October 2006 - Freeradius-Users - lists.freeradius.org

Bug on Accouting-Requests proxying
by Geoffroy Arnoud 27 Oct '06

27 Oct '06

FreeRADIUS 1.1.3 bug - Accounting requests reemission by FreeRADIUS In file "main\request_list.c", function "refresh_request". In the case of an accounting request (request->proxy->code == PW_ACCOUNTING_REQUEST), FreeRADIUS adds to the proxied packet the attribute "Acct-Delay-Time" (or updates it, if it was present in previous emission) with value set to the time difference between current time and time of initial proxied request. According to RFC 2866, chapter 4.1 : "The Identifier field MUST be changed whenever the content of the Attributes field changes, and whenever a valid reply has been received for a previous request. For retransmissions where the contents are identical, the Identifier MUST remain unchanged. Note that if Acct-Delay-Time is included in the attributes of an Accounting-Request then the Acct-Delay-Time value will be updated when the packet is retransmitted, changing the content of the Attributes field and requiring a new Identifier and Request Authenticator." FreeRADIUS updates the content of the packet when reemitting the accounting request, but does not change the Identifier. Thus, those packets sent after the first one are *not* true reemissions. This is a problem to us. For instance, we have the following setup : A client (A) sending an accounting request to FreeRADIUS (B), which retransmits the request to a proxy FreeRADIUS server (C). FreeRADIUS C is slow to respond, so FreeRADIUS B reemits the request, with different packet attributes (Acct-Delay-Time added), but keeps the same identifier. FreeRADIUS C receives the second request, but discards it since it has the same identifier as the request currently being processed. FreeRADIUS C then decides to finally respond (to the first request). FreeRADIUS B receives this response, and verifies if the request (the reemission) and response match. They do not, thus FreeRADIUS B drops the response and logs an error. FreeRADIUS should either : - NOT add Acct-Delay-Time attribute in accounting reemissions, thus preserving the content of the attributes in the packet. - or, add an Acct-Delay-Time, but change the identifier and handle the proxied packet as a new request. The second solution seems overly complicated, because FreeRADIUS would have to handle the second proxied request as a completely new request, but would also have keep the first one, as the proxy server can respond to any of the reemissions. The first solution is very simple to correct: it simply involves removing the block "if (request->proxy->code == PW_ACCOUNTING_REQUEST) {" in function "refresh_request" of file "main\request_list.c". I don't know if Acct-Delay-Time attribute is really useful to someone, I've never seen it used in any implementation of a RADIUS server. Anyhow, it seems way too much hassle to correctly handle this attribute in accounting reemissions. If tehre is any any objection, we will develop a patch to remove Acct-Delay-Time and provide it soon. Best regards, Geoff. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

Static IP Address allocation database - Active Directory?
by duckeo 27 Oct '06

27 Oct '06

Has anyone experimented with using Active Directory as a database for Static IP Addressing? I have two Radius groups in AD, Radius and Radius_StaticIP. If you are a member of the radius group, you are given a address by the NAS (I return 255.255.255.254 to the NAS). If you are a member of the Radius_StaticIP group I want to allocate an address out from my end, I am looking at perl at the moment but has anyone tried using a custom attribute in ActiveDirectory or similar to manage the addressing? Each account could have it's address defined in it's AD entry, but can FreeRadius look up these attributes and use them as replies? Has anyone gotten static ips to work from the client end? I'm not sure what I need to return to allow the client in a PPP dial-in session to set their own IP address in TCP/IP properties. Any help appreciated.

1 0

Freeradius on OS X with OD, password attribute is not checked
by Stepan Raichl 26 Oct '06

26 Oct '06

Hi all, I'm setting up a wireless network where users use login details provided by OpenDirectory + certificate. The goal is that user of the WiFi network must provide certificate and username with password. If the user is disabled in OD (via WGM - access account thick box), user must not access the network. My setup: OSX 10.4.8 Server, OpenDirectory, freeRADIUS, ZyWall 35 with WiFi AP using WPA Ent. Clients: 99.9% Mac OSX 10.4.8 I got all setup, freeRADIUS 1.1.3 running, certificates, but I can't get the freeRADIUS to check the user password from OD. Using radtest, I have no problems: ------- Sending Access-Request of id 123 to 127.0.0.1 port 1812 User-Name = "12345" User-Password = "12345" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=123, length=20 ------- However, when a client from WiFi logs in, username and certificate are the only criteria which are checked to grant access. If you can help, please read the debug dump below. It seems that RADIUS has managed to decrypt the password and adds it to checklist: rlm_ldap: Added password ******** in check items ... but then the access is granted anyway ... doesn't matter what you write in the password :-( To achieve my goals, am I using the correct method (EAP-TLS)? When using unecrypted connection, I can clearly see the password attribute, but that defeats the whole purpose of WPA ... I hope you guys don't mind that I dumped bits of my log & conf into this forum, I'm getting very frustrated ... I have already added userPassword as User-Password ... RADIUS reply to connection using certificate: ------- rad_recv: Access-Request packet from host 192.168.1.1:1131, id=16, length=144 User-Name = "12345" NAS-IP-Address = 192.168.1.1 NAS-Identifier = "zywall" Framed-MTU = 1496 Called-Station-Id = "00-11-22-33-44-55-66-77:Test Test" Calling-Station-Id = "00-11-22-33-44-55" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020b00060d00 State = 0xa5e4df76eacd676aa056b162e018e148 Message-Authenticator = 0x55082c87332500d61cb52cd8ca640361 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 rlm_eap: EAP packet type response id 11 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 rlm_ldap: - authorize rlm_ldap: performing user authorization for 12345 radius_xlat: '(uid=12345)' radius_xlat: 'dc=st,dc=ln' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=st,dc=ln, with filter (uid=12345) rlm_ldap: checking if remote access for 12345 is allowed by uid rlm_ldap: Added password ******** in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value ******** & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user 12345 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group authenticate (returns ok) for request 9 Sending Access-Accept of id 16 to 192.168.1.1 port 1131 MS-MPPE-Recv-Key = 0x1e908975f56513420942c8e6680139f19ebf58ee76c2c13a2315873f5ca1c6cf MS-MPPE-Send-Key = 0xedddaafac5513c090db385d154acfe8d19c5b7e542b264e1c6974850faddb2a6 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "12345" Finished request 9 --------- From radiusd.conf: --------- ldap { server = "192.168.1.2" basedn = "dc=st,dc=ln" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap password_attribute = userPassword } authorize { eap ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } ------ I have also added "checkItem User-Password userPassword" to ldap.attrmap. Please please help, many thanks in advance!!!! Stepan

2 2

race condition?
by Kevin J 26 Oct '06

26 Oct '06

I am running freeradius 1.0.5 version. I know this is old. ldap is used in authorization and pap is usually used in authentication. We made a client tool which can send 1000 packets per second (from data file) to freeradius. What we noticed that in multi-thread, there was a race condition which makes some ldapsearch failures. We are positive in that there is no problem in our ldap because we already tested our ldaps with a similar tool and verified that our ldap can support much more load. Do you have any idea what part of things that I need to check or was there any update in ldap with this kind of issue? Kevin

1 0

freeradius against AD not working
by Karthik R 26 Oct '06

26 Oct '06

Using freeradius v1.1.1 on a RHEL 4 box trying to authenticate users against Windows 2003 Active directory. I was able to bind linux box to Windows domain successfully and able to read the active directory users and groups using wbinfo - u R1\Administrator R1\Guest and wbinfo -g. Using ntlm_auth tool am able to successfully authenticate the users too. -bash-3.00# ntlm_auth --request-nt-key --username=kartthikr password: NT_STATUS_OK: Success (0x0) But while using radtest tool with the same logon credentials as above it rejects the user and here is the log message. rad_recv: Access-Request packet from host 127.0.0.1:32927, id=243, length=61 User-Name = "<removed>" User-Password = "<removed>" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "<removed>", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 243 to 127.0.0.1 port 32927 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 243 with timestamp 45413139 Nothing to do. Sleeping until we see a request. Here is nss config file: passwd: files winbind shadow: files winbind group: files winbind hosts: files winbind nis dns protocols: files winbind # nis services: files winbind # nis netgroup: files winbind # nis automount: files winbind nis Here is radiusd.conf file: modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no require_encryption = yes #require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Thanks in advance.

2 1

Freeradius consuming a lot of memory > 1.6G
by Pshem Kowalczyk 26 Oct '06

26 Oct '06

Hi, We've built a radius-proxy using freeradius and rlm_perl (with ithreads). Currently we have the following settings: thread pool { start_servers = 20 max_servers = 100 min_spare_servers = 20 max_spare_servers = 50 max_requests_per_server = 500 } perl { module = /usr/lib/perl5/rlmPerl.pm func_authenticate = authenticate func_authorize = authorize func_preacct = preacct func_accounting = accounting func_checksimul = checksimul func_pre_proxy = pre_proxy func_post_proxy = post_proxy func_post_auth = post_auth func_xlat = xlat func_detach = detach max_clones = 100 start_clones = 20 min_spare_clones = 20 max_spare_clones = 100 cleanup_delay = 5 max_request_per_clone = 100 } The whole setup works fine (there are two machines, load-balanced). Every single request is piped to the rlm_perl. The number of threads (ps -eLf) oscillates around 45-50 on both machines. There are no dealys, or any problems, except for the huge memory consumption. Authentication request are simply proxied (with minimal changes to the packets - filtering out some attributes and setting the others, no db access), accounting is send to a session database (postgresql) on a separate machine (no load problems there). Should freeradius use that amount of memory? The amount of memory is directly linked to the number of threads - with 25 threads (in the middle of the night) the memory consumption drops to about 900M. perl useses the following modules: use DBI; use Digest::JHash qw(jhash); use IPC::Shareable (':lock'); use Storable; (all variables shared between perl threads are stored in shared memory using perl IPC). So the question is should freeradius use that amount of memory and how can I decrease that? regards pshemko

1 0

authenticating question
by Matt Ashfield 26 Oct '06

26 Oct '06

Hi all, This is probably a bit newbie-ish, but I thought I'd try anyway. We are trying to authenticate users based on the username/password given AND the vlan they are authenticating from. Is this possible? A quick overview of our scenario is as follows: - Wireless service offering an SSID/VLAN for students and SSID/VLAN for staff. - Users connect to an SSID and are in the vlan associated for it. They are redirected to a portal where they must authenticate using radius - to -ldap authentication. We have this working. However, the question came up..what if a student connects to the Staff SSID/VLAN. His username/password would still authenticate correctly and he'd be given access at this point. But if we could get Radius to check and LDAP field which say which vlan he has access to, and allow or deny access to the network if the user is not currently in that vlan, then I guess that would be the ideal solution. Any suggestions are welcome. Thanks Matt mda(a)unb.ca

2 1

RE: radiusd service hangs
by Karthik R 26 Oct '06

26 Oct '06

Hi Karthik, I used to have the same problem in 2 different cases: - When Freeradius was installed on Redhat 9, it used to hang every 3 or 4 days as well but you're on Redhat Ent3 so you should be fine - When the connection to the MySQL server was dropping Are you sure your connection to AD is reliable? David ----- Am running freeradius ver 1.1.1. My connection to AD is reliable, but today i remembered before this issue araised recently i rebooted the domain controller. Not sure if this is causing the issue.

1 0

simple question
by Mike May 26 Oct '06

26 Oct '06

How can I determine that version of freeRadius that is currently running?

2 1

WAP EAP-TLS
by Pedro Henrique Morsch Mazzoni 26 Oct '06

26 Oct '06

Hello everybody, I'm implementing a environment for secure my wireless lan with radius. For this I choose WAP with EAP-TLS. But I have some questions to do. Is there a way to Authenticate/Authorizate: - Per machine certificate AND - Per user certificate AND - Per user password mapped on a NIS-Server, or a file in radius server. Note that I need this three modes of authentication. Thanks, Pedro Mazzoni

1 0