November 2006 - Freeradius-Users - lists.freeradius.org

Backing up Mysql
by Sarkis Gabriel 10 Dec '06

10 Dec '06

Hi all i started backing up the db using a crontab job early in the morning which backs up everything, but i have had complains from users who try to logon after the backup process. What is the best way to backup an active database with radiusd waiting for connection? Thank you Sarky

6 9

FreeRadius core dump on FreeBSD
by Lisa Besko 05 Dec '06

05 Dec '06

I'm getting a core dump with freeradius when I try to use Kerberos authentication on a FreeBSD box running 6.1-Stable with an AMD64 platform. I can run FreeRadius with Kerberos authentication on FreeBSD 6.1 Stable with the i386 platform with no problems. If you can point me in a direction to help fix the problem please do. Here's some more info.: FreeRADIUS Version 1.1.3, for host amd64-portbld-freebsd6.1 Kerberos5 Version 1.5 Sunfire 2100 Dual Core AMD Opteron(tm) Processor 180 Please let me know if I can provide any more info. Here's the debugging messages from starting radiusd -X (slightly sanitized to protect the innocent : Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded Kerberos krb5: keytab = "(null)" krb5: service_principal = "(null)" rlm_krb5: krb5_init ok Module: Instantiated krb5 (krb5) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host xx.x.x.xx:50724, id=200, length=65 User-Name = "userid(a)realm.realm" User-Password = "thisisnothepasswordyouarelookingfor" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "realm.realm" for User-Name = "userid(a)realm.realm" rlm_realm: No such realm "realm.realm" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Kerberos auth: type "Kerberos" Processing the authenticate section of radiusd.conf modcall: entering group Kerberos for request 0 Bus error (core dumped) Thanks for any pointers or help you can provide. I've been searching all over the web and beating my head against the wall for 3 days now. LB

1 1

Problem authenticating with Checkpoint Integrity.
by Ian Walker 05 Dec '06

05 Dec '06

I'm attempting 802.1x authentication with Checkpoint Integrity. I have it working with peap no problems and usings mschapv2. However, when I attempt with Integrity, I have to choose "Zone Labs Cooperative Enforcement" within the Windows 802.1x authentication options. I've then chosen peap/mschapv2 here, but an additional setting is eap-type "44" of which I'm unable to change on the client. When the authentication attempt is tried with freeradius, this is what I see from the debug log. rad_recv: Access-Request packet from host 172.20.12.220:4066, id=145, length=232 Framed-MTU = 1480 NAS-IP-Address = 172.20.12.220 NAS-Identifier = "HP ProCurve Switch 5304XL" User-Name = "bartek" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "A1" Called-Station-Id = "00-11-85-57-88-00" Calling-Station-Id = "00-00-39-53-b0-aa" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "111" State = 0xa470cc42adabab0256dc2c8bc1eed1a2 EAP-Message = 0x02020006032c Message-Authenticator = 0x7aaa286e636cd7d6d2db5775789ea1ec Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry bartek at line 223 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group eap for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for bad type 44 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group eap (returns invalid) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.20.12.220:4066, id=145, length=232 Sending Access-Reject of id 145 to 172.20.12.220 port 4066 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 144 with timestamp 4562beee Cleaning up request 1 ID 145 with timestamp 4562beee Nothing to do. Sleeping until we see a request. The main bit of this being the EAP NAK and "NAK asked for bad type 44". I'm unsure of how I'm supposed to configure freeradius to use this type, as in the IANA numbers, type 44 is shown as: 44 ZoneLabs EAP (ZLXEAP) Any ideas on what I can do to get this working?

2 3

Problem starting freeradius 1.1.3
by Ian Walker 05 Dec '06

05 Dec '06

I used the "rpmbuild -ta" command to build an rpm of freeradius-1.1.3 and all went well with the build. I then installed the rpm, and I'm getting the following error message after running radiusd -X. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: symbol lookup error: radiusd: undefined symbol: udpfromto_init I'm not sure what to do to get around the problem of the undefined symbol udpfromto_init error. Has anyone any ideas on what I can do to get freeradius working? Regards Ian

2 2

FreeRadius and LDAP
by Sundaram Divya-QDIVYA1 04 Dec '06

04 Dec '06

Hi all, I'm trying to configure the server to use LDAP for authentication And am finding the documentation to be less than straightforward. We don't use openldap or eDirectory - which is what the docs are Derived from. The information for FreeRADIUS and LDAP seems to suggest that I need to provide access to the LDAP server's password to the service account that the FreeRADIUS Server uses. What I need to understand is how to integrate FreeRADIUS with an LDAP Server without exposing the (crypted) password hashes. Any pointers on what I need to do for that? I'd be happy to provide updated documentation once I have gotten it working. I'd appreciate any insights. Divya Sundaram ----------------------------- CONDITUR IN PETRA Let us realize that the privilege to work is a gift, that power to work is a blessing, that love of work is success. --David O. McKay ==============================================================

3 2

Mutiple Seperate nt domains
by Christian Ejlertsen 01 Dec '06

01 Dec '06

Hello all I hope this question has been asked a dozen times before. I have the following idea to a setup that I want to ask this is even possible with a freeRadius server. The scenario is multiple customers with their own windows domain servers where I want to authenticate ciscp vpn clients against the users own active directory. Hardware setup is going to be something like this, Multiple Cisco vpn clients with a single point of entry -> Cisco 4500 -> Radius Server -> multiple windows domain servers.(not in any way trusted or connected to each other). 1. a vpn client contacts the cisco box 2. the ciscop box forwards the request to the radius server for authentication. 3. the radius server somehow proxies the request to the windows domain server 4. the domain server reports back an ok to the radius server? 5. the vpn tunnel is setup. What I can understand about freeRadius is that it is possible to proxy authentication requests to other radius servers depending on domain names and other fields. Is this correct? Is this type of setup even doable with a Radius Server and if so could anyone help me in the directions of some solid howto's as I'm fairly green working with radius servers. Hope someone has some input to this type of setup. Regards Christian

2 1

return user group information to radius client
by ganesh subramonian 01 Dec '06

01 Dec '06

Hi I am trying to create three groups of users. I want to restrict access to functionality based on which group the user is in. For this i need to get this group information in the radius client also. Is there some standard way of telling the client that this user belongs to this group.If so how do i set this on the radius server. please help. thanks, ganesh ____________________________________________________________________________________ Do you Yahoo!? Everyone is raving about the all-new Yahoo! Mail beta. http://new.mail.yahoo.com

2 3

Problems installing
by Peter Param 01 Dec '06

01 Dec '06

hi all, I'm trying to install FR onto a new box but am getting errors during make. I using Linux debian 2.6.8-2-386. ./configure --with-openssl-libraries=/usr/local/ssl/include/openssl/ --with-rlm-perl-lib-dir=/usr/lib/perl/ --with-snmp=no errors during make: *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/root/freeradius-1.1.3/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /root/freeradius-1.1.3/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.1.3.so -o .libs/rlm_perl-1.1.3.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/root/freeradius-1.1.3/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/root/freeradius-1.1.3/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/root/freeradius-1.1.3/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/root/freeradius-1.1.3/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/freeradius-1.1.3/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/root/freeradius-1.1.3' make: *** [all] Error 2 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Fail-Over to sql-lost file
by Wilmar Campos 30 Nov '06

30 Nov '06

Hello, I Just move from OpenRadius to Freeradius and I couldn't find any place to tell the accounting module to write the sql insert command into a file if the MySQL server is not available. I found a way to do it on the detail file, but not on a file to leave all the INSERT querys for later insertion. I am running freeradius 1.1.2 on a Slackweare 10.1. Kerner 2.6 Thanks for your support. Wilmar Campos

2 4

Slow Aceess-Reject if pasword id INVALID
by Alex M 30 Nov '06

30 Nov '06

Hi, For some reason I'm getting slow response of access-reject when user uses wrong passwords. I'm using MySQL and first I thought that the delay is due to db, but if user password is ok im getting access-accept in 1.9ms. Where if user pass is incorrect im getting access-rject only after 1 minute. And if I run radius in debug mode im getting system message that password is invalid like in 2ms and only after 4000ms in getting the access-reject on the screen Any ideas how to fix that? Thanks!

2 1