March 2008 - Freeradius-Users - lists.freeradius.org

ntlm_auth
by Dean, Barry 17 Mar '08

17 Mar '08

I know this is not strictly a FreeRADIUS problem, but I am betting someone on this list has been here and got the tee shirt! I have joined my two RADIUS servers (FreeRADIUS 2.0.2, Solaris 10 x86, winbindd 3.0.25a) to our AD domain with the "net join" command. This worked (eventually!). Now when I test "ntlm_auth" I get the following odd goings on: Scenario A: Works Type: ntlm_auth --username=USER --password=PASSWORD --domain=DOMAIN Result: NT_STATUS_OK: Success (0x0) Scenario B: FAILS Type: ntlm_auth --username=USER --domain=DOMAIN password: <PASSWORD> Result: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) What's different about the password handling between A and B? The upshot is that the command issued by FreeRADIUS: ntlm_auth = "/usr/sfw/bin/ntlm_auth --request-nt-key --username= %{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} -- nt-response=%{mschap:NT-Response:-00}" Also fails. So my MSCHAPv2 auth is now broken. This worked with our Test AD environment fine. I am told the only difference between test/production is: 1) Production is in "native mode" 2) Production supports logins using both "USER\DOMAIN" and "USER@DOMAIN" forms. If the answer to my problem is "As the Samba list", I'll pop over there! Thanks in advance. --------------- Barry Dean Networks Team

1 0

Instability with 1.1.7 and Alcatel Wifi controllers
by Fabio Pedretti 17 Mar '08

17 Mar '08

I am using freeradius 1.1.7 at my University since some time and never had any problem. I recently added two Alcatel controllers (Alcatel 6000 and 4302) with their APs. Since that I noticed that freeradius sometimes (about once every week) hangs with 100% cpu usage or crashes after similar messages: Fri Mar 14 08:23:16 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Fri Mar 14 08:23:16 2008 : Auth: Login incorrect: [33505@students] (from client SF-alcatel-4302 port 1 cli 001302065FE2) Fri Mar 14 08:43:35 2008 : Auth: Login OK: [testpap] (from client alcatel-ext port 0 cli 000000000000) Fri Mar 14 08:51:26 2008 : Error: Discarding duplicate request from client SF-alcatel-4302:32794 - ID: 25 due to unfinished request 1155 or Tue Feb 26 09:38:46 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Tue Feb 26 09:38:46 2008 : Auth: Login incorrect: [host/fabry-722333783] (from client SC-alcatel-6000 port 1 cli 00130287CBCD) Tue Feb 26 09:39:57 2008 : Info: rlm_eap_mschapv2: Issuing Challenge Tue Feb 26 09:40:07 2008 : Error: Discarding duplicate request from client SC-alcatel-6000:32794 - ID: 85 due to unfinished request 2143 I am using a selfcompiled freeradius 1.1.7 deb package on a 64 bit Ubuntu 6.06 and I am using mysql and ldap backends. Have someone idea on what can be the problem? I'll try to compile with --enable-developer if core dumps are needed. Thanks, Fabio

3 2

FreeRadius 2.0.2
by srdjan mish 17 Mar '08

17 Mar '08

Hi, i am new, so let's go.... I have freeradius on 1 machine - ver 2.0.1-pre (radiusd -v) I need to install radius to another machine... I used SuSE repo, and it was installed succesfully.. 1. I cannot start it: it says that there is a problem with eap: Failed to link to module 'rlm_eap': libfreeradius-eap-2.0.2.so: cannot open shared object file: No Such File or Directory 2. I checked, libdir = /usr/lib/freeradius is OK, and it contains that file... 3. If i turn off eap it starts, but I get error on authorize start: modsingle[authorize]: calling chap (rlm_chap) for request 0 - Segmentation fault I think that server is not finding lib files at all... Why Please, help... Best Regards...

2 1

FreeRADIUS Server Version 2.0.3 has been released
by Alan T DeKok 17 Mar '08

17 Mar '08

There are a number of bug fixes, and a few small feature improvements. FreeRADIUS 2.0.3 ; $Date: 2008/03/14 08:44:24 $ , urgency=medium Feature improvements * Updated raddb/certs/ca.cnf with extensions to allow ca.der to be imported as a CA on Symbian and Windows Mobile devices. Closes bug #524 * Enable multiple matches in "hints" via Fall-Through = Yes. Closes bug #477 * Added preliminary SQLite driver, contibuted by Apple. Untested, with no sample configuration. This address bug #470. * Updated logging sub-system so that log messages from libfreeradius can go to the log file, and not stdout. * Added dictionary.rfc5176 * EAP module now checks for instance name, and uses that for authentication. This avoids the need to set Auth-Type when there are multiple instances of the EAP module. * Added Module-Return-Code attribute, which contains the value returned by the previous module (ok/fail/update/etc.) Bug fixes * Corrected typos in rlm_dbm. Closes bugs #521 and #522. * Detail file "listen" sections now work much better. * Don't allow old "log_*" to over-ride new format. Closes bug #525 * Initialize allocated memory in Oracle SQL driver. This fixes occasional crashes on some systems. Closes bug #518 * Call correct function in rlm_protocol_filter. This enables the module to build. Closes bug #512. * Added deprecated flag to build for rlm_krb5. This allows it to run on 64-bit systems. Closes bug #491 * Corrected error message when parsing invalid configurations so it doesn't crash. Closes bug #527 * Fix handling of timeouts in rlm_ldap that affected 64-bit systems. * Handle $INCLUDE's in "instantiate" section. Closes #528. * Format updates to "man" pages from Stephen Gran.

2 1

Login anoymous?
by Sergio Belkin 17 Mar '08

17 Mar '08

Hi, I am radius 2.0.2 that is working fine, I am using EAP with TTLS. I found a line that it worried a bit in the logs: Auth: Login OK: [whateveruser-1] Auth: Login OK: [whateveruser-2] Auth: Login OK: [whateveruser-so-on] Auth: Login OK: [anonymous] Why I get anonymous? (Users are authenticated against a LDAP server) That use_tunneled_reply=no has to do with it? Should I turn on yes? Is it a security risk? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 1

Problem with authentication with rlm_perl
by johnson elangbam 15 Mar '08

15 Mar '08

hi, I am using free Radius 2.0. I want to try to authenticate with the perl module, I've done all the necessary configurations in sites-enabled/default directory and in radiusd.conf and it reads my perl script when running my radius, unfortunately my radius server rejects all the time no matter what i've put the return value rlm_module_ok in my perl script. Please tell me is there any other things what i've to do to authenticate the username from perl module. Here is the output after running the radius server in debugging mode FreeRADIUS Version 2.0.2, for host i686-pc-linux-gnu, built on Feb 25 2008 at 09:51:36 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/etc/raddb/example.pm" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } perl { max_clones = 32 start_clones = 32 min_spare_clones = 0 max_spare_clones = 32 cleanup_delay = 5 max_request_per_clone = 0 } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. And here is the output after rejecting the user rad_recv: Access-Request packet from host 127.0.0.1 port 32779, id=142, length=56 User-Name = "john" User-Password = "john" NAS-IP-Address = 192.168.1.227 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0xa10bb10 asigned new request. Handled so far: 1 found interpetator at address 0xa10bb10 rlm_perl: Added pair User-Name = john rlm_perl: Added pair User-Password = john rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 192.168.1.227 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xa10bb10 ++[perl] returns ok rlm_realm: No '@' in User-Name = "john", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[expiration] returns noop ++[logintime] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [john/john] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 142 to 127.0.0.1 port 32779 Waking up in 4.9 seconds. Cleaning up request 0 ID 142 with timestamp +3 Ready to process requests. With Regards Elangbam Johnson

2 1

FreeRADIUS MIB
by Lemaster, Rob 15 Mar '08

15 Mar '08

I've reviewed the SNMP MIB and I can't find traps for the following events: * Proxy Failure * Database Connection Broken * Restart/HUP Are these traps available? Thanks!

2 1

Advanced Queuing?
by Lemaster, Rob 15 Mar '08

15 Mar '08

Does FreeRADIUS have any advanced queuing abilities? If we restart a BRAS, it will try to authenticate between 30,000 to 60,000 users all at once. This can crash our RADIUS server. Does FreeRADIUS have any advanced queuing functionality that will enable it handle this sudden surge of traffic, or should we plan to upgrade our hardware? If advanced queuing functionality is available, can you point me to some documentation on this feature? Thanks!

2 1

Dead Proxy Detection?
by Lemaster, Rob 15 Mar '08

15 Mar '08

Can FreeRADIUS detect and remove dead proxies from the round-robin rotation and then add them back after it detects that the proxy is alive again? Can FreeRADIUS automatically set all subcribers to "authenticate all" if all proxies are unavailable, and then authenticate normally automatically after the proxies come back online? If these settings are available, can you reply with a link for more information? Thanks!

2 1

RE: Freeradius-Users Digest, Vol 35, Issue 48
by Gustavo Chavelas 14 Mar '08

14 Mar '08

Thanks for your response Martin. I will check this version.

1 0