May 2007 - Freeradius-Users - lists.freeradius.org

More debug info about LDAP?
by rickan 02 Oct '07

02 Oct '07

Hi guys, I am trying to establish a secure connection between freeradius and a Novell eDirectory LDAP server. After configuring LDAP in radiusd.conf it seemed to work, almost: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.5:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/ldap_ca_cert.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Operations error rlm_ldap: (re)connection attempt failed Because I don't know how to get logs from the eDirectory side, I recorded the traffic between both hosts and saw that the TLS handshake had been done, both mashines had exchanged cipher key and begun to send data. After 3 or 4 packets the LDAP server sent a "encrypted alert" and disconnected. Since these data are encrypted I could not see what happened indeed. My question: is it possible to get more debug info from the freeradius side? If yes, how? Thanks, Rickan

2 1

windows XP computer WPA, TKIP, PEAP, EAP-MSCHAP v2 has "No User-Password or CHAP-Password attribute in the request"
by PoWah Wong 25 Aug '07

25 Aug '07

My freeradius client is a windows XP SP2 computer running 802.11 WPA, TKIP, PEAP, EAP-MSCHAP v2 and trying to connect to the linux Fedora Core 2 wireless server. I run the freeradius server in debugging mode # radiusd -sfxxyz -l stdout This is the output. How to fix this problem? rad_recv: Access-Request packet from host 127.0.0.1:52001, id=38, length=134 Framed-MTU = 1380 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "wifictrl" User-Name = "test" NAS-Port-Id = ":2:2" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 Called-Station-Id = "00-f0-00-06-67-a8" Calling-Station-Id = "00-20-a6-57-7a-e9" EAP-Message = 0x020100090174657374 Message-Authenticator = 0x737afc3b6c1fb17ad13ee348ca5fbf4b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched test at 90 radius_xlat: 'Hello, test' modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 38 to 127.0.0.1:52001 Reply-Message = "Hello, test" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 38 with timestamp 43d1500d Nothing to do. Sleeping until we see a request. # radiusd -v radiusd: FreeRADIUS Version 1.0.1, for host , built on Apr 15 2005 at 11:57:29 # uname -a Linux wifictrl 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux __________________________________________________________ Find your next car at http://autos.yahoo.ca

8 15

Client-IP-Address not logged in detail
by Milan Holub 16 Aug '07

16 Aug '07

Hi Alan, despite the note in radiusd.conf: ... # It also adds the %{Client-IP-Address} attribute to the request. preprocess ... it looks like that the attribute is not added: >>>DEBUG rlm_acct_unique: WARNING: Attribute Client-IP-Address was not found in request, unique ID MAY be inconsistent >>>DEBUG and I do not find it in detail file neither(where I would need it for radrelaying). Apparently the attribute is available since I've written following dummy instance of attr_rewrite module to add the attribute to detail file: ...from modules{}: attr_rewrite add_clientip { attribute = Client-IP-Address searchin = packet searchfor = ".*" replacewith = "%{Client-IP-Address}" new_attribute = yes max_matches = 1 append = no } and in accounting{} I have: ... # add Client-IP-Address (fix) add_clientip # create detail file for radrelay(1.X binary) radrelay-detail I've compiled --without-udpfromto option - not sure whether it might have any impact. Is there something screwed with my config or the Client-IP-Address attribute is really missing? Thanks for reply. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

4 6

Duplicate requests in a session
by Santiago Balaguer García 16 Aug '07

16 Aug '07

Hi people, 1) In my activity I realize that when the conexion to Internet of a NAS is NOT good (there are some reday in the DSL), the NAS send several Start requests. My problen is my RADIUS server ask for all these requests and they are inserted in my DB. So, when the user or the NAS finalize the session and NAS sends Stop Request, the credit associates to the user account is decremented several times. It happens so because I put a trgger in my DB to decrement the user credit atomatically. Can I avoid the problem of inserting several times the start request? If it is so, how?? 2) Is it supposed that the value of acctsessionid and acctuniqueid in radacct table are UNIQUE and they can not be duplicated ? Thanks, Santiago _________________________________________________________________ Grandes éxitos, superhéroes, imitaciones, cine y TV... http://es.msn.kiwee.com/ Lo mejor para tu móvil.

6 9

Freeradius Auth via LDAP against Active Directory Server 2003
by Jacob Jarick 09 Jul '07

09 Jul '07

I have been at this for awhile now, so I thought I would share a summary of what I have figured out so far for anyone else that decides to try this. 1 - Documentation for this particular configuration is either out of date / incomplete / both. There are no howtos that will get from start to end (if you do know of one or wrote one yourself please share - I will myself when I figure it all out). 2 - Most the trouble is due to the fact we are making a linux service talk to a windows service (AD LDAP). Freeradius talking to the linux passwd file is a breeze by comprassion. 3 - Windows 2003 LDAP implementation will not provide a password when a user/ service preforms a ldap search, the proper way If I understand correctly is to supply plain text username / password then freeradius preforms a bind with the provided credentials against your ADS server, success means the password was correct. 4 - Installing "Services For Unix" on 2003 will make AD LDAP provide a password hash attribute among other unix LDAP attributes. The user has have posix enabled. 5 - Anonymous searchs can be preformed on 2003 AD LDAP if you set dSHeuristics to 0000002 using adsiedit.msc. 6 - Microsofts LDAP is different to Novells (big surprise) and so unfortunately their documentation isnt to helpfull as a reference for people trying to use ADS in the same fashion.

6 17

sql auth problems with 2.0.0-pre
by Alexander Serkin 07 Jul '07

07 Jul '07

Gurus, may be i'm pulling some common mistake with my configuration being tested against cvs snapshot, but no idea which one. I've an sql profile telling: some.dotted.user Cleartext-Password = cisco NAS-IP-Address =~ "xxx.xxx.97.(85|86)" authentication request: User-Name = "some.dotted.user" User-Password = "cisco" Calling-Station-Id = "000000000000000" Framed-Protocol = PPP Service-Type = Framed-User NAS-IP-Address = xxx.xxx.97.85 gives the access-reject for unknown (for me) reason: rlm_sql (sqlauth): sql_set_user escaped user --> 'some.dotted.user' rlm_sql (sqlauth): Reserving sql socket id: 3 radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id' SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id ... rlm_sql (sqlauth): Released sql socket id: 3 modcall[authorize]: module "sqlauth" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [some.dotted.user/cisco] (from client localhost port 0 cli 00000000000000) auth: Failed to validate the user. I've checked the authorization sql query shown in debug - it properly returns the profile configured -- Sincerely Yours, Alexander

5 21

Segmentation fault on conflicting packet
by Milan Holub 18 Jun '07

18 Jun '07

Hi Alan, I'm using cvs build based on cvs head on May 29 2007. I'm running it under conditions close to production(40 auth requests/hour, 700 accounting requests/hour). Most of the time it's doing well but I've observed already multiple times following behaviour: 2007-05-31 06:18:14.884403500 Thread 1 handling request 11920, (2384 handled so far) 2007-05-31 06:18:14.884406500 Processing the preacct section of radiusd.conf 2007-05-31 06:18:14.884408500 +- entering group preacct 2007-05-31 06:18:14.884410500 ++[preprocess] returns ok 2007-05-31 06:18:14.884412500 radius_xlat: '<CLIENT_IP>' 2007-05-31 06:18:14.884414500 rlm_attr_rewrite: Added attribute Client-IP-Address with value '<CLIENT_IP>' 2007-05-31 06:18:14.884417500 ++[add_clientip] returns ok 2007-05-31 06:18:14.884534500 rlm_acct_unique: Hashing 'NAS-Port = 5292,Client-IP-Address = <CLIENT_IP>,NAS-IP-Address = <NAS_IP>,Acct-Session-Id = "192458",User-Name = "<USERNAME>"' 2007-05-31 06:18:14.884540500 rlm_acct_unique: Acct-Unique-Session-ID = "4c66e6ddb85d6ed4". 2007-05-31 06:18:14.884543500 ++[acct_unique] returns ok 2007-05-31 06:18:14.884544500 rlm_realm: No '/' in User-Name = "<USERNAME>", looking up realm NULL 2007-05-31 06:18:14.884547500 rlm_realm: No such realm "NULL" 2007-05-31 06:18:14.884562500 ++[IPASS] returns noop 2007-05-31 06:18:14.884564500 rlm_realm: No '@' in User-Name = "<USERNAME>", looking up realm NULL 2007-05-31 06:18:14.884567500 rlm_realm: No such realm "NULL" 2007-05-31 06:18:14.884568500 ++[suffix] returns noop 2007-05-31 06:18:14.884570500 radius_xlat: '<CLIENT_IP>' 2007-05-31 06:18:14.884572500 acct_users: Matched entry DEFAULT at line 39 2007-05-31 06:18:14.884574500 ++[files] returns ok 2007-05-31 06:18:14.884575500 Using perl at 0x81691e0 2007-05-31 06:18:14.884590500 rlm_perl: rlm_perl: preacct 2007-05-31 06:18:14.884592500 rlm_perl: Request attributes: 2007-05-31 06:18:14.884594500 rlm_perl: RAD_REQUEST: WISPr-Location-Name = 21001:BE-HO Bern Holingen KVA 2007-05-31 06:18:14.884619500 rlm_perl: RAD_REQUEST: Calling-Station-Id = 0000000000000000 2007-05-31 06:18:14.884622500 rlm_perl: RAD_REQUEST: NAS-Port = 5292 2007-05-31 06:18:14.884624500 rlm_perl: RAD_REQUEST: Acct-Delay-Time = 0 2007-05-31 06:18:14.884626500 rlm_perl: RAD_REQUEST: WISPr-Location-ID = 68 2007-05-31 06:18:14.884628500 rlm_perl: RAD_REQUEST: Acct-Session-Id = 192458 2007-05-31 06:18:14.884630500 rlm_perl: RAD_REQUEST: NAS-Identifier = <NAS_IP>:5292 2007-05-31 06:18:14.884645500 rlm_perl: RAD_REQUEST: Class = TN_S1M 2007-05-31 06:18:14.884647500 rlm_perl: RAD_REQUEST: Acct-Unique-Session-Id = 4c66e6ddb85d6ed4 2007-05-31 06:18:14.884650500 rlm_perl: RAD_REQUEST: Called-Station-Id = 00:19:D2:3D:5A:EA 2007-05-31 06:18:14.884652500 rlm_perl: RAD_REQUEST: Acct-Authentic = RADIUS 2007-05-31 06:18:14.884654500 rlm_perl: RAD_REQUEST: Framed-IP-Address = 10.2.159.24 2007-05-31 06:18:14.884657500 rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 2007-05-31 06:18:14.884672500 rlm_perl: RAD_REQUEST: User-Name = <USERNAME> 2007-05-31 06:18:14.884674500 rlm_perl: RAD_REQUEST: Client-IP-Address = <CLIENT_IP> 2007-05-31 06:18:14.884676500 rlm_perl: RAD_REQUEST: NAS-IP-Address = <NAS_IP> 2007-05-31 06:18:14.884678500 rlm_perl: RAD_REQUEST: Acct-Status-Type = Start 2007-05-31 06:18:14.884680500 rlm_perl: Reply attributes: 2007-05-31 06:18:14.884682500 rlm_perl: Check attributes: 2007-05-31 06:18:14.884684500 rlm_perl: RAD_CHECK Proxy-To-Realm = LOCAL 2007-05-31 06:18:14.884699500 rlm_perl: Added pair WISPr-Location-Name = 21001:BE-HO Bern Holingen KVA 2007-05-31 06:18:14.884720500 rlm_perl: Added pair Calling-Station-Id = 0000000000000000 2007-05-31 06:18:14.884723500 rlm_perl: Added pair NAS-Port = 5292 2007-05-31 06:18:14.884725500 rlm_perl: Added pair Acct-Delay-Time = 0 2007-05-31 06:18:14.884727500 rlm_perl: Added pair WISPr-Location-ID = 68 2007-05-31 06:18:14.884729500 rlm_perl: Added pair Acct-Session-Id = 192458 2007-05-31 06:18:14.884731500 rlm_perl: Added pair NAS-Identifier = <NAS_IP>:5292 2007-05-31 06:18:14.884746500 rlm_perl: Added pair Class = TN_S1M 2007-05-31 06:18:14.884748500 rlm_perl: Added pair Acct-Unique-Session-Id = 4c66e6ddb85d6ed4 2007-05-31 06:18:14.884750500 rlm_perl: Added pair Called-Station-Id = 00:19:D2:3D:5A:EA 2007-05-31 06:18:14.884753500 rlm_perl: Added pair Acct-Authentic = RADIUS 2007-05-31 06:18:14.884755500 rlm_perl: Added pair Framed-IP-Address = 10.2.159.24 2007-05-31 06:18:14.884757500 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 2007-05-31 06:18:14.884772500 rlm_perl: Added pair User-Name = <USERNAME> 2007-05-31 06:18:14.884774500 rlm_perl: Added pair Client-IP-Address = <CLIENT_IP> 2007-05-31 06:18:14.884776500 rlm_perl: Added pair NAS-IP-Address = <NAS_IP> 2007-05-31 06:18:14.884778500 rlm_perl: Added pair Acct-Status-Type = Start 2007-05-31 06:18:14.884780500 rlm_perl: Added pair Proxy-To-Realm = LOCAL 2007-05-31 06:18:14.884782500 ++[perl] returns ok 2007-05-31 06:18:14.884784500 +- group preacct returns ok 2007-05-31 06:18:14.884835500 Processing the accounting section of radiusd.conf 2007-05-31 06:18:14.884837500 +- entering group accounting 2007-05-31 06:18:14.884839500 radius_xlat: '/var/log/freeradius/radacct/<CLIENT_IP>/detail-20070531' 2007-05-31 06:18:14.884860500 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradi us/radacct/<CLIENT_IP>/detail-20070531 2007-05-31 06:18:14.884865500 radius_xlat: 'Thu May 31 06:18:14 2007' 2007-05-31 06:18:14.884935500 Threads: total/active/spare threads = 5/1/4 2007-05-31 06:18:14.885099500 Received conflicting packet from client <SHORTNAME> port 33499 - ID: 0 due to unfinished request 11920.Giving up on old request. 2007-05-31 06:18:14.885168500 Failed to insert request 11921 in the list of live requests: discarding 2007-05-31 06:18:14.913060500 ++[detail] returns ok 2007-05-31 06:18:14.913068500 rad_accounting: Cancelling proxy to realm LOCAL, as it is a LOCAL realm. 2007-05-31 06:18:14.913071500 Request 11920 was cancelled. 2007-05-31 06:18:14.913073500 Going to the next request 2007-05-31 06:18:14.913074500 Thread 1 waiting to be assigned a request >>SEQMENTATION FAULT... If you check the timeline we've received conclicting packet after 0.000696 sec. Which I think was a duplicate packet due to some network problem. Packet 11920 was in the middle of processing(finished writing into detail file, but not yet written to database). Segmentation fault occured when another request was received. I was not able to simulate by sending duplicate packets via radclient. I think the sensitive part is receiving duplicate packet during the processing of original packet. Any ideas? Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

3 2

performace on chainging clients.conf and huntgroup
by Kevin J 14 Jun '07

14 Jun '07

Alan, I noticed that more IPs I add to clients.conf and huntgroups, more steep performance declines FreeRadius got. Guessing the linked-list. Have we considered other data structures like hashing or btree? -Kevin ____________________________________________________________________________________ Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. http://tools.search.yahoo.com/toolbar/features/mail/

10 25

I will be out of the office from Wednesday May 30 until Monday
by along 11 Jun '07

11 Jun '07

I will be out of the office from Wednesday May 30 until Monday June 4. Please use my cell number if you require immediate assistance. You may also call the main office number (716) 893-4984 to speak with someone else. I will receive your e-mail during this period and will try to get back to you as soon as possible. Thank You. Andrew Long

3 5

Proxy based on username
by Loffredo Tullio 06 Jun '07

06 Jun '07

Hello, I need to proxy AA request from some users. Therfore, the proxy is based on the string "username@realm", and non only on the realm... Do you have any suggestion in order to configure such feature? Thank you and regards Tullio Loffredo -------------------------------------------------------------------- CONFIDENTIALITY NOTICE This message and its attachments are addressed solely to the persons above and may contain confidential information. If you have received the message in error, be informed that any use of the content hereof is prohibited. Please return it immediately to the sender and delete the message. Should you have any questions, please contact us by replying to webmaster(a)telecomitalia.it. Thank you www.telecomitalia.it --------------------------------------------------------------------

3 2