January 2008 - Freeradius-Users - lists.freeradius.org

Re: sql accounting - no records - 2.0.1 RESOLVED
by Andrew Long 30 Jan '08

30 Jan '08

I expected to see some traffic too soon, now it's coming... but where are the accounting queries? Andrew On Jan 30, 2008 8:52 AM, Andrew Long <fursink(a)gmail.com> wrote: > I've just installed 2.0.1 on CentOS 5 with MySQL 5.x. I can get the > clients to authenticate and I see accounting requests come in, also I > see the accounting query as it should be updated to mysql, i.e., > "expand: UPDATE radacct...". I also see the accounting response > returned to the client, but no accounting records are being updated in > radacct table. There are no errors in debug mode relevent to mysql: > > rlm_sql (sql): received Acct On/Off packet > expand: %{Acct-Delay-Time} -> 0 > expand: UPDATE radacct SET > acctstoptime = '%S', acctsessiontime = > unix_timestamp('%S') - > unix_timestamp(acctstarttime), acctterminatecause = > '%{Acct-Terminate-Cause}', acctstopdelay = > %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 > AND acctstoptime = NULL AND nasipaddress = > '%{NAS-IP-Address}' AND acctstarttime <= '%S' -> > UPDATE radacct SET acctstoptime = > '2008-01-30 07:45:06', acctsessiontime = > unix_timestamp('2008-01-30 07:45:06') - > unix_timestamp(acctstarttime), acctterminatecause = > '', acctstopdelay = 0 WHERE > acctsessiontime = 0 AND acctstoptime = NULL > AND nasipaddress = '141.xxx.xxx.xxx' AND acctstarttime > <= '2008-01-30 07:45:06' > rlm_sql (sql): Reserving sql socket id: 2 > rlm_sql (sql): Released sql socket id: 2 > ++[sql] returns ok > expand: %{User-Name} -> elmaroma_cn3000 > attr_filter: Matched entry DEFAULT at line 12 > ++[attr_filter.accounting_response] returns updated > Sending Accounting-Response of id 33 to 141.xxx.xxx.xxx port 1025 > > I have tried this with 2 different clients and get the same NULL > result. Authentication is fine, but any features relying on data in > radacct clearly won't work, ie session-timout... > > I've checked the "default" config, and all accounting is set to sql. > The one oddity I notice is that "default" has: > # See "Accounting queries" in sql.conf > sql > > But I can see no accounting queries anywhere in the provided sql.conf ?? > > Thank You. > > Andrew Long > EWS Solutions >

2 1

Problems using EAP-TLS with freeradius version 2
by Stefan Puch 30 Jan '08

30 Jan '08

Hello everyone, I've got some problems with the new version of freeradius, but before I'm going to open a new bugreport or post long debugtraces from "radiusd -X" I want to ask here if someone else has made similar experiences. I've set up a freeradius server version 1.1.7 in our club to authenticate several Notebooks. This worked fine with Windows XP, Windows Vista and Linux clients using EAP-TLS certificates (many thanks for the good documentation of the OIDs in the TLS certificate). Then some people came with their mobile devices which are running Windows Mobile 2003, Windows Mobile 5 (WM5) or Windows Mobile6 (WM6) and the problems began. The same EAP-TLS certificate which worked fine on a Windows XP machine doesn't work on e.g. Windows Mobile 6 PDA. So first I updated the freeradius version to the latest release (2.0.1), checked and modified all configuration files and so on, but that didn't solve the problem, it made them getting worser. With the new version 2.0.1 the Windows and Linux Laptops are not able to authenticate any more with the freeradius server (the certificates are still the same). The server sends an ACCESS, but the behavior is like described in the FAQ "PEAP or EAP-TLS Doesn't Work with a Windows machine". Downgrading to the previous version of freeradius 1.1.7 makes them work again, freeradius version 2.0.0 doesn't work either. Does anyone of the experts here know what could be the problem (a guess, perhaps what changed from version 1.1.7 to version 2.0.1)? My goal is first to make the clients using Windows XP, Vista and Linux work again with freeradius version2 and EAP-TLS. After fixing that it would be fine, if freeradius would also work the different Windows Mobile systems. So, what would be helpful to analyze the problem? All config files or just the output from radiusd -X from both versions in order to make a diff or should I open a new bug in the tracking system as well? I would like to provide USEFULL debug-traces, so that it is easier for the experts to solve the problem and not to much work for me when providing useless informations. Best regards and thanks in advance Stefan Puch

3 2

memory corruption when proxying accounting requests
by Jørn Kostøl 30 Jan '08

30 Jan '08

Hi, Im having problems proxying accounting requests on FreeRadius 2. Local auth and acct works fine, and proxying auth works. But as soon as I try to proxy accounting then Freeradius crashes. I have tried proxying to an old stable freeradius server, through a home server, direct to a virtual server, home server pools, and I have tried to add and remove all the modules and options I can to try to find if there is a particular part that makes it crash but no luck. The accounting requests gets sent, and FreeRadius crashes after. Ive tried to install both version FreeRadius 2.0.0 and 2.0.1 on two different servers both running different Ubuntu versions. Anyone have an idea what I can try next? Here is output from one of the installations: *** glibc detected *** ../../sbin/radiusd: malloc(): memory corruption: 0x081b7460 *** ======= Backtrace: ========= /lib/tls/i686/cmov/libc.so.6[0xb7c7c1cd] /lib/tls/i686/cmov/libc.so.6(malloc+0x7f)[0xb7c7d83f] /usr/local/freeradius2/lib/libfreeradius-radius-2.0.1.so(paircopy2+0x69)[0xb 7f503d9] /usr/local/freeradius2/lib/libfreeradius-radius-2.0.1.so(paircopy+0x25)[0xb7 f50475] ../../sbin/radiusd[0x806150d] ../../sbin/radiusd(radius_handle_request+0x5b)[0x806160b] ../../sbin/radiusd(thread_pool_addrequest+0x36)[0x805bd56] ../../sbin/radiusd[0x8060c32] /usr/local/freeradius2/lib/libfreeradius-radius-2.0.1.so(fr_event_loop+0x236 )[0xb7f53db6] ../../sbin/radiusd(radius_event_process+0x30)[0x80624e0] ../../sbin/radiusd(main+0x572)[0x805ad52] /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xdc)[0xb7c2a8cc] ../../sbin/radiusd[0x804d1f1] ======= Memory map: ======== 08048000-08076000 r-xp 00000000 08:07 326643 /usr/local/freeradius2/sbin/radiusd 08076000-08078000 rw-p 0002d000 08:07 326643 /usr/local/freeradius2/sbin/radiusd 08078000-081d3000 rw-p 08078000 00:00 0 [heap] b7800000-b7821000 rw-p b7800000 00:00 0 b7821000-b7900000 ---p b7821000 00:00 0 b79ab000-b79b5000 r-xp 00000000 08:01 144592 /lib/libgcc_s.so.1 b79b5000-b79b6000 rw-p 00009000 08:01 144592 /lib/libgcc_s.so.1 b79bb000-b79bd000 r-xp 00000000 08:07 326401 /usr/local/freeradius2/lib/rlm_attr_filter-2.0.1.so b79bd000-b79be000 rw-p 00001000 08:07 326401 /usr/local/freeradius2/lib/rlm_attr_filter-2.0.1.so b79be000-b79e2000 r-xp 00000000 08:01 144858 /lib/tls/i686/cmov/libm-2.4.so b79e2000-b79e4000 rw-p 00023000 08:01 144858 /lib/tls/i686/cmov/libm-2.4.so b79e4000-b7b73000 r-xp 00000000 08:07 505387 /usr/lib/libmysqlclient_r.so.15.0.0 b7b73000-b7bb7000 rw-p 0018e000 08:07 505387 /usr/lib/libmysqlclient_r.so.15.0.0 b7bb7000-b7bb8000 rw-p b7bb7000 00:00 0 b7bba000-b7bbc000 r-xp 00000000 08:07 326391 /usr/local/freeradius2/lib/rlm_acct_unique-2.0.1.so b7bbc000-b7bbd000 rw-p 00001000 08:07 326391 /usr/local/freeradius2/lib/rlm_acct_unique-2.0.1.so b7bbd000-b7bbf000 r-xp 00000000 08:07 326608 /usr/local/freeradius2/lib/rlm_sql_mysql-2.0.1.so b7bbf000-b7bc0000 rw-p 00001000 08:07 326608 /usr/local/freeradius2/lib/rlm_sql_mysql-2.0.1.so b7bc0000-b7bc8000 r-xp 00000000 08:07 326613 /usr/local/freeradius2/lib/rlm_sql-2.0.1.so b7bc8000-b7bc9000 rw-p 00007000 08:07 326613 /usr/local/freeradius2/lib/rlm_sql-2.0.1.so b7bc9000-b7bcb000 r-xp 00000000 08:07 326598 /usr/local/freeradius2/lib/rlm_realm-2.0.1.so b7bcb000-b7bcc000 rw-p 00001000 08:07 326598 /usr/local/freeradius2/lib/rlm_realm-2.0.1.so b7bcc000-b7bce000 r-xp 00000000 08:07 326583 /usr/local/freeradius2/lib/rlm_preprocess-2.0.1.so b7bce000-b7bcf000 rw-p 00002000 08:07 326583 /usr/local/freeradius2/lib/rlm_preprocess-2.0.1.so b7bcf000-b7bd1000 r-xp 00000000 08:07 326411 /usr/local/freeradius2/lib/rlm_chap-2.0.1.so b7bd1000-b7bd2000 rw-p 00001000 08:07 326411 /usr/local/freeradius2/lib/rlm_chap-2.0.1.so b7bd2000-b7bd5000 r-xp 00000000 08:07 326567 /usr/local/freeradius2/lib/rlm_pap-2.0.1.so b7bd5000-b7bd6000 rw-p 00003000 08:07 326567 /usr/local/freeradius2/lib/rlm_pap-2.0.1.so b7bd6000-b7bd9000 r-xp 00000000 08:07 326551 /usr/local/freeradius2/lib/rlm_logintime-2.0.1.so b7bd9000-b7bda000 rw-p 00002000 08:07 326551 /usr/local/freeradius2/lib/rlm_logintime-2.0.1.so b7bda000-b7bdc000 r-xp 00000000 08:07 326514 /usr/local/freeradius2/lib/rlm_expiration-2.0.1.so b7bdc000-b7bdd000 rw-p 00001000 08:07 326514 /usr/local/freeradius2/lib/rlm_expiration-2.0.1.so b7bdd000-b7be0000 r-xp 00000000 08:07 326519 /usr/local/freeradius2/lib/rlm_expr-2.0.1.so b7be0000-b7be1000 rw-p 00002000 08:07 326519 /usr/local/freeradius2/lib/rlm_expr-2.0.1.so b7be1000-b7beaAborted Cheers, Jørn

2 4

Radclient multihomed host
by Etienne Pretorius 30 Jan '08

30 Jan '08

Hello list, Is there anyway that I could make radclient send a packet from a diffrent src ipaddress on a multihomed host -- Kind Regards Etienne Pretorius Network Administrator Kingsley Technologies <http://www.kingsley.co.za> Email: admin(a)kingsley.co.za <mailto:admin@kingsley.co.za> Tel: 086 11 KTECH Local Fax: 086 611 5001 International Fax: +27 21 761 9930 Email Disclaimer <http://www.kingsley.co.za/index.php?id=109> Acceptable Use Policy <http://www.kingsley.co.za/index.php?id=107> www.kingsley.co.za

2 1

one RADIUS server per realm setup
by Wm. Josiah Erikson 30 Jan '08

30 Jan '08

Hello all, We are trying to set up a cross-auth proxy setup between our five RADIUS servers in different realms at five different institutions, so that any active student, staff, or faculty from any of our institutions can go to any of the other institutions and log onto the network. This means that if a user from institution B comes to my institution, I want my RADIUS server to ask the RADIUS server over at institution B instead of using the local setup. I've gotten much of it working, both authorizing and authenticating against our LDAP database here, but something about the authorization step is unclear to me. At the moment, I have it set up so that if I get a login request, it checks to see if the user is a member of the correct group(s) (authorization), and THEN authenticates the user, checking the realm to see where it should send the request for authentication. This all works very well, except that the authorization step only works if the user is one of MY users. If the user is one of the other four-college users, then the authorization step fails (since the user doesn't exists in my LDAP database) and the user is rejected. So I think I need to do one of three things: 1. Proxy authorization as well - it's not clear how to do this. Can you? I'd really just like to forward the entire request elsewhere, before anything else happens, so I'd like to check the realm FIRST, and not do anything if it's not a local realm. 2. Skip authorization entirely unless the user is a member of a specific realm. Again, it's not clear to me how to do this. Any ideas? 3. something else I haven't thought of yet. This must be something other people do too, yes? We'd like to be able to do the authorization step, because I don't want, for instance, alumns or guest users, (who are in the LDAP database) to be able to log in. I'm currently using freeradius 1.0.2, but I can upgrade if I need to. Thanks for any help, and if more info is needed, just ask! -- Wm. Josiah Erikson Computing Support School of Cognitive Science Hampshire College Amherst, MA 01002 (413) 559-6091

3 8

sql accounting - no records - 2.0.1
by Andrew Long 30 Jan '08

30 Jan '08

I've just installed 2.0.1 on CentOS 5 with MySQL 5.x. I can get the clients to authenticate and I see accounting requests come in, also I see the accounting query as it should be updated to mysql, i.e., "expand: UPDATE radacct...". I also see the accounting response returned to the client, but no accounting records are being updated in radacct table. There are no errors in debug mode relevent to mysql: rlm_sql (sql): received Acct On/Off packet expand: %{Acct-Delay-Time} -> 0 expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S' -> UPDATE radacct SET acctstoptime = '2008-01-30 07:45:06', acctsessiontime = unix_timestamp('2008-01-30 07:45:06') - unix_timestamp(acctstarttime), acctterminatecause = '', acctstopdelay = 0 WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '141.xxx.xxx.xxx' AND acctstarttime <= '2008-01-30 07:45:06' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok expand: %{User-Name} -> elmaroma_cn3000 attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 33 to 141.xxx.xxx.xxx port 1025 I have tried this with 2 different clients and get the same NULL result. Authentication is fine, but any features relying on data in radacct clearly won't work, ie session-timout... I've checked the "default" config, and all accounting is set to sql. The one oddity I notice is that "default" has: # See "Accounting queries" in sql.conf sql But I can see no accounting queries anywhere in the provided sql.conf ?? Thank You. Andrew Long EWS Solutions

1 0

Re: Problems using EAP-TLS with freeradius version 2
by Stefan Puch 30 Jan '08

30 Jan '08

Stefan Puch wrote: >> Then some people came with their mobile devices which are running Windows >> Mobile 2003, Windows Mobile 5 (WM5) or Windows Mobile6 (WM6) and the >> problems began. The same EAP-TLS certificate which worked fine on a Windows >> XP machine doesn't work on e.g. Windows Mobile 6 PDA. > > You have to love Microsoft... Hmm, most of the time I'm using Linux, but 90% of the others only have a Microsoft system :-( > The EAP-TLS code was substantially re-worked in 2.0.0. It was tested with > Vista, XP SP1, XP SP2, Linux systems, MAC. It's working "live" in > environments with many, may different OS's and architectures. > > So it *should* work. I was afraid that someone says that, because I didn't believe that a new version would be released without testing. By the way, when you have tested so many different Windows systems you will have to Microsoft as well, won't you ;-) > ethereal packet traces of the RADIUS traffic would help. But I would first > suggest trying to use the test certificates that come with 2.0.1. If those > work, then the issue isn't 2.0.0 versus 1.1.7, it's that there is something > special about the certificates you're using. OK, then I will start with the provided certificates, well knowing that if then do work I will have to make new certificates for all current users... If the certificates that come with 2.0.1 also fail I will provide some ethereal packet traces. Thanks for the quick response Stefan Puch

1 0

Problem with XP Clients
by Patrice OLIVER 30 Jan '08

30 Jan '08

Hello, I recently setup freeradius 1.1.7 to run a EAP-TLS authentication. My clients run on windows xp pro sp2, with microsoft hotfixes to be abble to use WPA2 and EAP. Encryption is WPA2-AES. All certificates (root and client) are installed in the computer storage and in the user storage, as documented on the Internet (root in trusted, client in personnal). When I log in with an administrator account, everything works fine. When I log in with a domain user account, I can't access to the network. A look at freeradius logs shows that it authenticate every 1 second, so the network connection does not stay up ... All access requests are accepted. Does anyone of you have an idea of what's happening ? Regards, -- *Hospices Civils de Beaune* *Patrice OLIVER* /Chef de Projet Ville Hôpital/ /Responsable Réseau & Sécurité/ BP 104 21203 BEAUNE Cedex Tél. 03 80 24 44 09 Fax. 03 80 24 45 90 ------------------------------------------------------------------------ Ce message, y compris les pièces jointes, est établi à l'attention exclusive de son ou ses destinataires et est confidentiel. Toute utilisation non conforme à sa destination, toute diffusion ou publication, totale ou partielle, est interdite sauf autorisation expresse de l'expéditeur. Si vous n'êtes pas le destinataire de ce message, merci d'avertir l'expéditeur de l'erreur de distribution puis de le détruire. Tout message électronique est susceptible d'altération et son intégrité ne peut être assurée. L'expéditeur décline toute responsabilité dans l'hypothèse où il aurait été modifié ou falsifié.

1 0

trouble seting up freeradius :((
by SnahaD00 30 Jan '08

30 Jan '08

Hi, I really (desperatelly) need freeradius to work on my schools network - it's urgent. I've got server on Ubuntu 7.04. I setup freeradius accoring to some howtoos and tutorials, but with no luck. What I did was: - made deb package with tls support - installed deb freeradius package - did setup freeradius as told here http://ubuntuforums.org/showthread.php?t=478804&highlight=freeradius+openssl - problems... When I issue command freeradius -x i got this: rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt rlm_eap_tls: Error reading private key file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1944] Unknown module "eap". radiusd.conf[1891] Failed to parse authenticate section. Any idea ?

3 2

eap authentication problem
by Mike Zoeteweij 30 Jan '08

30 Jan '08

Can anyone tell me what I'm doing wrong here? trying to auth. a wireless user with freeradius. I'm not sure if the mistake is in the certificates of the radius config. authebtication process gets stuck in "attempting to authenticate" EAP-Message = 0x064d5a2d6166740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x55a44efe0a103d2b2a24bb8f72998edc Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.100.5:4855, id=3, length=191 Message-Authenticator = 0xfab5bbc4d21c025b436d243b9579b617 Service-Type = Framed-User User-Name = "wireless" Framed-MTU = 1488 State = 0x55a44efe0a103d2b2a24bb8f72998edc Called-Station-Id = "00-18-F8-F5-87-53:mikiemike" Calling-Station-Id = "00-13-E8-94-F3-B5" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300060d00 NAS-IP-Address = 192.168.100.5 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "wireless", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched DEFAULT at 152 users: Matched DEFAULT at 171 users: Matched wireless at 231 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 3 to 192.168.100.5:4855 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbf025c40824435e386c6a8b6a1ad5735 Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 4 ID 0 with timestamp 479f9369 Cleaning up request 5 ID 1 with timestamp 479f9369 Cleaning up request 6 ID 2 with timestamp 479f9369 Cleaning up request 7 ID 3 with timestamp 479f936 thanks a lot in advance for any help. reg. Mike

2 1