May 2007 - Freeradius-Users - lists.freeradius.org

DB handles dying slowly
by Milan Holub 25 May '07

25 May '07

2 5

missing entry for evaluate.c in Makefile.in
by Milan Holub 25 May '07

25 May '07

Hi Alan, I just compiled cvs head and it fails because of not updated makefile. here is a patch: Index: src/main/Makefile.in =================================================================== RCS file: /source/radiusd/src/main/Makefile.in,v retrieving revision 1.66 diff -u -r1.66 Makefile.in --- src/main/Makefile.in 16 Apr 2007 10:54:19 -0000 1.66 +++ src/main/Makefile.in 25 May 2007 11:59:34 -0000 @@ -8,7 +8,7 @@ listen.c log.c mainconfig.c modules.c modcall.c \ radiusd.c radius_snmp.c \ session.c smux.c threads.c util.c valuepair.c version.c \ - xlat.c event.c realms.c + xlat.c event.c realms.c evaluate.c SERVER_OBJS += $(SERVER_SRCS:.c=.lo) @@ -137,6 +137,9 @@ xlat.lo: xlat.c $(LIBTOOL) --mode=compile $(CC) $(CFLAGS) -c xlat.c +evaluate.lo: evaluate.c + $(LIBTOOL) --mode=compile $(CC) $(CFLAGS) -c evaluate.c + # # Helper programs # Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 1

Freeradius pauses before responding when not running in debug mode
by Patric 25 May '07

25 May '07

Hi all, As per the subject, I have found the following interesting behaviour with freeradius 1.1.6 When running the server in normal mode or in debug level 1 mode : radiusd -y or radiusd -y -x (lowercase x) When sending an access request, the server pauses for a few seconds somewhere in the exec part of the authorize section. When running the server in more verbose debug mode : Radiusd -y -X (uppercase X) This pause does not occur. I am using exec to run external authentication, and would have thought it was my script causing the pause, but it does not appear when running with -X Anybody else experience something like this? Thanks Patrick ---------------------------------------------------------------------- Find out how you can get spam free email. http://www.bluebottle.com

1 0

mysql database limit
by satish patel 25 May '07

25 May '07

Dear ALL I have single machine with model name : Intel(R) Pentium(R) D CPU 2.80GHz + RAM 512 - configuration i am plaing to use freeradius-1.0.0 with mysql with 500 users so what about the performance issue so it will working fine in this configuration or not ???? What is the limit of radacct table in mysql is there any limit of data how much it will go up to data in mysql or any performance issuse with more data ??? $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Download prohibited? No problem! CHAT from any browser, without download.

2 1

RE: freeradius and ntlm_auth howto
by King, Michael 25 May '07

25 May '07

Some things I've noticed from your attached files Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes I've never enabled these before, I'm unaware what affect they will have tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" Did you generate your OWN certs... They one's that ship with the server ARE NOT vailid. You have to generate your own. rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 That doesn't look right BUT YOUR FINAL ANSWER: xec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=b9ee04ca891c7b7d --nt-response=79b960c773fa101929d3bf8e738168e8b6d8ae8cd61f64f0 Exec-Program output: Account locked out (0xc0000234) Exec-Program-Wait: plaintext: Account locked out (0xc0000234) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Your account in the domain is not correct. Looks like it's been disabled or something. Fix that first before you change anymore config files. ________________________________ From: Stieven.Struyf(a)komatsu.eu [mailto:Stieven.Struyf@komatsu.eu] Sent: Monday, November 06, 2006 3:16 AM To: King, Michael Subject: Fw: freeradius and ntlm_auth howto Michael, I sent my reply already to the list, but due to the size(larger than 100k) it had to be reviewed by the admin and after a week it was rejected. Below you can find the mail. Thanks for helping me. Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 ----- Forwarded by Stieven Struyf/KEISA/BE/KOMEUR on 11/06/2006 09:13 AM ----- Stieven Struyf/KEISA/BE/KOMEUR 11/02/2006 08:55 AM To FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc Subject RE: freeradius and ntlm_auth howtoLink <Notes://BENT63KE/C1257011005324FB/DABA975B9FB113EB852564B5001283EA/625A 148B6EA233CDC125721400531414> I added the debuglog as attachment(as it is a little large to paste here). This is the mschap config: mschap { authtype = MS-CHAP use_mppe = yes require_strong = yes with_ntdomain_hack = yes require_encryption = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 freeradius-users-bounces+stieven.struyf=komatsu.eu(a)lists.freeradius.org wrote on 10/27/2006 04:36:00 PM: > Let's see if we can get this solved... > > > -----Original Message----- > > Here's the full log: > > Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 10.104.254.73:1645, > > This is NOT the full log. The full log would have started with the line > /path/to/radiusd -X > > Some important stuff is printed out there, it helps us help you. > > > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > Did you enable Ntdomain Hack in the MSCHAP module? (See below) > > > Including your radius.conf file would help. > > > > > HOWEVER, first you may want to check your mschap module definition: > > > > > > modules { > > > mschap { > > > ntlm_auth = "/usr/bin/ntlm_auth \ > > > --request-nt-key \ > > > --username=%{mschap:User-Name:-None} \ > > > --domain=%{mschap:NT-Domain:-None} \ > > > --challenge=%{mschap:Challenge:-00} \ > > > --nt-response=%{mschap:NT-Response:-00}" > > > > > > ...all on one line of course. Note the use of the > > "mschap:User-Name" > > > and "mschap:NT-Domain" values. > > Mine radiusd.conf file's mschap section looks like this: > NOTE that I do NOT have the :-00 and the :-None statements, and I DO > have with_ntdomain_hack=yes > > > # Microsoft CHAP authentication > # > # This module supports MS-CHAP and MS-CHAPv2 authentication. > # It also enforces the SMB-Account-Ctrl attribute. > # > mschap { > with_ntdomain_hack = yes > ntlm_auth = "/usr/bin/ntlm_auth \ > --request-nt-key \ > --username=%{mschap:User-Name} \ > --challenge=%{mschap:Challenge} \ > --nt-response=%{mschap:NT-Response} > } > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 9

Dynamic VLAN - limiting switchs VLANs?
by Robert 25 May '07

25 May '07

Hello all, I currently have FR running and happily doing MAC authentication against a MYSQL DB. I can plug a computer into the switch, have the switch grab the MAC addy, pass it to FR, hit the DB and return what VLAN that MAC belongs to, and then have the switch configure to port to the correct VLAN. Now the complication that I'm facing is that in our environment, a MAC might be assigned to multiple VLANs and our switches only have a fraction of the total number VLANs trunked to them. What I need is a way FR can not only match the MAC to a VLAN, but also to cross reference that result to the VLANs that are available from the requesting switch. Anyone know how to do this? Or at least a good place that I can start? I'll admit that I'm very noob-ish about all this and it's is my first time trying to setup FR so I apologize if this is a really simple or conversely an impossible task. I just can not get Google to give me any love on this. Thanks, Rob

5 4

freeradius 1.1.4 stops answering (why?)
by Roberto S. G. 25 May '07

25 May '07

hi, I'm experiencing strange problems with a compiled freeradius 1.1.4 that I have on a Reh Hat... I've used there other previous freeradius versions without problem, but this one seems to maintain service for just a couple of days, after which it stops authenticating. I had not noticed this before, 'cause it was almost idle until now. There's no strange error, even in "-X" mode. Maybe it has something to be with connections to the ldap server... freeradius makes connections to local stunnel ports, which then connects to an Active Directory via ldaps (it has always run smoothly), but the last configured freeradius ldap is a plain remote ldap connection just in case stunnel stops running... ¿Maybe new FR versions has changes in the way it manages connections?. The "Timed out while waiting for server to respond" error doesn't seem to me correct, since a restart makes it dissapear, and I'd already risen default values in radiusd.conf {ldap}: timeout = 60 timelimit = 3 net_timeout = 5 I just see in radius.log that there aren't more OK's (or KO's)... I do not understand also the "Logout entry for NAS wireless-leon port 1 has wrong IDs" message... (I make no accounting). [ I've tried also v1.1.6, but it's even worse: there're *much* more "Logout entry for..." and "Error: rlm_ldap: ldap_search() failed: Timed out..." and "Error: Discarding duplicate request..." logs, and others related to NAS that didn't appear before; all with exactly the same conf (which I compared line by line with 1.1.6 default one, without finding new or deprecated attributes...), so I downgrade to 1.1.4 again... ] Any comment will be appreciated. bye extract from radius.log, for v1.1.4: Wed May 23 13:16:05 2007 : Error: rlm_radutmp: Logout entry for NAS wireless-leon port 1 has wrong ID Wed May 23 13:16:31 2007 : Error: rlm_radutmp: Logout entry for NAS wireless-leon port 1 has wrong ID Wed May 23 13:20:34 2007 : Error: rlm_radutmp: Logout entry for NAS wireless-leon port 1 has wrong ID Wed May 23 14:07:36 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 170 due to unfinished request 141087 ... Wed May 23 14:08:08 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 172 due to unfinished request 141089 Wed May 23 14:08:34 2007 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Wed May 23 14:08:46 2007 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Wed May 23 14:08:58 2007 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Wed May 23 17:20:39 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 114 due to unfinished request 141090 ... Wed May 23 17:21:04 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 115 due to unfinished request 141091 Wed May 23 17:21:13 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 116 due to unfinished request 141092 Wed May 23 17:21:15 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 116 due to unfinished request 141092 Wed May 23 17:21:17 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 116 due to unfinished request 141092 Wed May 23 17:21:19 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 116 due to unfinished request 141092 Wed May 23 17:21:21 2007 : Error: Discarding duplicate request from client wireless-leon:1025 - ID: 116 due to unfinished request 141092 Wed May 23 17:21:36 2007 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Wed May 23 17:21:54 2007 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Wed May 23 17:22:11 2007 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout.

1 0

Including Vendor specific dictionary file
by H.Theissen＠nexans.com 25 May '07

25 May '07

Hi, I have created a vendor specific dictionary file for freeradius. This file includes two attributes for our mini switches. Is it possible to include this file within the next freeradius release? You will find the text below. Kind regards Hubert Theißen Research & Development Tel. +49 2166 272721 Fax +49 2166 272313 <http://www.nexans.de/ans/> <mailto:H.Theissen@nexans.com> - - - Nexans Deutschland Industries GmbH & Co. KG Bonnenbroicher Straße 2-14 41238 Mönchengladbach Sitz: Hannover Amtsgericht Hannover HRA 25339 Persönlich haftende Gesellschafterin: Nexans Deutschland GmbH Sitz: Hannover Amtsgericht Hannover HRB 60648 Geschäftsführer: Dr. Wolfgang Bedorf (Vors.), Christof Barklage Vorsitzender des Aufsichtsrats: Yvon Raak # -*- text -*- ############################################################################## # Nexans Active Networking Systems dictionary http://www.nexans.de/ans # # Version: $Id: dictionary.nexans,v 1.0 2007/05/05 08:10:11 aland Exp $ # # Hubert Theissen <h.theissen(a)nexans.com> # ############################################################################## VENDOR Nexans 266 ietf BEGIN-VENDOR Nexans ATTRIBUTE Nexans-Port-Default-VLAN-ID 1 integer Nexans ATTRIBUTE Nexans-Port-Voice-VLAN-ID 2 integer Nexans END-VENDOR Nexans

3 2

Radius authentication problems
by sizo nsibande 25 May '07

25 May '07

Goodmorow We are having a problem testing the authentication process on our radius box, please do not flame me, I am just trying to find out if any of you guys have ever maybe come across any such issue. Thanks in advance. <snip> May 24 14:09:52 allan snmpd[2435]: netsnmp_assert index == tmp failed if-mib/data_access/interface.c:467 _access_interface_entry_save_name() May 24 14:10:05 allan pppd[5714]: LCP: timeout sending Config-Requests May 24 14:10:05 allan pppd[5714]: Connection terminated. May 24 14:10:05 allan pppd[5714]: Modem hangup May 24 14:10:09 allan pppoe[5715]: Timeout waiting for PADS packets May 24 14:10:09 allan pppd[5714]: Exit. May 24 14:10:09 allan adsl-connect: ADSL connection lost; attempting re-connection. May 24 14:10:14 allan pppd[5788]: pppd 2.4.4 started by root, uid 0 May 24 14:10:14 allan pppd[5788]: Using interface ppp0 May 24 14:10:14 allan pppd[5788]: Connect: ppp0 <--> /dev/pts/6 May 24 14:10:22 allan snmpd[2435]: netsnmp_assert index == tmp failed if-mib/data_access/interface.c:467 _access_interface_entry_save_name() May 24 14:10:30 allan ntpd[2484]: sendto(212.244.104.2) (fd=23): Network is unreachable May 24 14:10:45 allan pppd[5788]: LCP: timeout sending Config-Requests May 24 14:10:45 allan pppd[5788]: Connection terminated. May 24 14:10:45 allan pppd[5788]: Modem hangup May 24 14:10:49 allan pppoe[5789]: Timeout waiting for PADS packets May 24 14:10:49 allan pppd[5788]: Exit. Sent at 14:26 on Thursday <snip> -- Communication is not just eglish grammaer and literature, but a well established database between people that have come to know each other!

2 1

dictionary handling
by Wolfgang Rosenauer 25 May '07

25 May '07

Hi, since I just begun to use freeradius in production I found some strangeness. The default configuration is to include all dictionaries but I wonder how they are evaluated? I have a Cisco NAS which sends (at least I think) VSA records and so I configured the Cisco VSA hack. For accounting reasons I'm interested in Cisco-PreSession-Time which is 198. In the detail log I found X-Ascend-PreSession-Time instead of Cisco-PreSession-Time though. If I grep through the dictionaries I found: dictionary.alvarion:ATTRIBUTE Alvariaon-VSA-198 198 string dictionary.aptis:ATTRIBUTE CVX-PreSession-Time 198 integer dictionary.ascend:ATTRIBUTE Ascend-PreSession-Time 198 integer dictionary.ascend:ATTRIBUTE X-Ascend-PreSession-Time 198 integer dictionary.cisco:ATTRIBUTE Cisco-PreSession-Time 198 integer dictionary.epygi:ATTRIBUTE Epygi-OutRTP_PacketSize 198 integer dictionary.lucent:ATTRIBUTE Lucent-PreSession-Time 198 integer So I find it strange that freeradius logs X-Ascend-PreSession-Time at all since it's not the first match and not the last one. In addition I wonder if it makes sense that dictionary.ascend has two definitions for 198. I was under the impression that the correct dictionary would be chosen by the vendor ID (9 in case of Cisco). So any idea why freeradius logs Ascend attributes then? Thanks, Wolfgang

2 1