October 2006 - Freeradius-Users - lists.freeradius.org

radiusd service hang
by Karthik R 26 Oct '06

26 Oct '06

Am running freeradius on a RHEL v3 box, to authenticate 802.11users against AD. All of sudden the 802.11 users cant get authenticated against AD, unless i reboot the radius service on linux box. It looks like radius service get hangs atleast weekly once for no reason, i couldnt find anything in the log file /var/log/messages. Is anyone facing this issue ? everytime when the user complain that wireless i not working, have to restart the service manually. any help would be appreciated.

3 2

Error: ERROR: Tunnel-Password attribute in request: Cannot decrypt it.
by B Thompson 26 Oct '06

26 Oct '06

Hi We are seeing a problem with RADIUS accounting from some of our Colubris AP's. We are getting the following errors in /var/log/radius/radius.log :- Tue Oct 24 14:02:59 2006 : Error: ERROR: Tunnel-Password attribute in request: Cannot decrypt it. Could someone explain a bit more about what this means and whether it is likely to be a problem with the NAS? We are running FreeRADIUS 1.0.1. Here is the tcpdump print out of the packet which caused the above message :- 14:02:59.913634 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 323) nasphysap0.york.ac.uk.32770 > nasaaa2.york.ac.uk.radius-acct: [udp sum ok] RADIUS, length: 295 Accounting Request (4), id: 0xa7, Authenticator: 7f79db43885d7e9745205662885af3bc Accounting Session ID Attribute (44), length: 19, Value: 94c34058-00000007 0x0000: 3934 6333 3430 3538 2d30 3030 3030 3030 0x0010: 37 NAS Port Attribute (5), length: 6, Value: 10 0x0000: 0000 000a NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 0x0000: 0000 0013 NAS ID Attribute (32), length: 12, Value: nasphysap0 0x0000: 6e61 7370 6879 7361 7030 NAS IP Address Attribute (4), length: 6, Value: nasphysap0.york.ac.uk 0x0000: 9020 c4b8 Framed MTU Attribute (12), length: 6, Value: 1496 0x0000: 0000 05d8 Username Attribute (1), length: 18, Value: xy506(a)york.ac.uk 0x0000: 7879 3530 3640 796f 726b 2e61 632e 756b Calling Station Attribute (31), length: 19, Value: 00:0c:f1:1b:47:7b 0x0000: 3030 3a30 633a 6631 3a31 623a 3437 3a37 0x0010: 62 Called Station Attribute (30), length: 19, Value: 00:03:52:dc:e5:31 0x0000: 3030 3a30 333a 3532 3a64 633a 6535 3a33 0x0010: 31 Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session Time Attribute (46), length: 6, Value: 18 secs 0x0000: 0000 0012 Accounting Input Packets Attribute (47), length: 6, Value: 30 0x0000: 0000 001e Accounting Output Packets Attribute (48), length: 6, Value: 34 0x0000: 0000 0022 Accounting Input Octets Attribute (42), length: 6, Value: 2181 0x0000: 0000 0885 Accounting Output Octets Attribute (43), length: 6, Value: 7541 0x0000: 0000 1d75 Accounting Termination Cause Attribute (49), length: 6, Value: Lost Carrier 0x0000: 0000 0002 Accounting Delay Attribute (41), length: 6, Value: 289:15:29 hours 0x0000: 000f e3b1 Vendor Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311) Vendor Attribute: 17, Length: 52, Value: .]......D?...D7.?}v.X.x....S.)/..7.).Z. .SiG...: 0x0000: 0000 0137 1134 945d bea2 85ee bfde 443f 0x0010: e6c6 d544 37a6 3f7d 7608 58f1 78cb cca7 0x0020: fd53 0429 2fd8 0437 c529 845a ae20 c653 0x0030: 077f 6947 e27f e8c1 Vendor Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311) 0x0000: 0000 0137 1034 9f5b 63ae ecb4 7e23 af47 0x0010: 7be9 c08b 5cbd b35f 7f8d 9b11 1a08 a52f 0x0020: b52c 09c5 f5ca 5e2c 8d53 8390 0d8f 24fb 0x0030: 3e39 1668 6858 af32 0x0000: 0030 4883 9880 0003 5204 635a 0800 4500 .0H.....R.cZ..E. 0x0010: 0143 0000 4000 4011 8fb5 9020 c4b8 9020 .C..@.@......... 0x0020: c4fb 8002 0715 012f 922a 04a7 0127 7f79 ......./.*...'.y 0x0030: db43 885d 7e97 4520 5662 885a f3bc 2c13 .C.]~.E.Vb.Z..,. 0x0040: 3934 6333 3430 3538 2d30 3030 3030 3030 94c34058-0000000 0x0050: 3705 0600 0000 0a3d 0600 0000 1320 0c6e 7......=.......n 0x0060: 6173 7068 7973 6170 3004 0690 20c4 b80c asphysap0....... 0x0070: 0600 0005 d801 1278 7935 3036 4079 6f72 .......xy506@yor 0x0080: 6b2e 6163 2e75 6b1f 1330 303a 3063 3a66 k.ac.uk..00:0c:f 0x0090: 313a 3162 3a34 373a 3762 1e13 3030 3a30 1:1b:47:7b..00:0 0x00a0: 333a 3532 3a64 633a 6535 3a33 3128 0600 3:52:dc:e5:31(.. 0x00b0: 0000 022e 0600 0000 122f 0600 0000 1e30 ........./.....0 0x00c0: 0600 0000 222a 0600 0008 852b 0600 001d ...."*.....+.... 0x00d0: 7531 0600 0000 0229 0600 0fe3 b11a 3a00 u1.....)......:. 0x00e0: 0001 3711 3494 5dbe a285 eebf de44 3fe6 ..7.4.]......D?. 0x00f0: c6d5 4437 a63f 7d76 0858 f178 cbcc a7fd ..D7.?}v.X.x.... 0x0100: 5304 292f d804 37c5 2984 5aae 20c6 5307 S.)/..7.).Z...S. 0x0110: 7f69 47e2 7fe8 c11a 3a00 0001 3710 349f .iG.....:...7.4. 0x0120: 5b63 aeec b47e 23af 477b e9c0 8b5c bdb3 [c...~#.G{...\.. 0x0130: 5f7f 8d9b 111a 08a5 2fb5 2c09 c5f5 ca5e _......./.,....^ 0x0140: 2c8d 5383 900d 8f24 fb3e 3916 6868 58af ,.S....$.>9.hhX. 0x0150: 32 -- Many Thanks Ben Thompson

3 12

FreeRadius + NIS
by Dagoberto Carvalio Junior 26 Oct '06

26 Oct '06

Expensive friends, I am with authentication problem, being that I opted to using the FreeRadius. I ask for the gentility you to answer if the FreeRadius has support to catch the base of users of a server NIS. It forgives for my English, therefore I am Brazilian. Until more, and thanks. Dagoberto Carvalio Junior Analyst Systems - Universidade de São Paulo. -- ######################################################## Dagoberto Carvalio Junior - CCNA/CCAI/FCPF/FCPM/SCS Analista de Sistemas Instituto de Ciencias Matematicas e de Computacao UNIVERSIDADE DE SAO PAULO USER LINUX #417157 EMail : dago(a)icmc.usp.br Tel : 55 16 3373-9652 ########################################################

1 0

Q:ABOUTE:GET AN ATTRIBUET FROM NAS TO CHANGE QUERY IN RADIUS
by Alejandro Sanchez 26 Oct '06

26 Oct '06

Hi evreybody. I need to get the attribute Caller-Station-ID and then include in the "where" section of the query that access the table radreply. This is because i have only 1 user to access the IP net from PSTN but i need send back different values to the device dependeing what station is calling. How can i get this behavor? Thank's in Advanced ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Double-free in src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c causes crash on HUP
by Phil Mayers 26 Oct '06

26 Oct '06

At least on RHEL4 with glibc 2.3.4-2.13, a double-free in the above file causes a crash on HUP in some circumstances. I've confirmed that removing this fixes the issue. 459 460 free(conf->check_cert_cn); 461 free(conf->check_cert_cn); 462 free(conf->cipher_list);

2 2

RE: freeradius and ntlm_auth howto
by Jonathan De Graeve 26 Oct '06

26 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 The debugging output is exactly saying whats wrong Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) This dir should be readable by freeradius AND winbind. I thought 750 would work J. - -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98 > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens > Stieven.Struyf(a)komatsu.eu > Verzonden: donderdag 26 oktober 2006 16:24 > Aan: freeradius-users(a)lists.freeradius.org > Onderwerp: freeradius and ntlm_auth howto > > > All, > I am trying to authenticate my wifi users via our AD. I'm finding bits and > pieces on the internet to configure things, but no completely usable > howto. > Can someone of the users look at the ouput below and point me to the > correct solution/howto? > > I setup smb.conf,krb5.conf and freeradius. I joined the server to the > domain and tested the connection with ntlm_auth: > [root@belx11ke ~]# /usr/bin/ntlm_auth --request-nt-key --username=sstruyf > --domain=KMT-EU.KMTG.NET > password: > NT_STATUS_OK: Success (0x0) > [root@belx11ke ~]# > > rights of the winbind pipe: > ls -l /var/cache/samba/winbindd_privileged > total 0 > srwxrwxrwx 1 root root 0 Oct 25 14:46 pipe > > below is the debug output of freeradius > > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 7 > rlm_eap: Request found, released from the list > rlm_eap: EAP/peap > rlm_eap: processing type peap > rlm_eap_peap: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > eaptls_process returned 7 > rlm_eap_peap: EAPTLS_OK > rlm_eap_peap: Session established. Decoding tunneled attributes. > rlm_eap_peap: EAP type mschapv2 > rlm_eap_peap: Tunneled data is valid. > PEAP: Got tunneled EAP-Message > EAP-Message = > 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000 > 0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d4555 > 2e4b4d54472e4e45545c73737472757966 > PEAP: Setting User-Name to KMT-EU.KMTG.NET\sstruyf > PEAP: Adding old state with a4 c3 > PEAP: Sending tunneled request > EAP-Message = > 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000 > 0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d4555 > 2e4b4d54472e4e45545c73737472757966 > FreeRADIUS-Proxied-To = 127.0.0.1 > User-Name = "KMT-EU.KMTG.NET\\sstruyf" > State = 0xa4c337a92357e8d90a5f8c64b37d2df1 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 7 > modcall[authorize]: module "preprocess" returns ok for request 7 > modcall[authorize]: module "mschap" returns noop for request 7 > rlm_realm: No '@' in User-Name = "KMT-EU.KMTG.NET\sstruyf", looking up > realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "kmt-eu.kmtg.net" returns noop for request 7 > rlm_realm: Looking up realm "KMT-EU.KMTG.NET" for User-Name = "KMT- > EU.KMTG.NET\sstruyf" > rlm_realm: Found realm "KMT-EU.KMTG.NET" > rlm_realm: Adding Stripped-User-Name = "sstruyf" > rlm_realm: Proxying request from user sstruyf to realm KMT-EU.KMTG.NET > rlm_realm: Adding Realm = "KMT-EU.KMTG.NET" > rlm_realm: Authentication realm is LOCAL. > modcall[authorize]: module "ntdomain" returns noop for request 7 > rlm_eap: EAP packet type response id 9 length 82 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 7 > users: Matched sstruyf at 98 > modcall[authorize]: module "files" returns ok for request 7 > modcall: group authorize returns updated for request 7 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 7 > rlm_eap: Request found, released from the list > rlm_eap: EAP/mschapv2 > rlm_eap: processing type mschapv2 > Processing the authenticate section of radiusd.conf > modcall: entering group Auth-Type for request 7 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: NT Domain delimeter found, should we have enabled > with_ntdomain_hack? > rlm_mschap: Told to do MS-CHAPv2 for KMT-EU.KMTG.NET\sstruyf with NT- > Password > radius_xlat: Running registered xlat function of module mschap for string > 'Challenge' > mschap2: 95 > rlm_mschap: NT Domain delimeter found, should we have enabled > with_ntdomain_hack? > radius_xlat: Running registered xlat function of module mschap for string > 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=sstruyf -- > challeng e=7b634e5c9dd73ddc --nt- > response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972' > Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf -- > challenge=7b634e5c9dd73ddc --nt- > response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972 > Exec-Program output: winbind client not authorized to use > winbindd_pam_auth_crap. Ensure permissions on > /var/cache/samba/winbindd_privileged are set correctly. > (0xc0000022) > Exec-Program-Wait: plaintext: winbind client not authorized to use > winbindd_pam_auth_crap. Ensure permissions on > /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > modcall[authenticate]: module "mschap" returns reject for request 7 > modcall: group Auth-Type returns reject for request 7 > rlm_eap: Freeing handler > modcall[authenticate]: module "eap" returns reject for request 7 > modcall: group authenticate returns reject for request 7 > auth: Failed to validate the user. > Login incorrect: [KMT-EU.KMTG.NET\\sstruyf/<no User-Password attribute>] > (from client localhost port 0) > Processing the post-auth section of radiusd.conf > modcall: entering group Post-Auth-Type for request 7 > > Stieven Struyf > M.I.S. Division - System Operations > Komatsu Europe International NV > Mechelsesteenweg 586 > B-1800 Vilvoorde > Stieven.Struyf(a)komatsu.eu > Tel. +32 (0)2 2552551 -----BEGIN PGP SIGNATURE----- Version: 9.5.0 (Build 1202) wsBVAwUBRUDJDNjY2X/BrZGJAQjchQf/QUKfxpmDYdPgui8BqBOLGnp9SeO/v97+ QJZa0iCfSPX7Sr2GoXq+lK4s5a+vFnyqTm2s1kHwCcZif4PaUAjmXf0kjsPiV4X9 IIeImenaGNnS8iEFmIWEaP7WnzrB8/rPAeA1xnSyML06g7ejyMK23b50NwcWUyrf lnPPrGxLLOu1FUg94NI28iVtwLs9eqoHKyAKddaw42m9IXomuc7rZDBYBRO6bNvv /3E9TZMLszpe2oy6SEIItNyx9qjZTZtP2K1KSBS1ING9rI6EIYL505aQ9OPYzj9t HsP0HnpdvZJL8D0EtcSxzzoQLuC5wPzBjlWmGUGtsDY/8Wil9fx07A== =wrIA -----END PGP SIGNATURE-----

1 0

Freeradius server can not see any request from clients.
by richard Bai 26 Oct '06

26 Oct '06

Hi, everyone, I face a very strange problem right now when I configure a freeradius server with PEAP + LDAP. I can start the radius in debug mode properly. I get following lines: Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Then I did test by using " *radtest username password localhost 0 sharedsecret*" And the radius server replied with Access-Accept message. So, I think the serve works just fine. But when I tested by using "*radtest username password IP of server 0 sharedsecret*" from a client conneted to the server through a hub, I can not get anything back. I even did not see any Access-Request information in debug mode on the radius server. It looks like the radius doesn't receive anything. However, I sniffered the interface via Ethereal and used " tcpdump -v port 1812 " in the server, I do see the Access-Request packet received by the interface on the server, I confirmed that the 1812 port is open. Please give me some idea. Any advices or solution is welcome. Thank you very much! Best Regards Richard

4 5

Radius Attributes
by Manuel Sánchez Cuenca 26 Oct '06

26 Oct '06

Hello all, How must I configure my freeradius server to include in the Access-Accept response to the AP several radius attributes such as Session-Timeout or Framed-IP-Address? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

1 0

rlm_krb5
by Stieven.Struyf＠komatsu.eu 26 Oct '06

26 Oct '06

3 5

Important question about module instantiation
by Guilherme Franco 25 Oct '06

25 Oct '06

Hello, In sqlippool.conf I've instantiated: sqlippool DYNAMIC{ ... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{check:Pool-Name}' AND expiry_time < 'now'::timestamp(0) \ ORDER BY RANDOM() \ LIMIT 1 \ FOR UPDATE" ... } sqlippool STATIC{ ... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{check:Pool-Name}' AND expiry_time < 'now'::timestamp(0) \ ORDER BY (username <> '%{SQL-User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time \ LIMIT 1 \ FOR UPDATE" ... } So, the first one allocates dynamic IP addresses to the user and the second assigns static ones. Then in radiusd.conf: post-auth { DYNAMIC STATIC ... } The problem is: when someone who have Pool-Name := STATIC in radcheck logs in, the sqlippool module used for assigning IP to that user is DYNAMIC because it was called first than STATIC in radiusd.conf. As a result the user get a dynamic IP. That's a problem. What can I do to solve this, please? Thank you.

1 0