April 2006 - Freeradius-Users - lists.freeradius.org

Fecora Core 5 & FR 1.1.1 & MySQL 5 -> segmention fault
by Olaf Schaefer 18 Apr '06

18 Apr '06

Hallo, First, I hope you all had Hapy Easter. :) Today I tried to setup the first of my 2 production radius servers. On my testing machines Fedora Core 4 was running (MySQL 4.1.16-log,FR 1.1.1, 2.6.11-1.1369_FC4). Now I've got FC5 with MySQL 5.0.18, FR 1.1.1, and 2.6.16-1.2080_FC5) I did the same I did with the testing machines before, installing Fedora, setting up MySQL-DB , building FR1.1.1. Then I copied my configuration files, did the necessary changes in the configuration files and finally tried to start radiusd. All I got was "Speicherzugriffsfehler" (segmentation fault) :( sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01 23456789.-_: /" Speicherzugriffsfehler ^ This are the last lines if I try to start radiusd (radiusd -X). I've never seen this before. I doesn't matter if I use my or the original (after build) configuration. As soon as I want to use SQL it crashes. Thus I figured out that it must be something concerning MySQL because it's besides the kernel the biggest change compared to my testing machines. If I switch off all sql modules I can start radiusd without any problems. The strange thing is that I haven't any problems accessing my mysql-database with Dialup Admin. Before I (have to) fall back to MySQL 4.1 or even FC4... Any ideas? Thanks in advance! Olaf -- Olaf Schaefer <olaf_freeradius(a)ojsch.de>

1 1

Advice on using FreeRadius client
by Chandra mohan 18 Apr '06

18 Apr '06

Hi, I am planning to use FreeRadius client in our commercial embedded product. The server can be from any vendor. It will be helpful, if any one can provide the statistics on stability, leak issues etc. Please advise me whether it is a wise decision to use FreeRadius client for this purpose. Thanks Chandra __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Problem with Cisco-AVPair
by Antonio Matera 18 Apr '06

18 Apr '06

Hi all, I have a problem with the user authentication with EAP TLS or PEAP on different SSID and VLAN. My objective is to authenticate one user only on a select SSID. At the moment I have this user with EAP-TLS, but if I use PEAP and I insert a user password, the problem is the same: TEST4 Auth-Type := EAP, Cisco-AVPair := "ssid=SSID1" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN user2 Auth-Type := EAP, Cisco-AVPair := "ssid=VLAN3" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN and the log is the following: rad_recv: Access-Request packet from host 192.168.9.104:1645, id=19, length=166 User-Name = "TEST4" Framed-MTU = 1400 Called-Station-Id = "0012.dacb.8420" Calling-Station-Id = "000c.f135.f1ba" Cisco-AVPair = "ssid=VLAN3" Service-Type = Login-User Message-Authenticator = 0xb2a3f1fd52d9d6ff9702cc8f1f480f46 EAP-Message = 0x020600060d00 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "260" NAS-Port = 260 State = 0x0491685cf8ece3184d685dedfedbb3d4 NAS-IP-Address = 192.168.9.104 NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 18 modcall[authorize]: module "preprocess" returns ok for request 18 modcall[authorize]: module "mschap" returns noop for request 18 rlm_realm: No '@' in User-Name = "TEST4", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 18 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 18 users: Matched entry TEST4 at line 11 modcall[authorize]: module "files" returns ok for request 18 modcall: leaving group authorize (returns updated) for request 18 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 18 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 18 modcall: leaving group authenticate (returns ok) for request 18 Login OK: [TEST4/<no User-Password attribute>] (from client ap-test port 260 cli 000c.f135.f1ba) Sending Access-Accept of id 19 to 192.168.9.104 port 1645 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "2" Tunnel-Type:0 = VLAN MS-MPPE-Recv-Key = 0x9cb007ac1a5c0cc6da1deaf25177ef52e7f8c195d876f95b2d18ac6106b497da MS-MPPE-Send-Key = 0x5cbd4de84c364538ec07001adad683cbbf80a349d0299d4790f4f16389aff161 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "TEST4" Finished request 18 The user TEST4 is authenticated with the bad SSID. the check Cisco-AVPair := "ssid=SSID1" does't work. What is wrong? I read a lot of mail on this mailing list, I tried the option with_cisco_hack = yes in the radiusd.conf file but but the problem is always the same. I don't understand what is the problem... Can someone help me? Thanks a lot to all Bye Antonio

7 14

ippool seems to be consistent about the IP addresses that it's giving out
by Nikos Vassiliadis 18 Apr '06

18 Apr '06

Hi all, I am using ippool and it seems that it is using the same IP addresses all the time(given that they are available). So when I am testing with just one client, I get two alternating addresses. Am I missing something or this is the wanted behaviour? ippool related information: Module: Loaded IPPOOL ippool: session-db = "/usr/local/etc/raddb/db.ippool" ippool: ip-index = "/usr/local/etc/raddb/db.ipindex" ippool: range-start = 213.142.157.1 IP address [213.142.157.1] ippool: range-stop = 213.142.157.254 IP address [213.142.157.254] ippool: netmask = 255.255.255.255 IP address [255.255.255.255] ippool: cache-size = 254 ippool: override = no ippool: maximum-timeout = 0 Module: Instantiated ippool (main_pool) radlast: nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:39 still logged in nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:38 - 16:38 (00:00) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:37 - 16:38 (00:00) nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:37 - 16:37 (00:00) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:37 - 16:37 (00:00) nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:37 - 16:37 (00:00) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:36 - 16:36 (00:00) nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:10 - 16:35 (00:25) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 16:09 - 16:10 (00:00) nikos.2048 000:mpd 213.142.157.151 Mon Apr 17 16:03 - 16:09 (00:05) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 15:54 - 16:00 (00:06) nikos.2048 000:mpd 213.142.157.160 Mon Apr 17 15:53 - 15:54 (00:01) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 15:52 - 15:53 (00:00) nikos.2048 000:mpd 213.142.157.160 Mon Apr 17 15:41 - 15:52 (00:11) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 14:50 - 15:40 (00:50) nikos.2048 000:mpd 213.142.157.160 Mon Apr 17 14:50 - 14:50 (00:00) nikos.2048 000:mpd 213.142.157.182 Mon Apr 17 14:47 - 14:50 (00:02) nikos.2048 000:mpd 213.142.157.160 Mon Apr 17 14:41 - 14:47 (00:06) BTW I am using FreeRADIUS 1.1.0 Thanks in advance, Nikos

2 2

Re: Re:Send information to the Radius Client
by Carlos Peñafiel 17 Apr '06

17 Apr '06

Hello again >why don't you use ldap for that?for the info. Because I really have to add only one more attribute. My client is a hostAp (working like a router), so the "new attribute" should be "amount of broadband" (I am trying to use QoS), and for only one attribute, I think (maybe I am wrong) that a LDAP is too much for my purpose. > Will the client understand those attributes, and do something with >them? If the client doesn't already say "send phone number in >attribute X", you'll have to modify it's source code to add that >feature. > Not yet. I was thinking about at the same time when the client receives the confirmation (the authentication), the RADIUS could send my-other-new-attribute ("amount of QoS"), because I guess I only need this attribute. > > I am not sure if I have to create a module (I do not know if it is > > necessary). But I do not know what files I must change. Can you help > > me? can you give an idea? > > The server contains documentation on how to configure it, and how to >send any attribute with any value to a client. Do you have a more >specific question? > Where can I get that information? I have been looking for it on the Internet and I did not find this information. Also, I was looking the man pages and I was thinking in the attributes in the dicctionary, but it said that the radius server never sends it to the client, so I declined that way. I will get any information or any idea which you all want to contribute. Thank you again.

1 0

Fwd: LDAP+EAP
by João Mamede 17 Apr '06

17 Apr '06

I have seen the output of radiusd -X -A It's in http://nebioq.ath.cx:85/radiuslog.txt I've made some other tries I don't if I'm closer or far away from goal. Run the server in debugging mode and read the output. ALL of it. Alan DeKok. ---------- Mensagem Reencaminhada ---------- Subject: LDAP+EAP Date: Segunda, 17 de Abril de 2006 20:54 From: João Mamede <foreveruni(a)clix.pt> To: freeradius-users(a)lists.freeradius.org Well noone gave me a hint about my config...so can someone send me your raddb dir(withouth the secrets and certs of course) of a freeradius+ldap+EAP to authenticate in an access point?I've read all the man's howto's everything I still can't understand why EAP is failing(radtest works ok for my ldap users) Best Regards João Mamede -------------------------------------------------------

2 1

LDAP+EAP
by João Mamede 17 Apr '06

17 Apr '06

Well noone gave me a hint about my config...so can someone send me your raddb dir(withouth the secrets and certs of course) of a freeradius+ldap+EAP to authenticate in an access point?I've read all the man's howto's everything I still can't understand why EAP is failing(radtest works ok for my ldap users) Best Regards João Mamede

2 1

non-number value in Acct-*-Octets
by magmike＠mail.ru 17 Apr '06

17 Apr '06

Hello, today my radius reveived very strange packet from pppd. Acct-Output-Octets was not number! accounting-Stop packet looks like follow: Wed Apr 12 04:27:39 2006 Acct-Session-Id = "443B9E03290F" User-Name = "user_name" Acct-Status-Type = Stop Service-Type = Framed-User Framed-Protocol = PPP Acct-Authentic = RADIUS Connect-Info = "10511" Acct-Session-Time = 36700 Acct-Output-Octets = Route-Appletalk-No Acct-Input-Octets = 42725588 Acct-Output-Packets = 539724 Acct-Input-Packets = 607374 Calling-Station-Id = "192.168.1.33" NAS-Port-Type = Async Framed-IP-Address = 10.0.0.9 NAS-IP-Address = 192.168.0.41 NAS-Port = 292 Acct-Delay-Time = 0 Client-IP-Address = 192.168.0.71 Timestamp = 1144794459 All previous "Interim-Update" packets for this sessions was right except last and "Stop" packets: Wed Apr 12 04:19:32 2006 Acct-Status-Type = Interim-Update Acct-Output-Octets = 74708441 Wed Apr 12 04:23:32 2006 Acct-Status-Type = Interim-Update Acct-Output-Octets = 74745120 Wed Apr 12 04:27:32 2006 Acct-Status-Type = Interim-Update Acct-Output-Octets = Route-Appletalk-No Wed Apr 12 04:27:39 2006 Acct-Status-Type = Stop Acct-Output-Octets = Route-Appletalk-No where are problem?

2 3

Accounting Module does not recognize shared secret
by Alex M 17 Apr '06

17 Apr '06

Hi I just found out that im getting error in accounting module. It say that shared secret is incorrect, but it was working fine for more then a week. Also im using DNS name in the NAS Name filed instead of ip address. Why am I getting this error? Here is the error message? rad_recv: Accounting-Request packet from host 192.168.0.10:61296, id=39, length=143 Received Accounting-Request packet from 192.168.0.10 with invalid signature! (Shared secret is incorrect.)

2 1

Send information to the Radius Client
by Carlos Peñafiel 17 Apr '06

17 Apr '06

Hello, I want to be able to send information (such a name, address, phone number ...) from the Radius Server to the Radius Client( I want to do that to a Host AP) after the Radius client has been authenticated. I am not sure if I have to create a module (I do not know if it is necessary). But I do not know what files I must change. Can you help me? can you give an idea? I am using freeradius-1.1.1 and the client is Hostap-0.4.8. Thank you a lot in advance.

2 1