June 2006 - Freeradius-Users - lists.freeradius.org

Openvpn server and Freeradius client
by hal 16 Jun '06

16 Jun '06

running: Redhat Enterprise Linux version 4 Openvpn 2.0.7 (server) freeradius pam_radius-1.3.16 (client) Using the above the Openvpn server will authenticate an Openvpn client using a radius server on a remote machine. The above ONLY works when the username supplied by the Openvpn client is found in the passwd file on the Openvpn server. Yes it does use the radius server to authenticate. As you can imagine this is not the behavior I want. I have no clue where the problem(s) is/are?! Is it redhat, Openvpn, Freeradius or a combination of the three? Does anyone have a clue, hint, or idea what the problem might be? Can anyone point me in the right direction? hal

2 2

mysql accounting
by Sean Taylor 16 Jun '06

16 Jun '06

I have a quick question on the mysql accounting. I am working on my own interface for managing the freeradius+mysql setup. Everything is working great, I can view all my users, see who's connected, add new users, manage static vs. dynamic IP's, etc..The problem is it doesnt seem to log authentication failures into the radacct table. It logs all the successes just fine, but it would be very beneficial to have it log the failures too. I have the sql module turned on in the accounting section of the config and have uncommented all of the accounting queries. Any help appreciated. Thanks Sean Taylor Systems Administrator Valutel Communications

3 4

rlm_detail bug when "locking = yes"
by Michael Chernyakhovsky 16 Jun '06

16 Jun '06

hello, everybody. my radius use a rlm_perl module, wich open and write some informations to files. also it use rlm_detail but without locking. 2 days ago i add second rlm_detail to config with option "locking = yes". since i got 2 files with corrupted datas which accessed by rlm_perl. i think bug is in rlm_detail.c. there is no close() after successful open and failed filelock! 198: /* 199: * Open & create the file, with the given permissions. 200: */ 201: if ((outfd = open(buffer, O_WRONLY | O_APPEND | O_CREAT, 202: inst->detailperm)) < 0) { 203: radlog(L_ERR, "rlm_detail: Couldn't open file %s: %s", 204: buffer, strerror(errno)); 205: return RLM_MODULE_FAIL; 206: } ... 233: if (!locked && inst->locking && lock_count >= 80) { 234: radlog(L_ERR, "rlm_detail: Failed to aquire filelock for %s, givingup", 235: buffer); 236: return RLM_MODULE_FAIL; 237: } we need close outfd right before "return RLM_MODULE_FAIL;" at line 236. Mike.

2 1

Re: \000 in "octets" attribute?
by Erik Bolsø 16 Jun '06

16 Jun '06

On 2006-06-15 07:50, Stefan Winter <stefan.winter(a)restena.lu> wrote: > Hi, > > I'm having a curious problem with a vendor-specific single-byte > > "octets"-attribute and attr_rewrite. > > > > Essentially, I'm trying to rewrite an ascii "0" to a single-byte > > 0x00 > > value. But after this rewrite rule, a zero-byte value is returned > > instead. Any way to get around this? > > > > With \001, \002, etc, all's well. > > > > (incidentally, this is freeradius version 1.0.1 in RHEL4) > > the RADIUS RFC forbids attributes with a terminating \000. The server > knows > that, and will shorten the octet attribute by cutting off the \000 - > leaving > an empty string behind. If your NAS really requires a trailing \000: > fix the > NAS. It is not RFC-compliant then. Essentially, the vendor-specific attribute value is a 1-byte unsigned integer, not a string. Haven't done a live test yet, so I do not know how it handles the empty value. Perhaps all goes well. I'll let you know. My rfc-reading seems to contradict you a little bit, though? RFC2869 section 5: Note that none of the types in RADIUS terminate with a NUL (hex 00). In particular, types "text" and "string" in RADIUS do not terminate with a NUL (hex 00). The Attribute has a length field and does not use a terminator. Text contains UTF-8 encoded 10646 [8] characters and String contains 8-bit binary data. Servers and servers and clients MUST be able to deal with embedded nulls. RADIUS implementers using C are cautioned not to use strcpy() when handling strings. -- Erik Bolsø Linpro AS

4 19

FreeRADIUS + LDAP Authentication/Authorization + MySQL Accounting
by Dan Brummer 15 Jun '06

15 Jun '06

Hello, I have been researching the use of FreeRADIUS on my network for the past few days. I'm not sure if FreeRADIUS can do what I want. Here is a list of my requirements: -Authentication through LDAP -Authorization through LDAP -Accounting through MySQL I have multiple Cisco and Foundry devices on my network. The RADIUS server will primarily be used for AAA for Telnet/SSH logins and eventually VPN dialin accounts. Is FreeRADIUS the software I should use? Thank you, Dan

2 1

Bug with multiple IPs?
by Matt 15 Jun '06

15 Jun '06

I have freeradius running on a machine with 2 IPs. I have it binding to all available IPs. xxx.xxx.xxx.44 is the main IP of the machine xxx.xxx.xxx.26 is the secondary IP. (eth0:1) When a request comes in on .26 freeradius processes it and THEN sends the reply out .44! Is this the way it is suppose to be acting?

3 3

Problems Using Digest-HA1 with MySQL storage backend
by Tavis P 15 Jun '06

15 Jun '06

I just installed Freeradius 1.1.2 to see how the Digest-HA1 modifications work and i was unable get it to work when using a sql/mysql storage backend. Manually defining the user/attribute in the "users" file works I had a look at the wiki on the freeradius site however it doesn't mention anything regarding a SQL backend, am i missing somthing? Output from radiusd -X: rad_recv: Access-Request packet from host 127.0.0.1:32923, id=186, length=258 User-Name = "200110005339(a)hq.galnet.ca" Digest-Attributes = 0x0a0e323030313130303035333339 Digest-Attributes = 0x010e68712e67616c6e65742e6361 Digest-Attributes = 0x022a34343930393537353134653736633735626235613463353361636163373161393264323365623339 Digest-Attributes = 0x04177369703a737062332e68712e67616c6e65742e6361 Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x050661757468 Digest-Attributes = 0x090a3030303030303031 Digest-Attributes = 0x080a3764626539636533 Digest-Response = "054d7dc7b2d6d969bcd60c5000d1bf3c" Service-Type = IAPP-Register Sip-Uri-User = "200110005339" NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 37 modcall[authorize]: module "preprocess" returns ok for request 37 rlm_realm: Looking up realm "hq.galnet.ca" for User-Name = "200110005339(a)hq.galnet.ca" rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "200110005339" rlm_realm: Proxying request from user 200110005339 to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DEFAULT" returns noop for request 37 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 37 radius_xlat: '200110005339' rlm_sql (sql): sql_set_user escaped user --> '200110005339' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radius_check WHERE Username = '200110005339' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: '' radius_xlat: 'SELECT id,UserName,Attribute,CONCAT(IFNULL(SubAttribute,''), IFNULL(Value, '')) AS Value,op FROM radius_reply WHERE Username = '200110005339' ORDER BY id' radius_xlat: '' rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): No matching entry in the database for request from user [200110005339] modcall[authorize]: module "sql" returns notfound for request 37 users: Matched entry DEFAULT at line 11 modcall[authorize]: module "files" returns ok for request 37 modcall: leaving group authorize (returns ok) for request 37 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 37 rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 37 modcall: leaving group authenticate (returns invalid) for request 37 auth: Failed to validate the user. Sending Access-Reject of id 186 to 127.0.0.1 port 32923 Finished request 37 MySQL output when manually executing the queries defined above: mysql> SELECT id,UserName,Attribute,Value,op FROM radius_check WHERE Username = '200110005339' ORDER BY id; +----+--------------+--------------+----------------------------------+----+ | id | UserName | Attribute | Value | op | +----+--------------+--------------+----------------------------------+----+ | 17 | 200110005339 | Digest-HA1 | e5282fc6665a69aed77b7d0a42d8f544 | = | +----+--------------+--------------+----------------------------------+----+ 1 row in set (0.00 sec) mysql> SELECT id,UserName,Attribute,CONCAT(IFNULL(SubAttribute,''), IFNULL(Value, '')) AS Value,op FROM radius_reply WHERE Username = '200110005339' ORDER BY id -> ; +----+--------------+-----------+------------+----+ | id | UserName | Attribute | Value | op | +----+--------------+-----------+------------+----+ | 24 | 200110005339 | SIP-AVP | is_local#1 | += | +----+--------------+-----------+------------+----+ 1 row in set (0.00 sec) Database Schemas(MySQL 5.0.22): CREATE TABLE `radius_check` ( `id` int(11) unsigned NOT NULL auto_increment, `UserName` varchar(64) NOT NULL default '', `Attribute` varchar(32) NOT NULL default '', `op` char(2) NOT NULL default '==', `Value` varchar(253) NOT NULL default '', PRIMARY KEY (`id`), KEY `UserName` (`UserName`(32)) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 CREATE TABLE `radius_reply` ( `id` int(11) unsigned NOT NULL auto_increment, `UserName` varchar(64) NOT NULL default '', `Attribute` varchar(32) NOT NULL default '', `SubAttribute` varchar(64) default NULL, `op` char(2) NOT NULL default '=', `Value` varchar(253) NOT NULL default '', PRIMARY KEY (`id`), KEY `UserName` USING BTREE (`UserName`(32),`SubAttribute`(32)) ) ENGINE=MyISAM DEFAULT CHARSET=latin1

3 3

rlm_perl forking zombies
by david.suarezdelis＠telefonica.es 15 Jun '06

15 Jun '06

Greetings, I have FreeRadius 1.1.0 working on Debian 3.1 on an Intel box. When using rlm_perl, the authenticate() sub does its job and, eventually, calls a method to send an email to a certain address before returning OK. The problem is that this SMTP connection can take longer than wished, therefore I am forking the SMTP call, so the authentication process can go on as normal. The problem with this solution, though, is that--as I cannot wait for the SMTP connection to be done--the process is left as a zombie. I have, therefore, used a double forking solution, where the grandfather returns inmediately to the authorize() function, and the child forks again, and waits (waitpid()) for the new (grand)child to do the job, so no zombie is created. By itself, this works and no zombies are left behind, as expected. However, when used with FreeRadius, zombies are left behind. I have tried to 'IGNORE' SIGCHLD, to use reaper function (and all the other tricks in perlipc(1)) to no avail (I am even using Proc::Fork to simplify things so I am sure I am doing things properly). Is this a problem with my calling this inside the authenticate() function, or with rlm_perl, or...? Is this a problem with 1.1.0 and solved with a later version? Any help appreciated. thanks a lot! david PS- Perl is version 5.8.4 compiled with threads and ithreads PPS- has the RLM_PERL module documentation's been improved in more recent versions, by any chance? ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

3 2

ntdomain_hack
by wekz 15 Jun '06

15 Jun '06

Hello everyone, I've configured a freeradius 1.1.1 + LDAP for eap-tls authentication with domains. authorize { preprocess ntdomain ... } realm host { type = radius authhost = LOCAL accthost = LOCAL strip } This configuration gives an error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. When I enable with_ntdomain_hack in eap.conf it works quite well. Could anyone tell me why it's neccesary? The problem is that this secondary_radius do proxy when it doesn't find the user in its LDAP and the master_radius gives this error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. I've tried in master_radius the same configuration with and without ntdomain_hack and it fails. I've been thinking of adding the realm before the secondary do proxy, so the master could treat the request as it's been local. But I don't like this too much. Does anyone have a better idea of what to do? Thanks.

4 4

Re: Freeradius 1.1.1: 'sqlippools' concurrency problems
by Robles Rodriguez,Alejandro 15 Jun '06

15 Jun '06

"Alan DeKok" <aland(a)nitros9.org> wrote: > A simple solution would be to go to the bottom of rlm_sqlippool.c, >and change it from RLM_TYPE_THREAD_SAFE to RLM_TYPE_THREAD_UNSAFE. >Then re-compile & re-install. That would be the case if I only had one single radiusd running, however as already mentioned this solution encompasses a number of radius servers each with its own mysql server adn the same storage (NDB cluster) behind the scenes i.e. virtually sharing data storage. By implementing the suggestion (which by the way didn't know it was possible so thanks for the tip) I would only solve it for one radius server (at the expense of a lower performance) but not wen several radius servers are at play.

2 1