May 2007 - Freeradius-Users - lists.freeradius.org

Accounting-Response with invalid signature
by Rio Yang 27 May '07

27 May '07

Hi All, I got the following message from my radius.log. Wed May 23 16:39:11 2007 : Error: Received Accounting-Response packet from 172.16.1.1:1813 with invalid signature (err=2)! (Shared secret is incorrect.) Wed May 23 16:39:11 2007 : Error: Reply from home server 172.16.1.1:1813 - ID: 180 arrived too late for request 2515449. Try increasing 'retry_delay' or 'max_request_time' It caused some problem on accounting record . The secret between NAS and RADIUS are the same. But the log tell me the secret is incorrect at Accounting-Response. Do anybody know what's the main cause and how to fix it ? PS. NAS and Radius are in the same subnet without any firewall. Rio@TW

5 9

dialupadmin not displaying menu
by Carl aniams 26 May '07

26 May '07

hi, I am installing a wireless hotspot with freeradius.the installation went fine, but when trying to display the dialupadmin html page http://localhost /dialupadmin <http://localhost/dialupadmin> the pae displays fine but the menu on the left is not displayed as it should be. instead i observed that it is the content of a php3 script in the conf file that are written need a help please -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

How to re-forward a request rejected by one proxy server to another proxy server?
by Clark J. Wang 26 May '07

26 May '07

I configuired two proxy servers `radius1' and `radius2' for realm `foo.com' in file `proxy.conf'. And I want those requests rejected by `radius1' to be re-forwarded to `radius2'. How can I do that? Thanks.

2 1

how to add feature authentification...
by Trio Yulistianto 26 May '07

26 May '07

dear all i'm using freeradius-1.1.6 and mysql database... for now running well.. but i need something add to authentification process.. i have one table "Payment_Table" (username,payment) all username in radcheck already copied to username field,payment field filled by '0' or '1' this is what i need : while user trying to connect, freeradius will check payment_table, if payment field is '0' user cannot log in,except field contain with '1' any suggestion? thanks trio

2 1

FreeRadius crash
by Doug Hardie 26 May '07

26 May '07

I am encountering an infrequent problem where FreeRadius crashes about once a week on a fairly busy server. I have a primary and secondary authentication server and just a primary accounting server. Both the primary and secondary crash at the same time (well the secondary is about 30 seconds behind the primary). Thus I know that it is an authentication request causing the problem. However, using the authentication requests that occurred just prior to the crash I am unable to replicate the problem. I have core dumps and have tried to find useful information on the cause but have not found anything. The trace always shows: (gdb) where #0 0x280a94ab in pthread_testcancel () from /usr/lib/libpthread.so.2 #1 0x280a1e3c in pthread_mutexattr_init () from /usr/lib/ libpthread.so.2 #2 0x2808b450 in ?? () FreeRadius 1.1.2 on FreeBSD 6.1 using libpthread. I have tried using libthr but that crashed instantly on receipt of any request so I suspect that was not intended to work. I am beginning to suspect that the problem may lie in libpthread. Is there anything that can be retrieved from the core files that might help? There are always several threads active at the time of the crash.

5 15

rlm_sql: processing radcheck & radgroupcheck
by Milan Holub 25 May '07

25 May '07

Hi all, I'm wondering about procedure of precessing radcheck&radgroupcheck database tables. On http://wiki.freeradius.org/Rlm_sql we can read: Group processing then begins if any of the following conditions are met: * The user IS NOT found in radcheck * The user IS found in radcheck, but the check items don't match ... Ok, the first point I can imagine that if the user is not found we still can accept the "generic" user and give him some reply attributes based on further group processing. But the 2nd point I do not understand. Few lines below on wiki we can read: > For any fairly complex setup, it is likely that most of the actual > processing will be done in the groups. In these cases, the user entry in > radcheck will be of limited use except for things like setting the > user's password. In fact in my case(I believe in almost all of the cases) we DO check users against their passwords. If this check fails we should reject the user else we give him reply attributes based on group membership and accept the request. Thus my question is: why to continue in group processing when the check items(password,...) in radcheck do not match? This leads to accepting users giving valid username but incorrect password... Here is my patch which enables read_groups option and targets the issue above(rejects user immediately if it's found that the radcheck failed): Index: src/modules/rlm_sql/rlm_sql.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_sql/rlm_sql.c,v retrieving revision 1.165 diff -u -r1.165 rlm_sql.c --- src/modules/rlm_sql/rlm_sql.c 5 Apr 2007 10:52:37 -0000 1.165 +++ src/modules/rlm_sql/rlm_sql.c 12 Apr 2007 09:54:34 -0000 @@ -57,6 +57,8 @@ offsetof(SQL_CONFIG,tracefile), NULL, SQLTRACEFILE}, {"readclients", PW_TYPE_BOOLEAN, offsetof(SQL_CONFIG,do_clients), NULL, "no"}, + {"read_groups", PW_TYPE_BOOLEAN, + offsetof(SQL_CONFIG,read_groups), NULL, "yes"}, {"deletestalesessions", PW_TYPE_BOOLEAN, offsetof(SQL_CONFIG,deletestalesessions), NULL, "yes"}, {"num_sql_socks", PW_TYPE_INTEGER, @@ -638,6 +640,11 @@ /* * Only do this if *some* check pairs were returned */ + DEBUG2("rlm_sql (%s): check items", inst->config->xlat_name); + vp_listdebug(check_tmp); + DEBUG2("rlm_sql (%s): items found in packet", inst->config->xlat_name); + vp_listdebug(request->packet->vps); + if (paircompare(request, request->packet->vps, check_tmp, &request->reply->vps) == 0) { found = 1; DEBUG2("rlm_sql (%s): User found in group %s", @@ -960,6 +967,11 @@ dofallthrough = fallthrough(reply_tmp); pairxlatmove(request, &request->reply->vps, &reply_tmp); pairxlatmove(request, &request->config_items, &check_tmp); + } else { + /* + * check items did not match; do not process groups; return REJECT immediately + */ + return RLM_MODULE_REJECT; } } Hope this helps someone. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 3

FYI : My workaround for freeradius not sending back an Access-Reject on a failed external script
by Patric 25 May '07

25 May '07

Hey guys, Thought it might interest some of you as to how I worked around the problem where freeradius does not return an Access-Reject if my php script does not exit successfully (in my case because a user should be rejected). The original code that checks the exit status of the script is this : src/modules/rlm_exec/rlm_exec.c : /* * Dispatch an exec method */ static int exec_dispatch(void *instance, REQUEST *request) { ... if (result != 0) { radlog(L_ERR, "rlm_exec (%s): External script failed", inst->xlat_name); return RLM_MODULE_FAIL; } ... return RLM_MODULE_OK; } So basically if my script does not return 0, it failed, regardless of its exit status. According to the RLM_MODULE_* definitions : enum { RLM_MODULE_REJECT, /* 0 - immediately reject the request */ RLM_MODULE_FAIL, /* 1 - module failed, don't reply */ RLM_MODULE_OK, /* 2 - the module is OK, continue */ RLM_MODULE_HANDLED, /* 3 - the module handled the request, so stop. */ RLM_MODULE_INVALID, /* 4 - the module considers the request invalid. */ RLM_MODULE_USERLOCK, /* 5 - reject the request (user is locked out) */ RLM_MODULE_NOTFOUND, /* 6 - user not found */ RLM_MODULE_NOOP, /* 7 - module succeeded without doing anything */ RLM_MODULE_UPDATED, /* 8 - OK (pairs modified) */ RLM_MODULE_NUMCODES /* 9 - How many return codes there are */ }; So if I wanted to authenticate a user I should *actually* be returning 2. If I wanted to *reject* the user I should be returning 0. But according to the code above if I return 2 the external script failed, and if I return 0, the external script was successful and my user is authenticated successfully. This is how I changed the logic : I *removed* : ... if (result != 0) { radlog(L_ERR, "rlm_exec (%s): External script failed", inst->xlat_name); return RLM_MODULE_FAIL; } ... And replaced it with : ... switch (result) { case 0: // Rejected return RLM_MODULE_REJECT; break; case 1: // Failed return RLM_MODULE_FAIL; break; case 2: // OK break; case 3: // Handled return RLM_MODULE_HANDLED; break; case 4: // Invalid return RLM_MODULE_INVALID; break; case 5: // UserLock return RLM_MODULE_USERLOCK; break; case 6: // Not Found return RLM_MODULE_NOTFOUND; break; case 7: // No Op return RLM_MODULE_NOOP; break; case 8: // Updated return RLM_MODULE_UPDATED; break; case 9: // Num Codes return RLM_MODULE_NUMCODES; break; default: // Fail return RLM_MODULE_FAIL; break; } ... In this way, if the result is 2 (user is OK), the process will drop out of the switch statement, and process the original code for handling a successful authentication. Now in my external script I can do : exit(2); --> User was accepted. OR exit(0); --> User was rejected. I realise that this is a bit of a contradiction for the external script, because for a reject it is exiting successfully, and for a successful authentication it is in fact failing with exit code 2. BUT in this way I can use the codes determined by freeradius in my external script. I do not think that this is the actual bug that Alan refered to, but it was a problem in my case. The original code is actually correct in that the external script *did* fail, but it was ignoring the exit code to determine what action to take. I believe that the actual bug is that freeradius does not return a reply to the authentication request if the status is set to RLM_MODULE_FAIL. From what I could tell the only time that freeradius replies to a request is if the status is RLM_MODULE_OK, or RLM_MODULE_REJECT and possibly RLM_MODULE_USERLOCK. I hope that this is understandable, I have the whole scenario in my head but its a bit difficult to verbalise... Please advise if any of my presumptions or understandings are incorrect, as I am happy to learn! Thanks for all your responses to my questions, Im back on track now! Patrick ---------------------------------------------------------------------- Get a free email address with REAL anti-spam protection. http://www.bluebottle.com

1 0

Bug 233 and 234 - only match one huntgroup per nas
by Walt Reynolds 25 May '07

25 May '07

I have looked at both of these bugs and am not sure I understand the programming, but I do understand that there seemed to be simple solutions to allowing a NAS to be in more than one huntgroup. One had a patch attached and the other mentions a section that needed to be re-added from a previous version. Neither bug has had any activity since 2005. Is this still something that has not been fixed, or are the fixes in the newer versions that I do not see (nothing in changelog either). If the answer is that it is still not fixed, what is the possibility of getting this resolved? Thanks. -- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

1 0

Authenticating many devices using one attribute
by Brian Johnson 25 May '07

25 May '07

Hello -- We're hoping to begin using radius to authenticate logins to our Cisco routers and Cisco switches. Currently, we're going to start with a group of core routers, but would like to make all of our switches authenticate to radius. Being the networking group for the University, our switches are located on many different networks all over campus, and we have ~900. We currently use our radius server to authenticate other services such as modems and the VPN. I'm looking for a radius configuration that's as compact as possible; obviously, when dealing with 900+ devices, using individual ips isn't ideal. Thank you for your help. Brian -- Brian Johnson "And I will be even more undignified than this, and will be humble in my own sight." (2 Samuel 6:22)

2 1

2.0.0-pre1 compile problem on ubuntu
by Norbert Wegener 25 May '07

25 May '07

on an ubuntu 6.06 configure does not show an error with 2.0.0-pre1. Compiling fails: ..... make[6]: Betrete Verzeichnis '/home/norbert/Desktop/freeradius-server-2.0.0-pre1/src/modules/rlm_perl'^M /home/norbert/Desktop/freeradius-server-2.0.0-pre1/libtool --mode=link gcc -release 2.0.0-pre1 \^M -module -export-dynamic -o rlm_perl.la \^M -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /home/norbert/Desktop/freeradius-server-2.0.0-pre1/src/lib/libradius.la \^M `perl -MExtUtils::Embed -e ldopts` -lnsl -lresolv -lpthread^M ^M *** Warning: Linking the shared library rlm_perl.la against the^M *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable!^M gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/norbert/Desktop/freeradius-server-2.0.0-pre1/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /home/norbert/Desktop/freeradius-server-2.0.0-pre1/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-2.0.0-pre1.so -o .libs/rlm_perl-2.0.0-pre1.so^M /usr/bin/ld: cannot find -lperl^M .... On the other hand, dpkg shows: dpkg -l|grep libperl ii libperl5.8 5.8.8-7build1 Norbert Wegener

4 3