November 2007 - Freeradius-Users - lists.freeradius.org

Received conflicting packet
by Norbert Wegener 08 Nov '07

08 Nov '07

With my actual freeradius cvs I have some messages like this ones: | 2007-11-08 11:37:07 | radiusd[17266]: Received conflicting packet from client 119.25.50.234 port 33496 - ID: 37 due to unfinished request 140423. Giving up on old request. | | 2007-11-08 11:37:07 | radiusd[17266]: Received conflicting packet from client 119.25.50.234 port 33512 - ID: 205 due to unfinished request 140435. Giving up on old request. | | 2007-11-08 19:04:11 | radiusd[22818]: Received conflicting packet from client 119.25.50.234 port 36363 - ID: 181 due to unfinished request 50778. Giving up on old request. | | 2007-11-08 19:04:17 | radiusd[22818]: Received conflicting packet from client 119.25.50.234 port 36363 - ID: 181 due to unfinished request 50779. Giving up on old request. | | 2007-11-08 19:04:28 | radiusd[22818]: Received conflicting packet from client 119.25.50.234 port 36363 - ID: 64 due to unfinished request 50783. Giving up on old request. | What causes those messages? I suppose, it might be serious? Norbert Wegener

2 1

Restricting user by realm
by Lisa Casey 08 Nov '07

08 Nov '07

Hi, I have Freeradius 1.1.6 running on FreeBSD. I authenticate users from a users file, not from a database. I have three default realms setup in the realms file and at the top of the users file like so: DEFAULT Realm == jellico.net Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 DEFAULT Realm == jellico.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 Then a list of users follows. Here's one example: lisa Auth-Type = Local, Password == xxxxxxx Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Slipstream-Auth = "true" The way things are setup now, any user can log in with any of the realms I have defined. For example, I (username lisa) could login as lisa(a)jellico.com and then turn around and login as lisa(a)jellico.net My boss would like me to restrict this so that (for example) lisa could log in as lisa(a)jellico.com but not lisa(a)jellico.net With my setup, can I do this easily (or at all)? If this is possible, please give me some idea of how to go about doing this. Thanks, Lisa Casey

5 5

Startup problem with ldap
by Massimo Meregalli 08 Nov '07

08 Nov '07

Hi, I'm trying to run a freeradius 1.1.7 with ldap as authorize and authenticate backend and I'm having trouble with freeradius startup. If the server is started with radiusd -X or radiusd -s all is fine and the requests get answered correctly. If the server is started with radiusd -y it doesn't statup correctly. >From the radiusd.log file I notice that the line Fri Nov 2 09:37:54 2007 : Info: Ready to process requests. is missing. If I comment the ldap section in authorize and authenticate the server startup correcly also with -y startup flag. I've tried some debugging and I found that the server will fork correctly, the parent exit but the child never come alive as the line "Here before setsid" dosn't compare in the logfile. I've also tried to start gdb on the running process to see where the process is and the results are reported at the end of the message. Here there are the modified section of radiusd.c, the radiusd.log and the output of the gdb session. :::::::::: radiusd.c: :::::::::: ..... /* * Disconnect from session */ if (debug_flag == 0 && dont_fork == FALSE) { pid = fork(); if(pid < 0) { radlog(L_ERR|L_CONS, "Couldn't fork"); exit(1); } /* * The parent exits, so the child can run in the background. */ if(pid > 0) { radlog(L_ERR, "Parent Exit"); exit(0); } radlog(L_ERR, "Here before setsid"); #ifdef HAVE_SETSID setsid(); #endif ...... :::::::::::: radiusd.log: :::::::::::: Fri Nov 2 09:56:33 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Nov 2 09:56:33 2007 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Fri Nov 2 09:56:33 2007 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Fri Nov 2 09:56:33 2007 : Error: Parent Exit ::::::::: gdb ::::::::: [root@stargate main]# gdb .libs/radiusd 20867 GNU gdb Red Hat Linux (6.6-16.fc7rh) Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... Using host libthread_db library "/lib/libthread_db.so.1". Attaching to program: /usr/src/redhat/BUILD/freeradius-1.1.7/src/main/.libs/radiusd, process 20867 Loaded symbols for /usr/src/redhat/BUILD/freeradius-1.1.7/src/main/.libs/radiusd Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libresolv.so.2...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libpthread.so.0...done. [Thread debugging using libthread_db enabled] [New Thread -1209166144 (LWP 20867)] Loaded symbols for /lib/libpthread.so.0 Reading symbols from /usr/lib/libradius-1.1.7.so...done. Loaded symbols for /usr/lib/libradius-1.1.7.so Reading symbols from /lib/libcrypt.so.1...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /usr/lib/libsnmp.so.15...done. Loaded symbols for /usr/lib/libsnmp.so.15 Reading symbols from /usr/lib/libltdl.so.3...done. Loaded symbols for /usr/lib/libltdl.so.3 Reading symbols from /lib/libdl.so.2...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /lib/libssl.so.6...done. Loaded symbols for /lib/libssl.so.6 Reading symbols from /lib/libcrypto.so.6...done. Loaded symbols for /lib/libcrypto.so.6 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /usr/lib/libgssapi_krb5.so.2...done. Loaded symbols for /usr/lib/libgssapi_krb5.so.2 Reading symbols from /usr/lib/libkrb5.so.3...done. Loaded symbols for /usr/lib/libkrb5.so.3 Reading symbols from /lib/libcom_err.so.2...done. Loaded symbols for /lib/libcom_err.so.2 Reading symbols from /usr/lib/libk5crypto.so.3...done. Loaded symbols for /usr/lib/libk5crypto.so.3 Reading symbols from /lib/libz.so.1...done. Loaded symbols for /lib/libz.so.1 Reading symbols from /usr/lib/libkrb5support.so.0...done. Loaded symbols for /usr/lib/libkrb5support.so.0 Reading symbols from /lib/libkeyutils.so.1...done. Loaded symbols for /lib/libkeyutils.so.1 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /usr/lib/libnss_ldap.so.2...done. Loaded symbols for /usr/lib/libnss_ldap.so.2 Reading symbols from /usr/lib/libldap-2.3.so.0...done. Loaded symbols for /usr/lib/libldap-2.3.so.0 Reading symbols from /usr/lib/liblber-2.3.so.0...done. Loaded symbols for /usr/lib/liblber-2.3.so.0 Reading symbols from /usr/lib/libsasl2.so.2...done. Loaded symbols for /usr/lib/libsasl2.so.2 Reading symbols from /usr/lib/rlm_exec.so...done. Loaded symbols for /usr/lib/rlm_exec.so Reading symbols from /usr/lib/rlm_expr.so...done. Loaded symbols for /usr/lib/rlm_expr.so Reading symbols from /usr/lib/rlm_chap.so...done. Loaded symbols for /usr/lib/rlm_chap.so Reading symbols from /usr/lib/rlm_mschap.so...done. Loaded symbols for /usr/lib/rlm_mschap.so Reading symbols from /usr/lib/rlm_ldap.so...done. Loaded symbols for /usr/lib/rlm_ldap.so Reading symbols from /usr/lib/libldap_r-2.3.so.0...done. Loaded symbols for /usr/lib/libldap_r-2.3.so.0 Reading symbols from /usr/lib/rlm_eap.so...done. Loaded symbols for /usr/lib/rlm_eap.so Reading symbols from /usr/lib/libeap-1.1.7.so...done. Loaded symbols for /usr/lib/libeap-1.1.7.so Reading symbols from /usr/lib/rlm_eap_md5.so...done. Loaded symbols for /usr/lib/rlm_eap_md5.so Reading symbols from /usr/lib/rlm_eap_leap.so...done. Loaded symbols for /usr/lib/rlm_eap_leap.so Reading symbols from /usr/lib/rlm_eap_gtc.so...done. Loaded symbols for /usr/lib/rlm_eap_gtc.so Reading symbols from /usr/lib/rlm_eap_mschapv2.so...done. Loaded symbols for /usr/lib/rlm_eap_mschapv2.so Reading symbols from /usr/lib/rlm_preprocess.so...done. Loaded symbols for /usr/lib/rlm_preprocess.so Reading symbols from /usr/lib/rlm_detail.so...done. Loaded symbols for /usr/lib/rlm_detail.so Reading symbols from /usr/lib/rlm_realm.so...done. Loaded symbols for /usr/lib/rlm_realm.so Reading symbols from /usr/lib/rlm_files.so...done. Loaded symbols for /usr/lib/rlm_files.so Reading symbols from /usr/lib/rlm_acct_unique.so...done. Loaded symbols for /usr/lib/rlm_acct_unique.so Reading symbols from /usr/lib/rlm_radutmp.so...done. Loaded symbols for /usr/lib/rlm_radutmp.so Reading symbols from /usr/lib/rlm_sql.so...done. Loaded symbols for /usr/lib/rlm_sql.so Reading symbols from /usr/lib/rlm_sql_postgresql.so...done. Loaded symbols for /usr/lib/rlm_sql_postgresql.so Reading symbols from /usr/lib/libpq.so.5...done. Loaded symbols for /usr/lib/libpq.so.5 0x0012d402 in __kernel_vsyscall () (gdb) backtrace #0 0x0012d402 in __kernel_vsyscall () #1 0x00166a0e in __lll_mutex_lock_wait () from /lib/libpthread.so.0 #2 0x00162883 in _L_mutex_lock_79 () from /lib/libpthread.so.0 #3 0x001623ad in pthread_mutex_lock () from /lib/libpthread.so.0 #4 0x00704e6d in ldap_pvt_thread_mutex_lock () from /usr/lib/libldap_r-2.3.so.0 #5 0x0070f79b in ldap_ld_free () from /usr/lib/libldap_r-2.3.so.0 #6 0x00663dd7 in ?? () from /usr/lib/libnss_ldap.so.2 #7 0x00667504 in ?? () from /usr/lib/libnss_ldap.so.2 #8 0x004892f2 in fork () from /lib/libc.so.6 #9 0x001693a4 in fork () from /lib/libpthread.so.0 #10 0xb7f017b1 in main (argc=2, argv=0xbffe0294) at radiusd.c:1006 Any help apprecieated. Thanks Massimo Meregalli

3 10

freeradius and cisco 3550 dynamic vlan assignment issue(authentication is working)
by schilling 08 Nov '07

08 Nov '07

We read all dynamic vlan related posts in this mailing list archive, but still can't get it to work even the authentication is working good. We are trying to get dynamic vlan assigmnet from freeradius version .... with local user database using eap-ttls-pap. But client PC was able to authenticator, but is not in the intented VLAN(dynamic vlan assignment is not working). Any suggestion is highly appreciated. FreeRADIUS Version 1.1.7, for host i686-pc-linux-gnu DEBUG INFO TTLS: Got tunneled reply RADIUS code 2 Service-Type = Framed-User Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = 802 Tunnel-Private-Group-Id:0 = "552" Wed Nov 7 11:48:33 2007 : Debug: TTLS: Got tunneled Access-Accept Wed Nov 7 11:48:33 2007 : Debug: rlm_eap: Freeing handler Wed Nov 7 11:48:33 2007 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 29 Wed Nov 7 11:48:33 2007 : Debug: modcall[authenticate]: module "eap" returns ok for request 29 Wed Nov 7 11:48:33 2007 : Debug: modcall: leaving group authenticate (returns ok) for request 29 Sending Access-Accept of id 4 to 128.186.252.8 port 1645 USER FILE userx Cleartext-Password := "hello" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = "552" debug dot1x all in cisco showed that switching is successfully assign vlan 0 the fa0/2(dot1x enabled port) after getting authenticated. We are thinking this means vlan is not communicated between the freeradius and switch, but we don't know why. The test switch is cisco3550 running ios 12.2(35)SE. I have ( also tried the configuration in freeradius wiki, the same result) aaa new model aaa authorization network default group radius aaa authentication dot1x default group radius and dot1x system-auth-control fa0/2 is my test port. med-res-t#sh run Building configuration... Current configuration : 3450 bytes ! ! Last configuration change at 11:19:46 eastern Wed Nov 7 2007 by cisco ! NVRAM config last updated at 11:17:30 eastern Wed Nov 7 2007 by cisco ! version 12.2 no service pad service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption ! hostname med-res-t ! logging buffered 65536 debugging no logging console enable secret 5 ***** ! username cisco privilege 15 secret 5 ******* aaa new-model aaa authentication login default local aaa authentication dot1x default group radius aaa authorization exec default local aaa authorization network default group radius ! aaa session-id common clock timezone eastern -5 ip subnet-zero ip domain-name test.edu ! ip ssh version 2 vtp mode transparent ! ! ! ! ! dot1x system-auth-control no file verify auto spanning-tree mode pvst spanning-tree extend system-id ! vlan internal allocation policy ascending ! vlan 100,200 ! ! vlan 552 name test-fwsm-lan ! vlan 553 name retricted-vlan ! ! interface FastEthernet0/1 switchport mode dynamic desirable ! interface FastEthernet0/2 switchport mode access dot1x pae authenticator dot1x port-control auto spanning-tree portfast ! ! interface GigabitEthernet0/1 switchport mode dynamic desirable ! interface GigabitEthernet0/2 switchport trunk encapsulation dot1q switchport trunk allowed vlan 543,552 switchport mode trunk switchport nonegotiate ! interface Vlan1 no ip address no ip route-cache shutdown ! interface Vlan552 ip address 10.128.252.8 255.255.255.0 ! ip default-gateway 10.128.252.1 ip classless ip http server ip http secure-server ! ! radius-server host 10.128.33.163 auth-port 1612 acct-port 1646 key 7 070C285F4D06 radius-server source-ports 1645-1646 ! control-plane ! line con 0 line vty 5 15 ! ntp clock-period 17179941 ntp server 10.128.8.8 end med-res-t#

3 8

(no subject)
by Terry Pelley 08 Nov '07

08 Nov '07

I want to be able to specify which Wireless Access Points certain users can gain access from. Is there an attribute that I can set so that a user can only be authenticated if the request comes from a predetermined NAS or group of NASs? thnx.

2 1

limiting Authentication based on the NAS
by Terry Pelley 08 Nov '07

08 Nov '07

Sorry, First posting contained no subject header. This is a repost. I want to be able to specify which Wireless Access Points certain users can gain access from. Is there an attribute that I can set so that a user can only be authenticated if the request comes from a predetermined NAS or group of NASs? thnx.

2 1

NAS is not available
by hadi golestani 08 Nov '07

08 Nov '07

Hi, I've a freeRadius that is configured to work with pptpd and it's working great, but when I've installed daloradius to generate some reports, dalo told me that there's no NAS configured ! so what's this NAS and is the NAS important for freeradius to find out disconnected people? tnx

2 3

ldap instead of /users file
by stefek143 08 Nov '07

08 Nov '07

Hello. I red that ldap can`t be used with eap-tls method to auth., but just what i wanna do is use LDAP instead of /raddb/users file . for example attribute VLAN ID etc. Is it possible? if yes, where i find some information about it? becouse everywhere is "howto authentication, authorization using LDAP" but i think its big different in radius configuration when i wanna use LDAP only instead of users file. THX for any information.

2 1

cisco freeradius problems
by Edgars Makņa 08 Nov '07

08 Nov '07

Hello I have interesting problems with freeradius authentication. NAS - cisco 2801 radius - freeradius running on freebsd with mysql db. I had a lot of such errors in radius.log: Auth: Login incorrect (rlm_pap: CRYPT password check failed): [1-102/D\014\003\222\374\267<z\013y\005\200\354S\373\344] (from client plaza port 0) In debug output i get "unprintable characters". In the same time authentication was working fine from other hosts, for example smtp server. Problem was solved in interesting way, on cisco i specified radius source interface. It was working fine until mysql server crashed and i got same garbage in authentication. I removed source radius interface from cisco configuration and everything started to work fine again. Any ideas?

2 6

radius going to sleep?
by Norbert Wegener 08 Nov '07

08 Nov '07

In a cvs version of pre2, which is newer than pre2, on one machine, after some time of inactivity, freeradius does not seem to answer at all- sometimes, not reliable reproducable. Freeradius has a lot of database connections to mysql, maybe they are the culprit for that behaviour? stracing freeradius gives: # strace -f -p 29757 Process 29807 attached with 51 threads - interrupt to quit [pid 29757] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29758] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29759] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29760] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29761] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- ... [pid 29796] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29797] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29798] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29799] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29800] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29801] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29802] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29803] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- --- [pid 29778] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29779] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29780] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29781] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29782] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29783] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29784] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29785] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29786] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- ... [pid 29803] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29804] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29805] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29806] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29807] --- SIGSTOP (Stopped (signal)) @ 0 (0) --- [pid 29758] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29759] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29760] read(9, <unfinished ...> [pid 29761] read(8, <unfinished ...> [pid 29762] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29763] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29764] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29765] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29766] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [..... [pid 29798] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29799] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29800] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29801] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29802] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29803] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29804] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29805] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29806] futex(0x8002f654, FUTEX_WAIT, 0, NULL <unfinished ...> [pid 29807] futex(0x8002f654, FUTEX_WAIT, 0, NULL with a few dozens lines deleted. strace's output stops here, also when radius request come in. They are not answered. Any idea, what's going wrong here or how to track that down? I already tried nohup gdb -x gdbargs /sbin/radiusd & with gdbargs containing: run -AX bt but was unable to reproduce that situation in this context. Running radiusd under gdb's control seemed to solve that problem, maybe that's not the final solution. Norbert Wegener

4 13