March 2006 - Freeradius-Users - lists.freeradius.org

Realms default problem
by Vasco Santos 08 Mar '06

08 Mar '06

Hi folks, I what to put a new service in my radius server and I have this configuration in realms file: mycompany.com LOCAL nostrip NULL LOCAL nostrip DEFAULT XXX.XXX.XXX.XXX:1600 nostrip I actualy have one default server to default domains that are unknown in my server, but I want to implement a new service with clients that I dont know the domain, this is a new default server. Its is possible to put a priotity in servers? someting like this: DEFAULT1 XXX.XXX.XXX.XXX:1700 nostrip DEFAULT XXX.XXX.XXX.XXX:1600 nostrip if the login fail in the server nº1 going to the server nº2. This its possible? If not possible, give-me solutions to my problem or ways to resolve. Thanks.

2 1

"Dropping conflicting packet" and "Rejecting request"
by Takeshi Yoshida 08 Mar '06

08 Mar '06

I am moving FreeRadius(1.1.0 Sparc Solaris9) by the following compositions. (Target is "* Proxy *") ------------ --------------- | Radius-1 |--> -->| HomeRadius1 |---RDB ------------ | ----------- | --------------- |-->|* Proxy *|-->| ------------ | ----------- | --------------- | Radius-2 |--> -->| HomeRadius2 |---RDB ------------ --------------- The role of this server is only a Proxy server. The occasionally following errors are output by "radius.log" Wed Feb 22 11:53:38 2006 : Error: Dropping conflicting packet from client Radus-1:1039 - ID: 246 due to unfinished request 7101301 and Wed Feb 22 11:53:38 2006 : Error: Rejecting request 7101299 due to lack of any response from home server Radius-1:1039 Why are these messages output? The number of requests that *Proxy* receive is AUTH=10 and ACCT=15 in about one second. It is a setting as follows. --- radiusd.conf --- max_request_time = 12 delete_blocked_requests = no cleanup_delay = 6 max_requests = 20480 hostname_lookups = no reject_delay = 3 proxy_requests = yes --- proxy.conf --- proxy server { synchronous = no retry_delay = 0 retry_count = 0 dead_time = 60 default_fallback = yes post_proxy_authorize = no } When the examination on which I put the load is done, this error is fully output. However, it is output when the load is low. There is always one kind of UDP transmission Port of "Radius-1" and "Radius-2". (It is not unique at each request. ) Because this server is being operated, it is not possible to do in debug mode. Please give something a good idea to me. I'm sorry in strange English. My best regards. ######################################### # # # Takeshi Yoshida # # # ######################################### --------------------------------- TSUKAME EIKOU! KAGAYAKE EGAO! Yahoo! JAPAN JPC OFFICIAL PARTNER INTERNET PORTAL SITE

2 1

freeradius hangs, using 98% CPU
by George C. Kaplan 08 Mar '06

08 Mar '06

For some time we've had an intermittent problem where freeradius becomes unresponsive, consuming at least 98% of the CPU. A 'kill -TERM' will sometimes kill the daemon, but usually a 'kill -9' is needed. This always seems to happen right about when we reload the config (with a HUP), or stop and restart the daemon. We're using freeradius 1.0.5 on FreeBSD 5.5-PRERELEASE, but we also saw this problem with FR 1.0.1 on FreeBSD 5.3 and 5.4. We recently added an authorization step (using LDAP and perl) to our Kerberos-authenticated wireless service, and this might offer some clues about the timing of the problem. A sample from our radius.log is attached. At 14:12:04, two users (user1 and user2) connect at about the same time, are authorized by rlm_perl, and then authenticated with Kerberos. Then, at 14:12:06, user3 connects just as the daemon gets the HUP signal. User3 is authorized, but never gets authenticated; the daemon reloads, but is unresponsive until I kill and restart it at 14:30:01 I'm guessing that the daemon can hang if it gets a signal just as the rlm_krb5 module is called. It's marked RLM_TYPE_THREAD_UNSAFE, so it gets a mutex, and attaching gdb to the hung daemon showed: [Switching to LWP 100171] 0x28205940 in pthread_mutexattr_init () from /usr/lib/libpthread.so.1 (gdb) where #0 0x28205940 in pthread_mutexattr_init () from /usr/lib/libpthread.so.1 Is anyone aware of any freeradius thread problems (especially related to the FreeBSD thread libraries) that might explain this? Any suggestions for avoiding the problem or tracking it down in more detail? Thanks, -- George C. Kaplan gckaplan(a)ack.berkeley.edu Communication & Network Services 510-643-0496 University of California at Berkeley Tue Mar 7 14:12:04 2006 : rlm_perl: [user1] EMPLOYEE-TYPE-ACADEMIC OK Tue Mar 7 14:12:04 2006 : rlm_perl: [user2] STUDENT-TERM-SPRING OK Tue Mar 7 14:12:04 2006 : Auth: Login OK: [user1] (from client wireless-gw1 port 3002 cli 000e35a87f43) Tue Mar 7 14:12:04 2006 : Auth: Login OK: [user2] (from client wireless-gw1 port 1002 cli 00904b5de43b) Tue Mar 7 14:12:06 2006 : rlm_perl: [user3] STUDENT-TERM-SPRING OK Tue Mar 7 14:12:06 2006 : Info: Reloading configuration files. Tue Mar 7 14:12:06 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Mar 7 14:12:06 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Mar 7 14:12:06 2006 : Auth: rlm_krb5: krb5_init ok Tue Mar 7 14:12:06 2006 : Info: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Tue Mar 7 14:12:06 2006 : Info: rlm_passwd: nfields: 6 keyfield 0(User-Name) listable: no Tue Mar 7 14:12:06 2006 : Info: rlm_passwd: nfields: 2 keyfield 0(User-Name) listable: no Tue Mar 7 14:12:07 2006 : Info: Ready to process requests. Tue Mar 7 14:30:01 2006 : Error: WARNING: Unresponsive child (id 136453120) for request 31420 Tue Mar 7 14:30:03 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Mar 7 14:30:03 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Mar 7 14:30:03 2006 : Auth: rlm_krb5: krb5_init ok Tue Mar 7 14:30:03 2006 : Info: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no Tue Mar 7 14:30:03 2006 : Info: rlm_passwd: nfields: 6 keyfield 0(User-Name) listable: no Tue Mar 7 14:30:03 2006 : Info: rlm_passwd: nfields: 2 keyfield 0(User-Name) listable: no Tue Mar 7 14:30:03 2006 : Info: Ready to process requests.

2 1

unsubscribe
by John Peebles 08 Mar '06

08 Mar '06

1 0

some users not authenticating
by Tony Spencer 08 Mar '06

08 Mar '06

I've got, well think I have, radius to accept all logins no matter what password they send. However some users still cannot login, its around 10 users out of 200. I'll show details for one user that can login ok and one user that can't. I'm guessing it's something the end user is doing because they all come in via the same NAS and have exactly the same radius entry. If I can get around this by just accepting anything that would be ideal, since our realm is the only radius logins that are sent to us. Here is a user that can't login: ## Thu Mar 2 09:59:03 2006 : Auth: Login incorrect (rlm_chap: Clear text password not available): [user22(a)dsl.realm.com/<CHAP-Password>] (from client l2tp port 510) ## Here is someone that did authenticate ok: ## Thu Mar 2 09:55:26 2006 : Auth: Login OK: [user3(a)dsl.realm.com/<CHAP-Password>] (from client l2tp port 492) ## My users file has: ## DEFAULT Auth-Type = Accept ## And the entries for both users above are identical apart from the username and IP assignment: ## user3(a)dsl.realm.com Auth-Type := Accept Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.0.1, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP, user22(a)dsl.realm.com Auth-Type := Accept Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 192.168.0.2, Framed-Netmask = 255.255.255.255, Framed-Compression = Van-Jacobsen-TCP-IP, ## Here is some radius debug first for the user that can't login: ## rad_recv: Access-Request packet from host 10.0.0.2:1645, id=46, length=98 Framed-Protocol = PPP User-Name = " user22(a)dsl.realm.com" CHAP-Password = 0x01295999be562b2eab944deb9647c5a664 NAS-Port-Type = Virtual NAS-Port = 563 Service-Type = Framed-User NAS-IP-Address = 10.0.0.2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "dsl.realm.com" for User-Name = " user22(a)dsl.realm.com" rlm_realm: No such realm "dsl.realm.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_chap: login attempt by " user22(a)dsl.realm.com" with CHAP password rlm_chap: Could not find clear text password for user user22(a)dsl.realm.com modcall[authenticate]: module "chap" returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [ user22(a)dsl.realm.com/<CHAP-Password>] (from client l2tp port 563) ## And a user that can login: ## rad_recv: Access-Request packet from host 10.0.0.2:1645, id=200, length=97 Framed-Protocol = PPP User-Name = "user3(a)dsl.realm.com" CHAP-Password = 0x012d51dff5b1bda7f6a370e79ff84e0dcf NAS-Port-Type = Virtual NAS-Port = 717 Service-Type = Framed-User NAS-IP-Address = 10.0.0.2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: Looking up realm "dsl.realm.com" for User-Name = "user3(a)dsl.realm.com" rlm_realm: No such realm "dsl.realm.com" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched DEFAULT at 152 users: Matched user3(a)dsl.realm.com at 243 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [user3(a)dsl.realm.com/<CHAP-Password>] (from client l2tp port 717) Sending Access-Accept of id 200 to 10.0.0.2:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.0.2 Framed-IP-Netmask = 255.255.255.255 Framed-Compression = Van-Jacobson-TCP-IP Finished request 2 ## I can see that it seems user33 is sending a blank white space before his username, but I don't see that this would make a difference since I'm accepting everything anyway. And from the command line I can use "radtest" and send blank spaces and it works fine. Although I do see that the user would not get assigned his IP address. But first I'd like to ensure everyone can authenticate. Any idea? Thanks in advance Tony

3 3

7 instances of freeradius - radiusd daemon
by sumi thra 08 Mar '06

08 Mar '06

Subject: 7 instances of freeradius - radiusd daemon Hi All, I builded the freeradius-1.0.5 source. In the config option i specified --with-threads=no( tried with --disable-threads too) But, when i ran the daemon, im seeing 7 instances. How do i compile it to run in single thread mode ?? Any earliest reply will be very helpfull. Thanks in Advance. -- Sumi -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!" -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

2 1

eap don't work
by pelusa vali 08 Mar '06

08 Mar '06

hi everybody, i have problems using freeradius 1.0.5, i cann't get it works as i hope. well i installed freeradius in my server and tried to see if clients can authenticate, so first tried test over server, my ip is 192.168.10.1, i generate certificates to use TLS. this is my users file: "mec01" Auth-Type := EAP and clients.conf file: client 192.168.10.1 { secret = clue shortname = www.kill.com } i tried put in shortname localhost too, but nothing happen eap.conf file: tls { private_key_file = ${raddbdir}/certs/www.kill.com.pem certificate_file = ${raddbdir}/certs/www.kill.com.pem CA_file = ${raddbdir}/certs/demoCA/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 ... } so, i do this: www:~# radtest mec01 clue www.kill.com 0 clue Sending Access-Request of id 49 to 192.168.10.1 port 1812 User-Name = "mec01" User-Password = "clue" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 192.168.10.1:1812, id=49, length=20 in messages from radius i see this: rad_recv: Access-Request packet from host 192.168.10.1:32768, id=49, length=62 User-Name = "mec01" User-Password = "clue" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_rmspace_pair: User-Password now 'clue' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "mec01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry mec01 at line 97 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message modcall[authenticate]: module "eap" returns fail for request 1 modcall: leaving group authenticate (returns fail) for request 1 auth: Failed to validate the user. Login incorrect: [mec01/clue] (from client localhost port 0) rad_lowerpair: User-Name now 'mec01' rad_rmspace_pair: User-Name now 'mec01' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "mec01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry mec01 at line 97 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message modcall[authenticate]: module "eap" returns fail for request 1 modcall: leaving group authenticate (returns fail) for request 1 auth: Failed to validate the user. Login incorrect: [mec01/clue] (from client localhost port 0) Delaying request 1 for 1 seconds Finished request 1 so i reviewed keys and shared secret and they are correct in server, client and CA, i even generate them again. i see radius says: rlm_eap:Malformed EAP Message, so may be i install freeradius in a bad way? or what is happening? why server don't authenticate users? thanks in advance. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

2 1

[Freeradius-Users]modcall[authenticate]: module "unix" returns notfound for request
by Jedliu 08 Mar '06

08 Mar '06

Hi, All! When I wanna run freeradius with the support of MySQL, I found such mes * modcall[authenticate]: module "unix" returns notfound for request 12 modcall: group authenticate returns notfound for request 12 * in "radiusd -X" mode,but the user in USERS file can be authenticated successfully. I've googled,but not find the solution. And i've searched from the mailing list,though there're some troubleshooting too,no way to solove. So pls help! Thx in advance! Regards for everyone. jedliu Jedliureceiver(a)gmail.com 2006-03-06

2 3

Problem with rlm_perl.
by wazn＠sibmail.ru 08 Mar '06

08 Mar '06

Hi. I use freeradius 1.1.0 on Debian 3.1 stable. freeradius is compiled to deb-package by the command "dpkg-buildpackage -rfakeroot -uc -b" and installed by "dpkg -i". I tried to use test perl module 'example.pl'. Here is part of my radiusd.conf: ... modules { ... perl test_module { module = ${confdir}/example.pl } ... } accounting { detail sql test_module } ... And /usr/sbin/freeradius -X says: ... Module: Loaded perl perl: module = "/etc/freeradius/example.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" rlm_perl: perl_parse failed: /etc/freeradius/example.pl not found or has syntax errors. radiusd.conf[211]: test_module: Module instantiation failed. radiusd.conf[245] Unknown module "test_module". radiusd.conf[242] Failed to parse accounting section. The file exists: # ls -l /etc/freeradius/example.pl -rw-r----- 1 root freerad 4620 Jan 24 14:26 /etc/freeradius/example.pl Perl says that syntax is OK: # perl -c /etc/freeradius/example.pl /etc/freeradius/example.pl syntax OK Where may be the error? If the errors are in the perl module "example.pl", how do I see the extended output? -- Best regards Yevgeny

4 3

Re: special characters in passwords + FR + ldap
by Turtiainen, Tero 07 Mar '06

07 Mar '06

Hi, > -----Original Message----- > Date: Sat, 4 Mar 2006 15:19:32 -0600 > From: "Natalia Escalera" <nescalera(a)gmail.com> > > Hello, > > What is needed is that Freeradius accepts passwors even if special > charaters are part of them. This is what is happening: > > > pass$word -> FR -> LDAP -> FR (Answer: wrong password) > > Any ideas of how to solve it? This looks very much like the feature we have seen with FR 0.9.3. Passwords with a "special character" are truncated, resulting in password check failing. http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-July/045 560.html This may be related to this bug, which is still open (I don't agree with the severity=minor :) http://bugs.freeradius.org/show_bug.cgi?id=261 We have made a small fix to the ldap-module (as seen in the link to the mailing list archive). I don't know if this has been fixed in 1.1.0. I once had a quick look at the ldap-module of 1.1.0, it should be quite easy to test if it still fails. -- Tero Turtiainen Technology Services Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

4 3