January 2008 - Freeradius-Users - lists.freeradius.org

radiusd 2.0.1 doesn't process packets
by Sven Lanckmans 31 Jan '08

31 Jan '08

Hi, I'm running 2.0.1 on a Red Hat linux box. I've configured freeradius to listen to ip 10.10.251.200 on eth1 on port 1645. When I do a radsniff I see the packets coming in: [root@pcc8-1 bin]# ./radsniff -i eth1 -p 1645 -X Device: [eth1] PCAP filter: [udp port 1645 or 1646 or 1647] RADIUS secret: [testing123] Packet number 1 has just been sniffed From: 10.10.253.34:21646 To: 10.10.251.200:1645 Type: Access-Request Framed-Protocol = PPP User-Name = "user1(a)vpn1-2.com" User-Password = "\224D\245[\370\\\327p\027y\211\360>£\372." NAS-Port-Type = Virtual NAS-Port = 1610743908 NAS-Port-Id = "6/0/0/2.100" Connect-Info = "speed:vbr:2048" Cisco-AVPair = "client-mac-address=0005.dc39.1548" Service-Type = Framed-User NAS-IP-Address = 10.10.253.34 Acct-Session-Id = "6/0/0/2.100_00000016" NAS-Identifier = "c10c12-2" But when I run radiusd -X, all I see is: > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = 10.10.251.200 > port = 1645 > } > listen { > type = "acct" > ipaddr = 10.10.251.200 > port = 1646 > } > Listening on authentication address 10.10.251.200 port 1645 > Listening on accounting address 10.10.251.200 port 1646 > Ready to process requests. Nothing else happens. lsof shows that radiusd is listening on the correct ports: > radiusd 1698 root 5u IPv4 2177523 UDP > 10.10.251.200:1645 > radiusd 1698 root 6u IPv4 2177525 UDP > 10.10.251.200:1646 > radiusd 1698 root 7u IPv4 2177526 UDP > 10.10.251.200:1647 What could I be missing? Why is radiusd not seeing the packets flowing to these ports, but radsniff is? Thanks, Sven.

2 1

2.0.1 Segfault
by Michael J. Hartwick 31 Jan '08

31 Jan '08

Hi, I know that this post may not contain all of the required information, this is just to get things going while I investigate further. I have had a problem with FreeRADIUS segfaulting intermittently for a number of months which makes it hard to gather the required information. The only thing that I found in all cases was the numerous, empty Cisco-AVPair's in the packet. With it being a segfault I suspect accessing a null pointer somewhere. I have captured a packet that is causing this to occur and sure enough it contains the numerous, empty Cisco-AVPair's. I have started it in gdb now, the output of bt is below. rad_recv: Accounting-Request packet from host w.x.y.z port 2903, id=213, length=362 Service-Type = Framed-User Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" Cisco-AVPair = "" NAS-Port-Type = Async Connect-Info = "3120" Calling-Station-Id = "NPANXXxxxx" X-Ascend-PreSession-Time = 41 X-Ascend-Disconnect-Cause = Remote-End-Hung-Up Acct-Session-Id = "00004E39" Acct-Session-Time = 114 Framed-IP-Address = W.X.Y.Z Acct-Link-Count = 1 Acct-Authentic = RADIUS User-Name = "test(a)test.com" NAS-Port = 1060 Called-Station-Id = "yyyxxxx" Framed-Protocol = PPP Acct-Terminate-Cause = User-Request Acct-Input-Packets = 53 Acct-Output-Packets = 39 X-Ascend-Data-Rate = 26400 Acct-Delay-Time = 0 Acct-Input-Octets = 1431 Login-Service = PortMaster Acct-Output-Octets = 9084 X-Ascend-Modem-SlotNo = 6 X-Ascend-Xmit-Rate = 31200 Acct-Status-Type = Stop Segmentation fault 0x40297d8f in memcpy () from /lib/libc.so.6 (gdb) bt #0 0x40297d8f in memcpy () from /lib/libc.so.6 #1 0x400289c1 in rad_attr2vp (packet=0x8177678, original=0x0, secret=0x8169168 "secret", attribute=90, length=0, data=0x817887c "\004\006\n\001\001\226x\006\001\005") at radius.c:1953 #2 0x40028df4 in rad_decode (packet=0x8177678, original=0x0, secret=0x8169168 "secret") at radius.c:2386 #3 0x080539d4 in client_socket_decode (listener=0x8174960, request=0x8178898) at listen.c:697 #4 0x0805faab in request_pre_handler (request=0x8178898) at event.c:995 #5 0x08061e2d in radius_handle_request (request=0x8178898, fun=0x804d2b0 <rad_accounting>) at event.c:2701 #6 0x0805ad21 in thread_pool_addrequest (request=0xffffffff, fun=0x8179f04) at threads.c:860 #7 0x08061510 in event_socket_handler (xel=0x8174f98, fd=13, ctx=0x8179f04) at event.c:2340 #8 0x40030c23 in fr_event_loop (el=0x8174f98) at event.c:412 #9 0x08061e03 in radius_event_process () at event.c:2696 #10 0x0805968f in main (argc=2, argv=0x2) at radiusd.c:381 #11 0x4022fd06 in __libc_start_main () from /lib/libc.so.6 I *think* that the problem might be the length=0 in the call to rad_attr2vp(). If that is the case then something like: if (length = 0) return NULL; at line 1928 or so of radius.c might resolve the problem. Before I go ahead and make that addition, am I on the right page or way off in left field on this? Michael ---------------------------------------------------------------------- Michael J. Hartwick, VE3SLQ hartwick(a)hartwick.com Hartwick Communications Consulting (519) 396-7719 Kincardine, ON, CA http://www.hartwick.com ----------------------------------------------------------------------

2 3

FR2: combining round-robin and fail-over home server pools
by John Horne 31 Jan '08

31 Jan '08

Hello, I am in the process of configuring FreeRADIUS 2.0.1. For some realms we proxy the authentication request to three other servers (svr-1, svr-2, svr-3). However, what we wanted was to, in effect, round-robin two of the servers (svr1 and svr-2), and then only use the third server (svr-3) if the other two were not available. I have configured the proxy.conf 'home_server_pool's as: home_server_pool local_IAS { type = client-port-balance home_server = svr-1 home_server = svr-2 } home_server_pool local_proxies { type = fail-over home_server = local_IAS home_server = svr-3 } Note that 'local_IAS' is actually a home_server_pool name, and not an actual home server. I was then going to configure FR to use 'local_proxies' for the relevant realms. However, starting FR gives an error: /usr/local/etc/raddb/proxy.conf[87]: Unknown home_server "local_IAS". Anyone any ideas how to mix round-robin servers with fail-over? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

2 1

Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy (forward) request as PAP
by Joakim Lindgren 31 Jan '08

31 Jan '08

Hi all (and really thanks to Alan DeKok), I have a complete EAP-PEAP/TLS/TTLS configuration working against FreeRadius and IAS. A software I´m using is offering two factor authentication and they got their own Radius who only supports PAP. Is it possible to terminate the client EAP connection at the FreeRadius proxy and forward the request as a PAP to the software vendors own Radius. In that case it works, briefly how do I do? Thanks all! (Im going to buy Alan DeKok coming FreeRadius book ;-) Sincerely Joakim

3 2

radiusd service do not start
by Nicolas 31 Jan '08

31 Jan '08

Hi, I installed freeradius to manage the wifi network of our organization (17 wifi ap) It works well when launched in command line (radiusd X), but I cant make it work as a service, Service radiusd start seems to work, but radius close immediately after, so a status will say that radiusd is dead, but subsys is locked. Here is the output of the radius X : # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: port = 1812 listen: type = "auth" listen: port = 1813 listen: type = "acct" radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/wifi.dasilva.int.pem" tls: certificate_file = "/etc/raddb/certs/wifi.dasilva.int.pem" tls: CA_file = "/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "tls" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. I dont see any errors in that, and I cant seem to find a solution via google. Fiy, the identification is done by certificates. Nicolas INNOCENT Resp. Informatique Groupe Da Silva ----------------------------------------------------- Tél : 05 62 20 41 31 Fax : 05 62 20 60 04 @ : sysadmin(a)groupe-dasilva.com Site web : <http://www.dasilva.fr/> http://www.dasilva.fr/ -----------------------------------------------------

2 2

Fwd: cannot connect to sql databse
by Devinder Singh 31 Jan '08

31 Jan '08

Hi I am using Dial Up Admin on Free radius Free Radius is Running but when i acccess Dial Up admin page i get cannot connect to sql databse I have done most of the configuration settings and followed the wiki tutorial on Free Radius. Please help as i want to get the Dial Up Admin Page to work. Thank you. -- Devinder -- Devinder

6 22

Re: trouble seting up freeradius :((
by SnahaD00 30 Jan '08

30 Jan '08

SnahaD00 wrote: > When I issue command freeradius -x i got this: > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt The password you put in the configuration file is not the same as the password used to create the private key. Alan DeKok. Ok. Got this part working. Now another thing or two: - installing certificates on windows xp box ? - creating my own cretificate - how to or better walk through ? Snaha

1 0

Setting radiusd user/cert permissions in Mac OSX
by Info 30 Jan '08

30 Jan '08

Good afternoon, When setting user/group to "nobody" in radiusd.conf, I get some permissions problems with loading the certs and just wanted to know how to properly set them to avoid this: rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file /opt/local/etc/raddb/ certs/server.pem rlm_eap: Failed to initialize type tls Thanks for answering the, no doubt, simplest of questions ! Jim P.S: The above output is from testing with radiusd -X ___________________________________________________ James H. Graham II, Creative Director • Spark Media Group 6511 Allegheny Avenue • Takoma Park, MD 20912-4737 Tel: 301.270.4810 • Fax: 301.270.4812 • www.sparkmediagroup.com

2 1

anyone provide consulting services to setup a radius server?
by Chad Whitten 30 Jan '08

30 Jan '08

Very simple setup - 1 server - novell suse enterprise 10.0, 1 nas - Lucent TNT, 700 or so users - all dialup. Would like to use a mysql database to store usernames and passwords and use the freeradius dialupdamin web tool for management of users. NAS is currently authenticating against a remote freeradius server that just uses unix passwd/shadow files. If anyone is interested in some light consulting work to do this, please let me know. Thanks -- Chad Whitten Metro Network Solutions (601) 366-6630 Phone (601) 366-6066 Fax (601) 842-6804 Cellular (601) 519-4172 Pager cwhitten(a)metronetsys.com

1 0

need help in using free radius
by johnson elangbam 30 Jan '08

30 Jan '08

Hi, When I first run the free Radius using the command "radtest test test localhost 0 testing123" i found the following errors. Please help rad_recv: Access-Request packet from host 127.0.0.1 port 32775, id=80, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.1.227 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication m ay fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 80 to 127.0.0.1 port 32775 Waking up in 4.9 seconds. Cleaning up request 0 ID 80 with timestamp +31 Ready to process requests. With Regards, Elangbam Johnson

3 2