February 2007 - Freeradius-Users - lists.freeradius.org

eap-tls certificates: help needed
by Arjuna Scagnetto 07 Feb '07

07 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi everyone, i'm trying to make freeradius works with the eap-tls and ttls, but i can't go so far. Can someone tell me a link or an updated howto or a book to be bought, to learn how to make the certificates, i need just some references, i've found only howto dated from 2002 to 2005 and they are too old ofcourse. any help would be greatly apreciated Arjuna -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFFyksn7hNGJisFPxQRAv3/AJ4oj7E+Cg9JnylPSKR2uCYjDiVkSgCgp6OT xjynN2T6CkLOb16BHF1JE0c= =wVsc -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

radiusd: memory use problem
by German Hernandez 07 Feb '07

07 Feb '07

Hi! I need please your help about this problem: we have working RADIUS Server (FreeRADIUS) with OpenLDAP like users database and MySQL for accounting; Serving WLAN users, with about 5,000 connections every day. FreeRadius and MySQL at the same Computer. radiusd usually use beetwen 0.5 and 3.0 of %MEM, but sometimes memory use (by radiusd) begins to increase; for example, some times in one week of 0.5 %MEM it arrives until 40 %MEM, then I need to restart the radiusd daemon. Somebody could help me? Thanks in advance German Common errors from radius.log: ... Wed Feb 7 08:13:41 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:13:41 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:13:41 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:13:42 2007 : Error: rlm_radutmp: Logout entry for NAS MYNAS port 4331 has wrong ID Wed Feb 7 08:13:44 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:13:44 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:13:44 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:13:44 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Feb 7 08:13:46 2007 : Error: rlm_radutmp: Logout for NAS MYNAS port 4462, but no Login record Wed Feb 7 08:14:05 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:14:05 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:06 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:14:06 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:06 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:06 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Feb 7 08:14:11 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:14:11 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:11 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:12 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Feb 7 08:14:21 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:14:21 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:21 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:21 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Feb 7 08:14:27 2007 : Error: rlm_radutmp: Logout entry for NAS MYNAS port 4744 has wrong ID Wed Feb 7 08:14:35 2007 : Error: --> verify error:num=20:unable to get local issuer certificate Wed Feb 7 08:14:35 2007 : Error: TLS Alert write:fatal:unknown CA Wed Feb 7 08:14:35 2007 : Error: TLS_accept:error in SSLv3 read client certificate B Wed Feb 7 08:14:35 2007 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Wed Feb 7 08:14:35 2007 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Wed Feb 7 08:14:35 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:14:35 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:36 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:40 2007 : Error: TLS_accept:error in SSLv3 read finished A Wed Feb 7 08:14:40 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:41 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:41 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:14:58 2007 : Error: rlm_radutmp: Logout entry for NAS MYNAS port 4993 has wrong ID Wed Feb 7 08:14:59 2007 : Error: rlm_radutmp: Logout entry for NAS MYNAS port 4993 has wrong ID Wed Feb 7 08:15:13 2007 : Error: rlm_radutmp: Logout entry for NAS MYNAS port 4312 has wrong ID Wed Feb 7 08:15:21 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:15:21 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:15:21 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:15:21 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Feb 7 08:15:39 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:15:39 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:15:54 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:15:54 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:15:54 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:15:55 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Feb 7 08:16:02 2007 : Error: rlm_radutmp: Logout entry for NAS MYNAS port 4390 has wrong ID Wed Feb 7 08:16:03 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:16:03 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:16:04 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:16:04 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Feb 7 08:16:05 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:16:05 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:16:05 2007 : Error: --> verify error:num=20:unable to get local issuer certificate Wed Feb 7 08:16:05 2007 : Error: TLS Alert write:fatal:unknown CA Wed Feb 7 08:16:05 2007 : Error: TLS_accept:error in SSLv3 read client certificate B Wed Feb 7 08:16:05 2007 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Wed Feb 7 08:16:05 2007 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Wed Feb 7 08:16:11 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:16:11 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:16:11 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:16:11 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Wed Feb 7 08:16:11 2007 : Error: rlm_radutmp: Logout for NAS MYNAS port 5172, but no Login record Wed Feb 7 08:16:25 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Feb 7 08:16:25 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:16:25 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Wed Feb 7 08:16:25 2007 : Info: rlm_eap_mschapv2: Issuing Challenge ... --------------------------------- Do You Yahoo!? La mejor conexión a Internet y 2GB extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Again: Major impact on authentication!
by Guilherme Franco 07 Feb '07

07 Feb '07

Hello, Thanks to everyone! I'm using Oracle just for radcheck/radacct and PostgreSQL for radippool only. No, Mr. Peter, no one is using dial-up admin nor anything alike when the problem occurs, just pure auth (without acct). I've disabled the cron.hourly job and the problem appeared again after some hours. A simple radiusd restart solves the problem. As this causes impact, I can't afford to do this all the time just to debug, but I think I gonna run a script to capture all the radiusd -xxx messages, so when the behaviour starts, I can see what's happening. Also, it's important to note that this server is the proxy radius and those error messages appear: Error: Discarding duplicate request from client ERX-1:50000 - ID: 115 due to unfinished request 32 Info: The maximum number of threads (32) are active, cannot spawn new thread to handle request Error: WARNING: Unresponsive child (id 1315006816) for request 105 With acct: Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user 'joe.black(a)foo.com', nas '10.10.2.1'] Error: Internal error processing module entry Thank you. On 2/6/07, Peter Nixon <listuser(a)peternixon.net> wrote: > On Mon 05 Feb 2007 13:05, A.L.M.Buxey(a)lboro.ac.uk wrote: > > Hi, > > > > > Freeradius 1.1.4 is randomly losing connection to both databases and > > > it's causing total loss in the authentication process: > > > > from a historical perspective you may find that is wasnt the 1.1.4 upgrade > > that has broken things - your database may have finally become too big and > > unwieldy. this has certainly been the case in many such cases. I would > > check how long your database queries/inserts are taking. perhaps > > vacuum/optimise the tables, move/drop older entries, create better KEYs > > for the purposes you need. > > The _random_ problems don't coincide with a user running a usage report from > a web interface by any chance do they?? > > Regards > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

3 8

Management of temporary users
by Nick Owen 07 Feb '07

07 Feb '07

Greetings: I am looking for the best way to provision groups of users for temporary access across multiple servers. The users would be using ssh and sudo. They would be assigned to a group of servers, then removed after the job was complete. There a hundreds of servers involved. I was thinking that I could use freeradius with dialup_admin to quickly add and remove users from huntgroup, but it doesn't appear that huntgroups are supported in dialup_admin, or am I missing something? Any suggestions welcome. Sincerely, nick -- Nick Owen WiKID Systems, Inc. 404.962.8983 (desk) 404.542.9453 (cell) http://www.wikidsystems.com At last, two-factor authentication, without the hassle factor Now open source: http://sourceforge.net/projects/wikid-twofactor/

2 2

remove the white space
by Ashraf Al-Basti 07 Feb '07

07 Feb '07

Dear, i have successfully replace the username from a file but it add "\n" or a white space for it, i'm using echo or cat command and the same result, here is the output for the debug, please advice how can i remove it..... modcall: entering group pre-proxy for request 1 radius_xlat: 'wanadoo' radius_xlat: Running registered xlat function of module exec for string '/bin/echo 11111111111111' rlm_exec (exec): Executing /bin/echo 11111111111111 radius_xlat: '/bin/echo 11111111111111' Exec-Program: /bin/echo 11111111111111 Exec-Program output: 11111111111111 Exec-Program-Wait: plaintext: 11111111111111 Exec-Program: returned: 0 rlm_exec (exec): result 0 radius_xlat: '11111111111111 ' rlm_attr_rewrite: Changed value for attribute User-Name from 'wanadoo' to '11111111111111 ' rlm_attr_rewrite: Could not find value pair for attribute User-Name modcall[pre-proxy]: module "fixusername" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/172.16.5.188/pre-proxy-detail-20070206' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/172.16.5.188/pre-proxy-detail-20070206 modcall[pre-proxy]: module "pre_proxy_log" returns ok for request 1 modcall: group pre-proxy returns ok for request 1 Sending Access-Request of id 1 to 10.3.83.11:1812 User-Name = "11111111111111\n" NAS-IP-Address = 10.0.0.2 Called-Station-Id = "080010101" User-Password = "11111111111111" Proxy-State = 0x31

2 4

online users checking
by satish patel 07 Feb '07

07 Feb '07

Dear all I have freeradius with mssql setup but dialup_admin not support MSSQL so how do i check online users on radius server is it any solution regarding this isse please inform me Satish patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

radiusd servies automaticly die
by satish patel 06 Feb '07

06 Feb '07

Dear ALL i have some problem of regradig radius service when i start radiusd daemon and after few min its process down or radius service stoped so what is the problem ??? Satish patel --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 1

counter module usage question
by tzieleniewski 06 Feb '07

06 Feb '07

Hi!! I am trying to utilize the counter module. I tried to do everything as it is written in the comments from the radiusd.conf file. unfortunately I still have some problem to make it work and fully understand. I ask for your assistance and small explanation. As I understood the counter modules generally controls the login process of the users, where logging is equivalent of sending a request to the radius server. So whenever the request is received by radius the module investigates the content of the packet. It checks if there are parameters corresponding to the 'count-attribute' and 'key' parameters defined for that module. Then if they are present it creates a counter which is stored in the 'filename' file. Then it updates the value of the 'counter-name' parameter which will be passed further with the packet. So now if I want to control the process further I need to make the proper modification in the users file against the value of the parameter pointed by the check-name parameter from the counter module configuration, am I right? Is there a way to somehow set the default value for 'check-name' parameter in the module configuration in the radiusd.conf? Thank You for your time!! tomasz

1 0

authentication according to nas ip adress
by Marc Boisis-Delavaud 06 Feb '07

06 Feb '07

Hello How can I do this with freeradius: If auth request come from NAS1 use ldap1 if auth request come from NAS2 use ldap2

4 5

Hibernating: Major impact on authentication!
by Guilherme Franco 06 Feb '07

06 Feb '07

Hello, Considering that all things indicate that there might be a problem with the DB, I did some tweaks in PostgreSQL and took off the cron.hourly job. Gonna watch out for problems then, thanks! --------------------------------------------------------- Hi, Freeradius 1.1.4 is randomly losing connection to both databases and it's causing total loss in the authentication process: Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Info: rlm_sql (sql_postgresql): There are no DB handles to use! skipped 0, tried to connect 0 Info: The maximum number of threads (32) are active, cannot spawn new thread to handle request Running either in multi or single threaded mode, that messages appeared 47.099,00 times since Jan 27! Freeradius is configured with 32 max_servers and 32 connections to each DB. There's no starving since no accounting is being used and the server have to handle just 3 auths per second. Every time this happens, no one can authenticate and doing a restart in Freeradius solves the problem. To circumvent the problem, I've added a cron.hourly job so each hour a "service radiusd restart" is issued. As this is random, it's hard to debug, but at the same time freeradius loses the connection, several other applications can successfully connect/ maintain previous established connections to the databases. I've enabled all sorts of debug in the databases trying to better understand why freeradius is doing this, but there was no luck. I've installed the latest CVS and the same problem appeared, please help!

3 3