October 2007 - Freeradius-Users - lists.freeradius.org

Freeradius logging w/syslog
by ballgyer＠mac.com 17 Oct '07

17 Oct '07

Hi all, I'm running freeradius 1.0.1 on CentOS 4.4 and I'm trying to get the radius to log to a syslog server. I followed the example "Syslog_HOWTO" but its not working. I was hoping that someone else might know the answer / fix. Thanks in Advance,

2 1

EAP+MD5+SQL trouble
by inl2goal 16 Oct '07

16 Oct '07

Hello, I am trying to configure freeradius with EAP/MD5+SQL support. I already followed all the SQL configuration procedures suggested in the SQL HOW TO, and the steps suggested in the EAP/MD5 HOW TO. However, for some reason when I try to authenticate from the NAS i get the following output in the server rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 5 modcall[authorize]: module "eap" returns noop for request 5 modcall: leaving group authorize (returns ok) for request 5 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 13 to w.x.y.z port 21645 Waking up in 4 seconds... It appears that it finds the user in SQL but then it does not do anything in the EAP module. The log from the NAS says *Jun 1 00:04:25: %RADIUS-4-RADIUS_DEAD: RADIUS server a.b.c.d:16214,16215 is not responding. *Jun 1 00:04:37: %RADIUS-3-ALLDEADSERVER: Group radius: No active radius servers found. Id 12. I don't understand why it says it is dead if the server IS receiving the request. What I find weird is that when I do a radtest from the server it seems to find the user and password and sends an access-accept. I guess this would make sense since there is no EAP involved in this case, but still, I do not understand what is wrong in the rest of the configuration, as i have followed all steps in the HOW TOs. If anyone has an idea on what could be the problem i would appreciate the help. Thank you. Oskar -- View this message in context: http://www.nabble.com/EAP%2BMD5%2BSQL-trouble-tf4571786.html#a13049739 Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 25

problem in integeration with poptop
by hadi golestani 16 Oct '07

16 Oct '07

hi, I've installed poptop and freeradius well and both are working, but when I try to connect from a vpn connection or even radtest some error occured. what I need to add to users.conf for a simple radtest connection or a vpn client? it's the output of debug mode for vpn client, some thing like this has been printed for radtest also: rad_recv: Access-Request packet from host 127.0.0.1:32770, id=30, length=132 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "root" MS-CHAP-Challenge = 0x4d1a9b1028ef83957754c83ce0f55e01 MS-CHAP2-Response = 0x9e000d1394f73d58cc731cd6cf58de7cb74f00000000000000008c6daec89825fb28b90bb60b737fb683a4a80f6252935547 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 11 modcall[authorize]: module "preprocess" returns ok for request 11 modcall[authorize]: module "chap" returns noop for request 11 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 11 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 11 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 11 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 11 modcall: leaving group authorize (returns ok) for request 11 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 11 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for root with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 4d radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/path/to/ntlm_auth --request-nt-key --username=root --challenge=f1090a99b916ef69 --nt-response=8c6daec89825fb28b90bb60b737fb683a4a80f6252935547' Exec-Program: /path/to/ntlm_auth --request-nt-key --username=root --challenge=f1090a99b916ef69 --nt-response=8c6daec89825fb28b90bb60b737fb683a4a80f6252935547 Exec-Program output: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute /path/to/ntlm_auth: No such file or directory Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 11 modcall: leaving group MS-CHAP (returns reject) for request 11 auth: Failed to validate the user. Delaying request 11 for 1 seconds Finished request 11 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 30 to 127.0.0.1 port 32770 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 11 ID 30 with timestamp 47152198 Nothing to do. Sleeping until we see a request.

2 3

rlm_passwd pulling file?
by Joe Mom 16 Oct '07

16 Oct '07

looking for some sort of indication that the radius.conf file is working. I've created a section in the radius.conf file under modules as per man rlm_passwd passwd tcovc_group { filename = /home/ftpuser/export.txt format = "*User-Name:LM-Password" delimiter = ":" } but either my hash is not working properly or its not pulling the user:passwords from the file. I checked in the startup.log file after doing a HUP and i dont see any indication that it pulled the data from the file. I also did a reboot of the system to be doubly sure. is there a spot that i can eliminate the possibility of the file not being pulled in or just me :) -- Regards Joe

1 0

encrypted password LDAP and EAP//TTLS
by Sergio Belkin 16 Oct '07

16 Oct '07

Hi, is it possible use in LDAP encrypted passwords and EAP/TTLS? Thanks in advance! -- -- Sergio Belkin -

3 5

802.1x & kerberos
by Lisa Besko 16 Oct '07

16 Oct '07

Is there a way to do 802.1x with Kerberos authentication using Freeradius? If their is can anyone point me in the right direction? We have been trying eap-ttls most recently with very little luck but everything I have read says this should be possible. What are we missing? Thanks, LB

6 11

rlm_perl (threads) performance question
by Apostolos Pantsiopoulos 16 Oct '07

16 Oct '07

I am using the rlm_perl module for accounting purposes. I tried to benchmark the whole process by doing something like this : sub accounting{ start_benchmark(); // acct start code here stop_benchmark(); send_bench_results_using_udp(); } sub stop_accounting{ start_benchmark(); // acct stop code here stop_benchmark(); send_bench_results_using_udp(); } I hope that the routines names I used are self-explanatory. In my config I have 32 servers running, using 32 perl clones. The results I get (after 2-3 k requests) are these : Mean time for acct start : 0.005 secs Mean time for acct stop : 0.01 secs Since there is a 1:1 ratio of start/stop requests I guess that we can say that for each request (regardless of its type) I should get a mean of 0.0075 secs. And this in turn should be giving about 130 req/sec. But I am not getting this kind of performance. I know that there is a handling overhead for each request. I don't know the exact percentage of this overhead but for simplicity's sake lets be pessimistic and consider it to be about 30%. Now the performance should be something like 80 req/sec. But I am not getting this kind of performance either. In fact, as soon as my main radius reaches a number of 50 req/sec my NAS starts sending requests to my backup radius. Correct me if I am wrong : If every perl clone can complete each request in X secs shouldn't 32 clones complete 1/X*32 requests per second? Or something similar to that? (even half of that would be great, considering the extra overhead for handling these threads) I used the debug output when my server served about 30-40 requests/sec and I noticed this "perl_pool total/active/spare [32/0/32]" With a utilisation such as that (30-40 req/secs) shouldn't more perl clones be active (unless the above line means something else). The problem does not seem to be the database. I made a simple program that uses the exact same code as my radius perl script does and I can get this kind of performance easily. So what I am trying to say here is that I get this "feeling" that I do not get any concurrency at all from my radius daemons. I checked my Perl installation an both threads and multiplicity is enabled : usethreads=define use5005threads=undef useithreads=define usemultiplicity=define Any help would be appreciated. -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com Support Center email: apant(a)kinetix.gr, support(a)kinetix.gr Tel. & Fax: +30 2310556134 Mobile : +30 6937069097 MSN : apant2(a)hotmail.com WWW: http://www.kinetix.gr/ -------------------------------------------

3 2

Compile errors
by Dánial Olsen 16 Oct '07

16 Oct '07

I'm getting these errors when compiling CVS and 2.0.0-pre2 on OpenBSD 4.1: Making all in lib... gmake[3]: Entering directory `/root/freeradius/freeradius-server-2.0.0-pre2/src/lib' /root/freeradius/freeradius-server-2.0.0-pre2/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/root/freeradius/freeradius-server-2.0.0-pre2/src -c dict.c mkdir .libs gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -D_LIBRADIUS -I/root/freeradius/freeradius-server-2.0.0-pre2/src -c dict.c -fPIC -DPIC -o .libs/dict.o In file included from /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/libradius.h:30, from dict.c:26: /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/missing.h:182: error: redefinition of `struct in6_addr' In file included from /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/libradius.h:30, from dict.c:26: /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/missing.h:188:1: warning: "s6_addr" redefined In file included from /usr/include/netinet/in.h:554, from /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/missing.h:42, from /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/libradius.h:30, from dict.c:26: /usr/include/netinet6/in6.h:124:1: warning: this is the location of the previous definition /root/freeradius/freeradius-server-2.0.0-pre2/src/freeradius-devel/missing.h:272: error: redefinition of `struct sockaddr_storage' In file included from dict.c:31: /usr/include/malloc.h:4:2: warning: #warning "<malloc.h> is obsolete, use <stdlib.h>" gmake[3]: *** [dict.lo] Error 1 gmake[3]: Leaving directory `/root/freeradius/freeradius-server-2.0.0-pre2/src/lib' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/root/freeradius/freeradius-server-2.0.0-pre2/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/root/freeradius/freeradius-server-2.0.0-pre2/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /root/freeradius/freeradius-server-2.0.0-pre2 (line 18 of Makefile). Any clues? /Danial

2 1

Freeradius Clustering
by Fred Zinsli 16 Oct '07

16 Oct '07

Hello everyone Sorry if this has been covered, but I have googled without finding. I am looking to replace our current servers and am looking to reconfigure the network. I am wanting to know if Freeradius can be clustered? and if so can someone point me to some documentation on the subject. I am also wanting to know how the calculate the new specs for the new servers. Many thanks in advance. Regards Fred

4 3

FATAL: Thread create failed: Cannot allocate memory
by Phil Mayers 15 Oct '07

15 Oct '07

We had one of our MAC-auth radius server instances hang up with this error at about 0200 this morning. That server receives pretty heavy load, and it's bursty, so we see this a couple of times a day: The maximum number of threads (32) are active, cannot spawn new thread to handle request ...but it does not cause problems. An inability to create a new thread is an entirely different matter though; it implies <max threads are running, the server tried to create a new one, and the OS couldn't allocate a thread. Any ideas how to resolve this? Version is FreeRadius 1.1.6 (only reason we haven't upgraded is change control, it's due shortly)

3 3