December 2007 - Freeradius-Users - lists.freeradius.org

About radwho
by Patrice Oliver 10 Dec '07

10 Dec '07

Hello, I run freeradius 1.1.7. when I use the radwho command, I get : radwho: Error reading /usr/local/var/log/radius/radutmp: No such file or directory I looked in /usr/local/var/log/radius/ and didn't find radutmp file. I didn't read in the documentation that this file is to be created manually. Can you say me why radiusd didn't create it at the first time ? Do I have to create it now ? Regards. -- *Hospices Civils de Beaune* *Patrice OLIVER* /Chef de Projet Ville Hôpital/ /Responsable Réseau & Sécurité/ BP 104 21203 BEAUNE Cedex Tél. 03 80 24 44 09 Fax. 03 80 24 45 90 ------------------------------------------------------------------------ Ce message, y compris les pièces jointes, est établi à l'attention exclusive de son ou ses destinataires et est confidentiel. Toute utilisation non conforme à sa destination, toute diffusion ou publication, totale ou partielle, est interdite sauf autorisation expresse de l'expéditeur. Si vous n'êtes pas le destinataire de ce message, merci d'avertir l'expéditeur de l'erreur de distribution puis de le détruire. Tout message électronique est susceptible d'altération et son intégrité ne peut être assurée. L'expéditeur décline toute responsabilité dans l'hypothèse où il aurait été modifié ou falsifié.

2 1

freeradius + cisco vpn 3000 ip assignment
by Marc delavaud 10 Dec '07

10 Dec '07

Hello, Can freeradius assign ip to users connecting to cisco VPN 3000 ?

2 1

Re: freeradius-pre2 - hostname lookup
by Alan DeKok 10 Dec '07

10 Dec '07

Edvin Seferovic wrote: > The client is entered in the virtual server config => server my_server { > client clientname { ... } } ! > > Bug or just a random feature ? Likely just an issue in -pre2. I don't see it in CVS head. Alan DeKok.

2 1

freeradius-pre2 - hostname lookup
by Edvin Seferovic 09 Dec '07

09 Dec '07

Hi, my freeradius does always a hostname lookup although hostname_lookup = no AND if the client is not found in the clients.conf... Mon Dec 10 05:29:43 2007 : Error: Trying to look up name of unknown client 172.19.10.160. Mon Dec 10 05:29:43 2007 : Auth: Login OK: [00:09:34:14:ad:57] (from client UNKNOWN-CLIENT port 24 cli 00-09-34-14-ad-57) The client is entered in the virtual server config => server my_server { client clientname { ... } } ! Bug or just a random feature ? Regards, E:S

1 0

HELP! testuser works, but local unix user dosn't! - WPA/WPA2 PEAP
by Kristian Junkov 09 Dec '07

09 Dec '07

Hi, I use freeradius 1.1.7, and my client pc runs windows Vista. I've set up a testuser with a clear-text password in the users file - which works:-). I can connect using the testuser with WPA/WPA2, PEAP, TTLS without problems. But when I try to connect using the local unix users it dosnt work:-((, what am I doing wrong? This is what i got when running in debug -X mode, and trying with root: ########## The user request ############# rad_recv: Access-Request packet from host 172.16.20.240:2056, id=0, length=121 User-Name = "root" NAS-IP-Address = 172.16.20.240 Called-Station-Id = "000001a728a8" Calling-Station-Id = "0013e8c11ed3" NAS-Identifier = "000001a728a8" NAS-Port = 12 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000901726f6f74 Message-Authenticator = 0x626a6cc69ca1f0b92f795e2542e86be3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 172.16.20.240 port 2056 EAP-Message = 0x01010016041054c071964fb44c8680fbb4110fcb766c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x06737742f028b5011a4eecca9b8e7047 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 475b3805 Nothing to do. Sleeping until we see a request. This is my configuration from debug mode: loki:/etc/freeradius# freeradius -X -A -y Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 60 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/wireless/server_key.pem" tls: certificate_file = "/etc/freeradius/certs/wireless/server_cert.pem" tls: CA_file = "/etc/freeradius/certs/wireless/CA/cacert.pem" tls: private_key_password = "xxxxxxxx" tls: dh_file = "/etc/freeradius/certs/wireless/dh" tls: random_file = "/etc/freeradius/certs/wireless/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ----------------------------------- Thanks, Kristian -- View this message in context: http://www.nabble.com/HELP%21-testuser-works%2C-but-local-unix-user-dosn%27… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: FW: MS-CHAP-v2 and CHAP with different passwords in LDAP
by Alan DeKok 08 Dec '07

08 Dec '07

Edvin Seferovic wrote: > before somebody yells "not again" - I just wish to ask if it is possible to > use MS-CHAP and CHAP authentication with a LDAP backend which contains > clear-text passwords as well as NT-Password ( used for MS-CHAP ) ??? Alan - > yes/no answer please :) Read the web page: http://deployingradius.com/documents/protocols/compatibility.html If you're doing "bind as user" in LDAP, read this: http://deployingradius.com/documents/protocols/oracles.html > If positive - can somebody give me an example of attribute mapping to ldap > for both ( MS-CHAP and CHAP ) to work ? You don't do attribute mappings. See the "ldap" section in radiusd.conf, and look for "password_attribute". > My setup with LDAP as backend is working with a mapping of NT-Password to > sambaNTPassword like this : > > checkItem NT-Password sambaNTPassword > > MS-CHAP works just fine ! > > For CHAP I added > > password_header = "{clear}" > password_attribute = "userPassword" > password_radius_attribute = "User-Password" Where did that last line come from? > to the LDAP module configuration. But unfortunately chap module doesn't like > my clear-text password ( stored in userPassword ) for authentication :( How > else can I say CHAP where to look for the clear-text password. See the FAQ for "it doesn't work". Alan DeKok.

2 1

1 byte leak ?
by blue_11j＠yahoo.co.jp 08 Dec '07

08 Dec '07

Hi, I'm *sorry* that I am not good at English because I'm Japanese. I found memory leak(?) of 1 byte when PEAP authentication, by valgrind. I tried fllowing patch for rlm_eap. it look like work well. is it corret way? -------------------------------- diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/eap.c ./src/modules/rlm_eap/eap.c --- ../freeradius-1.1.7/src/modules/rlm_eap/eap.c 2007-04-08 07:18:34.000000000 +0900 +++ ./src/modules/rlm_eap/eap.c 2007-10-10 02:44:20.000000000 +0900 @@ -421,6 +421,11 @@ */ if (reply->type.data && reply->type.length > 0) { memcpy(&hdr->data[1], reply->type.data, reply->type.length); + + // 2007/10/09 workaround for memory leak. + DEBUG2(" rlm_eap: in %s() in %s Freeing reply->type.data 0x%x", __func__, __FILE__, (unsigned int)reply->type.data); + reply->type.bNeedFreeData = 0; + free(reply->type.data); reply->type.data = reply->packet + EAP_HEADER_LEN + 1/*EAPtype*/; } diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eap_tls.c ./src/modules/rlm_eap/libeap/eap_tls.c --- ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eap_tls.c 2007-04-08 06:27:19.000000000 +0900 +++ ./src/modules/rlm_eap/libeap/eap_tls.c 2007-10-09 22:39:14.000000000 +0900 @@ -808,6 +808,10 @@ return 0; } + // 2007/10/09 workaround for memory leak. + DEBUG2(" rlm_eap: in %s() Malloc(%d) for eap_ds->request->type.data 0x%x", __func__, (reply->length - TLS_HEADER_LEN + 1), (unsigned int)eap_ds->request->type.data); + eap_ds->request->type.bNeedFreeData = 1; + /* EAPTLS Header length is excluded while computing EAP typelen */ eap_ds->request->type.length = reply->length - TLS_HEADER_LEN; diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eap_types.h ./src/modules/rlm_eap/libeap/eap_types.h --- ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eap_types.h 2006-05-19 23:19:15.000000000 +0900 +++ ./src/modules/rlm_eap/libeap/eap_types.h 2007-10-09 20:51:14.000000000 +0900 @@ -88,6 +88,9 @@ unsigned char type; unsigned int length; unsigned char *data; + + // 2007/10/09 workaround for memory leak. + unsigned int bNeedFreeData; } eaptype_t; /* diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eapcommon.c ./src/modules/rlm_eap/libeap/eapcommon.c --- ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eapcommon.c 2007-03-05 23:34:55.000000000 +0900 +++ ./src/modules/rlm_eap/libeap/eapcommon.c 2007-10-10 02:43:30.000000000 +0900 @@ -216,6 +216,11 @@ */ if (reply->type.data && reply->type.length > 0) { memcpy(&hdr->data[1], reply->type.data, reply->type.length); + + // 2007/10/09 workaround for memory leak. + DEBUG2(" rlm_eap: in %s() in %s Freeing reply->type.data 0x%x", __func__, __FILE__, (unsigned int)reply->type.data); + reply->type.bNeedFreeData = 0; + free(reply->type.data); reply->type.data = reply->packet + EAP_HEADER_LEN + 1/*EAPtype*/; } @@ -386,6 +391,11 @@ ep.type.type = eap_type; ep.type.length = vp->length; ep.type.data = malloc(vp->length); + + // 2007/10/09 workaround for memory leak. + DEBUG2(" rlm_eap: in %s() Malloc(%d) for ep.type.data 0x%x", __func__, vp->length, (unsigned int)ep.type.data); + ep.type.bNeedFreeData = 1; + memcpy(ep.type.data,vp->strvalue, vp->length); eap_basic_compose(req, &ep); } diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/mem.c ./src/modules/rlm_eap/mem.c --- ../freeradius-1.1.7/src/modules/rlm_eap/mem.c 2007-02-10 00:42:03.000000000 +0900 +++ ./src/modules/rlm_eap/mem.c 2007-10-09 22:40:28.000000000 +0900 @@ -54,6 +54,14 @@ * so we do not free it but we NULL it free(eap_packet->type.data); */ + + // 2007/10/09 workaround for memory leak. + if(eap_packet->type.bNeedFreeData) { + DEBUG2(" rlm_eap: in %s() Freeing eap-packet->type.data 0x%x", __func__, (unsigned int)eap_packet->type.data); + eap_packet->type.bNeedFreeData = 0; + free(eap_packet->type.data); + } + eap_packet->type.data = NULL; } -------------------------------- -------------------------------------- New Design Yahoo! JAPAN 2008/01/01 http://pr.mail.yahoo.co.jp/newdesign/

2 1

FW: MS-CHAP-v2 and CHAP with different passwords in LDAP
by Edvin Seferovic 08 Dec '07

08 Dec '07

Hello list members, before somebody yells "not again" - I just wish to ask if it is possible to use MS-CHAP and CHAP authentication with a LDAP backend which contains clear-text passwords as well as NT-Password ( used for MS-CHAP ) ??? Alan - yes/no answer please :) If positive - can somebody give me an example of attribute mapping to ldap for both ( MS-CHAP and CHAP ) to work ? My setup with LDAP as backend is working with a mapping of NT-Password to sambaNTPassword like this : checkItem NT-Password sambaNTPassword MS-CHAP works just fine ! For CHAP I added password_header = "{clear}" password_attribute = "userPassword" password_radius_attribute = "User-Password" to the LDAP module configuration. But unfortunately chap module doesn't like my clear-text password ( stored in userPassword ) for authentication :( How else can I say CHAP where to look for the clear-text password. Any hints please ? TIA ! Regards, E:S

1 0

freeradius compile problem
by Dave Gibelli 08 Dec '07

08 Dec '07

Hi I am having problems compiling with eap module. Here is the section from config.log showing what I think is the problem. I have the latest OpenSSL and Freeradius 1.1.7 Any ideas? configure:20584: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lssl -L/usr/local/ssl/lib -lnsl -lresolv -lpthread >&5 /usr/local/ssl/lib/libssl.a(ssl_lib.o): In function `SSL_clear': ssl_lib.c:(.text+0x28): undefined reference to `ERR_put_error' ssl_lib.c:(.text+0x13a): undefined reference to `BUF_MEM_free' /usr/local/ssl/lib/libssl.a(ssl_lib.o): In function `SSL_new': ssl_lib.c:(.text+0x1ba): undefined reference to `CRYPTO_malloc'

4 4

need patch to inst->session_tail clear ?
by blue_11j＠yahoo.co.jp 08 Dec '07

08 Dec '07

Hi, I'm *sorry* that I am not good at English because I'm Japanese.... I think that it is need following patch for eaplist_find() in rlm_eap/mem.c, FreeRADIUS 1.1.7. if no patch, when session_head == NULL and session_tail != NULL, add handler to TAIL in next eaplist_add(). How do you think about it? ------------------------ diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/mem.c ./src/modules/rlm_eap/mem.c --- ../freeradius-1.1.7/src/modules/rlm_eap/mem.c 2007-02-10 00:42:03.000000000 +0900 +++ ./src/modules/rlm_eap/mem.c 2007-12-07 12:32:23.000000000 +0900 @@ -301,6 +301,9 @@ rbtree_delete(inst->session_tree, node); inst->session_head = handler->next; + //--- 2007/12/07 added --------------- + if(!inst->session_head) inst->session_tail = NULL; + //------------------------------------ if (handler->next) handler->next->prev = NULL; eap_handler_free(handler); } ------------------------ -------------------------------------- New Design Yahoo! JAPAN 2008/01/01 http://pr.mail.yahoo.co.jp/newdesign/

2 1