

hi - below is a patch for a small change to conffile.c which enabled me to expand variables in $INCLUDED files, which are defined in the main radiusd.conf or earlier included files. *************** static CONF_SECTION *cf_section_read(con *** 669,675 **** DEBUG2( "Config: including file: %s", value ); ! if ((is = conf_read(cf, *lineno, value, parent)) == NULL) { cf_section_free(&cs); return NULL; } --- 669,675 ---- DEBUG2( "Config: including file: %s", value ); ! if ((is = conf_read(cf, *lineno, value, cs)) == NULL) { cf_section_free(&cs); return NULL; } should i send it to the -dev list? it seems to work over here - someone else should have a look as let me know if its the wrong thing to do! to summarise - the problem is this. included files cause a new top-level "main" structure to be created - which is later added to the real "main" list of variables (conf items). this is fine. when trying to expand a variable, if it is not in the current structure (conf section), then the existing code does try to go up a level and look in "main" - except its the "local temporary" main, and not the real top-level main - so it doesn't find the variable expansion. the above patch should fix this by ensuring that the newly alloced conf section is linked to the real top-level "main" conf section. in its absence, the "parent" being passed to conf_read() seems always to be null ... tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Tariq Rashid Sent: 22 September 2005 12:13 To: FreeRadius users mailing list Subject: RE: custom variable in config files i'm having a go at cracking this problem. i've discovered that any variable declared in radiusd.conf (var = abc) cannot be expanded when used in $INCLUDED files ( ${var} ) ... i'm seeing that during the search for the $var in the linked list of variables ... the list (known as main) used for the included files is not the same one as the one used for variables created in radiusd.conf. that is: * if i delcare aaa, bbb, ccc in radiusd.conf * and i declare xxx, yyy, zzz in proxy.conf * then trying to search for ${ccc} in proxy.conf actually traverses xxx, yyy, zzz and NOT aaa, bb, ccc so far i think i am seeing the item pairs being added to the wrong list and not appended to the proper list? can a more experienced developer have a look to confirm? i'm doing this using a combination of radlog() and ddd. also - why the need for "lineno" in the config item data structures? surely this is a bad idea - and prone to error when inlcuding files? what's the lineno for included files? tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 15 September 2005 18:56 To: FreeRadius users mailing list Subject: Re: custom variable in config files "Tariq Rashid" <tariq.rashid(a)uk.easynet.net> wrote: > thanks for the suggestion and clarification. trying what you suggested gives me ... > > Config: including file: /opt/freeradius102/etc/raddb/proxy.conf > config: No such entry network_address for string ${network_address}.126:1812 > Errors reading radiusd.conf Ah... I ran into that the other day. Expanding configuration variables in $INCLUDE'd files may not work, and I'm not sure why. It's a bug. Alan deKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

rlm_perl access-reject noobie question !!!
by ricklim＠telus.net 25 Sep '05

25 Sep '05

Hi there, I have been trying to understand the rlm_perl example script "example.pl". I have is setup that it returns RLM_MODULE_OK for anything, yet the nas client (NTRadPing) always sees Access-Reject. My understanding of how freeradius works is limited. Could someone point me in the right direction on how to get a rlm_perl script to send a Access-Accept message back to the client or cause an Acess-Accept message to be sent back to the client. I am a complete NOOBIE with radius, so please keep that in mind with your responses. Thanks.

2 1

Unknown Auth-Type "eap" in authenticate section.
by Wulf Kaiser 25 Sep '05

25 Sep '05

Hi, After doing the configure stuff on a Solaris 9 machine ./configure \ --prefix=/usr/local/freeradius-1.0.5 \ --sysconfdir=/usr/local/freeradius-1.0.5/conf \ --localstatedir=/usr/local/freeradius-1.0.5/var \ --sharedstatedir=/usr/local/freeradius-1.0.5/com \ --bindir=/usr/local/freeradius-1.0.5/bin \ --sbindir=/usr/local/freeradius-1.0.5/sbin \ --libdir=/usr/local/freeradius-1.0.5/lib \ --libexecdir=/usr/local/freeradius-1.0.5/libexec \ --includedir=/usr/local/freeradius-1.0.5/include \ --mandir=/usr/local/freeradius-1.0.5/man \ --datadir=/usr/local/freeradius-1.0.5/share \ --with-raddbdir=/usr/local/freeradius-1.0.5/etc \ --with-rlm_ldap-lib-dir=/usr/local/openldap2/lib \ --with-rlm_ldap-include-dir=/usr/local/openldap2/include \ --with-openssl-includes=/usr/local/ssl/include \ --with-openssl-libraries=/usr/local/ssl/lib \ --without-rlm_sql_mysql \ --without-rlm_sql_oracle \ --without-rlm_sql_unixodbc \ --without-rlm_sql_iodbc \ --without-rlm_sql_postgresql \ --without-rlm_x99_token \ --without-rlm_krb5 \ --with-gnu-ld I tried ./radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) radiusd.conf[64] Failed to link to module 'rlm_ldap': ld.so.1: ./radiusd: fatal: libldap_r-2.2.so.7: open failed: No such file or directory root@ldap1<8> bash bash-2.05# export LD_LIBRARY_PATH=/usr/local/openssl/lib:/usr/local/openldap/lib bash-2.05# ./radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded LDAP rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius-1.0.5/etc/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambalmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambantPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 56318 Module: Instantiated ldap (ldap) Module: Loaded eap rlm_eap: Loaded and initialized type tls rlm_eap: Loaded and initialized type ttls rlm_eap: Loaded and initialized type peap rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) radiusd.conf[124] Unknown Auth-Type "eap" in authenticate section. What does radiusd.conf[124] Unknown Auth-Type "eap" in authenticate section. mean? Wulf Kaiser IT Services Web Development | Database Administration Webmaster www.mpimf-heidelberg.mpg.de Zentrale Hard- und Softwarebeschaffung Max-Planck-Institut für medizinische Forschung Jahnstrasse 29 69120 Heidelberg Fon +49 6221 486560 Fax +49 6221 486561 Mobil +49 172 6235901

2 2

Error: Discarding duplicate request
by Abdul Lateef 24 Sep '05

24 Sep '05

HI all, any one can explain me about this error. I am getting too much error in radius log. and some time the radius is going to hang, and that time the log is apearing "No DB handele". but when i restart the radius manually it start to working with the same error. i am using two perl file via exe-wait in accounting stop event and in radreply table. ============ Error: Discarding duplicate request from client XXX:1812 - ID: 139 due to unfinished request ============================== Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Usage of pam_radius_auth
by Nagaraj Venkatapuram 24 Sep '05

24 Sep '05

All, Has anybody had the experience using pam_radius_auth for authenticating services like http/https, ssh, telnet. I tried running the sample application but authentication failed. my configuration is like this. /etc/raddb/server # server[:port] shared_secret timeout (s) # 127.0.0.1 secret 1 192.168.1.100 testing123-2 3 /etc/pam.d/other/pam.conf auth sufficient /lib/security/pam_radius_auth.so debug account sufficient /lib/security/pam_radius_auth.so my radius server is free radius version 1.0.5 The request does not even get to radius server running on 192.168.1.100 port 1812. Am I missing anything in the configuration ? Please let me know. Thanks, N

1 0