July 2007 - Freeradius-Users - lists.freeradius.org

Re: pool-key issue in rlm_sqlippool
by Hugh Messenger 05 Jul '07

05 Jul '07

Peter Nixon <listuser(a)peternixon.net> said: > On Wed 04 Jul 2007, Hugh Messenger wrote: > > I have a problem with the pool-key in rlm_sqlippool. > > You can run two copies of the module. As long as you don't have the same > pool > name in both, just assign your pool name based on hunt group and > everything > will work as you expect :-) Ah hah. I think I get it now! So basically I can replicate the "Multiple sqlippool instance example" setup from the wiki, where the only difference between the two instance configs is the pool-key. I was going at it the wrong way. Thinking in terms of "if it's a dialup do sqlippool_dialup, elsif it's a wireless do sqlippool_wireless". Instead of "try sqlippool_dialup, if it fails try sqlippool_wireless", just relying on the Pool-Name to take care of things. Thankyou for being so patient! > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 1

Help: "rlm_eap: processing type tls" Done, but "Segmentation fault"
by gaopeng 05 Jul '07

05 Jul '07

Dear all,I am a beginner about FreeRadius, and was learnning implement the WPA EAP-TLS by FreeRadius. I refer to the document named "WPA Authentication for Windows XP Clients with RADIUS HOWTO". I meet the problem: the trace stoped with error "Segmentation fault" after "rlm_eap: processing type tls". The log is attached, I wonder if you know what's wrong with it. I will really appreciate your helping me! Thanks a lot in advance!Gao Pengroot@RADIUS:~# freeradius -XStarting - reading configuration files ...reread_config: reading radiusd.confConfig: including file: /etc/freeradius/proxy.confConfig: including file: /etc/freeradius/clients.confConfig: including file: /etc/freeradius/snmp.confConfig: including file: /etc/freeradius/eap.confConfig: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" m! ain: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1600 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0read_config_files: reading dictionaryread_config_files: readin! g naslistUsing deprecated naslist file. Support for this will go away soon.read_config_files: reading clientsread_config_files: reading realmsradiusd: entering modules setupModule: Library search path is /usr/lib/freeradiusModule: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)"rlm_exec: Wait=yes but no output defined. Did you mean output=none?Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt"Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)"Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = norlm_eap: Loade! d and initialized type md5rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP"rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/wireless-auth/pem/RADIUS.pem" tls: certificate_file = "/etc/wireless-auth/pem/RADIUS.pem" tls: CA_file = "/etc/wireless-auth/pem/root.pem" tls: private_key_password = "password" tls: dh_file = "/etc/wireless-auth/dh" tls: random_file = "/etc/wireless-auth/random" tls: fragment_size = 1600 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)"rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yesrlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = n! orlm_eap: Loaded and initialized type mschapv2Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = noModule: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = noModule: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no"Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"Module: Instantiated acct_unique (acct_unique) Module: Lo! aded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = noModule: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yesModule: Instantiated radutmp (radutmp) Listening on authentication *:1812Listening on accounting *:1813Ready to process requests.rad_recv: Access-Request packet from host 192.168.1.1:1024, id=0, length=175 User-Name = "host/cn1ndr2c.cn001.siemens.net" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "001a704e2a1b" Calling-Station-Id = "000cf15c5443" NAS-Identifier = "001a704e2a1b" NAS-Port = 11 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200002401686f73742f636e316e647232632e636e3030! 312e7369656d656e732e6e6574 Message-Authenticator = 0x4cfed09a13 0593c598c4930aca9b01da Processing the authorize section of radiusd.confmodcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/cn1ndr2c.cn001.siemens.net", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 36 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry host/cn1ndr2c.cn001.siemens.net at line 218 modcall[authorize]: module "files" returns ok for request 0modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAPauth: type "EAP" Processing the authenticate section of radiusd.confm! odcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tlsSegmentation fault _________________________________________________________________ 探索 Windows Vista 的世界 http://search.live.com/results.aspx?q=windows+vista&mkt=zh-cn&FORM=LIVSOP

1 0

Useful sqlippool script
by Roy Walker 05 Jul '07

05 Jul '07

For those working with sqlippool, I made a quick script which will make it easy for you to create the ip blocks in the radippool table. Might be nice for new users if this was included in the scripts directory. #!/bin/sh # This script will output the necessary INSERT commands # for the sqlippool module in freeradius # Enter the pool name attribute POOL_NAME=your_pool_name # Set the first 2 octets of the IP network NETWORK=1.1 # Set the starting point of the third octet START_RANGE=1 # Set the ending point of the third octet END_RANGE=254 # Set the starting point of the fourth octet MIN_IP=1 # Set the ending point of the fourth octet MAX_IP=254 ######################################################################## # ######################################################################## # # Make sure that END_RANGE is higher than START_RANGE if [ $START_RANGE -gt $END_RANGE ] ; then echo "ERROR: Then ending range must be higher than the starting range." exit 1 fi SUBNET=$START_RANGE IP=$MIN_IP count=0 while [ true ]; do if [ $IP -gt $MAX_IP ] ; then if [ $SUBNET -eq $END_RANGE ] ; then exit 0; else SUBNET=$(( $SUBNET + 1 )) IP=$MIN_IP fi fi echo "INSERT INTO radippool (pool_name, FramedIPAddress) VALUES ('$POOL_NAME', '$NETWORK.$SUBNET.$IP');" IP=$(( $IP + 1 )) done; exit 0

2 2

Acct-Terminate-Cause = NAS-Error
by Flavio Silvestrone 05 Jul '07

05 Jul '07

Hello list, i have a problem with freeradius and an Access Point configured as NAS. I'm using freeradius version 1.1.6. I suppose that the problem is about this message: Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Error Here the complite log: Thu Jul 5 10:57:26 2007 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 401 NAS-Port-Type = Ethernet User-Name = "massi" Calling-Station-Id = "00:15:D6:24:32:52" Called-Station-Id = "internet-test-2.4GH" NAS-Port-Id = "wlan1" Acct-Session-Id = "81f0005c" Framed-IP-Address = 10.1.1.7 Framed-IP-Netmask = 255.255.255.0 Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Identifier = "FlyBoost" NAS-IP-Address = 192.168.10.36 Acct-Delay-Time = 0 Client-IP-Address = 192.168.10.36 Acct-Unique-Session-Id = "e4880271975e52f1" Timestamp = 1183625846 Thu Jul 5 10:57:26 2007 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 401 NAS-Port-Type = Ethernet User-Name = "massi" Calling-Station-Id = "00:15:D6:24:32:52" Called-Station-Id = "internet-test-2.4GH" NAS-Port-Id = "wlan1" Acct-Session-Id = "81f0005c" Framed-IP-Address = 10.1.1.7 Framed-IP-Netmask = 255.255.255.0 Acct-Authentic = RADIUS Acct-Session-Time = 0 Acct-Input-Octets = 56 Acct-Input-Gigawords = 0 Acct-Input-Packets = 5 Acct-Output-Octets = 50 Acct-Output-Gigawords = 0 Acct-Output-Packets = 5 Acct-Status-Type = Stop Acct-Terminate-Cause = NAS-Error NAS-Identifier = "FlyBoost" NAS-IP-Address = 192.168.10.36 Acct-Delay-Time = 0 Client-IP-Address = 192.168.10.36 Acct-Unique-Session-Id = "e4880271975e52f1" Timestamp = 1183625846 Any idea ? Thank's Flavio

3 4

EAP-TLS Certificate Loading Errors
by Darren Maden 05 Jul '07

05 Jul '07

This problem relates to a problem with wired EAP-TLS clients that I had previously. When using wpa_supplicant to connect, I am getting these errors: TLS: Trusted root certificate(s) loaded OpenSSL: tls_connection_client_cert - SSL_use_certificate_file (DER) failed error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:140C800D:SSL routines:SSL_use_certificate_file:ASN1 lib OpenSSL: SSL_use_certificate_file (PEM) --> OK OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (DER) failed error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag OpenSSL: pending error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib OpenSSL: pending error: error:140CB00D:SSL routines:SSL_use_PrivateKey_file:ASN1 lib OpenSSL: SSL_use_PrivateKey_File (PEM) --> OK SSL: Private key loaded successfully CTRL-EVENT-EAP-METHOD EAP method 13 (TLS) selected EAP: EAP entering state METHOD SSL: Received packet(len=6) - Flags 0x20 EAP-TLS: Start SSL: (where=0x10 ret=0x1) SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:before/connect initialization SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 write client hello A SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server hello A SSL: SSL_connect - want more data SSL: 99 bytes pending from ssl_out SSL: 99 bytes left to be sent out (of total 99 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL I've tried converting these to der which didn't help. I created these certs based on instructions here, http://www.linuxjournal.com/article/8095 and they work with FreeRADIUS over wireless using both SUSE 10.2 with KNetworkManager and Windows XP/2003. Any ideas what the problems are? ~Darren

1 0

Re: Build a custom module
by Hugh Messenger 05 Jul '07

05 Jul '07

Alan DeKok <aland(a)deployingradius.com> said: > Hugh Messenger wrote: > > <flame> > > I'm just wondering why some of the major Linux releases are still > shipping > > 1.1.3. > > There are versions of redhat that still use 1.0.4. Ouch. > Redhat either > doesn't care, or doesn't have the resources to keep up to date with > thousands of open source packages. Which is the ironic part, as the only thing I'm paying Redhat for is the packaging and upgrading of compatible open source components. Essentially, the expectation that when I type 'up2date' it doesn't mean "up2dateasof1999". I realize that one of the "selling points" of RHEL is that it is not bleeding edge, and doesn't update components as regularly as other flavors of Linux. But there's a difference between "not bleeding edge" and "severely infested with bit rot". I think what chaps my ass is that they are punting the resulting legacy support headaches straight into open source developers lap. Maybe change the license so it has a rider like "you may freely distribute this product, as long as you are distributing a version no more than 3 minor revision numbers older than the current release". :) > This is where systems like Debian have a *huge* win. I've been taking a hard look at Debian of late. It's that or Centos. A case of Better vs More Convenient. > Alan DeKok. -- hugh

2 1

How do I configure new attributes in FreeRadius 1.1.6
by Govardhana K N 05 Jul '07

05 Jul '07

Hi, Can anybody please tell me how can I configure specific Radius attributes and Vendor attributes in FreeRadius 1.1.6. -- With Regards, Govardhana K N

1 0

Wiki error
by Roberto Greiner 04 Jul '07

04 Jul '07

I know this is probably not the best place to report a problem with the wiki, but I don't have a login in it and there is no page to create one, and the 'bug report' link doesn't get to anywhere. The problem is in the http://wiki.freeradius.org/WPA_HOWTO page. Instead of having anything useful, its filled with links about crap, starting with 'buy diazepam' and going on, all with links pointing to pages in http://wc1.worldcrossing.com and http://people.msoe.edu/~millerni/forums.php. I don't think that this is what is expected to be in the freeradius wiki... :-( Roberto Greiner -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

4 3

Re: disappearing configuration items in unlang
by Hugh Messenger 04 Jul '07

04 Jul '07

Alan DeKok <aland(a)deployingradius.com> wrote > Hugh Messenger wrote: > > If I wrap an 'if' statement round something (in this case a query in > > mysql_dialup.conf), any config items seem to get blown away. > > You can't. "if" is a processing directive that is valid only when > packets are being processed. The configuration items are parsed once > when the server starts, and don't change after that. > > > So for instance: > > It would be very nice to be able to do that, but it would also be very > difficult to implement. It would be very nice, and very intuitive. How hard would it be to just provide that one simple construct ("if <config item related condition> {}") during parsing of the startup config? No need for the whole of unlang. More of an 'ifdef' style pre-processing directive than an integrated part of the language. I know you have bigger fish to fry at the moment, just a thought for the future. > The solution is to add a layer of indirection: > > authorize_reply_query = "%{control:Tmp-String-0}" > > Then, while processing the request, set: > > update control { > Tmp-String-0 = "..." > } > > That *should* work, I think. I'll let you know. > Alan DeKok. -- hugh

2 1

Re: "Shared secret is incorrect" - but it is identical!
by ken 04 Jul '07

04 Jul '07

Edvin Seferovic wrote: > Does this have anything to do with the authentication method and AD ? I > don't think so. Neither do I! We're not looking at AD yet. A colleague of mine tried to set it up for JRS by roughly copying someone else's configuration. It failed. So I reinstalled FreeRadius and samba from scratch and started again; re-introducing changes one at at time. I acan make ntlm_auth work from command line but not from FreeRadius yet - so I dropped it and am trying to ensure I can run a minimal test. > Ken are you using 64bit OS maybe? I had the same problem ( shared secret was > "incorrect" ) due a broken library on 64bit version of SuSE 9.1. Er, I don't think so! Well, I hope not! (wondering how to tell for sure...) # uname -a Linux ficus.ccs.bbk.ac.uk 2.6.20-1.2962.fc6 #1 SMP Tue Jun 19 18:24:12 EDT 2007 i686 i686 i386 GNU/Linux # # getconf LONG_BIT 32 # # getconf WORD_BIT 32 # # file /usr/local/bin/radclient /usr/local/bin/radclient: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped # # # cat /proc/cpuinfo processor : 3 vendor_id : GenuineIntel cpu family : 15 model : 4 model name : Intel(R) Xeon(TM) CPU 3.00GHz stepping : 10 cpu MHz : 3000.487 cache size : 2048 KB physical id : 3 siblings : 2 core id : 0 cpu cores : 1 fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 5 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe lm constant_tsc pni monitor ds_cpl cid cx16 xtpr lahf_lm bogomips : 5999.40 clflush size : 64

2 1