January 2006 - Freeradius-Users - lists.freeradius.org

Radius can't connect to LDAP
by Tim_Crouch＠uttyler.edu 23 Jan '06

23 Jan '06

We are running FreeRADIUS v. 1.0.2 2x load-balanced LDAP servers - Sun ONE DS 5.2 on W2k3 Ent. with network load balancing. One of the LDAPs is the primary and is handling the auth traffic. Here is the issue we're seeing: Approximately 10-20 times per day users are unable to authenticate - despite using correct credentials. The radius server reports bind failed because it "Can't contact LDAP server" The LDAP logs show the bind, search, and reply for the "does this user exist" request. Sometimes this search is repeated a couple of times. However, there is no follow-up bind as this user for checking the creds. If the user tries again in 30secs or more, they succeed - with the same creds as before. Any ideas? Thanks for any help! Below are excerpts from the logs: ------------------------ Radius log entry ------------------------ rlm_ldap: - authorize rlm_ldap: performing user authorization for someuser radius_xlat: '(uid=someuser)' radius_xlat: 'ou=people,dc=uttyler,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=uttyler,dc=edu, with filter (uid=someuser) rlm_ldap: ldap_search() failed: LDAP connection lost. rlm_ldap: Attempting reconnect rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to ldap.uttyler.edu:389, authentication 0 rlm_ldap: bind as uid=radiususer,ou=special users,dc=uttyler,dc=edu/radius_password to ldap.uttyler.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=uttyler,dc=edu, with filter (uid=someuser) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user someuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 987 modcall: group authorize returns ok for request 987 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 987 rlm_ldap: - authenticate rlm_ldap: login attempt by "someuser" with password "04191987" rlm_ldap: user DN: uid=someuser,ou=People,dc=uttyler,dc=edu rlm_ldap: (re)connect to ldap.uttyler.edu:389, authentication 1 rlm_ldap: bind as uid=someuser,ou=People,dc=uttyler,dc=edu/04191987 to ldap.uttyler.edu:389 rlm_ldap: uid=someuser,ou=People,dc=uttyler,dc=edu bind to ldap.uttyler.edu:389 failed: Can't contact LDAP server rlm_ldap: ldap_connect() failed modcall[authenticate]: module "ldap" returns fail for request 987 modcall: group Auth-Type returns fail for request 987 auth: Failed to validate the user. Login incorrect: [someuser/04191987] (from client AireSpace port 0 cli 10.3.1.72) Delaying request 987 for 1 seconds Finished request 987 Going to the next request -------------------- LDAP Log ------------------------------ [23/Jan/2006:07:47:13 -0600] conn=886 op=1 msgId=2 - SRCH base="ou=people,dc=uttyler,dc=edu" scope=2 filter="(uid=someuser)" attrs="radiusexpiration acctflags ntpassword lmpassword radiuscallingstationid radiuscalledstationid radiussimultaneoususe radiusauthtype radiuscheckitem radiusloginlatport radiusportlimit radiusframedappletalkzone radiusframedappletalknetwork radiusframedappletalklink radiusloginlatgroup radiusloginlatnode radiusloginlatservice radiusterminationaction radiusidletimeout radiussessiontimeout radiusclass radiusframedipxnetwork radiuscallbackid radiuscallbacknumber radiuslogintcpport radiusloginservice radiusloginiphost radiusframedcompression radiusframedmtu radiusfilterid radiusframedrouting radiusframedroute radiusframedipnetmask radiusframedipaddress radiusframedprotocol radiusservicetype radiusreplyitem" [23/Jan/2006:07:47:13 -0600] conn=886 op=1 msgId=2 - RESULT err=0 tag=101 nentries=1 etime=0 [23/Jan/2006:07:47:24 -0600] conn=886 op=2 msgId=3 - SRCH base="ou=people,dc=uttyler,dc=edu" scope=2 filter="(uid=someuser)" attrs="radiusexpiration acctflags ntpassword lmpassword radiuscallingstationid radiuscalledstationid radiussimultaneoususe radiusauthtype radiuscheckitem radiusloginlatport radiusportlimit radiusframedappletalkzone radiusframedappletalknetwork radiusframedappletalklink radiusloginlatgroup radiusloginlatnode radiusloginlatservice radiusterminationaction radiusidletimeout radiussessiontimeout radiusclass radiusframedipxnetwork radiuscallbackid radiuscallbacknumber radiuslogintcpport radiusloginservice radiusloginiphost radiusframedcompression radiusframedmtu radiusfilterid radiusframedrouting radiusframedroute radiusframedipnetmask radiusframedipaddress radiusframedprotocol radiusservicetype radiusreplyitem" [23/Jan/2006:07:47:24 -0600] conn=886 op=2 msgId=3 - RESULT err=0 tag=101 nentries=1 etime=0 [23/Jan/2006:07:47:25 -0600] conn=887 op=-1 msgId=-1 - fd=1132 slot=1132 LDAP connection from 198.213.57.20 to 198.213.56.5 [23/Jan/2006:07:47:25 -0600] conn=887 op=0 msgId=1 - BIND dn="uid=someuser,ou=People,dc=uttyler,dc=edu" method=128 version=3 [23/Jan/2006:07:47:25 -0600] conn=887 op=0 msgId=1 - RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=someuser,ou=people,dc=uttyler,dc=edu" [23/Jan/2006:07:47:25 -0600] conn=887 op=1 msgId=2 - UNBIND Tim Crouch Systems Administrator Campus Computing Services 903-566-7476

1 0

RE: MS-CHAP and Local Authentication
by ALMEIDA Antonio Jose 23 Jan '06

23 Jan '06

Great, it's working now. Thanks Antonio -----Original Message----- From: freeradius-users-bounces+ajalmeida=modelocontinente.pt(a)lists.freeradius. org [mailto:freeradius-users-bounces+ajalmeida=modelocontinente.pt@lists.fre eradius.org] On Behalf Of Phil Mayers Sent: segunda-feira, 23 de Janeiro de 2006 12:27 To: FreeRadius users mailing list Subject: Re: MS-CHAP and Local Authentication ALMEIDA Antonio Jose wrote: > Hello, > Can someone tell me how can I configure the users file (with the default > configuration - I'm just starting to use freeradius) to permit the same > user to be authenticated by MS-CHAP and Local? Now I have something link > this: > > User1 Auth-Type := Local, Password == "password" > > User2 Auth-Type := MS-CHAP, Password == " password " > > I need to make User1 and User2 the same. Firstly, "Password" is a configure item and should really be set with := uncondtionally. Secondly, you're setting Auth-Type with := which overwrites whatever is there, which is probably why MS-CHAP isn't working (Local will be overwriting it) Assuming you have the server otherwise setup with the defaults, which have mschap BEFORE files in authorize, this will work: user Auth-Type = Local, Password := "password" Because (in the default config) mschap runs before files, therefore Auth-Type will already be set to MS-CHAP and the "=" won't overwrite it, but will set it if it's otherwise unset. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

MS-CHAP and Local Authentication
by ALMEIDA Antonio Jose 23 Jan '06

23 Jan '06

Hello, Can someone tell me how can I configure the users file (with the default configuration - I'm just starting to use freeradius) to permit the same user to be authenticated by MS-CHAP and Local? Now I have something link this: User1 Auth-Type := Local, Password == "password" User2 Auth-Type := MS-CHAP, Password == " password " I need to make User1 and User2 the same. Antonio

2 1

Fallback Auth if forwarding fails
by Freeradius Users Mailing List 22 Jan '06

22 Jan '06

Hi, first of all: thanks for this great software! I would like to mainly do a radius forwarding through Proxy-To-Realm functionality. This works well. But for a short period of time I need to have a fallback strategy if forwarding fails (remote RADIUS server is dead). Is there a way to match on a different entry i.e. in the users file after recognizing that the remote RADIUS server is dead? Thanks a lot for help :-)

2 2

Freeradius 1.1.0 crash on FreeBSD 6
by bishal＠baayu.com.np 22 Jan '06

22 Jan '06

Dear all, I have installed Freeradius 1.1.0 in FreeBSD with Mysql 5.0.17. Authenticaiton an authorization works fine. But when I enable the "Max-Daily-Session" module it crashes with segmentation fault. and "radiusd.core" file is created. Below is the dumped file of radiusd.core file: ========================================== bw-proj# gdb /usr/local/sbin/radiusd radiusd.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"...(no debugging symbols found)... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libcrypt.so.3...(no debugging symbols found)...done. Loaded symbols for /lib/libcrypt.so.3 Reading symbols from /usr/local/lib/libradius-1.1.0.so...done. Loaded symbols for /usr/local/lib/libradius-1.1.0.so Reading symbols from /usr/local/lib/libltdl.so.4...done. Loaded symbols for /usr/local/lib/libltdl.so.4 Reading symbols from /usr/lib/libssl.so.4...done. Loaded symbols for /usr/lib/libssl.so.4 Reading symbols from /lib/libcrypto.so.4...done. Loaded symbols for /lib/libcrypto.so.4 Reading symbols from /usr/lib/libpthread.so.2...done. Loaded symbols for /usr/lib/libpthread.so.2 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /usr/local/lib/rlm_exec-1.1.0.so...done. Loaded symbols for /usr/local/lib/rlm_exec-1.1.0.so Reading symbols from /usr/local/lib/rlm_expr-1.1.0.so...done. Loaded symbols for /usr/local/lib/rlm_expr-1.1.0.so Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x280ba250 in lt_dlsym (handle=0x811a800, symbol=0xbfbfd8f0 "rlm_counter") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) [New LWP 100191] (gdb) bt #0 0x280ba250 in lt_dlsym (handle=0x811a800, symbol=0xbfbfd8f0 "rlm_counter") at ltdl.c:3330 #1 0x080544e7 in find_module_instance () #2 0x08054a64 in setup_modules () #3 0x0804c79e in main () =============================

2 2

EAP-TLS ErrorMessage but working
by Armin Krämer 21 Jan '06

21 Jan '06

Hi, i just got ldap in my testenvironment working but can someone tell me what the marked line in the log means? The authentication works fine and i get access to my network?? Or can i ignore this message? Greetings Armin

2 3

rlm_sqlcounter question
by Hekuran Doli 21 Jan '06

21 Jan '06

Hello, Im trying to use rlm_sqlcounter to make daily session limit, I use Max-Daily-Session := 60 to end the session in 60 seconds and finish the authentication for that day, but it dosent seems to work, it sets the Session-Timeout = 60 but the user is able to authenticate again in the same day. Also the Max-Monthly-Session dosent work but Max-All-Session work fine. Here are logs of rlm_sqlcounter in debugg mode: rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime - GREATEST((1137711600 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{User-Name}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1137711600'' radius_xlat: 'SELECT SUM(AcctSessionTime - GREATEST((1137711600 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='florin' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1137711600'' sqlcounter_expand: '%{sqlcca3:SELECT SUM(AcctSessionTime - GREATEST((1137711600 - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='florin' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '1137711600'}' radius_xlat: '' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user florin, check_item=60, counter=0 rlm_sqlcounter: Sent Reply-Item for user florin, Type=Session-Timeout, value=60 modcall[authorize]: module "dailycounter" returns ok for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair Thanks

1 0

Re: FreeRadius in a production environment
by Sean 20 Jan '06

20 Jan '06

> Hy :-) > I am interested to know about success stories of people using >FreeRadius in a production environment. > I have read http://www.freeradius.org/testimonials.html but I would >like to obtain a few more experiences. > Best regards, Susana Hi Susana, I've been using release 1.03 of FreeRadius to manage WiFi hotspots scattered all over the World for the last year I've had no downtime and the flexibility and power in the way that you can tailor the program to meet your requirements is unsurpassed. I very much doubt if you could find a commercial solution costing thousands of Euro that would be as reliable and powerful as FreeRadius. In addition the support from this mailing list and various forums such as dd-wrt.org and chillispot.org means that you are only a click away from solving any problems that you encounter. Regards, Sean Bracken http://swarmhotspots.com

1 0

how to allow only one authentication ?
by Riccardo.Veraldi 20 Jan '06

20 Jan '06

Hello, I could succesfully use EAP-TTLS with kerberos authentication. my problem now is that in this way also users who have a certificate can authenticate. I would like only users with kerberos credentials to being able to authenticate in my users file I have DEFAULT Auth-Type = Kerberos in this way any EAP-TLS with a valid certificate can authenticate while I do not want people to use the certificate, because the only method I wish to allow is login/password on kerberos server. There is a way to do it ? To allow ONLY kerberos via EAP-TTLS ? I Tryed with a Auth-Type := Reject but with no luck.. So what I did is this. I wrote this users file: "user1" Auth-Type = Kerberos DEFAULT Auth-Type := Reject in this case the user called user1 can authenticate with Kerberos credential and he cannot authenticate if it has a certificate, this as I Wantet but THIS WORKS only for user1 I want to do it for all users in the Kerberos database, and I do not like to write all the usernames in the users file. If I use DEFAULT instead of "user1" in the line above it does not work ... Please maybe there is a hint which could help me ? thanks Rick

2 3

file detail
by Alvaro Quiñones 20 Jan '06

20 Jan '06

Hi I run radiusd and the service up without errors, however i try to see file detail and it not appear. /usr/local/var/log/radius/radacct/ users are authenticating, but file detail is not create.Why ?? where is the problem? Thanks Alvaro

3 3