March 2006 - Freeradius-Users - lists.freeradius.org

mysql authentication doesn't work
by ???????, ?? ???????? 07 Mar '06

07 Mar '06

in radiusd.conf: authorize { auth_log sql } authenticate { } in sql.conf: sql_user_name = "%{Calling-Station-Id}" authorize_check_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authcheck_table} \ WHERE UserName = '%{SQL-User-Name}' AND User='%{User-Name}' \ ORDER BY id" /usr/local/sbin/radiusd -X show me: Listening on authentication XXX.XX.XX.XX:1812 Listening on accounting XXX.XX.XX.XX:1813 Ready to process requests. rad_recv: Access-Request packet from host XXX.XX.XX.XX:1812, id=190, length=117 NAS-Identifier = "mynas2" User-Name = "test" User-Password = "testpass" NAS-IP-Address = XXX.XX.XX.XX NAS-Port-Type = Virtual Called-Station-Id = "1000" Calling-Station-Id = "3339999999" Acct-Session-Id = "d45d6126058adce5" Acct-Multi-Session-Id = "d45d612600010610" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail.log' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail.log expands to /usr/local/var/log/radius/radacct/auth-detail.log modcall[authorize]: module "auth_log" returns ok for request 0 radius_xlat: '3339999999' rlm_sql (sql): sql_set_user escaped user --> '3339999999' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = '3339999999' AND User='test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: '' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE UserName = 'secondtest' ORDER BY id' radius_xlat: '' rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [3339999999] modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test/testpass] (from client mynas2 port 0 cli 3339999999) Sending Access-Reject of id 190 to XXX.XX.XX.XX port 1812 Finished request 0 So, select from database: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE UserName = '3339999999' AND User='test' ORDER BY id; +-----+------------+-------------------+--------+----+ | id | UserName | Attribute | Value | op | +-----+------------+-------------------+--------+----+ | 1 | 3339999999 | Auth-Type | Accept | := | | 37 | 3339999999 | User-Password | 378b243e220ca493 | == | | 73 | 3339999999 | User-Name | test | == | | 109 | 3339999999 | Called-Station-Id | 1000 | == | +-----+------------+-------------------+--------+----+ 4 rows in set (0.58 sec) ------------------------------------ As I understand, radius cannot understand crypted "User-Password" (by mysql function "password"). Is it possible to slide over it? How to do it, can someone give advice? ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

2 1

Realms in DB
by Santiago Balaguer García 07 Mar '06

07 Mar '06

Hi people, I am using freeradius-1.0.4 for more than two years in a Debian machine. I have all my user configurations in a Postgres DB. Now I migrate the clients.conf to DB successfully. For that porpouse I write at the end of my sql.conf: # Set to 'yes' to read radius clients from the database ('nas' table). readclients=yes I want to do the same with realm.conf file, but I don't know what line I must write in postgresql.conf file for reading realms table in my DB. Any suggestion?????? _________________________________________________________________ Acepta el reto MSN Premium: Protección para tus hijos en internet. Descárgalo y pruébalo 2 meses gratis. http://join.msn.com?XAPID=1697&DI=1055&HL=Footer_mailsenviados_proteccionin…

3 5

FreeRADIUS + LDAP + Wireless auth
by James Cort 07 Mar '06

07 Mar '06

Hi, I have an existing LDAP infrastructure which provides unified authentication for Windows and Linux (think Samba). I am trying to integrate WPA on a wireless access point with this using FreeRadius. The ultimate plan is that anyone who provides a valid username/password and whose account is not locked may connect through the wireless access point. I am using freeradius-1.0.5-r3. The problem I am having is that I cannot figure out how to get both the LDAP backend and the EAP parts working simultaneously. If I enable the "with_ntdomain_hack" option, LDAP works but EAP gives the "rlm_eap: Identity does not match User-Name, setting from EAP Identity." error. Removing the with_ntdomain_hack option results in the log below. The research I've done suggests I need something set up in the hints file, which I have: DEFAULT Prefix == "U4EATECH\" Hint = "EAP", Service-Type = Framed-User, Framed-Protocol = EAP LOG -------------------------------------------------------- rad_recv: Access-Request packet from host 172.30.10.40:1281, id=21, length=109 User-Name = "U4EATECH\\jamesc" NAS-IP-Address = 172.30.10.40 NAS-Identifier = "" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021500140155344541544543485c6a616d657363 Message-Authenticator = 0xad5561811aaffaf393b9c77ce04f5572 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/172.30.10.40/auth-detail-20060303' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/172.30.10.40/auth-detail-20060303 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_eap: EAP packet type response id 21 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for U4EATECH\jamesc radius_xlat: '(uid=U4EATECH)' radius_xlat: 'ou=people,dc=u4eatech,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.u4eatech.com:389, authentication 0 rlm_ldap: bind as cn=smbadmin,dc=u4eatech,dc=com/N0pm4Ln0 to ldap.u4eatech.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=u4eatech,dc=com, with filter (uid=U4EATECH) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP rad_check_password: Found Auth-Type EAP Warning: Found 2 auth-types on request for user 'U4EATECH\jamesc' auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 21 to 172.30.10.40:1281 EAP-Message = 0x011600061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f7167d39d5e06712574b4b38f69116b Finished request 0 Going to the next request ---------------------------------------------------------------- radiusd.conf prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } ldap { server = "ldap.u4eatech.com" identity = "cn=smbadmin,dc=u4eatech,dc=com" password = <HIDDEN> basedn = "ou=people,dc=u4eatech,dc=com" filter = "(uid=%u)" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = yes with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{Stripped-User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess files auth_log eap ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

2 3

RE: Radius server health monitor :
by Bart van Daal 07 Mar '06

07 Mar '06

Check out 'monit' too. It's able to take some defined actions when the server dies or something goes wrong. kr, Bart -----Original Message----- From: freeradius-users-bounces+b.vandaal=edpnet.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+b.vandaal=edpnet.net@lists.freeradius.org] On Behalf Of Devaraj Hattibelegal Patil Sent: dinsdag 7 maart 2006 15:44 To: FreeRadius users mailing list Subject: RE: Radius server health monitor : Can I get any idea on writing our own new open code? I mean I am looking for new small really light wait application which does monitoring and uses the best method (either snmp ping or Server status message or some radius API). Regards, Devah -----Original Message----- From: freeradius-users-bounces+devaraj=airvana.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+devaraj=airvana.com@lists.freeradius.or g] On Behalf Of Peter Nixon Sent: Tuesday, March 07, 2006 4:50 AM To: FreeRadius users mailing list Subject: Re: Radius server health monitor : On Mon 06 Mar 2006 15:11, Devaraj Hattibelegal Patil wrote: > Radius server health monitor: I was looking from best way monitor the > health of the Radius server. Can some body suggest the best possible > way? > Thanks in advance Nagios, OpenNMS (Which I use) and many other NMS systems have radius monitoring plugins that work just fine. They can also monitor your backend auth and accounting stores for you (LDAP and SQL for example) -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Radius server health monitor :
by Devaraj Hattibelegal Patil 07 Mar '06

07 Mar '06

Can I get any idea on writing our own new open code? I mean I am looking for new small really light wait application which does monitoring and uses the best method (either snmp ping or Server status message or some radius API). Regards, Devah -----Original Message----- From: freeradius-users-bounces+devaraj=airvana.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+devaraj=airvana.com@lists.freeradius.or g] On Behalf Of Peter Nixon Sent: Tuesday, March 07, 2006 4:50 AM To: FreeRadius users mailing list Subject: Re: Radius server health monitor : On Mon 06 Mar 2006 15:11, Devaraj Hattibelegal Patil wrote: > Radius server health monitor: I was looking from best way monitor the > health of the Radius server. Can some body suggest the best possible > way? > Thanks in advance Nagios, OpenNMS (Which I use) and many other NMS systems have radius monitoring plugins that work just fine. They can also monitor your backend auth and accounting stores for you (LDAP and SQL for example) -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

1 0

mysql 4.1.0 can not run normally in Freeradius 1.0.5
by yao guoxian 07 Mar '06

07 Mar '06

Freeradius works well through authenticating users throught "files" option. In order to authenticate users throng "sql" , I have installed mysql 4.1.0 on the machine which has the Redhat 9 operation system. I followed the suggestion : mysql -uroot -prootpass radius < db_mysql.sql and made changes to radiusd.conf like below: authorise { preprocess chap mschap #counter #attr_filter #eap suffix sql #files #etc_smbpasswd } authenticate { authtype PAP { pap } authtype CHAP { chap } authtype MS-CHAP{ mschap } #pam #unix #authtype LDAP { # ldap #} } preacct { preprocess suffix #files } accounting { acct_unique detail #counter unix sql radutmp #sradutmp } session { radutmp } However when I input : radiusd -X, only got the following errors: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "rootpass" sql: radius_db = "radius" sql: acct_table = "radacct" sql: acct_table2 = "radacct" sql: authcheck_table = "radcheck" sql: authreply_table = "radreply" sql: groupcheck_table = "radgroupcheck" sql: groupreply_table = "radgroupreply" sql: usergroup_table = "usergroup" sql: nas_table = "nas" sql: dict_table = "dictionary" sql: sqltrace = no sql: sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" sql: readclients = no sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}'" sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_table = "radpostauth" sql: postauth_query = "INSERT into radpostauth (id, user, pass, reply, date) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Could not link driver rlm_sql_mysql: file not found rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. Any suggestons?

2 1

Problem with EAP/TLS authentication
by Guillaume 06 Mar '06

06 Mar '06

hi, i am in trouble in the configuration of my radius server, eap/tls and wifi clients, i dont know where is the error, if its in my conf or if its in my certificates... I run the freeradius version 1.0.4. When Wifi client running winXP sp2 try to connect the radius, i have this following error after (i think) a succesfull authentication: rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 #error is here >> rlm_eap_tls: Received unexpected tunneled data after successful handshake. rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: group authenticate returns invalid for request 9 auth: Failed to validate the user. Do you have any idea why it doesnt work? If i use the radtest command with a fake user, it works... Thanks for your help :) --------------- here is my eap.conf: eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = yes tls { private_key_password = eripasse private_key_file = /etc/pki/ERITEST/private/ERITEST.srv.mail_key.pem certificate_file = /etc/pki/ERITEST/private/ERITEST.srv.mail_cert.pem CA_file = /etc/pki/ERITEST/eritestCA.pem random_file = /etc/pki/tls/random.rand fragment_size = 1024 } } -------------------------- and my users file "user" Auth-Type := EAP "test" Auth-Type := Local, User-Password =="test"

3 3

Radius server health monitor :
by Devaraj Hattibelegal Patil 06 Mar '06

06 Mar '06

Radius server health monitor: I was looking from best way monitor the health of the Radius server. Can some body suggest the best possible way? Thanks in advance

2 1

CRL not working....
by Robert Myers 06 Mar '06

06 Mar '06

I'm having some odd troubles here with the check_crl = yes I've added what I think is the appropriate config file directives, I must be missing something. Here is the debug output, any help would be much appreciated -Bob rad_recv: Access-Request packet from host 192.168.2.169:1038, id=37, length=208 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x0206000f01726d796572732d636d64 Message-Authenticator = 0xab51b4a66e5e063bf6ecb0244e478fd6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 6 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 5 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 37 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010700060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x011fcb927c106af30a76bf45e031e026 Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=38, length=291 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0x011fcb927c106af30a76bf45e031e026 EAP-Message = 0x020700500d800000004616030100410100003d0301440cb2749bc2a634cef7356a18a591bab4181aa08ad97702e92c360a5bca7cc900001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x8cd00e8b1b35684ba2b8b81c14861bb9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 7 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 6 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns notfound for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0562], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0073], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 38 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x0108040a0dc00000062e160301004a020000460301440ca6c9ce32946be1ccac53123187db21cf3feaece1f5da6209b1d150132d6f20427a2b648e04281c7433674b6bff47834d3b252cae63361527f5124a08cb76a300040016030105620b00055e00055b00024730820243308201aca003020102020900b02d53f88c901429300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d303630313331 EAP-Message = 0x3139313831355a170d3037303133313139313831355a3065310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310f300d0603550403130673657276657230819f300d06092a864886f70d010101050003818d0030818902818100d7ecba2856c6c8427536a5100cec4b7ceed9af3e7e9f82ae8a444b0b744724ea3e99b165c59746b2900bbc6218b604a9309322295643f8d168f5d55a9e7e1be81950ab022acf750d5063120b7b56ed8f594a6e89e523e2027ace19e452fe414710f6ed EAP-Message = 0xd0d79cea027e94e35d0f6095fd04db8416c4f11f63bcf02d41d7293e450203010001300d06092a864886f70d010104050003818100a617555e7ca5a90a7e0eef057c96eb6d9dc5b8439ebbb52b7f7925dc68237c529e763580949c851755df0ac76b1451724b866e6bae7945fb64faeb88499084398dc9e7c0cbc31bd8489f27467d683448fb5787eb2b9c66d964232552a46d74c524273ccd6d3a7be29c0439b8f2c20bc96ab16755437270a2b9f647eb9806856a00030e3082030a30820273a003020102020900b02d53f88c901427300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e EAP-Message = 0x73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d3036303133313139313733375a170d3038303133313139313733375a3062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d30819f300d06092a864886f70d010101050003818d0030818902818100cd464aa3398c84bd31985dea600f28cd60f7bced7e6c EAP-Message = 0x749306ff79145fb5e00628fc5908338f312aaf008a99 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa06c77f4cfd37fb9f16ced52ebdc6686 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=39, length=217 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xa06c77f4cfd37fb9f16ced52ebdc6686 EAP-Message = 0x020800060d00 Message-Authenticator = 0x2716dcc5794b1beffe21cf96c356e943 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 7 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns notfound for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 39 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010902380d800000062e01c770ef206700cbd397b8f4627e086d6b2872b23e467fff195f007451bcb1547b66ca23a46ec638978c904ca8a942b73928be83ef91154e6c22817461d944f6ed41f7bfd17bc1ba8b6a6295eba1d63549d5dbd30203010001a381c73081c4301d0603551d0e041604147084def1ae8ce1a8344e404cfe763700473b65f43081940603551d2304818c30818980147084def1ae8ce1a8344e404cfe763700473b65f4a166a4643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009 EAP-Message = 0x060355040b13024954310c300a0603550403130352504d820900b02d53f88c901427300c0603551d13040530030101ff300d06092a864886f70d010104050003818100a4448cd34e1dd346ee6638304d4b8f2e9ee6d8b3fc85c68d71f80b9b74cc549332042dbec402dcf84655c2478cd9ec086c4df0ae8ace50992085005e76fd10b9f7a237984a196d7614437ee9e97e7e621e6b2a07d67d0384e0485960257f2074644699b9ec065cc673a7b05622013abb3beb77d0cd2d1624e7676922eaa6e82f16030100730d00006b020102006600643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e696131133011 EAP-Message = 0x0603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfc10b5f87ea497dbce8d66694199924f Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=40, length=1387 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xfc10b5f87ea497dbce8d66694199924f EAP-Message = 0x020904900d800000048616030104560b0003460003430003403082033c308202a5a003020102020900b02d53f88c90142c300d06092a864886f70d01010405003062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d301e170d3036303330363231303532345a170d3036303630343231303532345a3069310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a4861727269736275 EAP-Message = 0x7267310c300a060355040a13034d5349310b3009060355040b13024954311330110603550403130a726d796572732d636d6430819f300d06092a864886f70d010101050003818d0030818902818100daf05c6716f9346a5b14322363d56e9e47bce702e316f9961f06beaf89e571b6c81d7ec957bb4103ef28898be6cac14dacfb6d71265134cf9193dc08ce5e05b71d0074daca80665453493ef750381e94f8033f3212e94f7cf24e6ae34537edaf3c3b0a9e09a40cb7fec19c32d0753bfab5d6424acb1e8bb0b7a7bb453d00905d0203010001a381f23081ef30090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c EAP-Message = 0x2047656e657261746564204365727469666963617465301d0603551d0e04160414139d43580e4b595bf65001b9fb711d3a5cf04bc93081940603551d2304818c30818980147084def1ae8ce1a8344e404cfe763700473b65f4a166a4643062310b3009060355040613025553311530130603550408130c50656e6e73796c76616e6961311330110603550407130a48617272697362757267310c300a060355040a13034d5349310b3009060355040b13024954310c300a0603550403130352504d820900b02d53f88c901427300d06092a864886f70d010104050003818100289d684fa9f9e1df1757e61a0396237d891de9780a69d3db969d0c901ac8 EAP-Message = 0x36722ca531e05c52e116121dd0afabf1d8994b669084140b94c15c9ce05104a021bbfb5e79ede88ceaf592b3366df0d50eafe8bcf4ceaeddf284d3801de3eea9fab5cbe1b539784a825da253facb813e15b36a3eebd68da4add2ab48a7085c799886100000820080c72a0e26751c13b01c91545ff716fe9f16ff0328cfa0eb8822edd6c870b2fe6303e12c642f31edf017cf6cb49d6078b7b69809374f39ea5591144a0e97f882d7f99ea9eb8a3bc2e77f48dd0a9bac62857c51d7221ab13d9261dbe12240f3d9b8547242b4746e7500af619f80b9bc7ae8f8bf565941e83c639e86e5eef7877b720f0000820080a9fca434166b7bd12f2cc27bfe2462 EAP-Message = 0x87a99ec1d2579f9db69e725b1b7293b40ad087b41245bdfb338fcf70ce246f0924802e83573fdaad1f87438ede8a2edc7ec46b720edac3c3ad201b58771c2b09a2723fd2a16a8e5b20e9f7a073adb14635a3c2e59b966243fb5e974eea38111093fb27bca1e022225b161574f15a5159b01403010001011603010020a20a05e395b2ed0dfcc2e8f44addda5b3238f904b9f20c6017a772acb12c1608 Message-Authenticator = 0x43ae9e2d4338d3d0d1c91c3db6ca955e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 9 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 8 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns notfound for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 034a], Certificate --> verify error:num=3:unable to get certificate CRL rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B 31460:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:2021: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 8 modcall: group authenticate returns handled for request 8 Sending Access-Challenge of id 40 to 192.168.2.169:1038 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010a00110d800000000715030100020230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb722537bdfd460d8a203eab6301e97d9 Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=41, length=217 Framed-MTU = 1480 NAS-IP-Address = 192.168.2.169 NAS-Identifier = "PU-5300" User-Name = "rmyers-cmd" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 13 NAS-Port-Type = Ethernet NAS-Port-Id = "A13" Called-Station-Id = "00-13-21-ba-14-00" Calling-Station-Id = "00-11-11-64-a1-e6" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" State = 0xb722537bdfd460d8a203eab6301e97d9 EAP-Message = 0x020a00060d00 Message-Authenticator = 0x1ffb7e5aeb268158ff2c4a81fb2d07eb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "rmyers-cmd", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 10 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 157 users: Matched entry DEFAULT at line 188 modcall[authorize]: module "files" returns ok for request 9 radius_xlat: 'rmyers-cmd' rlm_sql (sql): sql_set_user escaped user --> 'rmyers-cmd' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'rmyers-cmd' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radcheck radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'rmyers-cmd' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): User rmyers-cmd not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns notfound for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack alert eaptls_verify returned 4 eaptls_process returned 4 rlm_eap: Handler failed in EAP/tls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: group authenticate returns invalid for request 9 auth: Failed to validate the user. Delaying request 9 for 1 seconds Finished request 9 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.2.169:1038, id=41, length=217 Sending Access-Reject of id 41 to 192.168.2.169:1038 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 37 with timestamp 440ca6c9 Cleaning up request 6 ID 38 with timestamp 440ca6c9 Cleaning up request 7 ID 39 with timestamp 440ca6c9 Cleaning up request 8 ID 40 with timestamp 440ca6c9 Cleaning up request 9 ID 41 with timestamp 440ca6c9 Nothing to do. Sleeping until we see a request.

1 0

pix auth and spawn_flag
by Curtis Doty 06 Mar '06

06 Mar '06

I just found a PIX that kicks out the following auth: User-Name = "bozo" NAS-IP-Address = 10.1.1.1 User-Password = "krusty" NAS-Port = 103 Cisco-AVPair = "ip:source-ip=10.1.1.2" To which freeradius does not respond until *after* the pix sends the first retry packet. The delay is always until the first retry; regardless if whatever I set the pix retry timer. Nor is it affected by the cleanup_delay or reject_delay. However, the last retry is eventually responded to after the 30 second max_request_time. The pix is only collecting timeouts on the aaa-server scoreboard. The problem goes away if radiusd is put in single process mode. Platform is Fedora Core and this is reproducible with their RPMs as well as pristine freeradius 1.1. ../C

2 6