November 2007 - Freeradius-Users - lists.freeradius.org

freeradius-pre2 .. "unknown client" appears in log !
by Edvin Seferovic 27 Nov '07

27 Nov '07

Hi, Ive just installed freeradius-pre2 and configured it for MAC auth... when I define my clients in the virtual host file like server mac-auth { client IP { name... } ... } I get following in the log Login OK: [00:e0:7d:75:ca:31] (from client UNKNOWN-CLIENT port 14 cli 00-e0-7d-75-ca-31) ! After I enter the same client IP { ... } stuff into clients.conf I get the expected Login OK: [00:01:6c:a0:93:57] (from client switch_1stock port 23 cli 00-01-6c-a0-93-57) ! Is it supposed to be like this ( broken ?? ) ? Would it be possible to have the name of the virtual server in the log too ? Something like Servername: Auth: Login OK: [00:01:6c:a0:93:57] (from client switch_1stock port 23 cli 00-01-6c-a0-93-57) Thanks, E:S

1 0

Errors when installing FreeRADIUS 1.1.7
by jborquez＠alum.calarts.edu 27 Nov '07

27 Nov '07

I am a newbie at using FreeRADIUS. After I run ./configure, I run make and get the following errors: usr/home/jose/freeradius-1.1.7/src/modules/rlm_sql/rlm_sql.h:68: error: syntax error before "lt_dlhandle" rlm_sqlippool.c: In function `sqlippool_postauth': rlm_sqlippool.c:526: warning: unused variable `self' gmake[5]: *** [rlm_sqlippool.lo] Error 1 gmake[5]: Leaving directory `/usr/home/jose/freeradius-1.1.7/src/modules/rlm_sqlippool' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/usr/home/jose/freeradius-1.1.7/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/usr/home/jose/freeradius-1.1.7/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/usr/home/jose/freeradius-1.1.7/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/usr/home/jose/freeradius-1.1.7/src' gmake: *** [common] Error 2 *** Error code 2 Could someone please enlighten me as to what I could be missing here? Thank you in advance, Jose

2 1

mod_auth_radius add_cookie segfault
by Brandon Ewing 26 Nov '07

26 Nov '07

Greetings, I am having some issues with mod_auth_radius causing httpd to segfault when "set_cookie" is called. The server in question is CentOS 4.5, with httpd-2.0.52-32.3 and apr-0.9.4-24.5.c4.2 RPMs installed. I downloaded mod_auth_radius from http://www.freeradius.org/mod_auth_radius/mod_auth_radius-2.0.c It compiled correctly via apxs after I added #include "apr_compat.h" I compiled with the following line: apxs -i -a -c mod_auth_radius-2.0.c I have the following in the .htaccess for the directory I wish to protect: <IfModule mod_auth_radius-2.0.c> AddRadiusAuth 10.10.17.15:1812 secret 5:3 AuthName "RADIUS Access" AuthType Basic Require valid-user AuthRadiusActive On </IfModule> If I access the page, I am presented with a basic authtype prompt -- however, after I enter a valid username and password, the httpd child segfaults: [Mon Nov 26 15:00:01 2007] [notice] child pid 21136 exit signal Segmentation fault (11) I know that the issue is in the set_cookie routine, because if I comment out the "set_cookie" call after a successful authentication and recompile, the segfault does not happen. However, this results in a RADIUS call for every single GET request, which is not desired. I am not proficient in C, so if anyone has any suggestions as to further troubleshooting/resolution for this issue, I would appreciate the input, off or on-list. -- Brandon Ewing (nicotine(a)warningg.com)

2 1

syaoran.sakura@gmail.com
by Syaoran Li 26 Nov '07

26 Nov '07

syaoran.sakura(a)gmail.com

1 0

Problem with CHAP
by Javier Fernando 26 Nov '07

26 Nov '07

I configure Freeradius , when the client try to connect with CHAP i have this error, and only connect with linux system users. When I connect locally with radtest i connect ok but when i connect remotely whit Windows Xp using CHAP don't connect. I run radius in debug mode with -X option. Part of clients.conf usuario1 Auth-Type := Local, Cleartext-Password := "testusuario1" usuario2 Auth-Type := Local, Password := "testusuario2" usuario3 Cleartext-Password := "testusuario3" Error of freeradius running with -X option: rad_recv: Access-Request packet from host 192.168.1.100:1645, id=106, length=126 Framed-Protocol = PPP User-Name = "chap" CHAP-Password = 0x019c1a0fb685942ed07fdb1e2d100e93f0 NAS-Port-Type = Virtual NAS-Port = 1586 Calling-Station-Id = "1141323200" Called-Station-Id = "8003450410" Connect-Info = "TLS-MISERVER-DIALUP" Service-Type = Framed-User NAS-IP-Address = 192.168.1.100 Processing the authorize section of radiusd.confmodcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "chap", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 2rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 2modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type CHAPauth: type "CHAP" Processing the authenticate section of radiusd.confmodcall: entering group CHAP for request 2 rlm_chap: login attempt by "chap" with CHAP password rlm_chap: Could not find clear text password for user chap modcall[authenticate]: module "chap" returns invalid for request 2modcall: leaving group CHAP (returns invalid) for request 2auth: Failed to validate the user.Login incorrect (rlm_chap: Clear text password not available): [chap/<CHAP-Password>] (from client rasiplan2 port 1586 cli 1141323200)Delaying request 2 for 1 secondsFinished request 2Going to the next request--- Walking the entire request list ---Waking up in 1 seconds...--- Walking the entire request list ---Waking up in 1 seconds...--- Walking the entire request list ---Sending Access-Reject of id 106 to 192.168.1.1 port 1645Waking up in 4 seconds...--- Walking the entire request list ---Cleaning up request 2 ID 106 with timestamp 47472e23Nothing to do. Sleeping until we see a request. _________________________________________________________________ Tecnología, moda, motor, viajes,…suscríbete a nuestros boletines para estar a la última http://newsletters.msn.com/hm/maintenanceeses.asp?L=ES&C=ES&P=WCMaintenance…

2 10

Unresponsive child and accounting
by Christophe Saillard 26 Nov '07

26 Nov '07

Hi, I use freeradius (1.1.7) to authenticate wireless users (EAP-TTLS/PAP) with an OpenLDAP backend. Our first experience with Freeradius on a FreeBSD server was a nightmare (it seemed to be a thread related problem, the server stopped working with a lot of "unresponsive child" error logs). So, we tried on a Linux server (kernel 2.6.22-14-server ubuntu feisty fawn) and it worked fine since last week : Wed Nov 21 15:33:21 2007 : Auth: Login OK: [xxxx] (from client localhost port 576353 cli 001c.bf09.480c) Wed Nov 21 15:33:21 2007 : Auth: Login OK: [xxxx(a)u-strasbg.fr] (from client wds3 port 576353 cli 001c.bf09.480c) Wed Nov 21 15:33:22 2007 : Error: WARNING: Unresponsive child (id 3046112160) for request 2419782 (in component accounting module rlm_radutmp) Wed Nov 21 15:33:22 2007 : Error: WARNING: Unresponsive child (id 2841623456) for request 2419798 (in component accounting module rlm_radutmp) The CPU went up to 100%. There was about 300 802.1X clients connected (with a 2 minutes reauth period). At this time we had no other choice than upgrading the hardware, it runs now on a 8 processor server but even with more CPU power we noticed a 20% system load. Here's the threading part of the radiusd.conf : max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1000 thread pool { start_servers = 10 max_servers = 1000 min_spare_servers = 15 max_spare_servers = 30 max_requests_per_server = 300 } I don't know if it's relevant but there were about 80 Eduroam users connected when the problem happens. Thanks. -- --------------------------- Christophe Saillard Centre Réseau Communication Université Louis Pasteur --------------------------- Tél : 03 90 24 03 17 Fax : 03 90 24 03 12 ---------------------------

2 1

Cisco NAS enable password
by J M 25 Nov '07

25 Nov '07

Hello, I have the NAS login and enable passwords (for cisco equipment) working fine with freeradius using mysql, but I am considering splitting my NAS equipment into 6 huntgroups and would like to have a different enable password for each of the 6 different huntgroups. If I were using the users file, I would try entries like: $enab15$ Huntgroup-Name == "alpha", Cleartext-Password := "alphpasswd" Service-Type = NAS-Prompt-User $enab15$ Huntgroup-Name == "beta", Cleartext-Password := "btapasswd" Service-Type = NAS-Prompt-User etc. for 6 huntgroups I'm just not sure I understand how I can translate that into the sql information necessary to equal the above. Is there a trick I am missing here or do I need to re-read the docs a couple more times? Thanks for any help John ____________________________________________________________________________________ Be a better pen pal. Text or chat with friends inside Yahoo! Mail. See how. http://overview.mail.yahoo.com/

1 0

a few questions
by Paul Bartell 25 Nov '07

25 Nov '07

Im working on a project at my school district to implement RADIUS authentication. I have two Mac powerpc servers for use, which could run either OSX or some linux variant. We are planning on using a mysql backend. Our network has around 6k machines throughout the district, a few hundred on the wifi at any given time. so my questions are: 1. since mysql in OSX isn't kernel based from what i understand, would it make a big difference to use a linux based os (debian/unofficial powerpc port of ubuntu is my initial thought)? 2. Are both servers needed, and if so would it make sense to use mysql replication and just have two of the same? 3. Would it make sense to just point some Ap's at one RADIUS server and some at the other, or is there a better/easier way to load balance? thanks, Paul -- "If you are savvy and smart about the choices you make in life, The sky is not the limit!" Mark Shuttleworth Random quote of the week/month/whenever i get to updating it: " hate compasses i like can't use them. they don't stay straight, and i end up looking like an emo by the time i'm done, it stabs me so much" - Jasmine Lee

3 4

Is it something wrong in EAP-TLS ?
by OLIVER Patrice 23 Nov '07

23 Nov '07

Hello, I try to use EAP-TLS authentication. Here is a part to the debugging messages : rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A TLS_accept: SSLv3 write certificate A TLS_accept: SSLv3 write key exchange A TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode What's about this error ? Regards. Cordialement, ---------------------------------------- Patrice OLIVER Chef du Projet Ville Hôpital Responsable Réseaux & Sécurité ---------------------------------------- HOSPICES CIVILS DE BEAUNE Service Informatique BP 104 21203 BEAUNE CEDEX Tél. 33 3 80 24 44 09 Fax 33 3 80 24 45 90 ----------------------------------------

2 1

radwho does not show me any user
by OLIVER Patrice 23 Nov '07

23 Nov '07

Hello, When I use the radwho utility to know actually connected radius users. It returns me an empty list since I'm actually connected and authenticated. Yesterday, I saw that the radutmp file did not exist. So I created it with 600 permissions. The radiusd.conf has been setup like this : radutmp { filename = ${logdir}/radutmp Can you help me ? Cordialement, ---------------------------------------- Patrice OLIVER Chef du Projet Ville Hôpital Responsable Réseaux & Sécurité ---------------------------------------- HOSPICES CIVILS DE BEAUNE Service Informatique BP 104 21203 BEAUNE CEDEX Tél. 33 3 80 24 44 09 Fax 33 3 80 24 45 90 ----------------------------------------

2 2