August 2007 - Freeradius-Users - lists.freeradius.org

Re: Error running FreeRadius 1.1.7
by George Beitis 13 Aug '07

13 Aug '07

Hi Alan, i removed all the dictionary files as you recommended and any other freeradius related file on the system, i even made a package using the freeradius build guide and installed and uninstalled it. The problems i have remain the same. This is what i get for my output. The only dictionaries on my system are under usr/share/freeradius regards George /usr/sbin/freeradius -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess /etc/freeradius/hints[37]: Parse error (check) for entry DEFAULT: Unknown value Yes for attribute Strip-User-Name rlm_preprocess: Error reading /etc/freeradius/hints radiusd.conf[1021]: preprocess: Module instantiation failed. radiusd.conf[1802] Unknown module "preprocess". radiusd.conf[1792] Failed to parse authorize section. > > > Alan DeKok wrote: > >> George Beitis wrote: >> >> >>> Thanks for the reply Alan, i was running version 1.1.1 before. I >>> deleted the raddb directory, what else should i delete before making a >>> clean install? >>> >>> >> That should have worked. >> >> Read the debug output to see which dictionary files it's loading. >> Make sure you've installed the ones from 1.1.7, and that the server is >> using them. >> >> Alan DeKok. >> >> >> >> > > >

2 2

Problem on WPA-EAP with Linux
by Alexandros Gougousoudis 13 Aug '07

13 Aug '07

Hi, I'am having trouble to authenticate my linux workstations with wpa_supplicant to Freeradius (1.1). The Windows Stations are working fine, but linux is making trouble. The AP is a Linksys WLAN Accesspoint, as said WPA Radius works, because all Windows Notebooks can login. I'am doing a WPA over EAP. And my Error is: Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request After switching on my debug I see this: rlm_eap: NAK asked for bad type 0 rlm_eap: Failed in EAP select Which is most certanly the reason why the auth fails. But I'am far away from knowing the solution. Can you help please? Below the complete Log of the conversation: rad_recv: Access-Request packet from host 10.48.244.28:3073, id=1, length=131 User-Name = "scit-acer" NAS-IP-Address = 10.48.244.28 Called-Station-Id = "0016b64f44cc" Calling-Station-Id = "0016cfab64e4" NAS-Identifier = "0016b64f44cc" NAS-Port = 43 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000e01736369742d61636572 Message-Authenticator = 0x8b86db463306f78257b8e03600912a5b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry scit-acer at line 14 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 1 to 10.48.244.28 port 3073 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb2f2a1559ef1683126762202eeec3974 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.48.244.28:3073, id=1, length=141 User-Name = "scit-acer" NAS-IP-Address = 10.48.244.28 Called-Station-Id = "0016b64f44cc" Calling-Station-Id = "0016cfab64e4" NAS-Identifier = "0016b64f44cc" NAS-Port = 43 Framed-MTU = 1400 State = 0xb2f2a1559ef1683126762202eeec3974 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060300 Message-Authenticator = 0x9a1a879ecba47ab01f2f3410625ceabc Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry scit-acer at line 14 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: NAK asked for bad type 0 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group authenticate (returns invalid) for request 1 auth: Failed to validate the user. Login incorrect: [scit-acer] (from client khb-buehring port 43 cli 0016cfab64e4) Delaying request 1 for 1 seconds Finished request 1 TIA Alex

3 3

Error running FreeRadius 1.1.7
by George Beitis 13 Aug '07

13 Aug '07

Hi everyone I get this error when trying to run FreeRadius 1.1.7 for the first time, does this sound familiar?: /usr/local/etc/raddb/hints[37]: Parse error (check) for entry DEFAULT: Unknown value Yes for attribute Strip-User-Name regards George

3 4

Re: error on start freeradius + jradius
by Kevin Bonner 13 Aug '07

13 Aug '07

* moved to -users list... On Friday 13 July 2007 10:25:15 Renan Tateoka wrote: > 2007/7/13, Alan DeKok <aland(a)deployingradius.com>: > > Renan Tateoka wrote: > > > hi everybody, > > > > > > I have installed freeradius 1.1.5 > > > > Why? Install 1.1.6. > > > > Alan DeKok. > > hi, > > i`m sorry, I think that the message went wrong... > > I have installed freeradius 1.1.5 and jradius patch 1.1.5... > ... > Module: Library search path is /usr/local/lib > *** glibc detected *** /usr/local/sbin/radiusd: double free or corruption > (fasttop): 0x800fae98 *** What part of Alan's message was unclear? 1.1.5 has a bug that has been beaten to death on the users list. 1.1.6 doesn't. Use 1.1.6 or later, then try your tests again. Kevin Bonner

2 3

EAP-Handshakes: every reply runs the full authorize-section
by Rainer Brinkmann 13 Aug '07

13 Aug '07

FreeRADIUS Version 1.1.0: Hello, we run EAP-TTLS and what we get in Debug-Mode is, that every received EAP-Packet within the TLS-Tunnel-establish runs the complete authorize-section and slows down the overall time to create a TTLS-Tunnel. Reason is, that the User-Name e.g. "NTB-BRINK-610", which is the EAP-Identity, comes with every received EAP-Packet and is always checked against the full authorize-section. Is it possible to skip this redundant checks in the following EAP-responses that build a specific EAP-Session? (the EAP-Idents cant be resolved in our LDAP, cause that machinenames are always unknown to us. What we have to check are the inner-Tunnel - credentials) kind regards Rainer Brinkmann Network-Management University-Clinicum Hamburg / Germany -- Pflichtangaben gemäß Gesetz über elektronische Handelsregister und Genossenschaftsregister sowie das Unternehmensregister (EHUG): Universitätsklinikum Hamburg-Eppendorf Körperschaft des öffentlichen Rechts Gerichtsstand: Hamburg Vorstandsmitglieder: Prof. Dr. Jörg F. Debatin (Vorsitzender) Dr. Alexander Kirstein Ricarda Klein Prof. Dr. Dr. Uwe Koch-Gromus

2 2

Patch for SQL and SQLIPPool performance
by Roy Walker 13 Aug '07

13 Aug '07

This patch has 2 things. Rewritten SQL queries for Postgres on the SQLIPPool. This actually makes using the SQLIPPool possible with a lot of clients (for Postgres at least, the FOR UPDATE was unnecessary since it is already in a transaction block, and actually dangerous as you could leave have dead lock scenarios). Query times dropped from 250+ ms to under 1 ms. For my needs I had removed CallingStationId from the query and index since it is always the same as username, but I left it in for the patch, is there really a situation where those 2 are different? There is now a configurable cache option for the 5 read-heavy tables involved in an auth request. You can of course as the config file sales, just leave it at 0 to disable the caching. Roy **** Some warnings for those that are trying use SQLIPPool. Even after optimizing the query, the performance still will not allow more than about 10 or 20 simultaneous requests. The biggest problem I see is that one connection is not used to finish one client request all the way through. Ie the client requests and is auth'd against the check and reply tables, then the SQLIPPool call is made, but all the DB connections are in use, so your client gets a reject because the SQLIPPool call is not able to complete. One potential fix is to setup another SQL DB for just the IPPool and so you ensure that any connection that is handled can get an IP. One thought is to make an IPPool module that calls to a DHCP server (or a pool of DHCP servers). Regardless, the IP allocation has to be able to scale to 500 or so simultaneous IP requests. ****

3 2

Trying to work out 24hour access cards
by Evert Meulie 13 Aug '07

13 Aug '07

Hi all! I have a system here that's based on freeradius-1.0.2-r5 (Gentoo distro) and we're having some problem with 24hour access cards. With these I mean logins that will give a user access for a period of max. 24 hours from first login. Should be able to be over a period of 2 days. For example first login: 3pm day 1 2nd login: 1pm day 2 should be allowed I've been looking at http://wiki.freeradius.org/Rlm_sqlcounter and see that Max-Daily-Session=86400 will NOT do the trick, since this will allow 24 hours of access PER day Max-All-Session=86400 will not work either, since this will allow a total of 24 hours of login time over an undefined period. How do I get the correct config for my situation? Do I set BOTH Max-Daily-Session & Max-All-Session to 86400 in my case to get the correct result? Regards, Evert

2 2

After signal HUP freeRADIUS Segmentation fault
by Hangjun He 13 Aug '07

13 Aug '07

freeRADIUS version is 1.1.6.. I saw same question in mail-list(freeRADIUS 0.8), Did this problem fix?? Thanks. Nothing to do. Sleeping until we see a request. Reloading configuration files. reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/ldap.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 45 main: cleanup_delay = 5 main: max_requests = 256 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no main: debug_level = 0 read_config_files: reading dictionary Mon Aug 13 06:55:25 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Aug 13 06:55:25 2007 : Error: radiusd.conf[84] Auth-Type MS-CHAP already configured - skipping Mon Aug 13 06:55:25 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon Aug 13 06:55:25 2007 : Info: radiusd.conf Auth-Type eap already configured - skipping Mon Aug 13 06:55:25 2007 : Info: Ready to process requests. Segmentation fault --------------------------------- 雅虎免费邮箱3.5G容量，20M附件！

1 0

Help Using PEAP with Unix Password
by Duc Nguyen 12 Aug '07

12 Aug '07

Hi, I'm running FreeRadius 1.0.1-3 on CentOS4 and I'm trying to configure my wireless network to authenticate users with PEAP-MSCHAPv2 using their unix username/password. Here are some of the things that I did: - I set the deafult eap type in eap.conf to be peap and set peap to use mschapv2 - I also configured the ms-chap module in the modules section in radiusd.conf file and enabled mschap in the authorize section in radiusd.conf. Based on the debugging log when I ran /usr/sbin/radius -X, I could see that my username matched the DEFAULT that was the system user. However, it did not authenticate. In the mschap module of the radiusd.conf file, I also tried using a different authtype to override the default MS-CHAP, but that didn't work either. I even tried using the etc_smbpasswd module that they have(not in the mschap module but outside of it and enabled it in the authorize section) but that didn't work either. From what I understand and I maybe wrong on this, with PEAP, I don't have to use certificates with the clients so I didn't copy any certificate to the client laptop. I'm pretty much out of ideas to try. The one time that it did work was when I have the username and password in clear text in the radius users file. So my question is: Is PEAP with unix password is possible? Has anyone done this? If so, can you shed some light on this topic or point me to a tutorial somewhere? I haven't found any that pertains to this particular topic yet. Thanks in advance for any help -duc

3 2

Re: Patch to fix the 0x thing in *NTPassword LDAP attr... Comments?
by Stefan Adams 12 Aug '07

12 Aug '07

> Hmm... in 1.1.7, the "pap" module will take care of fixing > NT-Passwords. i.e. map sambaNTPassword to NT-Password in ldap.attrmap, > and list "pap" at the end of the "authorize" section. The pap module > will see the 32-character hex string NT-Password, and convert it to > 16-character binary format, which the rest of the server needs. Wonderful!! That's obviously better...! :) Which encryption_scheme do I use? Stefan

2 1