December 2008 - Freeradius-Users - lists.freeradius.org

Postgress SQL connections
by Massimiliano Tarquini 14 Dec '08

14 Dec '08

Hi all, im sperimenting a strange problem using freeradius. We have a full installation on freeradius 2.1.1 using postgreSql 8.1 running onto 2 different machines. The auth work fine 8we have tested it for two days with a killer script that tests in continuously) but if the proxy stops sending auth requests for a few minutes (sometimes 15, sometimes 40), at the first request freeradius start malefunctioning. Following the log content ---------------------------------------------------------------------------- -------------------------------- Sat Dec 13 16:19:38 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:41 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:44 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:47 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:50 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:19:53 2008 : Error: Discarding duplicate request from client csnradpvip port 1814 - ID: 28 due to unfinished request 11657 Sat Dec 13 16:20:01 2008 : Error: WARNING: Unresponsive child for request 11657, in module sql component authorize Sat Dec 13 16:20:07 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:13 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:19 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:25 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:31 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:37 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:43 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:49 2008 : Error: Received conflicting packet from client csnradpvip port 1814 - ID: 90 due to unfinished request 11627. Giving up on old request. Sat Dec 13 16:20:49 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:20:55 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:21:01 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Sat Dec 13 16:21:07 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 ---------------------------------------------------------------------------- ---------------------------------- Which is really strange is that the connections to the database are up and the database works fine. After some retry the radius crash. We tried to schedule a -HUP signal every 5 minutes, but it has non effect. Please help me! 4IT S.r.l. Massimiliano Tarquini | Amministratore unico --------------------------------------------------------- Via Udine 30-36, 00161 Roma Phone +39 06 97601680 Mobile +39 392 9660669 Fax +39 06 97601683 m.tarquini(a)4it.it www.4it.it Il presente messaggio e gli eventuali allegati sono di natura confidenziale. Qualora vi fosse pervenuto per errore, vi preghiamo di cancellarlo immediatamente dal vostro sistema e di avvisare il mittente. Grazie. This electronic mail transmission and any accompanying attachments contain confidential information. If you have received this communication in error, please immediately delete the E-mail and either notify the sender. Thank you.

1 0

Client library for using CoA
by Padam J Singh 14 Dec '08

14 Dec '08

Hello, Are you aware of any radius client library which also implements CoA/Packet of Disconnect? I have checked radiusclient-ng and its earlier version - they do not contain any such feature. I saw that CoA is on the roadmap for FR (2007 announcement), any work done on it yet? Thanks, Padam -- PGP Id 9EED2E09

3 3

ownership change
by Norbert Wegener 14 Dec '08

14 Dec '08

Upgrading from 2.1.1 to 2.1.3 on a Suse10.2 system and restarting radiusd with the identical configuration showed the following message: We do not own /var/run/radiusd/radiusd.sock. ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 radiusd radiusd 0 12. Dez 16:18 /var/run/radiusd/radiusd.sock That fits to the entries user = radiusd group = radiusd in radiusd.conf. Removing radiusd.sock and restarting radiusd solved the problem. 2.1.3 obviously changed the ownership: ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 root radiusd 0 12. Dez 16:20 /var/run/radiusd/radiusd.sock Shouldn't the ownership still be radiusd.radiusd ? Norbert Wegener -- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Norbert Wegener Siemens IT Solutions and Services GmbH & Co. OHG SIS GO GIO NW PSU2 Kruppstraße 16 D-45128 Essen Phone : +49 (0) 201 816-3116 Fax. : +49 (0) 201 816-5581284 mailto:norbert.wegener@siemens.com Siemens IT Solutions and ServicesGmbH & Co. OHG Offene Handelsgesellschaft, Sitz der Gesellschaft: München; Registergericht: München, HRA 69235; Geschäftsführende Gesellschafterin: Siemens Business Services Beteiligungs-GmbH, Geschäftsführer: Christoph Kollatz, Vorsitzender; Jürgen Frischmuth, Michael Schulz-Drost; Sitz der Gesellschaft: München; Registergericht: München, HRB 50462; Weitere Gesellschafter: Siemens Business Services Investment GmbH & Co. KG, Sitz der Gesellschaft: München; Registergericht: München, HRA 86893; Persönlich haftende Gesellschafterin der Siemens Business Services Investment GmbH & Co. KG: Siemens Business Services Beteiligungs-GmbH, Geschäftsführer: Christoph Kollatz, Vorsitzender; Jürgen Frischmuth, Michael Schulz-Drost; Sitz der Gesellschaft: München; Registergericht: München, HRB 50462 WEEE-Reg.Nr. DE 88294312

2 2

RE: freeradius not responding on machine specific IPs
by Jason Wittlin-Cohen 13 Dec '08

13 Dec '08

Kevin, The relevant line is: "> rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.)" The shared secret to authenticate a client to the RADIUS server (for RADIUS, not EAP traffic) is either not set, or you're using the wrong secret. By default there is no shared secret set for localhost. Edit clients.conf, search for 127.0.0.1. You'll find a line that looks like: ipaddr = 127.0.0.1 Now, add this line beneath: secret = secret Restart freeradius and try again. The message should go away. Remember, you're still going to get an access-reject response unless you setup the user account and password your authenticating with in the "users" file. Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

3 4

FreeRADIUS and LDAP Groups
by Tim Gustafson 13 Dec '08

13 Dec '08

Now that I have FreeRADIUS authenticating users via MSCHAPv2 and the sambaNTPassword attributes, the next step in my project is to limit the system so that only users in certain user groups can log in. I'm using posixGroup groups, not groupOfNames or groupOfUniqueNames. In my modules/ldap files I have: groupname_attribute = "cn" groupmembership_attribute = "memberUid" groupmembership_filter = "(memberUid=%{Stripped-User-Name:-%{User-Name}})" In my users I have DEFAULT LDAP-Group == foo However, even with these configuration options set, anyone with a valid login and password can authenticate right now. In my "radiusd -X" I see: rlm_ldap: performing search in dc=blah, with filter (&(cn=foo)(memberUid=test)) rlm_ldap: object not found or got ambiguous search result But it then goes on the authenticate the user anyhow: rlm_ldap: user test authorized to use remote access I looked around on Google, and I see -lots- of stuff about configuring LDAP group checks, but I haven't found anything that's all too helpful right now. Is there some option that I have to set to tell the system to ignore a user that's not in the proper group? And then the follow-up question to this will be: is it possible to configure FreeRADIUS to check for membership in more than one group? Put another way, how can I let the system authenticate users in the "foo" group -or- in the "bar" group? Tim Gustafson SOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 3

Sending Accounting Response
by Padam J Singh 13 Dec '08

13 Dec '08

Hello, According to the RFC 2866, it is possible to send back attributes to an accounting update packet sent from a NAS. What I have done is this: The authorization and authentication queries are basically calls to a stored procedure in postgres that returns a set of table type which contains the attribute, operator and value (for authorization), and encrypted password for authentication. I can write a stored procedure to return a set of attributes to send back in an accounting start/update/stop, but all the queries given as examples in the default dialup.conf are update queries that do not return any attribute. How do I configure the postgres module to return the attributes to the NAS? The NAS is an application I have written that parses all attributes sent back after an auth-request and acct-start/update/stop. Thanks, Padam -- PGP Id 9EED2E09

1 0

accounting bug in Mikrotik
by Santiago Balaguer García 12 Dec '08

12 Dec '08

Hi, I am working with freeradius and mikrotik gateway for a long time, but recently I detect in my PostgreSQL database, in radacct table some inconsistencies. First af all, I say that I have the standard configuration file (postgres.sql) for accounting queries. My problem is sometimes the field acctstoptime is full when the user is connected. I can see the user in my hotspot as alive session. What is my problem? the issue is all interim update queries are rejected because the SQL update query does not find the folloing SQL WHERE: AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND FramedIPAddress= '%{Framed-IP-Address}' AND AcctStopTime IS NULL because AcctStopTime = '<date>' When this field is fill in? Another thing is when the acctsopttime is not null, too the acctterminatecause = '' (it is a blank, instad of a NULL value) . Thanks. _________________________________________________________________ Descarga el nuevo Messenger, más divertido que nunca. http://download.live.com/

4 6

freeradius not responding on machine specific IPs
by kevin 12 Dec '08

12 Dec '08

I was loathe to ask a newbie question, but it appears I have one. How does one configure freeradius to listen on all IPs specific to a machine? I have a remote Ubuntu 7.10 server (32bit) which I want to use for authentication via freeradius. It (freeradius 1.1.6-2) installed all nice and is running properly in default config, or it would seem. I cannot get a response when a remote authenticate is made. When I ssh into the server, it appropriately responds to the following: > root@server3:/home/kevin# radtest fred wilma 127.0.0.1 1812 mysecret > Sending Access-Request of id 1 to 127.0.0.1 port 1812 > User-Name = "fred" > User-Password = "wilma" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > Re-sending Access-Request of id 1 to 127.0.0.1 port 1812 > User-Name = "fred" > User-Password = "wilma" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=1, length=20 > rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) When I try radtest on the network IP, it fails, as per: > root@server3:/home/kevin# radtest fred wilma 192.168.3.199 1812 mysecret > Sending Access-Request of id 5 to 192.168.3.199 port 1812 > User-Name = "fred" > User-Password = "wilma" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > Re-sending Access-Request of id 5 to 192.168.3.199 port 1812 > User-Name = "fred" > User-Password = "wilma" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 etc... I have tried setting the listen in Radiusd.conf to be the network IP of the machine (x.x.3.199), but that gave the same results. Any thoughts on what this n00b is doing wrong? Thanks, Kevin

2 2

rpmbuild errors 2.1.3-0
by Andrew Long 12 Dec '08

12 Dec '08

I'm back again trying to build the latest into rpm for our CentOS 5.x servers. I have edited the spec file so Name: freeradius and repacked the tgz so it is freeradius-2.1.3.tar.gz but I get [along@host SPECS]$ rpmbuild -ba --nobuild freeradius.spec Processing files: freeradius-2.1.3-0 error: File not found: /var/tmp/freeradius-root/etc/pam.d/radius error: File not found: /var/tmp/freeradius-root/etc/logrotate.d/radiusd error: File not found: /var/tmp/freeradius-root/etc/rc.d/init.d/radiusd error: File not found by glob: /var/tmp/freeradius-root/etc/raddb/* error: File not found: /var/tmp/freeradius-root/usr/share/doc/freeradius-2.1.3 error: File not found by glob: /var/tmp/freeradius-root/usr/bin/* error: File not found: /var/tmp/freeradius-root/usr/share/freeradius error: File not found by glob: /var/tmp/freeradius-root/usr/lib/* error: File not found by glob: /var/tmp/freeradius-root/usr/share/man/*/* error: File not found by glob: /var/tmp/freeradius-root/usr/sbin/* error: File not found by glob: /var/tmp/freeradius-root/usr/include/freeradius/* error: File not found: /var/tmp/freeradius-root/var/log/radius error: File not found: /var/tmp/freeradius-root/var/log/radius/radacct error: File not found: /var/tmp/freeradius-root/var/run/radiusd Processing files: freeradius-debuginfo-2.1.3-0 error: Could not open %files file /home/along/rpmbuild/BUILD/freeradius-2.1.3/debugfiles.list: No such file or directory RPM build errors: File not found: /var/tmp/freeradius-root/etc/pam.d/radius File not found: /var/tmp/freeradius-root/etc/logrotate.d/radiusd File not found: /var/tmp/freeradius-root/etc/rc.d/init.d/radiusd File not found by glob: /var/tmp/freeradius-root/etc/raddb/* File not found: /var/tmp/freeradius-root/usr/share/doc/freeradius-2.1.3 File not found by glob: /var/tmp/freeradius-root/usr/bin/* File not found: /var/tmp/freeradius-root/usr/share/freeradius File not found by glob: /var/tmp/freeradius-root/usr/lib/* File not found by glob: /var/tmp/freeradius-root/usr/share/man/*/* File not found by glob: /var/tmp/freeradius-root/usr/sbin/* File not found by glob: /var/tmp/freeradius-root/usr/include/freeradius/* File not found: /var/tmp/freeradius-root/var/log/radius File not found: /var/tmp/freeradius-root/var/log/radius/radacct File not found: /var/tmp/freeradius-root/var/run/radiusd Could not open %files file /home/along/rpmbuild/BUILD/freeradius-2.1.3/debugfiles.list: No such file or directory BTW - my last build was via rpmbuild: $ rpm -qv freeradius freeradius-2.0.3-0 Thank you. And look forward to a few more questions... -- I never think of the future - it comes soon enough. - Albert Einstein

1 1

Forging a RADIUS request within a module
by Geoffroy Arnoud 12 Dec '08

12 Dec '08

Hi all, During authentication process, I need to send an Accounting-Start to a network equipment when the authentication is successful (when processing the Access-Request), before sending the Access-Accept back. Is it possible to create the Accounting-Request from inside a module and "post it" as an event, to let FreeRADIUS core manage processing/sending? If not, I will have to trigger an external radiusclient to do the job. Thanks for your answers. Geoff.

5 6