March 2007 - Freeradius-Users - lists.freeradius.org

Freeradius Login
by robinson santos 30 Mar '07

30 Mar '07

My freeradius is working, the thing is that the computer that logged in, every time that it is turned off it remembers the user and do not ask for it. Can someone help me???

3 4

Re: load balancing 802.1x auth requests
by Arran Cudbard-Bell 30 Mar '07

30 Mar '07

> Message: 4 > Date: Fri, 30 Mar 2007 09:04:40 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: load balancing 802.1x auth requests > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <460CB688.2060804(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Alison Lee wrote: >> We would like to load-balance 802.1X wireless authentications on >> multiple radius servers. The problem is that EAP methods require a >> series of requests and replies between the client and the same radius >> server, but a normal radius proxy will treat each request as a new one >> and forward them to different servers. With the latest release of >> FreeRADIUS, is it possible to keep states in the proxy server so that it >> can distinguish new requests from current outstanding requests? > > No. > > Coincidentally, though, I've been working on upgrading the server core > in preparation for 2.0. > > I *believe* it's possible to add that load-balancing of EAP as a > module. Not as part of EAP, because other methods use State, too. But > it looks to be pretty simple. > > If you're willing to run the CVS head, there may be this capability > next week. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > Id be more than willing to help test this too :) -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

1 0

DEFAULT and users file
by Erico Augusto 30 Mar '07

30 Mar '07

Hi, I'm using EAP-TTLS to supplicant authentication. to authenticate the users at freeradius, I'm using users file to match user's password: .... user User-Password == "test" Reply-Message = "success" .... Is there a way, using DEFAULT, for example, to return success to all users without the necessity to match the User-Password(bypass freeradius authentication). What I'm trying to do is authenticate users just at post-auth. I'm using some examples from doc directory, but without success... Thanks, Erico. __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

3 2

load balancing 802.1x auth requests
by Alison Lee 30 Mar '07

30 Mar '07

Hi, We would like to load-balance 802.1X wireless authentications on multiple radius servers. The problem is that EAP methods require a series of requests and replies between the client and the same radius server, but a normal radius proxy will treat each request as a new one and forward them to different servers. With the latest release of FreeRADIUS, is it possible to keep states in the proxy server so that it can distinguish new requests from current outstanding requests? Any suggestions/insights would be much appreciated. Thanks, Alison Lee Telecommunications and Networking University of Texas

2 1

Res: DEFAULT and users file
by Erico Augusto 29 Mar '07

29 Mar '07

Hi, 1. Post-Auth packet becomes empty with that approach 2. eap module works different with that approach radiusd.conf: authenticate { .... eap .... } Got the output (radiusd -X): Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/10.10.10.1/auth-detail-20070329' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.1/auth-detail-20070329 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_realm: No '@' in User-Name = "agentnode", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 164 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'success' Login OK: [agentnode] (from client erico-gprt port 2 cli 00-40-F4-C5-88-C7) Sending Access-Accept of id 0 to 10.10.10.1 port 2015 Reply-Message = "success" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 10.10.10.1:2015, id=0, length=29 Authentication reply packet code 2 sent to a non-proxy reply port from client erico-gprt:2015 - ID 0 : IGNORED --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 460c15b6 Nothing to do. Sleeping until we see a request. Thanks, Erico. ----- Mensagem original ---- De: joe vieira <jvieira(a)clarku.edu> Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Enviadas: Quinta-feira, 29 de Março de 2007 16:23:24 Assunto: Re: DEFAULT and users file Erico Augusto wrote: > Hi, > > I'm using EAP-TTLS to supplicant authentication. > > to authenticate the users at freeradius, I'm using users file to match > user's password: > .... > user User-Password == "test" > Reply-Message = "success" > .... > Is there a way, using DEFAULT, for example, to return success to all > users without the necessity to match the User-Password(bypass > freeradius authentication). What I'm trying to do is authenticate > users just at post-auth. I'm using some examples from doc directory, > but without success... > Thanks, Erico. > do you mean like,? DEFAULT Auth-Type := Accept Reply-Message = "success" to accept all users and reply success to them or just DEFAULT Reply-Message = "success" just to reply success to everyone (im pretty sure) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

1 0

SNMP support for radius problem
by satish patel 29 Mar '07

29 Mar '07

Dear I have useing freeradius since long time and it is working fine for me but i have some issue thats why i want support for SNMP. means i want to monitor my remote freeradius server through SNMP but it is not work i have read many document FAQ but i didn't get satisfectory ans... My configuration I have compile freeradius with snmp support ( --with-snmp ) $ cat /etc/raddb/snmp.conf smux_password = verysecret snmp_write_access = no $ cat /etc/snmpd/snmpd.conf <---add this line smuxpeer .1.3.6.1.4.1.3317.1.3.1 verysecret restart snmpd daemon $radiusd -X <--- debug mode main: smux_password = "verysecret" main: snmp_write_access = no SMUX connect try 1 SMUX open oid: 1.3.6.1.4.1.3317.1.3.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. SMUX read start SMUX read len: 12 SMUX message received type: 67 rest len: 4 SMUX_RRSP SMUX_RRSP value: 0 errstat: 0 --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Now i have run snmpwalk but i didnt get any output from radius $snmpwalk -v 1 -c public localhost .1.3.6.1.2.1.67.1.1.1.1 End of MIB also i have try many veriasion with MIB but i didntget ans and i m confusing about snmp community when i try with this community verysecret i got Time out so what is the difference between verysecret and public ??? which comunity i use to qurey with my freeradius and how can i check my radius comiple successfuly with SNMP support ??? $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

3 5

Problems with freeradius 1.1.5 (2.0.0) 20070322 with postgresql (SIGHUP => segmentation fault)
by Claudiu Filip 29 Mar '07

29 Mar '07

Hello freeradius-users, I'm running Freeradius 20070322 snapshot with postgresql backend. (I tried older versions too) I have 3 questions for you, all related to $subject. Everything is working fine (the radius is getting the nas clients from the database, doing db auth/acct, etc.) until we send a -HUP to the radiusd.. First one: 8x------8x----- $ /radius/sbin/radiusd -fsX $ killall -HUP radiusd rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 read_config_files: reading realms Thu Mar 22 16:21:23 2007 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Thu Mar 22 16:21:23 2007 : Info: rlm_sql (sql): Attempting to connect to radius@127.0.0.1:5432/dbradius Segmentation fault No core file.. I solved this problem by commenting out the "we do other magic" in mainconfig.c lines 1059->1064. This will disable debug level change on the fly facility, it's not that important anyway 8x-----8x------ Second: 8x-----8x------ rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 3 , fields = 5 rlm_sql (sql): Read entry nasname=1.2.3.4,shortname=nume,secret=secret rlm_sql (sql): Adding client 1.2.3.4 (nume) to clients list Segmentation fault (core dumped) #0 rbtree_insert (tree=0x7d4c4c55, Data=0x80025808) at rbtree.c:246 246 Current = tree->Root; (gdb) bt #0 rbtree_insert (tree=0x7d4c4c55, Data=0x80025808) at rbtree.c:246 #1 0x8000685d in client_add (clients=0x800fbb18, client=0x80025808) at client.c:231 #2 0xb7db29ca in rlm_sql_instantiate (conf=0x8012efc8, instance=0x7d4c4c55) at rlm_sql.c:347 #3 0x8000f77c in find_module_instance (modules=0x8012e5e0, instname=0x80130100 "sql") at modules.c:322 #4 0x80010243 in setup_modules (reload=1) at modules.c:917 #5 0x8000ed65 in read_mainconfig (reload=1) at mainconfig.c:1162 #6 0x80012dc0 in main (argc=2, argv=0xbfdb1a34) at radiusd.c:560 I add DEBUG2("OLD: %p",(void *)old_clients); DEBUG2("NEW: %p",(void *)clients); right before mainconfig.clients = clients; clients_free(old_clients); in mainparse.c Start radiusd -fsX OLD: (nil) NEW: 0x800fbb18 killall -HUP radiusd: OLD: 0x800fbb18 NEW: 0x800fbb18 rlm_sql (sql): Adding client 1.2.3.4 (nume) to clients list Segmentation fault (core dumped) So, we free the same location.. I guess the problem is in the clients_parse_section which doesnt return a new address space. clients.c - if (clients) return clients; + if (clients) clients_free(clients); mainconfig.c - clients_free(old_clients); + if ((void *)old_clients != (void *)clients) + clients_free(old_clients); solved the problem. Do I still need the clients_free(old_clients)? 8x----------8x------------ Three: 8x------------------------ There is any other way to make the radius re-reread its clients from database, without an expensive HUP (and not so easy to send when you add entries to db)? 8x------------------------ Thanks for scrolling this down.. Best wishes, Claudiu FILIP claudiu(a)globtel.ro Phone : +40344880100 http://www.globtel.ro Fax: +40344880113

3 3

logging trouble
by Brad Lachel 29 Mar '07

29 Mar '07

I am trying to create a log that tell me who attempted to login, when, where and what the result was. I have uncommented the auth_log line and the reply_log line as well as the detail auth_log and detail reply_log sections. When I start up radius, it appears that both the auth_log and reply log are activated as they both appear correctly in the instantiated section of the startup process. When an attempt is made to login, the authentication is logged, but the reply is not. What am I missing? I will admit that I am not real comfortable in deciphering the how- to's and config files associated with freeradius, but I think that I have done what I need to in order to get what I am looking for. NOTE: freeradius is being used to authenticate users to wireless access points, the ideal log would look something like this: MAC time WAP IP result Thanks in advance for any help Brad Lachel District Computer Coordinator Community High School District #155 1 South Virginia Road Crystal Lake, IL 60014 815-455-8500 x 28 ----------------------------- All e-mail to and from this address is subject to the Acceptable Use Policies of Community High School District #155. All e-mail may be monitored and/or disclosed to third parties. Any views or opinions presented in an e-mail are solely those of the author and may not represent those of Community High School District #155. Community High School District #155 http://www.d155.org

4 8

ACCESS-REJECT authentication messages are not logged
by Grzegorz_Bech 29 Mar '07

29 Mar '07

Hi I have difficulty in setting radius to create logs of ACCESS-REJECT authentication messages. It logs only ACCESS-ACCEPT packets (sent and received). Double debug mode (radiusd -xx) shows the following lines (when recive ACCESS-REJECT messages): rad_recv: Access-Request packet from host 192.168.12.22:1327, id=63, length=63 --- Walking the entire request list --- Waking up in 31 seconds... Thread 1 got semaphore Thread 1 handling request 1, (2 handled so far) User-Name = "dialog" User-Password = "test" Cisco-NAS-Port = "tty" NAS-IP-Address = 192.168.12.22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_ora3arts : - encode_context rlm_ora3arts (ora3arts): Reserving sql socket id: 28 preparing statement begin :result := t3arts42.iradius.authorize(:context); end; executing statement begin :result := t3arts42.iradius.authorize(:context); end; statement executed begin :result := t3arts42.iradius.authorize(:context); end; result encoded context result:n=0; parsing reply result:n=0; parsing attribute result:n=0 reply parsed , returning -1 rlm_ora3arts : request rejected rlm_ora3arts (ora3arts): Released sql socket id: 28 modcall[authorize]: module "ora3arts" returns reject for request 1 modcall: group authorize returns reject for request 1 Invalid user: [dialog/test] (from client localhost port 0) Sending Access-Reject of id 63 to 192.168.12.22:1327 Finished request 1 Going to the next request Thread 1 waiting to be assigned a request ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- ------------------------------------------------------------------------- Double debug mode (radiusd -xx) shows the following lines (when recive ACCESS-ACCEPT messages): rad_recv: Access-Request packet from host 192.168.12.22:1326, id=62, length=63 Thread spawned new child 1. Total threads in pool: 1 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 1/0/1 Threads: Spawning 2 spares Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread 1 waiting to be assigned a request Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) User-Name = "dialog" User-Password = "test1" Cisco-NAS-Port = "tty" NAS-IP-Address = 192.168.12.22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ora3arts : - encode_context rlm_ora3arts (ora3arts): Reserving sql socket id: 29 preparing statement begin :result := t3arts42.iradius.authorize(:context); end; executing statement begin :result := t3arts42.iradius.authorize(:context); end; Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request statement executed begin :result := t3arts42.iradius.authorize(:context); end; result encoded context result:n=1;Cisco-AVPair:589825:s=shell:priv-lvl=14;Service-Type:6:n=7; parsing reply result:n=1;Cisco-AVPair:589825:s=shell:priv-lvl=14;Service-Type:6:n=7; parsing attribute result:n=1 parsing attribute Cisco-AVPair:589825:s=shell:priv-lvl=14 creating pair Cisco-AVPair shell:priv-lvl=14 Cisco-AVPair = "shell:priv-lvl=14" parsing attribute Service-Type:6:n=7 creating pair Service-Type 7 Service-Type = NAS-Prompt-User reply parsed , returning 1 Cisco-AVPair = "shell:priv-lvl=14" Service-Type = NAS-Prompt-User rlm_ora3arts: check items Auth-Type = Accept rlm_ora3arts: reply items Cisco-AVPair = "shell:priv-lvl=14" Service-Type = NAS-Prompt-User rlm_ora3arts (ora3arts): Released sql socket id: 29 returning OK modcall[authorize]: module "ora3arts" returns ok for request 0 radius_xlat: '/u01/radius_data/detail-20070327' rlm_detail: /u01/radius_data/detail-%Y%m%d expands to /u01/radius_data/detail-20070327 modcall[authorize]: module "auth_log" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [dialog/test1] (from client localhost port 0) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: '/u01/radius_data/detail-20070327' rlm_detail: /u01/radius_data/detail-%Y%m%d expands to /u01/radius_data/detail-20070327 modcall[post-auth]: module "reply_log" returns ok for request 0 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 62 to 192.168.12.22:1326 Cisco-AVPair = "shell:priv-lvl=14" Service-Type = NAS-Prompt-User Finished request 0 Going to the next request Thread 1 waiting to be assigned a request --- Walking the entire request list --- Cleaning up request 0 ID 62 with timestamp 4608ed7f Nothing to do. Sleeping until we see a request. Threads: total/active/spare threads = 3/0/3 ---------------------------------------------------------------------------- --------------------------------------------------------- Perhaps some of you know how to solve this problem? Greg

2 1

OT: MAC OS X - wired 802.1x supplicant
by Michael Messner 29 Mar '07

29 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hey all, not a freeRADIUS problem but I hope that someone can help me. I have no problem with my ibook to connect to a wireless network via 802.1x but I can't find any possibility to make a connection to a 802.1x-secured wired network! Am I blind or is this not supported from OSX? Any other supplicants for OSX available? thanks for every info mIke -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGClVuyUY4xkIcFVQRAlJQAKDiVymIOJat407bwe4ox/yhY14NUgCeOeRu n1WQAIFuiE+PLLw14UZ8pjY= =XoAX -----END PGP SIGNATURE-----

2 1