May 2007 - Freeradius-Users - lists.freeradius.org

pam_mysql
by Jon Westgate 06 May '07

06 May '07

Hi, I'm trying to get freeradius 1.1.6 (debian) to work with pam_mysql Why? you may ask, as freeradius already supports mysql. Well I have my reasons. The first being that I have already got an authentication backend setup using mysql that I'm using for among other things samba and email access, it uses mysql 5 crypted passwords which freeradius does not support. The really odd thing is that freeradius just comes back with access denied. I'm have tried running as root, but it makes no difference. I wondered if it was cheating and looking directly at the shadow file, but the source code does not mention it. Both exim and cyrus-saslauthd have no problems with authenticating users using the exact same pam.d config files, yet freeradius just sits there giving access denied messages. Apex:/etc/pam.d# ps aux |grep radius root 5849 0.1 0.1 3808 2484 pts/7 S+ 20:12 0:00 freeradius -AXxx root 5857 0.0 0.0 1736 544 pts/2 S+ 20:13 0:00 grep radius root 11478 0.0 0.0 3112 576 pts/8 S 16:11 0:00 /usr/sbin/radiusd -b -p 1645 Sun May 6 20:12:08 2007 : Debug: auth: type "PAM" Sun May 6 20:12:08 2007 : Debug: Processing the authenticate section of radiusd.conf Sun May 6 20:12:08 2007 : Debug: modcall: entering group authenticate for request 0 Sun May 6 20:12:08 2007 : Debug: modsingle[authenticate]: calling pam (rlm_pam) for request 0 Sun May 6 20:12:08 2007 : Debug: pam_pass: using pamauth string <radiusd> for pam.conf lookup Sun May 6 20:12:08 2007 : Debug: pam_pass: function pam_authenticate FAILED for <oryn>. Reason: Permission denied Sun May 6 20:12:08 2007 : Debug: modsingle[authenticate]: returned from pam (rlm_pam) for request 0 Sun May 6 20:12:08 2007 : Debug: modcall[authenticate]: module "pam" returns reject for request 0 Sun May 6 20:12:08 2007 : Debug: modcall: leaving group authenticate (returns reject) for request 0 Sun May 6 20:12:08 2007 : Debug: auth: Failed to validate the user. Any ideas? Regards Jon Westgate (Oryn)

1 0

Re: Authentication with Novell 802.1x client fails butWinXP supplicant works fine ?
by Phil Mayers 06 May '07

06 May '07

Marc Charbonneau wrote: > Hi, > I had truncated the log. Here's more of it (still truncated because of No need to email me directly. I'm on the list. > list limit). > It's probably stuck in a re-iterative process, visible in this log, but > I wouldn't be able to spot where it starts and finishes. As I said in my original email, it looks like it stops with FreeRadius issuing an Access-Challenge, and the Novell supplicant stops responding (for at least 6 seconds). Presumably it then drops the link and tries again. If your server works with the native XP supplicant then you've probably got everything configured (the XP supplicant is pretty picky) and there's probably little you can do - you will need to debug the Novell supplicant. I've never used it, so can't advise you how to go about doing that.

1 0

Stops working all of a sudden
by Matt Neumark 06 May '07

06 May '07

Hello, I have a radius server and it works great for days upon days then all of a sudden it stops authenticating users. Sat May 5 00:17:07 2007 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:freeradius Sat May 5 00:17:07 2007 : Error: rlm_sql_mysql: Mysql error 'Lost connection to MySQL server during query' Sat May 5 00:17:07 2007 : Error: rlm_sql (sql): Failed to connect DB handle #1 Sat May 5 00:17:07 2007 : Error: rlm_sql (sql): reconnect failed, database down? Sat May 5 00:17:07 2007 : Error: rlm_sql (sql): Couldn't update SQL accounting STOP record - rlm_sql_mysql: no connection to db Sat May 5 00:17:07 2007 : Error: Discarding duplicate request from client mikrotik:39381 - ID: 18 due to unfinished request 588849 I also noticed in the log I found a lot of lines like this. but authentication still works just fine. Fri May 4 16:09:51 2007 : Error: rlm_radutmp: Logout entry for NAS mikrotik port 47337 has wrong ID Thanks, Matt Neumark

2 1

auth-type problem
by liran tal 06 May '07

06 May '07

Hey everyone, I've used an older version of FreeRADIUS before (I think 1.1.0) with mysql as a backend and all I had to do to authenticate users is have the following entry in radcheck table: | 1 | admin | Password | == | admin | although I see some errors when using radiusd -X and the error received is username/password not correct. The log from freeradius is: modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'admin' rlm_sql (sql): sql_set_user escaped user --> 'admin' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'admin' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'admin' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' radius_xlat: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='admin'' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='admin'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='admin'' rlm_sql (sql): - sql_xlat radius_xlat: 'admin' rlm_sql (sql): sql_set_user escaped user --> 'admin' radius_xlat: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='admin'' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 1 radius_xlat: '27' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user admin, check_item=86400, counter=27 rlm_sqlcounter: Sent Reply-Item for user admin, Type=Session-Timeout, value=300 modcall[authorize]: module "noresetcounter" returns ok for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 1 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlycounter" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [admin/admin] (from client localhost port 1) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... It mentions some error about Auth-Type so I added another entry for that user in the table which is: | 2 | admin | Auth-Type | := | Local | And then it works fine. My question is why does it require the Auth-Type entry to be added? I've used freeradius with mysql before without having to enter an Auth-Type entry for each user in the radcheck table. My radiusd.conf authenticate { } section has no sql mentioning there. Could that be it? Thanks in advance, Liran.

2 2

Authentication with Novell 802.1x client fails but WinXP supplicant works fine ?
by Marc Charbonneau 05 May '07

05 May '07

Hi all, I have tried everything recommended to me by Novell (as far as Microsoft patches) that may address an issue with their new (beta) Client 4.91 SP4. This client allows you to select 802.1x authentication and it's suppose to pass the login credentials to the Windows XP supplicant. Once 802.1x authentication is done, the Novell Client is supposed to continue it's login process. Based on the RADIUSD logs, I'm not getting a proper PEAP authentication at the Novell login prompt stage. Once this stage times out and I log in locally to the WinXP workstation, the PEAP authentication works fine. The timeout error is: 802.1x Authentication Failed. Timeout waiting for authentication to finish. Logging to workstation only. <OK> FYI, Once the Novell 802.1x is enabled, the only thing I see that changes with WinXP supplicant's configuration (under PEAP) is that the Authentication Method is now listed as "Novell (EAP-MSCHAP v2)" instead of "Secured password (EAP-MSCHAP v2)". I'm wondering if the issue is related to something with my FreeRADIUS configuration? I've inculded the logs for when my pure Windows XP workstation authenticates and included the logs for what's going on while waiting for the Novell 802.1x client to timeout. I'm hoping a trained eye can spot something or anything that would lead me to a solution. Thanks for any help. Marc --------------------------------*------------------------------------*-------- --------------------------------Novell 802.1x*------------------------------- --------------------------------*------------------------------------*-------- Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.242.4:32768, id=156, length=184 User-Name = "UOHI-40626" Calling-Station-Id = "00-40-96-B1-43-A8" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x0202000f01554f48492d3430363236 Message-Authenticator = 0xf173e2f693b6439540056725af55c9a5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5046 modcall[authorize]: module "preprocess" returns ok for request 5046 modcall[authorize]: module "chap" returns noop for request 5046 modcall[authorize]: module "mschap" returns noop for request 5046 rlm_realm: No '@' in User-Name = "UOHI-40626", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5046 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40626 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40626))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40626)) rlm_ldap: checking if remote access for UOHI-40626 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40626 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5046 rlm_eap: EAP packet type response id 2 length 15 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5046 modcall: group authorize returns updated for request 5046 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5046 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 5046 modcall: group authenticate returns handled for request 5046 Sending Access-Challenge of id 156 to 192.168.242.4:32768 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x236c181e57c0ea83025c9e57460d53fb Finished request 5046 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=157, length=267 User-Name = "UOHI-40626" Calling-Station-Id = "00-40-96-B1-43-A8" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x0203005019800000004616030100410100003d0301463a53cad2f596a4d17f6cdba65ae68141b95a139ae441539224f3830ecfbd2d00001600040005000a000900640062000300060013001200630100 State = 0x236c181e57c0ea83025c9e57460d53fb Message-Authenticator = 0x3c69468e56b4da685f74f2ee77b5b65f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5047 modcall[authorize]: module "preprocess" returns ok for request 5047 modcall[authorize]: module "chap" returns noop for request 5047 modcall[authorize]: module "mschap" returns noop for request 5047 rlm_realm: No '@' in User-Name = "UOHI-40626", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5047 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40626 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40626))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40626)) rlm_ldap: checking if remote access for UOHI-40626 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40626 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5047 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5047 modcall: group authorize returns updated for request 5047 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5047 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0af4], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 5047 modcall: group authenticate returns handled for request 5047 Sending Access-Challenge of id 157 to 192.168.242.4:32768 EAP-Message = 0x0104040a19c000000b51160301004a02000046030146399d4d91edd8cb95d2ede5c24ddbf00855871dea30a66113c57772f9caf8c8206e4958d7d4c95074067aad0113ae120af60337670458b2638256c9cd7f19b6830004001603010af40b000af0000aed00063a308206363082051ea003020102020a6129017f000000000015300d06092a864886f70d0101050500305a31153013060a0992268993f22c64011916056c6f63616c31123010060a0992268993f22c64011916026361311b3019060a0992268993f22c640119160b6f747461776168656172743110300e06035504031307756f68692d6361301e170d3037303432373139343330325a EAP-Message = 0x170d3039303432363139343330325a3077310b30090603550406130243413110300e060355040813074f6e746172696f310f300d060355040713064f7474617761310d300b060355040a1304554f48493111300f060355040313084f4849534c4553313123302106092a864886f70d010901161461646d696e406f747461776168656172742e636130820122300d06092a864886f70d01010105000382010f003082010a02820101009c62aac4b4d7c2a0a3b074bc3a9922f6eade8be2b126ef833e55f97b61f8ddc0b90d016c0f0bdc12c94ba162085969a2ea5348e6ecdd88dbbd2a24723fb099730e01ae6f3b7bd7eafcdb69f847ced1b09a04eed9 EAP-Message = 0x6d813d07547b3b998f164cd74539e432acd8f0bdfdfb6a9820e92b85e0576412108da40f41775f8f4e78f34d549db299a3f74d8d01fc92c9929f4e48d4a6886656a44a37f3536c4a8da0fcec8f6f6552b5f61c3227808aaa9c6cbb5f1e927316419eaba102aea640cf280a6cbfc0f2757d7ae89d9efadc4b64ebf540af9ee1895bd5329305745ff6a9693efb9eb007e4ec939794b37d038702b1f934d58ce4f6d568cb87bc1f779b833821e30203010001a38202df308202db301d0603551d0e041604144355ae8326e8e176e53691675c60bc20e389907f301f0603551d23041830168014f2e6025e7d0e816e7f54b3c650fd4d7bca8a5ef230820112 EAP-Message = 0x0603551d1f048201093082010530820101a081fea081fb8681bb6c6461703a2f2f2f434e3d756f68692d63612c434e3d6f686961707033302c434e3d4344502c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d6f747461776168656172742c44433d63612c44433d6c6f63616c3f63657274696669636174655265766f636174696f6e4c6973743f626173653f6f626a656374436c6173733d63524c446973747269627574696f6e506f696e74863b687474703a2f2f6f686961707033302e6f747461776168656172742e63612e6c6f63616c2f43 EAP-Message = 0x657274456e726f6c6c2f756f68692d63612e63726c30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x50ae1445bfa19e9199ff676e0527a36d Finished request 5047 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.242.4:32768, id=158, length=193 User-Name = "UOHI-40626" Calling-Station-Id = "00-40-96-B1-43-A8" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x020400061900 State = 0x50ae1445bfa19e9199ff676e0527a36d Message-Authenticator = 0xe439288adf4546ea77fd4b41db6d415f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5048 modcall[authorize]: module "preprocess" returns ok for request 5048 modcall[authorize]: module "chap" returns noop for request 5048 modcall[authorize]: module "mschap" returns noop for request 5048 rlm_realm: No '@' in User-Name = "UOHI-40626", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5048 rlm_ldap: - authorize rlm_ldap: performing user authorization for UOHI-40626 radius_xlat: '(&(objectClass=inetOrgPerson)(cn=UOHI-40626))' radius_xlat: 'o=OHICO' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=OHICO, with filter (&(objectClass=inetOrgPerson)(cn=UOHI-40626)) rlm_ldap: checking if remote access for UOHI-40626 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user UOHI-40626 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5048 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5048 modcall: group authorize returns updated for request 5048 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5048 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 5048 modcall: group authenticate returns handled for request 5048 Sending Access-Challenge of id 158 to 192.168.242.4:32768 EAP-Message = 0x01050406194082012e06082b06010505070101048201203082011c3081b206082b060105050730028681a56c6461703a2f2f2f434e3d756f68692d63612c434e3d4149412c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d6f747461776168656172742c44433d63612c44433d6c6f63616c3f634143657274696669636174653f626173653f6f626a656374436c6173733d63657274696669636174696f6e417574686f72697479306506082b060105050730028659687474703a2f2f6f686961707033302e6f747461776168656172742e63612e EAP-Message = 0x6c6f63616c2f43657274456e726f6c6c2f6f686961707033302e6f747461776168656172742e63612e6c6f63616c5f756f68692d63612e637274302106092b060104018237140204141e12005700650062005300650072007600650072300c0603551d130101ff04023000300b0603551d0f0404030205a030130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038201010075b204baebe82901036bb830065f26844a0f213df174c9b4af8dd92b5a8c5290cced2f2ab28d6eda45c659fe6a331c117b0c761b590d7323f6f7bdd5b863c31bbb56085e97f0f2b0830777fab6c6760b19accb2ae195e9b5f9858bc3 EAP-Message = 0xeac04eb89e052a856661a194f8cbe3c013ea4dd5047092935bd7551cb41a5a1995f3ab82ee990e3b81fc8be9434df8172b66e358293c0a85ee8a0935b97415ac9b3133068c613ade745a4976fb8d3eca03f938cc8c7ab71b4c0fe95925b9013c0b1ab08676ec7779ca6ee8252c7252fc54b24a20bdda5ca33cb70b6308f4fc0e2af423e5fd02397e3655af5d869257b38406be19600966266b3eb6002072cd919fd602100004ad308204a930820391a003020102021015846cfa42f5b2904f917bb3c3381bc4300d06092a864886f70d0101050500305a31153013060a0992268993f22c64011916056c6f63616c31123010060a0992268993f22c6401 EAP-Message = 0x1916026361311b3019060a0992268993f22c640119160b6f747461776168656172743110300e06035504031307756f68692d6361301e170d3036313031383132333134325a170d3131313031383132343033395a305a31153013060a0992268993f22c64011916056c6f63616c31123010060a0992268993f22c64011916026361311b3019060a0992268993f22c640119160b6f747461776168656172743110300e06035504031307756f68692d636130820122300d06092a864886f70d01010105000382010f003082010a02820101009d08ba6ca5266c5161bff2aba9fea2dfc2f20347f7de7f21c9886b4cd7a1a189159fa78815bbd73b43e1bf73 EAP-Message = 0xf4af9701ecd685f783c48b6db282334729fb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x76bc89cb174520f20da1729de7efd20f Finished request 5048 Going to the next request Waking up in 6 seconds... .................truncated log................... --------------------------------*------------------------------------*-------- --------------------------------WinXP 802.1x*------------------------------ --------------------------------*------------------------------------*-------- Ready to process requests. rad_recv: Access-Request packet from host 192.168.242.4:32768, id=121, length=184 User-Name = "uohi-40626" Calling-Station-Id = "00-40-96-B1-43-A8" Called-Station-Id = "00-15-2C-49-E0-B0:UOHISSID2" NAS-Port = 1 NAS-IP-Address = 192.168.242.4 NAS-Identifier = "UOHIWLAN2" Vendor-14179-Attr-1 = 0x00000002 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "23" EAP-Message = 0x0202000f01756f68692d3430363236 Message-A

2 1

operators clarification
by Andrew Long 05 May '07

05 May '07

I have looked at the wiki and read the docs... never-the-less... I inherited a 0.9 freeradius/mysql/chap setup which I have updated to 1.4. Currently I am sending radreply like | 358 | indigoAmh-AP05 | Colubris-AVPair | += | mac-address=00-0D-BD-0F-90-83,indigoAmh-AP05,ap_connect | 359 | indigoAmh-AP06 | Colubris-AVPair | += | mac-address=00-0D-BD-59-57-EB,indigoAmh-AP06,ap_connect | 360 | indigoAmh-AP07 | Colubris-AVPair | += | mac-address=00-0D-BD-0F-91-89,indigoAmh-AP07,ap_connect Now this works, but I have read that the op ':=' would be more correct and this is what Colubris suggests in their examples. What I don't understand is.. my reading of the wiki leads me to believe that := would replace existing attributes of the same name (Colubris-AVPair) with the current one, rather than appending them, as we want. Can someone explain where my reading of the docs is wrong. ---QUOTE ':=' Always matches as a check item, and replaces in the configuration items any attribute of the same name. If no attribute of that name appears in the request, then this attribute is added. As a reply item, it has an identical meaning, but for the reply items, instead of the request items. ---END QUOTE Regards, Andrew Long

2 1

libradius error
by Roberto Greiner 04 May '07

04 May '07

Hi, I'm having a small problem with radwho/libradius. When I give a 'radwho' command, I receive the following error: radwho: error while loading shared libraries: libradius-1.1.6.so: cannot open shared object file: No such file or directory I've installed FreeRadius following the guidelines for Debian from de wiki, including mysql support. FreeRadius itself works fine, as does access to the mysql base. The mentioned libradius file is in /usr/lib/freeradius, and the radius.conf file has the following entry(it's the pre-installed entry, I didn't change it): libdir = /usr/lib/freeradius So freeradius should find the library file. I'm running FreeRadius version 1.1.6, in a fresh Debian Etch install. Any Ideas? Thank you very much, Marcos Roberto Greiner The -x entry from freeradius is the following (although, as I said, FreeRadius itself works fine). Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to dialup@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=localhost,shortname=local,secret=foobar rlm_sql (sql): Adding client 127.0.0.1 (local) to clients list rlm_sql (sql): Read entry nasname=a.b.c.d,shortname=xxxxxxx,secret=s3mf!o/ rlm_sql (sql): Adding client a.b.c.d (xxxxxxx) to clients list rlm_sql (sql): Read entry **** Cut => more entries from the nas table in mysql rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

3 7

How to configure multiple LDAPs with different DN's ?
by Eric Martell 04 May '07

04 May '07

Hi, We are trying to use LDAP group for authentication and authorization. Ldap1 => baseDN = "dc=user,dc=net,o=internet" This Ldap1 will have users and passwords store in it along with profile. Ldap2 => baseDN = "dc=role,dc=system,o=internet" This Ldap2 will have only users and associated roles. No passwords will be store in Ldap2. While accessing the service, Radius should check if the user/password matches in Ldap1. If its fine, check on Ldap2 which has different baseDN to see if the role for that user validated. If both conditions satisfies, permits the user to access the service. I am not sure how to configured this. Please kindly help in changing radiusd.conf and users file. Thanks so much in advance. Regards. ____________________________________________________________________________________ Expecting? Get great news right away with email Auto-Check. Try the Yahoo! Mail Beta. http://advision.webevents.yahoo.com/mailbeta/newmail_tools.html

1 0

Default Authentication
by Norman Zhang 04 May '07

04 May '07

I have the following setup for users DEFAULT Auth-Type = System Fall-Through = Yes, cisco-avpair = "shell:priv-lvl=1", Service-Type = NAS-Prompt-User DEFAULT Group == router-ro cisco-avpair := "shell:priv-lvl=7" DEFAULT Group == router-rw cisco-avpair := "shell:priv-lvl=15" However, system users not in group router-ro or router-rw are still able to login with privilege level = 1. Is there a way to force only group router-ro and router-rw can login? Norman

4 7

Freeradius proxy code questions and proposed patch
by Kostas Zorbadelos 04 May '07

04 May '07

Hello to everyone. In a previous thread http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg33354.… I had described a strange behavior in our large proxy setup. After running the server in debug mode (radiusd -xxx) in our production systems we found out what was causing our problems. The problem was that the home server in our proxy setup was marked dead quite often during the day and with a dead_time of 30 secs every request that came within these 30 secs was rejected. Our proxy conf initially looked like the following: proxy server { synchronous = yes retry_delay = 0 retry_count = 0 dead_time = 30 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. # ... We first changed the dead_time to 0 so as to avoid marking the home server dead in synchronous mode. Additionally, we implemented the following patch (against version 1.1.6): --- ./src/main/files.c.orig 2007-04-23 15:14:14.569932000 +0300 +++ ./src/main/files.c 2007-04-23 15:22:30.995686000 +0300 @@ -489,6 +489,15 @@ if (cl->last_reply > (( now - mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count ))) { continue; } + /* + * If we are running in synchronous proxy mode, there's no point marking the target + * server(s) dead, since this should be done by the radius client + */ + if (mainconfig.proxy_synchronous) { + radlog(L_PROXY, "authentication server %s:%d for realm %s seems unresponsive.", + cl->server, port, cl->realm); + continue; + } cl->active = FALSE; cl->wakeup = now + mainconfig.proxy_dead_time; @@ -498,6 +507,15 @@ if (cl->last_reply > (( now - mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count ))) { continue; } + /* + * If we are running in synchronous proxy mode, there's no point marking the target + * server(s) dead, since this should be done by the radius client + */ + if (mainconfig.proxy_synchronous) { + radlog(L_PROXY, "accounting server %s:%d for realm %s seems unresponsive.", + cl->acct_server, port, cl->realm); + continue; + } cl->acct_active = FALSE; cl->acct_wakeup = now + mainconfig.proxy_dead_time; The purpose of this patch is to not have the freeradius server mark the home server dead when working in synchronous mode. We believe that in synchronous operation it is a good idea to leave the job of marking the server dead to the NAS client. All the above actions solved our initial problems. However, after a while we noticed again clients being rejected when they shouldn't. The following code in request_list.c caught my attention: /* * Refresh a request, by using proxy_retry_delay, cleanup_delay, * max_request_time, etc. * * When walking over the request list, all of the per-request * magic is done here. */ static int refresh_request(REQUEST *request, void *data) { ... (around line 1264 version 1.1.6) } else if (request->proxy && !request->proxy_reply) { /* * The request is NOT finished, but there is an * outstanding proxy request, with no matching * proxy reply. * * Wake up when it's time to re-send * the proxy request. * * But in synchronous proxy, we don't retry but we update * the next retry time as NAS has not resent the request * in the given retry window. */ if (mainconfig.proxy_synchronous) { /* * If the retry_delay * count has passed, * then mark the realm dead. */ if (info->now > (request->timestamp + (mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count))) { rad_assert(request->child_pid == NO_SUCH_CHILD_PID); request_reject(request); realm_disable(request->proxy->dst_ipaddr, request->proxy->dst_port); request->finished = TRUE; goto setup_timeout; } request->proxy_next_try = info->now + mainconfig.proxy_retry_delay; } difference = request->proxy_next_try - info->now; } else { ... It seems that in some "strange" occations the code enters the above path. A decision is made in case the current time is older than mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count. If this is the case, the request is rejected and the code tries to disable the realm. However in the proxy.conf configuration file it is mentioned: # If you want to have the server send proxy retries ONLY when the NAS # sends it's retries to the server, then set this to 'yes', and # set the other proxy configuration parameters to 0 (zero). # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # Additionally, if you want 'failover' to work, the server must manage # retries and timeouts. Therefore, if this is set to yes, then no # failover functionality is possible. # synchronous = no When we have proxy_retry_delay and proxy_retry_count zero, the request is rejected whenever we enter the above code path. I can't tell for sure if there is a problem in that code but it does not look clean to me. In order to circumvent the problems we just gave values to these 2 configuration parameters, so we ended up with the following proxy.conf: proxy server { synchronous = yes retry_delay = 15 retry_count = 5 dead_time = 0 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. # ... Please let me know your thoughts on these matters (also on the patch we provide) Thanks, Kostas

4 6