March 2006 - Freeradius-Users - lists.freeradius.org

upgrade path to v1.1.1
by jck-freeradius＠southwestern.edu 28 Mar '06

28 Mar '06

I am running a version of FreeRadius < 1.0.0. Is there a patch path to upgrade to v1.1.1? Or must I rebuild completely from source? --johnk

3 3

RE: Version 1.1.1 stops responding
by King, Michael 28 Mar '06

28 Mar '06

> -----Original Message----- > From: > adius.org] On Behalf Of Alan DeKok > > Until we can get more information about what's happening > (strace/ktrace, or gdb backtrace), there isn't much anyone > can do to fix it. How would I create those traces? (I'm looking for a suggested command line, since I don't normally use those programs)

3 3

dialup admin & ippool administraton
by olaf.schaefer＠gmx.com 28 Mar '06

28 Mar '06

Hi, I need a GUI for administration of the ippool-feature. Currently I'm using freeradius 1.1.1 with dialup admin 1.8 from CVS. The ippool-feature works fine, my aim is to add/edit/delete ip-pools within the dialup-admin. I know, I have to parse the radiusd.conf and write an approperiate php-script. My questions: - Has anybody done this before? Any suggestions? - Is it possible to put the ippool-information into a table of the radius-db (like the nas list) and let freeradius use the information in this table instead of the radiusd.conf? - Are there security issues, letting dialup-admin write into the radiusd.conf file? with best regards, olaf -- Echte DSL-Flatrate dauerhaft f�r 0,- Euro*! "Feel free" mit GMX DSL! http://www.gmx.net/de/go/dsl

2 1

RE: Multiple Accounting in Radacct
by zack musa 28 Mar '06

28 Mar '06

Hi all. Thanks for your reply gunther. Can you explain a bit of what might happen when radius start duplicating/recording/receiving the same user information 3 times in a row and some cases might be more, maximum i got is 7 times in mysql database. what brings u to that solution? Or is there anyone else who got similar problems before? user get connection but recorded until 7 times within 40 seconds! Is this come from NAS or radius server conifguration or MySQL? Thanks to all. --------------------------------- Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls. Great rates starting at 1¢/min.

2 1

Two factor authentication
by alfonso.lazaro＠eresmas.com 28 Mar '06

28 Mar '06

hi i am trying to configure freeradius to authenticate wireless users. i would like to use a two-factor authentication. - all pcs that want to connect to the wireless network need a certificate signed by CA - users must authenticate with their user/pass active directory i am not sure how to do it rasdius.conf authorize { eap } authenticate { Auth-Type MS-CHAP { mschap } } eap.conf tls { private_key_password = password private_key_file = /cert/cert-srv.pem CA_file = /CA/ca-cert.pem dh_file= /dev/urandom } best regards alfonso

3 3

Re:Ignoring resquest from unkown client
by yao guoxian 28 Mar '06

28 Mar '06

to Alex M: >If u are using MySQL you need to set, radiusd.config >to read NAS table im MuSQL (look et the end of the config file, I >think it's a last line) and then add your NAS clients to NAS table im >db Thanks for your advice. Will you please explain and describe the detail to me ? I searched through the radiusd.conf and couldn't locate the entry for nas. And my NAS table in 'freeradius' database looks like the following: mysql> select * from nas; +----+------------------------+---------------+---------+----------+---------------+-----------------+------------------+ | id | nasname |shortname | type | ports | secret | community | description | +-----+-----------------------+---------------+---------+----------+---------------+-----------------+-------------------+ | 1 | 202.117.15.164 | liv1 | other | NULL | testing123 | NULL | RADIUS Client

1 0

RE: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available?
by John Mylchreest 28 Mar '06

28 Mar '06

How would they work in this case? -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Jonathan De Graeve Sent: 27 March 2006 19:28 To: FreeRadius users mailing list Subject: RE: Different user attributes based on NAS-IP-Address?AlsoSuffixwildcards available? Uh, huntgroups? J. > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens John > Mylchreest > Verzonden: maandag 27 maart 2006 15:00 > Aan: FreeRadius users mailing list > Onderwerp: RE: Different user attributes based on NAS-IP-Address? > AlsoSuffixwildcards available? > > Funnily enough, I asked the very same thing recently. We do it quite > crudely at the moment, but it works. > > We add an nshortname field to radreply/anything else necessary, and in > sql.conf we link it to the user reply. Ie: > > Something like this would work: > > authorize_reply_query = "SELECT radreply.id,UserName,Attribute,Value,Op > FROM radreply, nas WHERE Username = '%{SQL-User-Name}' AND nas.ipaddr = > %{Client-IP-Address}' AND (radreply.nshortname = nas.shortname OR > radreply.nshortname is NULL) ORDER BY id" > > If you find any cleaner solution using the default schema, I would LOVE to > hear about it, since that's the problem/task I'm currently facing. > > -----Original Message----- > From: freeradius-users- > bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius- > users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org] On Behalf Of > Andy Coates > Sent: 27 March 2006 13:35 > To: freeradius-users(a)lists.freeradius.org > Subject: Different user attributes based on NAS-IP-Address? Also > Suffixwildcards available? > > > Hey, > > Is this even possible? > > The basic problem is that I have 2 devices that will use the same > username. > For example, one device handles dialup, one handles DSL. I'd like the > user > to have the same username, and depending on the NAS sending the request > the > correct IP/Netmask would be returned. > > I've setup huntgroups for the NAS, and can match them in various setups in > the users file - but this only seems like it would work for group based > attributes (i.e. common fields). Returning unique fields for each user > based on the NAS-IP-Address doesn't seem possible? > > That aside, does anyone know if its possible to use wildcards with Suffix > when stripping usernames? I've tried "@*" or "@*.domain.com" and it > doesn't > seem to match :( > > Thanks in advance, > Andy. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > Communications on or through ioko's computer systems may be monitored or > recorded to secure effective system operation and for other lawful > purposes. > > Unless otherwise agreed expressly in writing, this communication is to be > treated as confidential and the information in it may not be used or > disclosed except for the purpose for which it has been sent. If you have > reason to believe that you are not the intended recipient of this > communication, please contact the sender immediately. No employee is > authorised to conclude any binding agreement on behalf of ioko with > another party by e-mail without prior express written confirmation. > > ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

RE: Version 1.1.1 stops responding
by King, Michael 28 Mar '06

28 Mar '06

Just for some reference (Trying to find commonalities): What OS/Distro are you? I'm Debian testing release How did you Install? (Prebuilt binary / created local package and install / install from source) I created a local Debian package, and installed it. What modules did you enable? PEAP, TTLS, and TLS What is your authentication source? Using ntlm_auth against Active Directory 2003 What is your supplicant? 98% Windows XP built in supplicant. The rest are Linux / Mac clients. I wonder if this has something to do with this bug that got squashed.... 2006.03.20 v1.0.5, and v1.1.0 - A validation issue exists with the EAP-MSCHAPv2 module in all versions from 1.0.0 (where the module first appeared) to 1.1.0. Insufficient input validation was being done in the EAP-MSCHAPv2 state machine. A malicious attacker could manipulate their EAP-MSCHAPv2 client state machine to potentially convince the server to bypass authentication checks. This bypassing could also result in the server crashing. We recommend that administrators upgrade immediately. > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Stefan Winter > Sent: Monday, March 27, 2006 1:49 AM > To: FreeRadius users mailing list > Subject: Re: Version 1.1.1 stops responding > > > Mine seg faulted as well.. > > Here's the last few lines of the freeradius -X -A > > > modcall: entering group authenticate for request 1002 > > rlm_eap: Request found, released from the list > > rlm_eap: EAP/peap > > rlm_eap: processing type peap > > rlm_eap_peap: Authenticate > > rlm_eap_tls: processing TLS > > rlm_eap_tls: Length Included > > eaptls_verify returned 11 > > Interesting. This morning I encountered again that radiusd > was claiming to be still listening on its ports, but didn't > process anything any more. As other logs showed, someone > logged into an Access Point via TTLS at 8:22 and at 8:25 the > Nagios Monitoring system marked the RADIUS Server as > critical. Scan interval for Nagios is every three minutes. So > it could very well be that FreeRADIUS stopped processing > packets when it tried to do TTLS. Sounds similar to your > case, just that it didn't segfault. Note that we usually use > TTLS it several times a day, and FreeRADIUS shows this > behaviour only sporadically. > I now reverted to 1.1.0 in the hope that it's better there. > The way it is now is... disturbing. > > Greetings, > > Stefan Winter > > -- > Stefan WINTER > > Stiftung RESTENA - Réseau Téléinformatique de l'Education > Nationale et de la Recherche Ingenieur Forschung & Entwicklung > > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 > http://www.restena.lu Fax: +352 422473 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

RE: How Getting accounting informations ?
by Vincent MARGUERIE 27 Mar '06

27 Mar '06

Hi, I've always got the same problem with accounting informations...sorry to query you one more time !! But I've made a new test with radclient and I have this log (maybe it will be helpfull) > echo "User-Password = tata, User-Name = tata, Accounting-Status-Type = Start" | radclient -x -d /usr/local/etc/raddb/ radius:1813 acct whatever rad_recv: Accounting-Request packet from host 192.168.0.1:32768, id=218, length=44 User-Password = "\256\032\246\027\310$!\305\313UBc\306." User-Name = "tata" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 7 modcall[preacct]: module "preprocess" returns noop for request 7 rlm_realm: No '@' in User-Name = "tata", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 7 modcall: leaving group preacct (returns noop) for request 7 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 7 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/detail-20060328 modcall[accounting]: module "detail" returns ok for request 7 rlm_unix: no Accounting-Status-Type attribute in request. modcall[accounting]: module "unix" returns noop for request 7 rlm_radutmp: No Accounting-Status-Type record. modcall[accounting]: module "radutmp" returns noop for request 7 radius_xlat: '*packet has no accounting status type*. [user 'tata', nas '192.168.0.1']' rlm_sql (sql) in sql_accounting: packet has no accounting status type. [user 'tata', nas '192.168.0.1'] modcall[accounting]: module "sql" returns invalid for request 7 modcall: leaving group accounting (returns invalid) for request 7 Finished request 7 Going to the next request --- Walking the entire request list --- Cleaning up request 7 ID 218 with timestamp 44289161 Nothing to do. Sleeping until we see a request. What does "*packet has no accounting status type*" means ? Is it the reason for accounting doesn't work ? I fell lost...please help :-) ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- For the auth section....there's no problem (see the following lines) > echo "User-Password = tata, User-Name = tata, Accounting-Status-Type = Start" | radclient -x -d /usr/local/etc/raddb/ radius:1812 auth whatever rad_recv: Access-Request packet from host 192.168.0.1:32768, id=215, length=44 User-Password = "tata" User-Name = "tata" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/auth-detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/auth-detail-20060328 modcall[authorize]: module "auth_log" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "tata", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 4 radius_xlat: 'tata' rlm_sql (sql): sql_set_user escaped user --> 'tata' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'tata' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'tata' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'tata' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'tata' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tata' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 auth: type Local auth: user supplied User-Password matches local User-Password Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 4 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.0.1/reply-detail-20060328' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.1/reply-detail-20060328 modcall[post-auth]: module "reply_log" returns ok for request 4 rlm_sql (sql): Processing sql_postauth radius_xlat: 'tata' rlm_sql (sql): sql_set_user escaped user --> 'tata' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW())' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: INSERT into radpostauth (id, user, pass, reply, date) values ('', 'tata', 'tata', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 0 modcall[post-auth]: module "sql" returns ok for request 4 rlm_sql_log (sql_log): Processing sql_log_postauth radius_xlat: 'INSERT INTO radpostauth ?? (user, pass, reply, date) VALUES ?? ('tata', 'tata', ?? 'Access-Accept', '2006-03-28 03:22:25');' radius_xlat: '/usr/local/var/log/radius/radacct/sql-relay' modcall[post-auth]: module "sql_log" returns ok for request 4 modcall: leaving group post-auth (returns ok) for request 4 Sending Access-Accept of id 215 to 192.168.0.1 port 32768 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 215 with timestamp 44288fd1 Nothing to do. Sleeping until we see a request. Regards, Vincent

1 1

rlm_eap_tls sometimes fails to read files after HUP
by Ben Thompson 27 Mar '06

27 Mar '06

Hi I have just upgraded to FreeRADIUS 1.1.1 after previously using the 1.0.1 RedHat package. At first startup it works fine but sometimes when the server receives a HUP signal (we do this every 15 mins) to re-read the config files I am getting the following errors :- Wed Mar 22 16:48:45 2006 : Info: Reloading configuration files. Wed Mar 22 16:48:47 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Mar 22 16:48:47 2006 : Error: rlm_eap_tls: Error reading certificate file Wed Mar 22 16:48:47 2006 : Error: rlm_eap: Failed to initialize type tls Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[9]: eap: Module instantiation failed. Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[1719] Unknown module "eap". Wed Mar 22 16:48:47 2006 : Error: radiusd.conf[1666] Failed to parse authenticate section. At this point I have to restart. As I said this only happens sometimes, at other times it is successful and I just get this :- Wed Mar 22 16:47:36 2006 : Info: Reloading configuration files. Wed Mar 22 16:47:36 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Mar 22 16:47:37 2006 : Info: Ready to process requests. Could someone advise how to go about debugging this problem? Thanks Ben Thompson

3 5