April 2007 - Freeradius-Users - lists.freeradius.org

Freeradius Testing
by Fernando Prince 07 Apr '07

07 Apr '07

I am using freeradius_1.1.3 i want to test the capacity of it. For that i m using radclient tool to measure the capacity. I want to test how much request per second radius is capable to handle for that i m firing the below mention command. echo "User-Name = 10001(a)10.0.0.1", "CHAP-Password = 1234" | radclient 10.0.0.2 auth test123 But when i m using -n option with radclient it is giving me below error # echo "User-Name = 10001(a)10.0.0.1", "CHAP-Password = 1234" | radclient -n 10 10.0.0.2 auth test123 radclient: invalid option -- n Usage: radclient [options] server[:port] <command> [<secret>] <command> One of auth, acct, status, or disconnect. -c count Send each packet 'count' times. -d raddb Set dictionary directory. -f file Read packets from file, not stdin. -r retries If timeout, retry sending the packet 'retries' times. -t timeout Wait 'timeout' seconds before retrying (may be a floating point number). -i id Set request id to 'id'. Values may be 0..255 -S file read secret from file, not command line. -q Do not print anything out. -s Print out summary information of auth results. -v Show program version information. -x Debugging mode. When i am seeing the man radclient Than the option n is giving so please tell me how should i use the command . Thanks

2 3

SQL Groups broken in v 1.1.5 but fixed in CVS head :)
by Arran Cudbard-Bell 07 Apr '07

07 Apr '07

Hi, Updated The sql querys to honour priority field, and happily it seems that rlm_sql processes groups in the order they come out of the database... which is good. What the packets below are show, is that if the group with the highest priority has all it's check items match, then it's reply items are added fine. However if the first group doesn't match then the other groups arn't processed ! So although the user is still authorised via LDAP none of the group reply items are sent :( If the priority of the groups is reversed, so the 'nas_admins' group comes out of the database first, then the nas_admins reply items work, but the roaming_users group doesn't *sigh*. Would also appear that CIDR ip notation doesn't work for NAS-IP-Address ... But thats not too bad, as you can stick the relevant NAS's in a huntgroup and check against that instead. * Confirmed this is broken in branch_1_1 * Confirmed this is fixed in CVS head with group priority being honoured properly. Don't suppose there's any chance of bringing some of the changes in the CVS Head rlm_sql over to branch_1_1 for the next 1.1.* release is there ? .... Namely the new sql_clients function with the user definable query, and the new groups handling. As the groups handling is a pretty major bug, and i'm sure anyone else using sql will be having issues with the later releases. Oh and a huge great big thanks, to whoever fixed rlm_sql in the cvs head ... I think it was Alexander Serkin. :) *Rad Group Check SQL query:* SELECT radgroupcheck . id , radgroupcheck . GroupName , radgroupcheck . Attribute , radgroupcheck . Value , radgroupcheck . op FROM radgroupcheck , usergroup WHERE usergroup . UserName = 'ac221' AND usergroup . GroupName = radgroupcheck . GroupName ORDER BY usergroup . priority DESC , radgroupcheck . GroupName LIMIT 0, 30 ; *Rows:* 2 id GroupName Attribute Value op 5 roaming_users Service-Type Framed-User == 1 nas_admins Service-Type NAS-Prompt-User == *Rad Group Reply* *SQL query:* SELECT radgroupreply . id , radgroupreply . GroupName , radgroupreply . Attribute , radgroupreply . Value , radgroupreply . op FROM radgroupreply , usergroup WHERE usergroup . UserName = 'ac221' AND usergroup . GroupName = radgroupreply . GroupName ORDER BY usergroup . priority DESC , radgroupreply . GroupName LIMIT 0, 30 ; *Rows:* 7 id GroupName Attribute Value op 3 roaming_users Tunnel-Type 13 = 4 roaming_users Tunnel-Medium-Type 6 = 5 roaming_users Tunnel-Private-Group-ID 134 = 8 roaming_users Service-Type 4 = 10 roaming_users Fall-Through yes = 1 nas_admins Service-Type 6 = 9 nas_admins Fall-Through yes = Sending Access-Request of id 178 to 139.184.**.*** port 1812 User-Name = "ac221" User-Password = "nopassword" Service-Type = NAS-Prompt-User NAS-IP-Address = 139.184.8.1 rad_recv: Access-Accept packet from host 139.184.**.***:1812, id=178, length=20 Sending Access-Request of id 225 to 139.184.**.*** port 1812 User-Name = "ac221" User-Password = "nopassword" Service-Type = Framed-User NAS-IP-Address = 139.184.8.1 rad_recv: Access-Accept packet from host 139.184.**.***:1812, id=225, length=43 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "134" Service-Type = Callback-Framed-User Thanks, Arran

3 3

problem with EAP-TLS
by Ivan 06 Apr '07

06 Apr '07

Hi, i am using freeradius 1.1.3 and i have a problem with eap-tls, in full log it seems that it works, but windows xp client cannot connect here is the log Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/testCA/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/testCA/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/testCA/cacert.pem" tls: private_key_password = "" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Initializing the thread pool... thread: start_servers = 5 thread: max_servers = 32 thread: min_spare_servers = 3 thread: max_spare_servers = 10 thread: max_requests_per_server = 0 thread: cleanup_delay = 5 Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread spawned new child 4. Total threads in pool: 4 Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 5 waiting to be assigned a request rad_recv: Access-Request packet from host 10.0.0.195:1812, id=121, length=99 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) User-Name = "testing.zssdk.edu.sk" NAS-IP-Address = 10.0.0.195 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02bf00190174657374696e672e7a7373646b2e6564752e736b Message-Authenticator = 0xef6f9f8a1914826c9e2d1b96313d9ba1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testing.zssdk.edu.sk", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 191 length 25 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 62 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 121 to 10.0.0.195 port 1812 Reply-Message = "ALL OK" EAP-Message = 0x01c000160410b00adae82f7f2b29ad57a58d5565ae91 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51818fc8c3ad564ec1951724db30b737 Finished request 0 Going to the next request and here are many messages like this and it ends with: Finished request 17 Going to the next request Thread 3 waiting to be assigned a request --- Walking the entire request list --- Cleaning up request 4 ID 125 with timestamp 461696c4 Cleaning up request 5 ID 126 with timestamp 461696c4 Cleaning up request 6 ID 127 with timestamp 461696c4 Cleaning up request 7 ID 128 with timestamp 461696c4 Sending Access-Reject of id 132 to 10.0.0.195 port 1812 Reply-Message = "ALL OK" Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 129 with timestamp 461696c5 Cleaning up request 9 ID 130 with timestamp 461696c5 Cleaning up request 10 ID 131 with timestamp 461696c5 Cleaning up request 11 ID 132 with timestamp 461696c5 Cleaning up request 12 ID 133 with timestamp 461696c5 Cleaning up request 13 ID 134 with timestamp 461696c5 Cleaning up request 14 ID 135 with timestamp 461696c5 Cleaning up request 15 ID 136 with timestamp 461696c5 Cleaning up request 16 ID 137 with timestamp 461696c5 Cleaning up request 17 ID 138 with timestamp 461696c5 Nothing to do. Sleeping until we see a request. thanks for your help

2 1

cisco device says "% Backup authentication" and won't log me in
by Molteni Davide 06 Apr '07

06 Apr '07

I configured freeradius on a Fedora Core 6 machine to use PAP against a cisco switch radtest on localhost is successfully. I think radiusd.conf users and clients.conf files are ok >From the cisco device after I insert user and password telnetting to it I got: % Backup authentication 000206: Apr 5 12:42:29: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.25.110.8:1645, 1646 is not responding. 000207: Apr 5 12:42:29: %RADIUS-4-RADIUS_ALIVE: RADIUS server 172.25.110.8:1645 ,1646 has returned. the cisco device won't let me log in... 172.25.110.8 is the right IP of the freeradius And this is the freeradius server log: rad_recv: Access-Request packet from host 172.25.110.109:21645, id=37, length=77 NAS-IP-Address = 172.25.110.109 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "test" Calling-Station-Id = "172.25.120.40" User-Password = "test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry test at line 218 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 37 to 172.25.110.109 port 21645 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.110.109:21645, id=37, length=77 Sending duplicate reply to client SW-DATA-1:21645 - ID: 37 Re-sending Access-Accept of id 37 to 172.25.110.109 port 21645 --- Walking the entire request list --- Cleaning up request 0 ID 37 with timestamp 4614ef14 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.25.110.109:21645, id=37, length=77 NAS-IP-Address = 172.25.110.109 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "test" Calling-Station-Id = "172.25.120.40" User-Password = "test" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry test at line 218 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 37 to 172.25.110.109 port 21645 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.110.109:21645, id=37, length=77 Sending duplicate reply to client SW-DATA-1:21645 - ID: 37 Re-sending Access-Accept of id 37 to 172.25.110.109 port 21645 --- Walking the entire request list --- Cleaning up request 1 ID 37 with timestamp 4614ef1f Nothing to do. Sleeping until we see a request. I can't figure out what's wrong... It's seems that something missing on the cisco side Is right that radius send back Access-Accept on port 21645? Thanks in advance

3 5

Re : problem with freeradius & fedors core 5,6
by Eshun Benjamin 06 Apr '07

06 Apr '07

> Module: Library search path is /usr/local/lib > *** glibc detected *** radiusd: double free or corruption (fasttop): > 0x090fcde8 *** if you are installing 1.1.5 then install cvs . $ cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login CVS password: anoncvs $ cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout -r branch_1_1 radiusd ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Jackson Jerry-NPC637 <Jerry.Jackson(a)motorola.com> À : Jackson Jerry-NPC637 <Jerry.Jackson(a)motorola.com>; freeradius-users(a)lists.freeradius.org Envoyé le : Jeudi, 5 Avril 2007, 16h16mn 58s Objet : problem with freeradius & fedors core 5,6  Hi I hope I haven’t missed something obvious, but am having trouble getting radius to start after /configure/make/make install running Fedora core 5 or 6. This is the error – [root@LinuxServer freeradius-1.1.5]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib *** glibc detected *** radiusd: double free or corruption (fasttop): 0x08b30140 *** ======= Backtrace: ========= /lib/libc.so.6[0x8d6f18] /lib/libc.so.6(__libc_free+0x79)[0x8da41d] /usr/local/lib/libltdl.so.3[0x5736bb] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xbe)[0x57404e] radiusd(find_module_instance+0x317)[0xf571a7] radiusd(setup_modules+0x1d8)[0xf57758] radiusd(main+0x45c)[0xf5ad8c] /lib/libc.so.6(__libc_start_main+0xdc)[0x8887e4] radiusd[0xf4ecd1] Thanks for your help. Jerry J. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

3 7

Segfault after HUP
by Bastiaan van Kesteren 06 Apr '07

06 Apr '07

Hello, I'm running a freeradius server on a fresh slackware 11 installation. Everything seems to work OK, except after i've done a 'killall -HUP radiusd'. The server reloads it's configurationfiles, but once the first request comes in after this, it segfaults. I'm using the standard config whit the exception of an added fast_users module, which is also the onlyone I use for authentication. I currently have only one user in the users_fast file. Is this a known problem? What can I do to fix this? If you need more info, do ask. -Bastiaan

2 1

Getting required information from freeradius accounting log
by Diot, Sylvain 06 Apr '07

06 Apr '07

Hi all, Is there any kind of tool like a log viewer that would allow me to "extract" the information I want from the /var/log/radius/acct-radius.log? I'd like to be able to obtain a report that would look like this: +-----------------------------------------+ | Session Start Date/Time | +-----------------------------------------+ | Session Stop Date/Time | +-----------------------------------------+ | Session Duration | +-----------------------------------------+ | Client Username | +-----------------------------------------+ | Client MAC Address (Calling ID Station) | +-----------------------------------------+ | User IP Address | +-----------------------------------------+ | NP Policy Name | +-----------------------------------------+ | Tunnel Private Group ID | +-----------------------------------------+ I have to mention I don't have any experience in scripting. Cheers, Sylvain Sylvain Diot Network Support Officer Infrastructure Services Directorate of Information Technology University of Aberdeen sylvain.diot(a)abdn.ac.uk Tel: 01224 272083

3 2

Cisco Configuration
by Norman Zhang 06 Apr '07

06 Apr '07

Hi, I'm learning how to use freeradius. Does anyone have a working conf that works for cisco devices? Regards, Norman Zhang

4 3

TTLS/MSChapv2 Failure
by Andrew 05 Apr '07

05 Apr '07

[sorry for sending the previous email without a subject] When I am goind TTLS/MSChapv2 with wrong username/password comination, I found the FreeRadius server is sending out EAP-Failure message to the Security Supplicant. My question is according to MSChapv2 RFC, a MSChapv2 Failure packet is also supposed to be sent out. Why the MSChapv2 Failure is not sent? Thanks, Andrew -- http://www.fastmail.fm - IMAP accessible web-mail

2 1

None
by Andrew 05 Apr '07

05 Apr '07

When I am goind TTLS/MSChapv2 with wrong username/password comination, I found the FreeRadius server is sending out EAP-Failure message to the Security Supplicant. My question is according to MSChapv2 RFC, a MSChapv2 Failure packet is also supposed to be sent out. Why the MSChapv2 Failure is not sent? Thanks, Andrew -- http://www.fastmail.fm - Does exactly what it says on the tin

1 0