February 2007 - Freeradius-Users - lists.freeradius.org

rlm_perl problem (Detaching!!)
by Rohaizam Abu Bakar 08 Feb '07

08 Feb '07

Hi.. FR: 1.1.2 FBSD: 6.0 My rlm_perl keep logging error as example below. Everytime this happen radiusd will hang and DO NOT respond to any request. But this NEVER happen while running in debug mode and working fine. rlm_perl is used to load timeout based on certain rules.. u can see below my perl script (newtimeou5.pl) and also config files setting. Please help TQ. Error /var/log/radius.log ################################################################################## Thu Feb 8 12:30:09 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout4.pl , func = authorize exit status= Undefined subroutine &main:: called. Thu Feb 8 12:32:00 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 12:39:46 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout4.pl , func = authorize exit status= panic: leave_scope inconsistency at /usr/local/etc/raddb/newtimeout4.pl line 184. Thu Feb 8 12:39:47 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:08:52 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:22:40 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:57:25 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Fri Feb 9 09:53:52 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = authorize exit status= Usage: Encode::is_utf8(sv, check = 0) at /usr/local/lib/perl5/site_perl/5.8.7/Convert/ASN1.pm line 422, <DATA> line 424. Fri Feb 9 10:21:59 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = authorize exit status= Undefined subroutine &Convert::ASN1::authorize called at /usr/local/lib/perl5/site_perl/5.8.7/Net/LDAP.pm line 759 Fri Feb 9 10:57:59 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = preacct exit status= Undefined subroutine &Convert::ASN1::preacct called at /usr/local/lib/perl5/site_perl/5.8.7/Net/LDAP.pm line 759 #################################################### ######################users############################ DEFAULT NAS-Identifier == "Wireless-802.11", Autz-Type := Y5, Auth-Type :Y5 ######################################################## #################radiusd.conf################################# authorize { Autz-Type Y5 { redundant { ldapy51 ldapy52 } y5perl } } modules { perl y5perl { module = /usr/local/etc/raddb/newtimeout5.pl } } authenticate { Auth-Type Y5 { redundant { ldapy51 ldapy52 } } } ########################################################## #######################newtimeout5.pl######################## sub authorize { ##main my $return_value = 0; $return_value = &timeout; print "VALUE return: $return_value\n"; if ($return_value eq '-1'){ return RLM_MODULE_REJECT; }else{ return RLM_MODULE_OK; } } sub timeout { my $query; my $query2; my $uid=$RAD_REQUEST{'User-Name'}; my $userfrom; my $userconnect=$RAD_REQUEST{'NAS-Identifier'}; my $timeout; ################################ if ($userconnect =~ /Wireless-802.11|WiFi/) { $query="Service"; $query2 = "TimeoutWIFI"; } if ($query){ $userfrom = ldapquery($uid,$query); if ($userfrom =~ /Y5PLAT|Y5GOLD/){ $userfrom = "WiFi-BTP"; }elsif ($userfrom =~ /^Y5$/){ $userfrom = "Wireless-802.11"; } if ($userconnect eq $userfrom){ print "rlm_perl: Local user.. No timeout.. Unlimited!!!\n"; return (1); }elsif ($userconnect ne $userfrom){ print "rlm_perl: Roaming user.. Timeout will be loaded !!\n"; $timeout = ldapquery($uid,$query2); print "rlm_perl: $query2:$timeout\n"; if (!$timeout){ return (-1); }else{ $RAD_REPLY{'Session-Timeout'} = $timeout; print "rlm_perl: NOT YET....\n"; return (1); } } }else{ print "rlm_perl: Not a wifi connection !!!\n"; return (1); } } sub ldapquery { my ( $uid, $query ) = @_; my $host = "xxxxxxxxxx"; my $value; my $baseDN = "ou=Y5,ou=AAA, ou=xxxxx, dc=xxxxx, dc=xxxx"; my $ldap = Net::LDAP->new( $host ) or die "$@"; my $mesg = $ldap->bind ; # an anonymous bind $mesg = $ldap->search( # perform a search base => $baseDN, filter => "(&(uid=$uid))" ); my $count = $mesg->count; if ($mesg->code) { return ("NULL"); } if ($count < 0 ){ return ("NULL"); }elsif ($count > 0){ for ( my $i = 0 ; $i < $count ; $i++ ) { my $entry = $mesg->entry ( $i ); my $data = $entry->dn; $value = $entry->get_value($query); } } $mesg = $ldap->unbind; return ($value); }

1 0

freeradius on eth1
by Cihan DEMİR 08 Feb '07

08 Feb '07

Hi, I am using the latest FreeRadius version on Redhat. I want to run FreeRadius on eth1 because it's gateway is different and it is directly connected to GSM operator. How can i configure it? Thanks in advance, Cihan. -------------------------------------------------------------------------------- Omsan'in sundugu hizmetleri nasil degerlendiriyorsunuz? Görüsleriniz bizim için degerli. Aldiginiz hizmetin beklentilerinizi ve ihtiyaçlarinizi ne ölçüde karsiladigi konusunda benimle irtibata geçebilir veya pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr veya innovate(a)omsan.com.tr adreslerine e-mail gönderebilirsiniz. How do you evaluate the services of Omsan? Your opinions are valuable for us. You can contact me or send an e-mail to , pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr or innovate(a)omsan.com.tr to inform us about the extent to which the services provided fulfill your expectations and needs. -------------------------------------------------------------------------------- Bu e-posta mesaji kisiye özel olup, gizli bilgiler içeriyor olabilir. Eger bu e-posta mesaji size yanlislikla ulasmissa, içerigini hiç bir sekilde kullanmayiniz ve ekli dosyalari açmayiniz. Bu durumda lütfen e-posta mesajini kullaniciya hemen geri gönderiniz ve tüm kopyalarini mesaj kutunuzdan siliniz. Bu e-posta mesaji, hiç bir sekilde, herhangi bir amaç için çogaltilamaz, yayinlanamaz ve para karsiligi satilamaz. Bu e-posta mesaji virüslere karsi anti-virüs sistemleri tarafindan taranmistir. Ancak yollayici, bu e-posta mesajinin - virüs koruma sistemleri ile kontrol ediliyor olsa bile - virüs içermedigini garanti etmez ve meydana gelebilecek zararlardan dogacak hiçbir sorumlulugu kabul etmez. This message is intended solely for the use of the individual or entity to whom it is addressed, and may contain confidential information. If you are not the intended recipient of this message or you receive this mail in error, you should refrain from making any use of the contents and from opening any attachment. In that case, please notify the sender immediately and return the message to the sender, then, delete and destroy all copies. This e-mail message, can not be copied, published or sold for any reason. This e-mail message has been swept by anti-virus systems for the presence of computer viruses. In doing so, however, sender cannot warrant that virus or other forms of data corruption may not be present and do not take any responsibility in any occurrence.

3 2

latest cvs - gdbm fatal: lseek error
by tzieleniewski 08 Feb '07

08 Feb '07

Hi!! I compiled the latest cvs version of freeradius and installed it as always. When I tried to run it by radiusd -X to check if everything was ok I got the following error which probably considered counter module (is it error or I missed something?): Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded counter counter: filename = "/home/radius/freeradius/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: reply-name = "Session-Timeout" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1830 rlm_counter: Current Time: 1170980756 [2007-02-09 01:25:56], Next reset 1171062000 [2007-02-10 00:00:00] gdbm fatal: lseek error My radiusd.conf: instantiate { exec expr daily expiration logintime } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout allowed-servicetype = Framed-User cache-size = 5000 } bests -tomasz

1 0

SQL help from someone who groks c, please?
by Dan Mahoney, System Admin 08 Feb '07

08 Feb '07

Hey all... Disclaimer: If I should ask this on the devel list, let me know and I will. As I'm not qualified in the languages to be a developer, this seemed the more logical place. I'm decent with Radius but have just come to freeradius over Cistron...I'm still in the process of assimilating the "op" syntax, but that's not the problem, I think. That said, I figured out two possible ways to handle my previous question regarding advanced SQL auth (including multiple occurances of the same username with different check-items). What I need to know is which way it was "intended" to work (either one of my two thoughts here, or something entirely -- or even "what I want to do isn't possible".) Here's the thought (apologies if the tabs get messed up). a) The rows returned are parsed in order, just as if they were a users file, and something (perhaps a password entry or an op of ==) triggers the system that it's on the "next record". of b) The "id" field (which some of the docs say are unused) is used to "bind" multiple items having the same ID. i.e (citing my earlier example)... Jeremy nas-ip-address="the vpn server" password="x" Service-Type = "Framed-User" # Our switches, which we trust jeremy not to mess up Jeremy password = "y" Service-Type = "Admin-User" Jeremy nas-ip-address="a big powerful router" Service-Type = Reject If it's (a): Based on the standard values in the database, would this work: id username attribute value op 1 jeremy password X == 2 jeremy nas-ip-address "vpnsvr" := 3 jeremy password y == 4 jeremy password "z" == 5 jeremy nas-ip-address "router" := The problem I see with this one is that a) there's no easy way to keep your (presumably auto-increment) id field entries properly ordered. Also, line 4 above doesn't make sense -- there really ARE no check items that would work here. If line 4 above were deleted, it would instead match password=y, nas-ip-address=router (again, I may be missing something critical about operators and their signaling here). Also, based on this, you would have to then find which attributes in the reply table to ask, which could *possibly* be based on the id of the "password" attribute, but that's hardly normalized. If it's (b): id username attribute value op 1 jeremy password X == 1 jeremy nas-ip-address "vpnsvr" := 2 jeremy password y == 3 jeremy password "z" == 3 jeremy nas-ip-address "router" := This one implies you either have a keyless table (bad), or that there's another key value here, which isn't in the included schemas. It also implies that the server acutally LOOK AT the "id" value to know when to stop parsing. In this case your reply items would be pulling based on that "id" field, not the username at all (since in this case the username is not unique). /endif The assumption I worked with is: My knowledge of SQL is far better than my knowledge of the inner workings of freeradius-SQL. What I've done is I've had to hard code the NAS-IP address into my queries, coupled with some special tables to return the right values expected by certain network devices (for example), if it's a PDU, return the admin (or userlevel) service-type for those devices, if it's a switch, return the appropriate there -- even allowing our customers access to those PDU ports that they control, but this still isn't as flexible as an old-fashioned users file. In reality, I should be able to return ALL records related, and radius should pick up the differences in the check-items, instead of the query only returning a select few. This will make more sense if we decide we need to start checking more values than just the one. I've also had to UNION my queries together because employees and clients are in different tables (and I am only checking on employee access on some devices -- but this is also done through the SQL). I noticed, interestingly enough, that UNION works, but the semicolon does not (perhaps this is to prevent SQL injection?). As I am unable to grok the c, I can't be sure. I.e. at the moment there's about forty users, some of which have differing access than others, and there's no real radius "groups", since each person's needs are slightly different and vary based on what each person has been certified and tested on. Apologies for seeming long. If anyone has any ideas, let me know, please. I may be able to compensate someone for an hour or two of consultation time, if it gets the questions answered (please contact me off-list regarding this). -Dan -- --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------

4 9

Problem with the attribute "Message-Authenticator"
by yao guoxian 08 Feb '07

08 Feb '07

I write a program to send Access-request packet to the Radius server. The packet format is as follow: __________________________________________________________ | code = 1 | ID = 1 | Length = 73 ( 0x 00 49 ) | __________________________________________________________ | 16 bytes authenticator | __________________________________________________________ | user_name = "test" | __________________________________________________________ | chap_password | __________________________________________________________ | eap_message = "pdsicygx" | __________________________________________________________ | Message_authenticator | __________________________________________________________ The Message_authenticator is calculated as follow: Message_authenticator = HMAC-MD5 (code ,ID, Length,16 bytes Authenticator, user_name,chap_password,eap_message) , using the shared secret between NAS and radius server , in this case ,"testing123". While sending "chap" packets without the "eap_message" and "Message_authenticator" gets "Access request" , sending packets like above gets response from radius server as follow: rad_recv: Access-Request packet from host 202.117.7.223:1408, id=1, length=73 Received packet from 202.117.7.223 with invalid Message-Authenticator! (Shared secret is incorrect.) Server rejecting request 1. Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 1 to 202.117.7.223:1408 Segmentations of the "Radiusd -X " are as follow: ... Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap ... Can the "eap_message" attribute be set randomly, in my packets, "pdsicygx"? Is it right to calculate "Message_authenticator" as I did? Regards Guoxian

3 3

Radius brokes down during "Accounting Request"
by tzieleniewski 08 Feb '07

08 Feb '07

Hi! I am trying to use radius as the accounting server for Sip proxy. After i send the Accounting request to radius the radius server brokes down and informs about memory segmentation fault. Please point me what could be the reason for this. Here is the radius debug output: rad_recv: Accounting-Request packet from host 127.0.0.1 port 32825, id=88, length=463 SER-Attr = "" Acct-Session-Id = "69E969D9-A757-D5D1-477F-77FEF8DAA44D(a)192.168.1.2" Sip-To-Tag = "795669631" SER-From = "tomix <sip:tomix@tezet.no-ip.org:7060>;tag=795669631" SER-Flags = 12 SER-Original-Request-ID = "sip:tomix@tezet.no-ip.org" Sip-Method = "INVITE" Sip-Cseq = 51319 Sip-Translated-Request-ID = "sip:tomix@192.168.1.2:7060" Sip-Source-IP-Address = 192.168.1.2 Sip-From-Tag = "795669631" SER-To = "<sip:tomix@tezet.no-ip.org>;tag=795669631" SER-Digest-Username = "tomix" SER-Request-Timestamp = 1170882487 Calling-Station-Id = "sip:tomix@tezet.no-ip.org:7060" Sip-Source-Port = 7060 SER-Digest-Realm = "tezet.no-ip.org" Sip-Response-Code = 486 Called-Station-Id = "sip:tomix@tezet.no-ip.org" SER-Response-Timestamp = 1170882487 Acct-Status-Type = Failed Service-Type = IAPP-Register NAS-Port = 5060 Acct-Delay-Time = 0 NAS-IP-Address = 127.0.0.1 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 Naruszenie ochrony pamięci (translation -> memory segmentation fault) (when I commented out the preprocess module form the preacct it didn't broke down but still nothig was logged in the database) My radiusd.conf file look like this: preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } preacct { preprocess acct_unique suffix files } accounting { acc_req_log radutmp sql attr_filter.accounting_response }

3 7

Usage of Cleartext-Password
by Federico Giannici 08 Feb '07

08 Feb '07

I have just upgraded from 1.1.2. to 1.1.4. Now I tried to convert my custom authorization module to use the "Cleartext-Password" attribute instead of "User-Password" (my passwords are in clear-text). I simply replaced the following command at the end of the authorization routine of my module: pairadd( &request->config_items, pairmake("User-Password", password, T_OP_CMP_EQ) ); with: pairadd( &request->config_items, pairmake("Cleartext-Password", password, T_OP_CMP_EQ) ); But the daemon started to give "Login incorrect" errors (with no other error description), so I had to revert the change. What am I missing? Thanks. -- ___________________________________________________ __ |- giannici(a)neomedia.it |ederico Giannici http://www.neomedia.it ___________________________________________________

3 5

Nortel telnet authentication using FreeRadius
by Paul Conn 08 Feb '07

08 Feb '07

Anyone have experience configuring Nortel devices (450/60/70) for radius, telnet/ssh authentication? I keep getting "Sending Access-Accept of id 2 to x.x.x.x port 1024. Thanks. Paul Conn

4 4

PAP2EAP bridging
by Dinko Korunic 08 Feb '07

08 Feb '07

Hi. Due to the various reasons, we have to use PAP on our NASes. I would like to setup a FreeRADIUS proxy server which will tunnel a regular PAP requests from remote NASes into an EAP requests (TTLS) than can be proxied to remote FreeRADIUS servers in a more secure manner. At this moment we have a PAP to EAP bridge which utilises multithreaded Java server based on TinyRadius server API which invokes eapol_test as a client per every given request. This is quite ugly hack, unfortunately. Judging from the rlm_eap and proxy code in FreeRADIUS, I would say there is no way of doing it with current modules/code. I thought of hacking rlm_eap and making it to copy PAP requests to TTLS ones which can be later proxied. Is this the correct way? Thank you in advance. -- NAME:Dinko.kreator.Korunic DISCLAIMER:Standard.disclaimer.applies IRC:kre ICQ:16965294 JAB:kreatorMoo@jabber.org PGP:0xea160d0b HOME:http://dkorunic.net BLOG:http://dkorunic.wordpress.com

2 2

specific username, specific conexion
by Santiago Balaguer García 08 Feb '07

08 Feb '07

1 0