February 2007 - Freeradius-Users - lists.freeradius.org

VALGRIND: Major impact on authentication!
by Guilherme Franco 08 Feb '07

08 Feb '07

Hello Mr. Alan, Thank you for your concern! Just another message I've seen under /var/log/messages: kernel: radiusd[1672]: segfault at 0000000000000110 rip 0000002a97de2c1e rsp 0000007fbfffe340 error 4 Gonna implement radrelay now, then! (I was holding back because I've seen somewhere in this mail list that it breaks simultaneous-use). Thanks a lot!

1 0

VALGRIND: Major impact on authentication!
by Guilherme Franco 08 Feb '07

08 Feb '07

Hi, I did run "valgrind radiusd -xxx" at Wed Feb 7 19:15:08 2007 and at Wed Feb 7 20:59:04 2007 radiusd DIED. Afterwards, "service radius restart" would not work and of lots of "Error: Internal error processing module entry", "Error: rlm_sql_oracle: fetch failed in sql_fetch_row: ORA-24338: statement handle not executed", and "Error: rlm_sql (sql): failed after re-connect" appeared. I've just disabled accounting in the NAS and then "service radiusd start" worked. Last messages (I have the entire log, 70MB, if you want): Wed Feb 7 20:59:04 2007 : Debug: radius_xlat: 'UPDATE radacct SET AcctStopTime = TO_DATE('2007-02-07 20:56:41','yyyy-mm-dd hh24:mi:ss'), AcctSessionTime = '0', AcctInputOctets = '0', AcctOutputOctets = '0', AcctTerminateCause = 'User-Request', AcctStopDelay = '21', ConnectInfo_stop = '' WHERE AcctSessionId = 'erx GigabitEthernet 11/0.109:2109:0021188786' AND UserName = 'fiba(a)foobar.com' AND NASIPAddress = '10.10.1.2' AND AcctStopTime IS NULL' Wed Feb 7 20:59:04 2007 : Debug: rlm_sql (sql): Reserving sql socket id: 19 00000000 65746D6F 6F632E6C 72622E6D 4E412027 44432044 49544953 31203D20 444E4120 00000000 50545320 45504F47 203D2052 20275327 20444E41 4C425453 4555514F 3D204F49 00000000 274E2720 44524F20 42205245 64692059 00000000 00000000 202068E0 00000000 00000000 04A238D4 00000000 63726573 65746D6F 6F632E6C 72622E6D 04A238DF 00000000 00000000 72677265 2E70756F 00000000 00000000 203D2065 67646172 70756F72 6C706572 00000000 72472E79 4E70756F 20206320 00000000 Argument/Register addr=be20748. Dump of memory from 0x00BE20708 to 0x00BE20848 00000000 0BE20748 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000080 00000000 00000078 00000000 00000000 00000000 00000000 00000000 00000000 0BE207C0 00000000 0BE28C78 00000000 0BE29950 00000000 00000000 0BE2A838 00000000 0BEAFAD8 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000078 00000000 000077C8 00000000 00000000 00000000 00000000 00000000 00000000 F8E9DACB 00000105 00000000 00000000 0BE207C0 00000000 00008048 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0BE28648 00000000 00000000 00000000 00000000 00000000 0BE28738 00000000 00000000 00000000 00000000 0BE26CE0 00000000 00000000 00000000 0BE20DB8 00000000 00000000 00000000 00000000 Argument/Register addr=4e936d0. Dump of memory from 0x004E93690 to 0x004E937D0 00000000 36353433 2E393837 203A5F2D 0000002F 00000000 00000000 00000000 00000000 00000000 00000078 00000000 00000038 00000000 00000000 00000000 00000000 00000000 00000000 006C7173 00000000 00000000 00000000 00000000 00000000 00000000 00000038 00000000 00000150 00000000 00000000 00000000 00000000 00000000 00000000 006C7173 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 Repeat 4 times 00000000 00000000 00000000 00000000 00000000 Argument/Register addr=4e91e9a. Dump of memory from 0x004E91E5A to 0x004E91F9A 00000000 20444E41 49534443 00000000 3D204954 41203120 5320444E 4F475054 20524550 5327203D 4E412027 54532044 00000000 514F4C42 4F494555 27203D20 4F20274E 52454452 20594220 00006469 00000000 00000000 00000000 00000000 00000000 00000000 000000D0 00000000 00000098 00000000 00000000 00000000 00000000 00000000 00000000 454C4553 69205443 73552C64 614E7265 00000000 412C656D 69727474 65747562 6C61562C 6F2C6575 52462070 72204D4F 65726461 00000000 20796C70 52454857 73552045 616E7265 3D20656D 7B252720 2D4C5153 72657355 00000000 6D614E2D 20277D65 4544524F 59422052 00646920 00000000 00000000 00000000 00000000 00000000 00000000 00000098 00000000 00000138 00000000 00000000 00000000 00000000 00000000 00000000 454C4553 72205443 72676461 6370756F 6B636568 2C64692E 00000000 67646172 70756F72 63656863 72472E6B 4E70756F 2C656D61 67646172 Argument/Register addr=20206270. Dump of memory from 0x020206230 to 0x020206370 00000000 44432044 49544953 31203D20 444E4120 00000000 50545320 45504F47 203D2052 20275327 20444E41 4C425453 4555514F 3D204F49 00000000 274E2720 44524F20 42205245 64692059 00000000 00000000 202068E0 00000000 00000000 04A238D4 00000000 63726573 65746D6F 6F632E6C 72622E6D 04A238DF 00000000 00000000 72677265 2E70756F 00000000 00000000 203D2065 67646172 70756F72 6C706572 00000000 72472E79 4E70756F 20206320 00000000 0FB0B12C 32310000 FFFFFFFF FFFFFFFF 00000000 0FB0B12C 00000000 0FB0B12C 00000000 20206440 00000000 04A238D4 00000000 00000000 00000006 00000000 0FBADC38 00000000 0FB0B12C 00000000 7185CFB9 00000039 00000000 FBAD8001 00000000 0FB0B12C 00000000 0FB0B12C 00000000 0FB0B12C 00000000 00000000 0FB0B12C 00000000 0FB0B137 00000000 FFFFFFFF FFFFFFFF 0FB0B12C 00000000 00000000 FFFFFFFF FFFFFFFF 00000000 00000000 ----- End of Call Stack Trace ----- ==30772== ==30772== Invalid write of size 1 ==30772== at 0x5E82AD0: kpuhhrsp (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5E918FA: kpuexResPrefRows (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5E9791F: kpuexecv8 (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5E946C2: kpuexec (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5F44B0A: OCIStmtExecute (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5A6B4FA: sql_select_query (sql_oracle.c:301) ==30772== by 0x59670BA: rlm_sql_select_query (sql.c:538) ==30772== by 0x5967195: sql_getvpdata (sql.c:583) ==30772== by 0x5965690: rlm_sql_authorize (rlm_sql.c:759) ==30772== by 0x40D172: modcall (in /usr/local/sbin/radiusd) ==30772== by 0x40D710: (within /usr/local/sbin/radiusd) ==30772== by 0x40D2B6: modcall (in /usr/local/sbin/radiusd) ==30772== Address 0x0 is not stack'd, malloc'd or (recently) free'd ==30772== ==30772== Process terminating with default action of signal 11 (SIGSEGV) ==30772== Access not within mapped region at address 0x0 ==30772== at 0x5E82AD0: kpuhhrsp (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5E918FA: kpuexResPrefRows (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5E9791F: kpuexecv8 (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5E946C2: kpuexec (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5F44B0A: OCIStmtExecute (in /usr/local/instantclient_10_2/libclntsh.so.10.1) ==30772== by 0x5A6B4FA: sql_select_query (sql_oracle.c:301) ==30772== by 0x59670BA: rlm_sql_select_query (sql.c:538) ==30772== by 0x5967195: sql_getvpdata (sql.c:583) ==30772== by 0x5965690: rlm_sql_authorize (rlm_sql.c:759) ==30772== by 0x40D172: modcall (in /usr/local/sbin/radiusd) ==30772== by 0x40D710: (within /usr/local/sbin/radiusd) ==30772== by 0x40D2B6: modcall (in /usr/local/sbin/radiusd) ==30772== ==30772== ERROR SUMMARY: 129640 errors from 286 contexts (suppressed: 7 from 2) ==30772== malloc/free: in use at exit: 9,108,522 bytes in 39,502 blocks. ==30772== malloc/free: 683,099 allocs, 643,597 frees, 151,100,648 bytes allocated. ==30772== For counts of detected errors, rerun with: -v ==30772== searching for pointers to 39,502 not-freed blocks. Thanks!

3 3

a problem about radius and ldap
by Ramazan Ulker 08 Feb '07

08 Feb '07

Hi I'm working on 802.1x implementation(cisco 2950, freeradius, ldap), i face a problem. First of all, defining users and passwords in users file in raddb works well with md5 authentication. Then i tried to use ldap, then with radtest i get accept-accept packet. But while authenticating from xp client with md5-challenge, I got Auth:rlm_ldap:Attribute "User-Password" is required for authentication error. In one of the e-mail you said don't authenticate from ldap, but with radtest function i get success!!! The passwords are kept clear text. I'm looking forward to getting your help. I also send radius debug log. Best Regards Ramazan Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "192.168.100.18" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "" ldap: start_tls = no ldap: password = "" ldap: basedn = "dc=dot1x.com" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "radiusgroupname" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "radiusGroupName" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes conns: (nil) rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8101f58 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 rlm_eap: Loaded and initialized the type md5 rlm_eap: Loaded and initialized the type leap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on IP address *, ports 1812/udp and 1813/udp, with proxy on 1814/udp. Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.17:1812, id=11, length=129 NAS-IP-Address = 192.168.100.17 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "ramazan" Called-Station-Id = "00-0F-8F-77-DB-81" Calling-Station-Id = "00-12-79-AE-D2-4D" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000c0172616d617a616e Message-Authenticator = 0x68c41631d4feb2234d900b37a9845348 modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_eap: EAP packet type notification id 0 length 12 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated for request 0 rlm_realm: No '@' in User-Name = "ramazan", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched DEFAULT at 152 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=dot1x.com' radius_xlat: '(uid=ramazan)' ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.100.18:389, authentication 0 rlm_ldap: bind as / to 192.168.100.18:389 rlm_ldap: waiting for bind result ... rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com ))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc=dot1x.com )))' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=dot1x.com, with filter (&(cn=VPN)(|(&(objectClass=GroupOfNames)(member=uid=ramazan,cn=users,cn=idc,dc= dot1x.com))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid=ramazan,cn=users,cn=idc,dc= dot1x.com)))) rlm_ldap: object not found or got ambiguous search result ldap_release_conn: Release Id: 0 ldap_get_conn: Got Id: 0 rlm_ldap: performing search in uid=ramazan,cn=users,cn=idc,dc=dot1x.com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: User found in group VPN ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 171 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ramazan radius_xlat: '(uid=ramazan)' radius_xlat: 'dc=dot1x.com' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=dot1x.com, with filter (uid=ramazan) rlm_ldap: checking if remote access for ramazan is allowed by radiusgroupname rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusAuthType as Auth-Type, value ldap & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 6 & op=11 rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 rlm_ldap: Adding radiusClass as Class, value group-net & op=11 rlm_ldap: user ramazan authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Login incorrect: [ramazan/<no User-Password attribute>] (from client radius port 50001 cli 00-12-79-AE-D2-4D) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 192.168.100.17:1812 Waking up in 4 seconds...

6 12

Cisco-AVPair = "client-mac-address=000f.ea20.e1ad" to Calling-Station-Id = "000f.ea20.e1ad" rule
by Victor 08 Feb '07

08 Feb '07

Hello, I have accouning packet with attributes like: Acct-Session-Id = "0/0/1/3_01000000000000CC" Cisco-AVPair = "client-mac-address=000f.ea20.e1ad" Framed-Protocol = PPP Framed-IP-Address = 192.168.0.235 User-Name = "global" Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=100000000" Cisco-AVPair = "nas-rx-speed=100000000" ... How can i create (or rewrite if exist) Calling-Station-Id attribute with value 000f.ea20.e1ad (MAC from Cisco-AVPair = "client-mac-address=000f.ea20.e1ad") for SQL accounting? If exist Cisco-AVPair with client-mac-address, sure. ps: Im not sure than in current accounting packet its in %{Cisco-AVPair[0]} and not %{Cisco-AVPair[3]} or %{Cisco-AVPair[156]}, etc. Thanx! -- Best regards, Victor mailto:kha0s@ukr.net

2 1

Configuring FreeRADIUS and BAM for Motorola Canopy SM authentication and Bandwidth Maanagement
by Bernard Ochieng 08 Feb '07

08 Feb '07

Hello All, I have configured FreeRADIUS to do bandwidth and authentication together with the BAM server, however the RADIUS does authenticate but it fails on BAM hence the CPEs are not authenticated and registered by the Access Points. Anyone who can help on this? Bernard

3 5

Segmentation fault on PAP calling
by Giovanni Lovato 08 Feb '07

08 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm using FreeRADIUS 1.1.4 compiled from sources on Debian Etch. I backend against LDAP with hashed password. Now I'm trying to configure authentication to use with WPA, but it segfaults on calling PAP: # radiusd -Xxxx 2>&1 ... rad_recv: Access-Request packet from host 192.168.1.250:3074, id=0, length=125 User-Name = "testuser" NAS-IP-Address = 192.168.1.250 Called-Station-Id = "00c0..." Calling-Station-Id = "001..." NAS-Identifier = "00c..." NAS-Port = 223 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020... Message-Authenticator = 0x431... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modsingle[authorize]: calling chap (rlm_chap) for request 0 modsingle[authorize]: returned from chap (rlm_chap) for request 0 modcall[authorize]: module "chap" returns noop for request 0 modsingle[authorize]: calling mschap (rlm_mschap) for request 0 modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modsingle[authorize]: calling suffix (rlm_realm) for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modsingle[authorize]: returned from suffix (rlm_realm) for request 0 modcall[authorize]: module "suffix" returns noop for request 0 modsingle[authorize]: calling eap (rlm_eap) for request 0 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modsingle[authorize]: returned from eap (rlm_eap) for request 0 modcall[authorize]: module "eap" returns updated for request 0 modsingle[authorize]: calling files (rlm_files) for request 0 users: Matched entry DEFAULT at line 152 modsingle[authorize]: returned from files (rlm_files) for request 0 modcall[authorize]: module "files" returns ok for request 0 modsingle[authorize]: calling ldap (rlm_ldap) for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser radius_xlat: '(uid=testuser)' radius_xlat: 'dc=aldu,dc=net' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.laurelin.aldu.net:389, authentication 0 rlm_ldap: bind as cn=radius,dc=aldu,dc=net/PASSWORD to ldap.laurelin.aldu.net:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=aldu,dc=net, with filter (uid=testuser) rlm_ldap: checking if remote access for testuser is allowed by dialupAccess rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value {md5}rL0Y20zC+Fzt72VPzMSk2A== & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 modcall[authorize]: module "ldap" returns ok for request 0 modsingle[authorize]: calling pap (rlm_pap) for request 0 Segmentation fault Some configuration snippets (maybe not useful, but the entire file would have been too long I guess): radiusd.conf: ... modules { .. pap { auto_header = yes } ... } ... authorize { ... ldap pap } authenticate { Auth-Type PAP { pap } ... } ... If I revert the password to clear-text on LDAP, it runs fine and authenticate. Any ideas? Thank you, Giovanni Lovato - -- www.aldu.net/~heruan giovanni.lovato(a)aldu.net ldaps://pgpkeys.aldu.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFygRYaWLXrn9dopwRAjqCAJ9S0ztPnbdnFh4rR5UDkUt25Ix8lACfbBAf 7FY2dwyMEGVi8LTkvuIvhNs= =HQjo -----END PGP SIGNATURE-----

2 2

simple mac-auth
by Mikko Husari 08 Feb '07

08 Feb '07

Hi! im currently running eap-tls with username and password (from ldap), but now we're having a bunch of "stupid" wlan-client machines, and we need an simple mac-auth (from ldap?) to the network. basic idea: (example from outside world) "so, no certificate and login credentials, cant let you in. but im on an vip-list!. Oh, i see, come on in, sorry for inconvenience", for now we are happy to get just that to work, next level would be something concerning vlans... i think (in the long run) we don't want to have too much accessibility in those stupid machines. poorly explained, not enough coffee in veins yet... thanks in advance

2 6

Re: authentication according to nas ip adress
by Stefan Winter 08 Feb '07

08 Feb '07

Hello, (please send your messages to the mailing list for the benefit of everyone) > Hey, this problem is almost exactly related to what I'm trying to do which > is give 2 different responses based on the source NAS ID. The user could > potentially come from either NAS IP, but they need a specific response that > is different depending on which NAS they send the request from. Is there a > way to do this in SQL form? I prefer doing it in the users file, as in DEFAULT Client-IP-Address == 1.2.3.4 Your-Reply-Attribute-Here = whatever, Another-Reply-Attribute = stuff In SQL, this is more difficult because AFAIK the DEFAULT user doens't get evaluated here properly. Not sure though. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

1 0

Assign static ip based on MAC
by N S 08 Feb '07

08 Feb '07

Is there a way in the radius to assign static ip based on MAC either in config files or through a script. I want some MAC to always have a fixed ip on the LAN. Thanks Naeem. _________________________________________________________________ Invite your Hotmail contacts to join your friends list with Windows Live Spaces http://clk.atdmt.com/MSN/go/msnnkwsp0070000001msn/direct/01/?href=http://sp…

5 5

EAP-TLS issues
by Riccardo Veraldi 07 Feb '07

07 Feb '07

Hello, I would like to authorize users based on their certificate. Actually is only possible to look at CN using freeradius. Is there any plan to support looking at the complete DN of the certificate so that is possible to check for Locality field or other fileds inside hte certificate subject ? Often hte CN is not a unique method, more than one user can have same CN if the locality is different. This happens in my situation for example. IS there a way to check against other fields of the certificate other than CN ? Is it planned to be supported one day ? thanks Rick

2 1