August 2006 - Freeradius-Users - lists.freeradius.org

Second reload Error with module rlm_eap
by Thomas BAUDELET 16 Aug '06

16 Aug '06

When I reload my configuration files with "rc.radiusd reload", the first reload is ok, but the second one fails with an SSL error. First Reload: Wed Aug 16 11:59:59 2006 : Info: Reloading configuration files. Wed Aug 16 11:59:59 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Aug 16 11:59:59 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Aug 16 11:59:59 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Aug 16 11:59:59 2006 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Aug 16 11:59:59 2006 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Wed Aug 16 11:59:59 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed Aug 16 11:59:59 2006 : Info: Ready to process requests. Second Reload: Wed Aug 16 12:00:07 2006 : Info: Reloading configuration files. Wed Aug 16 12:00:07 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Aug 16 12:00:07 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Aug 16 12:00:07 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Wed Aug 16 12:00:07 2006 : Error: rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line Wed Aug 16 12:00:07 2006 : Error: rlm_eap_tls: Error reading certificate file Wed Aug 16 12:00:07 2006 : Error: rlm_eap: Failed to initialize type tls Wed Aug 16 12:00:07 2006 : Error: radiusd.conf[10]: eap: Module instantiation failed. Wed Aug 16 12:00:07 2006 : Error: radiusd.conf[1920] Unknown module "eap". Wed Aug 16 12:00:07 2006 : Error: radiusd.conf[1867] Failed to parse authenticate section. Does anyone has an idea ? ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. **********************************************************************

1 0

Expiration account
by Ludovic Toussaint 16 Aug '06

16 Aug '06

Hi, I got Freeradius working with Chillispot and Mysql. I would like to create account with expiration attribute. For example, I would like to create account with a validity of 24 hours after the first connection. And i would like do to the same with validity of à week. I tryed to done it with PhpMyprepaid, but the way to do it is not clear for me. If someone can explain me how to handle this problem. I know that i have to activate "POSTAUTH" in Radius.conf and to insert a query in Mysql.conf. Thanks in advance

1 0

RE: access reject replies
by Hasan Ovuc 16 Aug '06

16 Aug '06

Dear Alan, I added below line after line 458 in src/main/util.c and everything is OK. pairmove2(&vps, &(packet->vps), PW_VENDOR_SPECIFIC); Thank you... Hasan Ovuc & Levent Kurt Superonline.net >-----Original Message----- >From: freeradius-users-bounces+hasan.ovuc=superonline.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+hasan.ovuc=superonline.net@lists.freera dius.org] On Behalf Of Alan DeKok >Sent: Tuesday, August 15, 2006 5:47 PM >To: FreeRadius users mailing list >Subject: Re: access reject replies > >"Hasan Ovuc" <hasan.ovuc(a)superonline.net> wrote: >> I am using FR-1.0.1, unixODBC 2.2.11, Sybase ODBC-12_5 drivers on FC5. >>I have problem version of FR because of I couldn't upgrade it. New >> versions of FR does not send cisco attributes in access reject replies. > > See src/main/util.c, function rfc_clean(). You will have to edit & recompile. > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

1 0

RE: access reject replies
by Hasan Ovuc 16 Aug '06

16 Aug '06

>-----Original Message----- >From: freeradius-users-bounces+hasan.ovuc=superonline.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+hasan.ovuc=superonline.net@lists.freera dius.org] On Behalf Of Alan DeKok >Sent: Tuesday, August 15, 2006 5:47 PM >To: FreeRadius users mailing list >Subject: Re: access reject replies >"Hasan Ovuc" <hasan.ovuc(a)superonline.net> wrote: >> I am using FR-1.0.1, unixODBC 2.2.11, Sybase ODBC-12_5 drivers on FC5. >>I have problem version of FR because of I couldn't upgrade it. New >> versions of FR does not send cisco attributes in access reject replies. See src/main/util.c, function rfc_clean(). You will have to edit & recompile. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

1 0

pair_cmp overwrites user file instance data [sec: unclas]
by Ranner, Frank MR 16 Aug '06

16 Aug '06

Hello, In my users file I have rules that link ldap groups to hunt groups, possibly with suffixes. They look something like this: DEFAULT Ldap-Group == `%{Huntgroup-Name}` Access-Level := RW, Service-Type = Administrative-User, Cisco-AVPair := "shell:priv-lvl=15", Passport-Command-Impact = configuration # Check passport access groups DEFAULT Ldap-Group == `%{Huntgroup-Name}_configuration` Passport-Command-Impact = configuration DEFAULT Ldap-Group == `%{Huntgroup-Name}_systemadmin` Passport-Command-Impact = systemAdministration DEFAULT Ldap-Group == `%{Huntgroup-Name}_passive` Passport-Command-Impact = passive # These checks cover Nortel switches, et al. DEFAULT Ldap-Group == `%{Huntgroup-Name}_RWA` Service-Type = Administrative-User, Access-Level := RWA DEFAULT Ldap-Group == `%{Huntgroup-Name}_RO` Access-Level := RO, Service-Type = Nas-Prompt-User On the first request that comes in, the system worked fine. In the radiusd output you would see and ldap group search for, say, QLD_South, then QLD_South_configuration, etc. Eventually one would match (or all would fail) and the request would complete. Now a second request for a different huntgroup would come in, but the ldap search would stil be for QLD_South and so on. After tracing through with gdb I discovered that pair_cmp when xlating the config item was actually overwriting the source data with the xlat result. I didn't want to fiddle with pair_cmp so i looked at rlm_files with the intention of supplying pair_cmp with a copy of the user record rather than the original. It turns out that pl->check was already being copied, so all that needed to be done was make the copy earlier, and supply check_tmp rather than pl->check to pair_cmp. Long story short, this fixes the problem. here is the patch: *** src/modules/rlm_files/rlm_files.c~ Thu Oct 21 03:14:38 2004 --- src/modules/rlm_files/rlm_files.c Tue Aug 15 12:48:22 2006 *************** *** 313,324 **** continue; } /* * If the current request matches against the * check pairs, then add the reply pairs from the * entry to the current list of reply pairs. */ ! if ((paircmp(request, request_pairs, pl->check, reply_pairs) == 0)) { if ((mainconfig.do_usercollide) && (strcmp(pl->name, "DEFAULT"))) { --- 313,327 ---- continue; } + /* Don't let paircmp overwrite original record when expanding variables */ + check_tmp = paircopy(pl->check); + /* * If the current request matches against the * check pairs, then add the reply pairs from the * entry to the current list of reply pairs. */ ! if ((paircmp(request, request_pairs, check_tmp, reply_pairs) == 0)) { if ((mainconfig.do_usercollide) && (strcmp(pl->name, "DEFAULT"))) { *************** *** 331,337 **** check_save = paircopy(request->config_items); /* Copy this users check pairs to the request */ - check_tmp = paircopy(pl->check); pairmove(check_pairs, &check_tmp); pairfree(&check_tmp); --- 334,339 ---- *************** *** 367,373 **** DEBUG2(" users: Matched entry %s at line %d", pl->name, pl->lineno); found = 1; - check_tmp = paircopy(pl->check); reply_tmp = paircopy(pl->reply); pairxlatmove(request, reply_pairs, &reply_tmp); pairmove(check_pairs, &check_tmp); --- 369,374 ---- *************** *** 379,384 **** --- 380,387 ---- */ if (!fallthrough(pl->reply)) break; + } else { + pairfree(&check_tmp); } }

1 0

rlm_proxy problems
by Geoff Silver 15 Aug '06

15 Aug '06

I'm running FreeRadius 1.1.0 on Red Hat Linux, and appear to be running into an issue where heavy load causes rlm_proxy to stop responding. If I restart radiusd, authentication will be properly proxied for 15-30 seconds, at which point I see incoming Access-Request messages logged, but I don't see any Access-Request messages being send to the backend server, and I don't see any Access-Accept or Access-Reject messages (or I see a few Access-Reject messages which appear to come from my proxy server, as there is no Reply-Message attribute set in them). One of the most difficult problems I'm seeing is that while this is happening in production, it's NOT happening when I run radclient a half dozen times in parallel against radiusd, so it's *very* difficult to re-create outside of production. Restarting radiusd solves the problem for 15-30 seconds. Pointing lightly-loaded NASes at radiusd works fine - it's only the NASes which have hundreds of simultaneous logins that auth frequently enough to cause this issue. My proxy.conf looks like: proxy server { synchronous = no retry_delay = 5 retry_count = 1 dead_time = 300 default_fallback = yes post_proxy_authorize = yes } realm BackendAuth { type = radius authhost = radius.vip.domain.com:1812 secret = ThisIsNotMyRealSecret } I've attached some logs for review. What I see is a valid auth at 14:39:59-14:40:01, but then a failing one at 14:40:08. Note that the SI_radius_keepalive packets are from our VIPs which are doing health checks, so they are expected to fail, but any other usernames should work. Aug 15 14:39:59 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "junyi2000", User-Password = (hidden), NAS-Port = 26300, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "66.218.46.114", Tunnel-Client-Endpoint:0 = "66.218.46.114", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "HasSlash", Huntgroup-Name = "Office", Aug 15 14:40:01 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "junyi2000", User-Password = (hidden), NAS-Port = 26300, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "66.218.46.114", Tunnel-Client-Endpoint:0 = "66.218.46.114", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "HasSlash", Huntgroup-Name = "Office", Realm = "UAS", Client-IP-Address = 10.180.203.7, Aug 15 14:40:01 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Accept, User-Name = "junyi2000", Class = 0x6c49755a5754477631786d45474d736c4d376b78475068396b43673d, Account-Flags = 553680896, Connect-Info = "AOLOFFICE", User-Name = junyi2000, Client-IP-Address = 10.180.203.7, NAS-IP-Address = 10.180.203.7, NAS-Port = 26300, Aug 15 14:40:07 205.188.188.212 radiusd-auth[6509]: Packet-Type = Access-Request, User-Name = "SI_radius_keepalive", User-Password = (hidden), Service-Type = Dialout-Framed-User, NAS-IP-Address = 205.188.188.250, Client-IP-Address = 205.188.188.250, Hint = "Port-1812", Aug 15 14:40:07 205.188.188.212 radiusd-auth[6509]: Packet-Type = Access-Reject, User-Name = SI_radius_keepalive, Client-IP-Address = 205.188.188.250, NAS-IP-Address = 205.188.188.250, NAS-Port = , Aug 15 14:40:08 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "nsitton", User-Password = (hidden), NAS-Port = 26302, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "69.228.216.95", Tunnel-Client-Endpoint:0 = "69.228.216.95", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "Port-1645", Huntgroup-Name = "Office", Aug 15 14:40:08 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Reject, User-Name = nsitton, Client-IP-Address = 10.180.203.7, NAS-IP-Address = 10.180.203.7, NAS-Port = 26302, Aug 15 14:40:08 152.163.209.142 radiusd-auth[23725]: Packet-Type = Access-Request, User-Name = "SI_radius_keepalive", User-Password = (hidden), NAS-IP-Address = 152.163.209.154, Client-IP-Address = 152.163.209.154, Hint = "Port-1812", Aug 15 14:40:08 152.163.209.142 radiusd-auth[23725]: Packet-Type = Access-Reject, User-Name = SI_radius_keepalive, Client-IP-Address = 152.163.209.154, NAS-IP-Address = 152.163.209.154, NAS-Port = , Aug 15 14:40:09 64.12.153.209 radiusd-auth[4826]: Packet-Type = Access-Request, User-Name = "SI_radius_keepalive", User-Password = (hidden), NAS-IP-Address = 64.12.153.218, Client-IP-Address = 64.12.153.218, Hint = "Port-1812", Aug 15 14:40:09 64.12.153.209 radiusd-auth[4826]: Packet-Type = Access-Reject, User-Name = SI_radius_keepalive, Client-IP-Address = 64.12.153.218, NAS-IP-Address = 64.12.153.218, NAS-Port = , Aug 15 14:40:16 64.12.186.46 radiusd-auth[26637]: Packet-Type = Access-Request, User-Name = "SI_radius_keepalive", User-Password = (hidden), NAS-IP-Address = 64.12.186.58, Client-IP-Address = 64.12.186.58, Hint = "Port-1812", Aug 15 14:40:16 64.12.186.46 radiusd-auth[26637]: Packet-Type = Access-Reject, User-Name = SI_radius_keepalive, Client-IP-Address = 64.12.186.58, NAS-IP-Address = 64.12.186.58, NAS-Port = , Aug 15 14:40:18 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "karenc876", User-Password = (hidden), NAS-Port = 26303, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "65.120.79.33", Tunnel-Client-Endpoint:0 = "65.120.79.33", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "HasSlash", Huntgroup-Name = "Office", Aug 15 14:40:19 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "donaldknight11", User-Password = (hidden), NAS-Port = 26305, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "66.208.64.157", Tunnel-Client-Endpoint:0 = "66.208.64.157", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "HasSlash", Huntgroup-Name = "Office", Aug 15 14:40:22 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "alemoyamx", User-Password = (hidden), NAS-Port = 8537, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.128.7", Calling-Station-Id = "207.248.229.111", Tunnel-Client-Endpoint:0 = "207.248.229.111", NAS-IP-Address = 10.178.197.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.178.197.7, Hint = "HasSlash", Huntgroup-Name = "Office", Aug 15 14:40:23 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Request, User-Name = "swxdan", User-Password = (hidden), NAS-Port = 26306, Service-Type = Framed-User, Framed-Protocol = PPP, Called-Station-Id = "64.236.209.87", Calling-Station-Id = "208.255.178.130", Tunnel-Client-Endpoint:0 = "208.255.178.130", NAS-IP-Address = 10.180.203.7, NAS-Port-Type = Virtual, Client-IP-Address = 10.180.203.7, Hint = "Port-1645", Huntgroup-Name = "Office", Aug 15 14:40:23 205.188.136.151 radiusd-auth[30371]: Packet-Type = Access-Reject, User-Name = swxdan, Client-IP-Address = 10.180.203.7, NAS-IP-Address = 10.180.203.7, NAS-Port = 26306,

2 1

RE: authenticating based on Nas-Port-Id
by Colm Ennis 15 Aug '06

15 Aug '06

hiya, does anyone know if users/sql authentication based on the NAS-Port-Id field possible? and if so how? thanks for your help, colm > -----Original Message----- > From: Colm Ennis > Sent: 26 July 2006 15:00 > To: freeradius-users(a)lists.freeradius.org > Subject: authenticating based on Nas-Port-Id > > > hi, > > i been using freeradius fastuser based authentication for several > thousand adsl customers for the last year or so now and it has > proved extremely reliable. > > in order to simplify customer setup and minimise lost password > support etc id like to start authenticating users based on > NAS-Port-Id rather than User-Name. (the dslams/basen we use > support populating NAS-Port-Id with the dslam/frame/slot/port). > > i am also working on migrating to a mysql authentication backend. > > so, does anyone have any tips on setting up NAS-Port-Id based > authentication with users/fastusers/sql? i hope to permit the > user to use any username/password combination. > > thanks for your help and an excellent radius server, > > colm >

2 1

Limit Number of Authentication Attempt
by fvt3 15 Aug '06

15 Aug '06

Hi, I have clients constantly trying to authenticate off of freeradius after being rejected. How do I set freeradius to deny or timeout a user from authenticating after three attempts? This is authenticating off mysql database . I am not exactly sure if the change is in sql.conf or radiusd.conf. Thanks in advance... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Accounting Update packets
by Michael da Silva Pereira 15 Aug '06

15 Aug '06

Hi, I have a cisco PDSN sending me accouting update packets every 10minutes, This packet is also sent to the servers which I have realms with. I don't want these update accounting packets to be send to the realm server. Is there any way only to allow the start and start accounting packets to the realm servers? Thanks, Michael da Silva Pereira

2 1

Comments problem in huntgroups file
by Thomas BAUDELET 15 Aug '06

15 Aug '06

Hello, I have problems when I comment the file huntgroups like this: (comments on the third column) Switchs NAS-IP-Address == 10.195.132.7 # test Switchs NAS-IP-Address == 10.195.132.8 # testbps2000 Switchs NAS-IP-Address == 10.195.132.9 # test450 I get the following error: /home/radius/freeradius/etc/raddb/huntgroups[47]: Parse error (check) for entry Switchs: dict_init: /home/radius/freeradius/share/freeradius/dictionary.versanet[36]: Names for VALUEs cannot start with a digit. rlm_preprocess: Error reading /home/Rzoadm/radius/freeradius/etc/raddb/huntgroups radiusd.conf[1011]: preprocess: Module instantiation failed. radiusd.conf[1764] Unknown module "preprocess". radiusd.conf[1754] Failed to parse authorize section. There is no error anymore when I add a comma before the commentary like this: Switchs NAS-IP-Address == 10.195.132.7 ,# test Switchs NAS-IP-Address == 10.195.132.8 ,# testbps2000 Switchs NAS-IP-Address == 10.195.132.9 ,# test450 How to add comments at the end of a line ? I don't want to have a file like this: # test Switchs NAS-IP-Address == 10.195.132.7 # testbps2000 Switchs NAS-IP-Address == 10.195.132.8 # test450 Switchs NAS-IP-Address == 10.195.132.9 Thanks a lot for your answers, Thomas ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. **********************************************************************

2 1