April 2007 - Freeradius-Users - lists.freeradius.org

Huntgroups/preprocess issue 1.1.6
by Craig Huckabee 25 Apr '07

25 Apr '07

If this is already a known issue, forgive me - I did not find anything in the archives or bug database that appeared relevant. I'm trying to upgrade from FreeRADIUS 1.1.2 to 1.1.6 - building from source on Debian Linux (sarge). The build goes without a hitch, but when running the new version and using the existing configuration files I get the following (relevant output from 'radiusd -X'): ... Module: Loaded preprocess preprocess: huntgroups = "/s/freeradius-1.1/etc/raddb/huntgroups" preprocess: hints = "/s/freeradius-1.1/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no /s/freeradius-1.1/etc/raddb/huntgroups[30]: Parse error (check) for entry snt-console: Unknown value 1-22 for attribute NAS-Port rlm_preprocess: Error reading /s/freeradius-1.1/etc/raddb/huntgroups radiusd.conf[249]: preprocess: Module instantiation failed. radiusd.conf[341] Unknown module "preprocess". radiusd.conf[340] Failed to parse authorize section. The section in the huntgroups file it is choking on is this: snt-console NAS-IP-Address == aaa.bbb.ccc.ddd, NAS-Port == 1-22 If I comment that line out, it also chokes on this entry with a slightly different error ( "=" expected): nci-console NAS-IP-Address == aaa.bbb.ccc.ddd, NAS-Port == 1,25-32 So - did the syntax for huntgroups change or is this a real bug ? This config works fine with 1.1.2 - I have not tried any of the versions between 1.1.2 and 1.1.6 to narrow down the issue. I can send the full debug output if needed but I didn't want to clobber the list unnecessarily. Thanks, Craig

3 4

Accept users by NAS-IP-Address
by Svend Eriksen 25 Apr '07

25 Apr '07

Hi, I'm running version 1.1.6 against a Postgres database. In the radcheck table I check the password and sets Expiration for the users. In the nas table I have listed all the NAS that the users can connect through, and this seems to work fine. I also want the users to be member of a group, where the group gives access to some of the NAS. If I set 'NAS-IP-Address == ip_of_a_nas' in the radgroupcheck, the user can only connect through that NAS. The problem occurs when I want a group to contain several NAS. How can I make freeradius accept the login if the NAS-IP-Address from the user, is one of several listed in a group that a user is member of? reg Svend

2 1

MultiFactor authentication with FreeRadius
by Ouahiba MACHANI 25 Apr '07

25 Apr '07

Hi, I need to extend FreeRadius to allow Mmulti-Factor Authentication. I should extend it to support OTP authentication in addition to static password authentication. Did anyone manage to do it ? and how ? Thanks. Ouahiba.

1 0

EAP MD5 with Accounting
by Tan hanyin 25 Apr '07

25 Apr '07

Hi All, I was wondering if I were to perform authentication using EAP MD5, does it accommodate for Accounting in FreeRADIUS? Many Thanks. _________________________________________________________________ Check it out! Windows Live Spaces is here! http://spaces.live.com/?mkt=en-my Its easy to create your own personal Web site.

3 4

Non-ascii usernames
by Alexander V. Klepikov 25 Apr '07

25 Apr '07

Hello, All! How do I make FreeRadius work correct with non-ascii usernames? With best regards, Alexander V. Klepikov. E-mail: klepikov_a(a)up.ua

2 4

pam_radius: mutiple bad logins hitting radius server
by J S 25 Apr '07

25 Apr '07

I'm running pam_radius 1.3.16 on Solaris 10 using a Cisco ACS backend that authenticates to an MS AD server. I'm running into an issue where a user will fail a single login attempt (one username/password challenge with a bad password) and the ACS will record 3 attempts from the client (the Solaris 10 server). after a single attempt (or a valid login with a local password) the 3 fails bollixes up the AD login attempts and locks the user out. Am I missing a compile option to only attempt a single RADIUS login per authentication or do I possible have pam.conf misconfigured. I use sshd-kbdint and sshd-password with the same results. Otherwise the system works well. # pam_radius_auth configuration file. Copy to: /etc/raddb/server # # For proper security, this file SHOULD have permissions 0600, # that is readable by root, and NO ONE else. If anyone other than # root can read this file, then they can spoof responses from the server! # # There are 3 fields per line in this file. There may be multiple # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is # optional. The default timeout is 3 seconds. # # If multiple RADIUS server lines exist, they are tried in order. The # first server to return success or failure causes the module to return # success or failure. Only if a server fails to response is it skipped, # and the next server in turn is used. # # The timeout field controls how many seconds the module waits before # deciding that the server has failed to respond. # # server[:port] shared_secret timeout (s) #127.0.0.1 secret 1 #other-server other-secret 3 localhost secret 3 10.0.0.10:2048 XXXXXXXX 3 # # having localhost in your radius configuration is a Good Thing. # # See the INSTALL file for pam.conf hints. bash-3.00# cat /etc/pam.conf # #ident "@(#)pam.conf 1.28 04/04/21 SMI" # # Copyright 2004 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # PAM configuration # # Unless explicitly defined, all services use the modules # defined in the "other" section. # # Modules are defined with relative pathnames, i.e., they are # relative to /usr/lib/security/$ISA. Absolute path names, as # present in this file in previous releases are still acceptable. # # Authentication management # # login service (explicit because of pam_dial_auth) # login auth sufficient /usr/lib/security/pam_radius_auth.so.1 debug login auth requisite pam_authtok_get.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_unix_auth.so.1 login auth required pam_dial_auth.so.1 # telnet auth sufficient /usr/lib/security/pam_radius_auth.so.1 debug #telnet auth required /usr/lib/security/pam_unix.so.1 # # rlogin service (explicit because of pam_rhost_auth) # rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth required pam_unix_auth.so.1 # # Kerberized rlogin service # krlogin auth required pam_unix_cred.so.1 krlogin auth binding pam_krb5.so.1 krlogin auth required pam_unix_auth.so.1 # # rsh service (explicit because of pam_rhost_auth, # and pam_unix_auth for meaningful pam_setcred) # rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 # # Kerberized rsh service # krsh auth required pam_unix_cred.so.1 krsh auth binding pam_krb5.so.1 krsh auth required pam_unix_auth.so.1 # # Kerberized telnet service # ktelnet auth required pam_unix_cred.so.1 ktelnet auth binding pam_krb5.so.1 ktelnet auth required pam_unix_auth.so.1 # # PPP service (explicit because of pam_dial_auth) # ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_unix_cred.so.1 ppp auth required pam_unix_auth.so.1 ppp auth required pam_dial_auth.so.1 # # Default definitions for Authentication management # Used when service name is not explicitly mentioned for authentication # other auth requisite pam_authtok_get.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth required pam_unix_auth.so.1 # # passwd command (explicit because of a different authentication module) # passwd auth required pam_passwd_auth.so.1 # # cron service (explicit because of non-usage of pam_roles.so.1) # cron account required pam_unix_account.so.1 # # Default definition for Account management # Used when service name is not explicitly mentioned for account management # other account requisite pam_roles.so.1 other account required pam_unix_account.so.1 # # Default definition for Session management # Used when service name is not explicitly mentioned for session management # other session required pam_unix_session.so.1 # # Default definition for Password management # Used when service name is not explicitly mentioned for password management # other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 # # Support for Kerberos V5 authentication and example configurations can # be found in the pam_krb5(5) man page under the "EXAMPLES" section. # # sshd access # either local or radius login will work sshd-kbdint auth requisite pam_authtok_get.so.1 sshd-kbdint auth required pam_dhkeys.so.1 sshd-kbdint auth required pam_unix_cred.so.1 sshd-kbdint auth required pam_unix_auth.so.1 sshd-kbdint auth required pam_dial_auth.so.1 sshd-kbdint auth sufficient pam_radius_auth.so.1 debug

2 3

Re : RES: Re: RES: Re: PEAP/EAP-TLS with client and server certificate
by Eshun Benjamin 25 Apr '07

25 Apr '07

Use this: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no # Supported EAP-types # EAP-TLS tls { private_key_password = xxxxxxxxxxxxxxxxx private_key_file = ${raddbdir}/certs/freeradius_key.pem certificate_file = ${raddbdir}/certs/freeradius_cert.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no } #tls { #private_key_password = xxxxxxxxxxxxxxxxxxxxx #private_key_file = ${raddbdir}/certs/freeradius_key.pem #certificate_file = ${raddbdir}/certs/freeradius_cert.pem #CA_file = ${raddbdir}/certs/demoCA/cacert.pem #dh_file = ${raddbdir}/certs/dh #random_file = ${raddbdir}/certs/random #fragment_size = 1024 #include_length = yes #} mschapv2 { } } ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Marcelo Augusto Rodrigues Pimentel <marcelo.pimentel(a)cgu.gov.br> À : freeradius-users(a)lists.freeradius.org Envoyé le : Mardi, 24 Avril 2007, 20h36mn 17s Objet : RES: Re: RES: Re: PEAP/EAP-TLS with client and server certificate Marcelo Augusto Rodrigues Pimentel wrote: > OK. But I?m trying to use peap to make an encrypted tunnel validating the server certificate and then I want to authenticate the clients whith EAP-TLS using client/server certificate. The TLS tunnel is working fine, but the second part of EAP-TLS authentication not. > What second part of EAP-TLS? The server supports authenticating via client certificates, and nothing else. I said two parts, because those parts of my configuration uses TLS: The first part is making the encrypt tunnel using PEAP --> Only validates server certificate to create the tunnel. The second part is the authenticathion inner the tunnel with EAP-TLS --> Mutual validation of client and server certificate. This configuration is like Geroge Ou said below: ... PEAP-EAP-TLS is an improved version of the original EAP-TLS protocol that goes further to encrypt client digital certificate information. Both PEAP-EAP-TLS and EAP-TLS have the same server and client side digital certificate requirements. ... Reference: Wireless LAN security guide --> Level 3: Medium to large Enterprise WLAN security" http://www.lanarchitect.net/Articles/Wireless/SecurityRating/ Thank´s ! > So .... in the peap section in the eap.conf, what I?ve to configure for default eap type? Is tls ? > No. You can leave it alone. It's fine. > If I configure tls, I?ve to create a tls section in the peap section or the tls section of the eap.conf is enough. I?ve attached my eap.conf file. > If you want to use just TLS, you don't need the PEAP section. If you want to use PEAP, you need the TLS section. The comments in the "eap.conf" file explain this. "Mensagem protegida por sigilo profissional. Sua utilização indevida sujeita o infrator às penas da lei. Não sendo seu destinatário, por favor, elimine-a e informe o equívoco ao emitente." "This e-mail message and any attachment are intended exclusively for the named addressee. They may contain confidential information which may also be protected by professional secrecy. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use this message or any attachment or disclose the contents to anyone else. If this e-mail was sent to you by mistake please notify the sender immediately and delete this e-mail." - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

More on double free or corruption errors
by ken 24 Apr '07

24 Apr '07

I strongly suspect its a Fedora problem, not a Freeradius problem. (Or else I made a boo-boo configuring the OS) Alan DeKok replied to matthew zeier: > Let me clear: I cannot reproduce this problem here. > No one else has > seen the same problem. May or may not be relevant, but I've got two supposedly identical Fedora 6 machines, one gets a similar error, the other doesn't!. Both upgraded with yum to current level, followed by manual install and configure of Freeradius 1.1.5 - I cut and pasted the commands from one machine to the other and I FTPed the files including ones I modified. (And the one it works on is the SECOND one I installed, so its not a failure to copy correctly!) I think there must be some difference in my /usr/local/lib/libltdl.so.3.1.4 - they are slightly different sizes. I have no idea why, I used the same commands to install both systems. I will compare them. Just in case it means anything to anyone I attach the command output, but as I said my guess is its a Fedora problem [root@ficus raddb]# radiusd -v radiusd: FreeRADIUS Version 1.1.5, for host i686-pc-linux-gnu, built on Mar 9 2007 at 13:16:16 Copyright (C) 2000-2006 The FreeRADIUS server project. [root@ficus raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 --More--*** glibc detected *** radiusd: double free or corruption (fasttop): 0x81029498 *** ======= Backtrace: ========= /lib/libc.so.6[0x24b09d] /lib/libc.so.6(cfree+0x90)[0x24e6f0] /usr/local/lib/libltdl.so.3[0x14151b] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xbe)[0x141eae] radiusd(find_module_instance+0x317)[0x8000cbb7] radiusd(setup_modules+0x1d8)[0x8000d168] radiusd(main+0x45c)[0x8001079c] /lib/libc.so.6(__libc_start_main+0xdc)[0x1faf2c] radiusd[0x80004771] ======= Memory map: ======== 00110000-00123000 r-xp 00000000 fd:00 13959203 /lib/libpthread-2.5.so 00123000-00124000 r-xp 00012000 fd:00 13959203 /lib/libpthread-2.5.so 00124000-00125000 rwxp 00013000 fd:00 13959203 /lib/libpthread-2.5.so 00125000-00127000 rwxp 00125000 00:00 0 00127000-0013c000 r-xp 00000000 fd:00 13087333 /usr/local/lib/libradius-1.1.5.so 0013c000-0013d000 rwxp 00014000 fd:00 13087333 /usr/local/lib/libradius-1.1.5.so 0013d000-0013e000 rwxp 0013d000 00:00 0 0013e000-00143000 r-xp 00000000 fd:00 13086902 /usr/local/lib/libltdl.so.3.1.4 00143000-00144000 rwxp 00004000 fd:00 13086902 /usr/local/lib/libltdl.so.3.1.4 00144000-0014b000 r-xp 00000000 fd:00 13087742 /usr/lib/libkrb5support.so.0.1 0014b000-0014c000 rwxp 00006000 fd:00 13087742 /usr/lib/libkrb5support.so.0.1 0014e000-0014f000 r-xp 0014e000 00:00 0 [vdso] 0014f000-00161000 r-xp 00000000 fd:00 13082790 /usr/lib/libz.so.1.2.3 00161000-00162000 rwxp 00011000 fd:00 13082790 /usr/lib/libz.so.1.2.3 00162000-0016b000 r-xp 00000000 fd:00 13959208 /lib/libnss_files-2.5.so 0016b000-0016c000 r-xp 00008000 fd:00 13959208 /lib/libnss_files-2.5.so 0016c000-0016d000 rwxp 00009000 fd:00 13959208 /lib/libnss_files-2.5.so 0016d000-00171000 r-xp 00000000 fd:00 13959206 /lib/libnss_dns-2.5.so 00171000-00172000 r-xp 00003000 fd:00 13959206 /lib/libnss_dns-2.5.so 00172000-00173000 rwxp 00004000 fd:00 13959206 /lib/libnss_dns-2.5.so 00173000-0017e000 r-xp 00000000 fd:00 13959199 /lib/libgcc_s-4.1.1-20070105.so.1 0017e000-0017f000 rwxp 0000a000 fd:00 13959199 /lib/libgcc_s-4.1.1-20070105.so.1 001a0000-001e1000 r-xp 00000000 fd:00 13959361 /lib/libssl.so.0.9.8b 001e1000-001e5000 rwxp 00040000 fd:00 13959361 /lib/libssl.so.0.9.8b 001e5000-0031c000 r-xp 00000000 fd:00 13959186 /lib/libc-2.5.so 0031c000-0031e000 r-xp 00137000 fd:00 13959186 /lib/libc-2.5.so 0031e000-0031f000 rwxp 00139000 fd:00 13959186 /lib/libc-2.5.so 0031f000-00322000 rwxp 0031f000 00:00 0 00322000-003a8000 r-xp 00000000 fd:00 13100407 /usr/lib/libkrb5.so.3.2 003a8000-003aa000 rwxp 00086000 fd:00 13100407 /usr/lib/libkrb5.so.3.2 00474000-0048d000 r-xp 00000000 fd:00 13959170 /lib/ld-2.5.so 0048d000-0048e000 r-xp 00018000 fd:00 13959170 /lib/ld-2.5.so 0048e000-0048f000 rwxp 00019000 fd:00 13959170 /lib/ld-2.5.so 00710000-0082c000 r-xp 00000000 fd:00 13959247 /lib/libcrypto.so.0.9.8b 0082c000-0083e000 rwxp 0011c000 fd:00 13959247 /lib/libcrypto.so.0.9.8b 0083e000-00842000 rwxp 0083e000 00:00 0 008ec000-00911000 r-xp 00000000 fd:00 13100406 /usr/lib/libk5crypto.so.3.0 00911000-00912000 rwxp 00025000 fd:00 13100406 /usr/lib/libk5crypto.so.3.0 00a47000-00a56000 r-xp 00000000 fd:00 13959217 /lib/libresolv-2.5.so 00a56000-00a57000 r-xp 0000e000 fd:00 13959217 /lib/libresolv-2.5.so 00a57000-00a58000 rwxp 0000f000 fd:00 13959217 /lib/libresolv-2.5.so 00a58000-00a5a000 rwxp 00a58000 00:00 0 00c7a000-00ca4000 r-xp 00000000 fd:00 13100408 /usr/lib/libgssapi_krb5.so.2.2 00ca4000-00ca5000 rwxp 00029000 fd:00 13100408 /usr/lib/libgssapi_krb5.so.2.2 00cf1000-00cf3000 r-xp 00000000 fd:00 13099224 /usr/local/lib/rlm_exec-1.1.5.so 00cf3000-00cf4000 rwxp 00001000 fd:00 13099224 /usr/local/lib/rlm_exec-1.1.5.so 00d1b000-00d2e000 r-xp 00000000 fd:00 13959209 /lib/libnsl-2.5.so 00d2e000-00d2f000 r-xp 00012000 fd:00 13959209 /lib/libnsl-2.5.so 00d2f000-00d30000 rwxp 00013000 fd:00 13959209 /lib/libnsl-2.5.so 00d30000-00d32000 rwxp 00d30000 00:00 0 00de4000-00de6000 r-xp 00000000 fd:00 13959245 /lib/libcom_err.so.2.1 00de6000-00de7000 rwxp 00001000 fd:00 13959245 /lib/libcom_err.so.2.1 00e98000-00e9a000 r-xp 00000000 fd:00 13959193 /lib/libdl-2.5.so 00e9a000-00e9b000 r-xp 00001000 fd:00 13959193 /lib/libdl-2.5.so 00e9b000-00e9c000 rwxp 00002000 fd:00 13959193 /lib/libdl-2.5.so 00e9c000-00ea1000 r-xp 00000000 fd:00 13959219 /lib/libcrypt-2.5.so 00ea1000-00ea2000 r-xp 00004000 fd:00 13959219 /lib/libcrypt-2.5.so 00ea2000-00ea3000 rwxp 00005000 fd:00 13959219 /lib/libcrypt-2.5.so 00ea3000-00eca000 rwxp 00ea3000 00:00 0 80000000-8001d000 r-xp 00000000 fd:00 13100199 /usr/local/sbin/radiusd 8001d000-8001e000 rw-p 0001d000 fd:00 13100199 /usr/local/sbin/radiusd 8001e000-8001f000 rw-p 8001e000 00:00 0 80f4e000-81035000 rw-p 80f4e000 00:00 0 b7e00000-b7e21000 rw-p b7e00000 00:00 0 b7e21000-b7f00000 ---p b7e21000 00:00 0 b7fbe000-b7fc2000 rw-p b7fbe000 00:00 0 b7fd0000-b7fd2000 rw-p b7fd0000 00:00 0 bf81b000-bf84c000 rw-p bf81b000 00:00 0 [stack]

2 1

Potgres query error
by Dariusz Dwornikowski 24 Apr '07

24 Apr '07

From time to time a im getting this kind of error ( after for example serving 2-3k requests), and after tha freeradius just hangs and takes 90% of CPU. I am using freeradius 1.1.6 with threads. I tried to make it happen again and log it but i could not meet such data, that causes the error. Maybe you have idea what is happening that error, and moreover why freeradius hangs. Tue Apr 24 13:22:40 2007 : Error: rlm_sql_postgresql: PostgreSQL Query failed Error: ERROR: invalid message format -- Dariusz Dwornikowski tdi(a)vercom.pl

2 3

radius accounting problem on Wintendo
by Peder Bach 24 Apr '07

24 Apr '07

Hi. Freeradius on wintendo, seems to have problem with accounting. It send the accounting data as hex values. Bay-Networks-Attr-196 = 0x73686f77206c6f672066696c65207461696c Bay-Networks-Attr-196 = 0x65786974 The strange is that this works on Linux and Sun. And the dictionary.bay doesn't contain Attr-196 nor on Linux and Windows. Any Clue ?

2 1