April 2008 - Freeradius-Users - lists.freeradius.org

Compiling freeradius.org 2.0.3 on Red Hat 7.3
by Robert Haskins 23 Apr '08

23 Apr '08

I'm trying to compile freeradius.org version 2.0.3 on Red Hat 7.3, and I'm getting the following error: /usr/local/src/radius/freeradius-server-2.0.3/src/freeradius-devel/rad_assert.h:26: warning: `used' attribute directive ignored In file included from ../../eap.h:34, from eap_tnc.c:58: ../../libeap/eap_types.h:30: warning: `used' attribute directive ignored eap_tnc.c: In function `eaptnc_extract': eap_tnc.c:137: parse error before `unsigned' eap_tnc.c:141: parse error before `int' eap_tnc.c:147: `ptr' undeclared (first use in this function) eap_tnc.c:147: (Each undeclared identifier is reported only once eap_tnc.c:147: for each function it appears in.) eap_tnc.c:153: `thisDataLength' undeclared (first use in this function) eap_tnc.c:154: `dataStart' undeclared (first use in this function) eap_tnc.c: In function `eaptnc_compose': eap_tnc.c:212: parse error before `unsigned' eap_tnc.c:214: `swappedDataLength' undeclared (first use in this function) eap_tnc.c:217: parse error before `thisDataLength' eap_tnc.c:220: parse error before `int' eap_tnc.c:224: `offset' undeclared (first use in this function) eap_tnc.c:225: `thisDataLength' undeclared (first use in this function) gmake[9]: *** [eap_tnc.lo] Error 1 gmake[9]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3/src/modules/rlm_eap/types/rlm_eap_tnc' gmake[8]: *** [common] Error 2 gmake[8]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3/src/modules/rlm_eap/types' gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3/src/modules/rlm_eap/types' gmake[6]: *** [common] Error 2 gmake[6]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/radius/freeradius-server-2.0.3' make: *** [all] Error 2 I've searched the wiki site and the mailing list archives and not found much on this error. Yes, I know that RH 7.3 is old/etc., so I'm not looking for pat answers like "upgrade to the latest O/S version". In searching for the error message (`used' attribute directive ignored) I haven't come up with anything helpful. Thanks for any assistance you can provide!

2 1

Nas IP address in logs
by Sergio Belkin 23 Apr '08

23 Apr '08

Hi, how can I get the "NAS-IP-Address" in radius.log? -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 4

802.1x+WLAN and radtest
by Dr.Peer-Joachim Koch 23 Apr '08

23 Apr '08

Hi, we are using one radius server for external users to get access to a 802.1x WLAN. The radius server is configured to look for the domain and only answer local request or form our domain. Everything else is forwareded to central instance (using the proxy.conf). Now I have a strange problem: When I use our local domain "radtest" and the WLAN is working fine. When I try to use an external domain account, radtest tells OK, but using the same account for the WLAN will fail. How can I debug this error ? -- Bye, Peer _________________________________________________________ Max-Planck-Institut fuer Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

2 5

FW: is okay
by alberto beas castañeda 23 Apr '08

23 Apr '08

> From: freeradius-users-confirm+207f898fd4ffaa48bbe50ae10f48767ca4f802a7(a)lists.freeradius.org> To: beas_abc(a)hotmail.com> Subject: Your confirmation is required to join the Freeradius-Users mailing list> Date: Wed, 23 Apr 2008 17:25:45 +0200> > Mailing list subscription confirmation notice for mailing list> Freeradius-Users> > We have received a request from 200.0.112.129 for subscription of your> email address, "beas_abc(a)hotmail.com", to the> freeradius-users(a)lists.freeradius.org mailing list. To confirm that> you want to be added to this mailing list, simply reply to this> message, keeping the Subject: header intact. Or visit this web page:> > http://lists.freeradius.org/mailman/confirm/freeradius-users/207f898fd4ffaa…> > > Or include the following line -- and only the following line -- in a> message to freeradius-users-request(a)lists.freeradius.org:> > confirm 207f898fd4ffaa48bbe50ae10f48767ca4f802a7> > Note that simply sending a `reply' to this message should work from> most mail readers, since that usually leaves the Subject: line in the> right form (additional "Re:" text in the Subject: is okay).> > If you do not wish to be subscribed to this list, please simply> disregard this message. If you think you are being maliciously> subscribed to the list, or have any other questions, send them to> freeradius-users-owner(a)lists.freeradius.org. _________________________________________________________________ Juega y gana, tenemos 3 Xbox a la semana. http://club.prodigymsn.com/

1 0

the problem about the session key
by xiningtom_1986 23 Apr '08

23 Apr '08

Hello,I learn that there is a MK that need to pass to the AP after the auth is complete.Do you know how to generate the key? Are they generated differently in different way of auth? Xingtom

1 0

Multiple instances of attribute in tunnelled reply
by Arran Cudbard-Bell 23 Apr '08

23 Apr '08

Hi, We formulate our reply inside of the virtual server dealing with EAP and send it back to the outer server. This is the only way I could think of to insert the Inner identity into the Access-Accept. It all works fine... however it seems there's a bug when dealing with multiple instances of the same attribute. For example: users / sql DEFAULT Service-Type == Framed-User, Realm == 'local', SS-Flags =~ "^.1........$" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 603, Reply-Message = "User %{%{Stripped-User-Name}:-%{User-Name}} authenticated for ResNet access on NAS:%{%{NAS-Identifier}:-Uknown NAS} SSID:%{%{Called-Station-SSID}:-none}.", HP-IP-FILTER-RAW = 'deny in 41 from any to any', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.1', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.2', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.3', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.4', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.5', Fall-Through = no Ends up being sent as the response: # server default-inner PEAP: Got tunneled reply RADIUS code 2 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" Reply-Message = "User ac221 authenticated for ResNet access on NAS:hp-e-engg1-1-dev-8021x-sw1 SSID:none." HP-Ip-Filter-Raw = "deny in 41 from any to any" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.1" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.2" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.3" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.4" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.5" EAP-Message = 0x03490004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ac221" PEAP: Processing from tunneled session code 0x845cb10 2 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" Reply-Message = "User ac221 authenticated for ResNet access on NAS:hp-e-engg1-1-dev-8021x-sw1 SSID:none." HP-Ip-Filter-Raw = "deny in 41 from any to any" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.1" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.2" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.3" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.4" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.5" EAP-Message = 0x03490004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ac221" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS Saving tunneled attributes for later So when it's actually used in the Access-Accept packet it appears as: Sending Access-Accept of id 173 to 139.184.8.16 port 1024 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" HP-Ip-Filter-Raw = "deny in 41 from any to any" User-Name = "ac221(a)sussex.ac.uk" MS-MPPE-Recv-Key = 0xdec383f4a269cb3d8fcf59cd9e351971c3a9a3683a7c245144a0b852634c7a03 MS-MPPE-Send-Key = 0xb9f49bba9f9020deaa745c6ea0e8f5b92e72e2fc5b6465aed4a9231f10edd696 EAP-Message = 0x034a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 9. What's really weird is in the previous rounds of EAP, the attributes retain the += operator, it's only in the one where the EAP-Success message is returned where all the operators are stripped out. Relevant EAP bits: eap { ... ttls { ... copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "default-inner" } } Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 3

reference packet code in unlang?
by Stefan Winter 23 Apr '08

23 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list, we sometimes get Accounting-On/Off tickets that are not meant for us (don't ask... bugyy NASes). I have a filter criterion: the NAS sends in Acct-Session-Id a unique string. When it's meant for us it has a certain value, wehen not, the string is different. I would like to match the packets in unlang in preacct and ACK the packets while not actually processing them (empty accounting{} section). Using the following in preacct threw a parser error. Maybe I'm just blind. I don't see the syntax error: if (Acct-Status-Type == "Accounting-Off" && !(Acct-Session-Id =~ "restena.*")) update control { ~ Proxy-To-Realm := testrealm.lu ~ } (first and second line wrapped) I'm sort of lost... Greetings, Stefan Winter -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFIDdpE+jm90f8eFWYRAgUkAJ9ivmuZk+W50wXkEV2PeMeSH/sJVgCfQBSO 6UK49D6t2Fk1UPagntYa10I= =CSEz -----END PGP SIGNATURE-----

3 6

EAP SSL certificates - how to?
by matthew zeier 22 Apr '08

22 Apr '08

I'm having problems figuring out how to create an SSL certificate for WPA Enterprise authentication. Self-signed ones cause "unknown root" errors on OS X clients which I'd expect. I took a GeoTrust certificate off a webserver and now get "unknown trust" errors. I'm looking for something that doesn't require end-user interaction. I generated a test certificate using the bootstrap script in the src dist. The server.crt appears to have the same x509 fields GeoTrust has (GeoTrust has more) so I'm not sure what I'm missing. I'm also entirely unclear what he CN should be. Any pointers? -- matthew zeier | Network Engineer | Mozilla Corp. | (650)903-0800 x219

2 1

Freeradius performance settings or bug?
by Jeremiah Millay 22 Apr '08

22 Apr '08

Hi, I'm seeing some odd behavior running freeradius-1.1.7 in a freebsd 6.3 environment. I see a lot of these in the radius log: Tue Apr 22 09:27:44 2008 : Error: Discarding duplicate request from client arc3.wnskvtao.sover.net:1645 - ID: 208 due to unfinished request 1267 Tue Apr 22 09:27:44 2008 : Error: Discarding duplicate request from client arc3.wnskvtao.sover.net:1645 - ID: 209 due to unfinished request 1268 as well as the cputime constantly increasing the longer I leave radiusd running: last pid: 34247; load averages: 0.29, 0.32, 0.39 up 4+22:29:48 09:27:05 30 processes: 2 running, 28 sleeping CPU states: 2.6% user, 0.0% nice, 10.5% system, 0.0% interrupt, 86.8% idle Mem: 17M Active, 447M Inact, 173M Wired, 20K Cache, 112M Buf, 2618M Free Swap: 4096M Total, 4096M Free PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 34011 root 20 0 9852K 6904K kserel 2 8:09 1.61% radiusd 34011 root 96 0 9852K 6904K select 0 8:09 0.00% radiusd 34011 root 20 0 9852K 6904K kserel 2 8:09 0.00% radiusd 34011 root 20 0 9852K 6904K kserel 2 8:09 0.00% radiusd 34011 root 20 0 9852K 6904K ksesig 0 8:09 0.00% radiusd 34011 root 98 0 9852K 6904K CPU0 0 8:09 0.00% radiusd Looking at older messages posted to the list, I see Alan suggests that the duplicate requests are related to radiusd not replying quickly enough due to either having hostname lookups enabled or due to sql backend slowness. I'm not using sql in my configuration and do not have hostname lookups enabled. Are there any settings I could tweak in radiusd.conf to help? Maybe there is a bug I am not aware of relating to running freeradius under freebsd (I know there are some SMP related issues). Here are some configuration snippets that may be relevant: cleanup_delay = 2 max_requests = 10240 hostname_lookups = no thread pool { start_servers = 20 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } Any help or suggestions would be greatly appreciated. Jeremiah

3 4

Re: Freeradius-Users Digest, Vol 36, Issue 130
by Jack Murgia 22 Apr '08

22 Apr '08

Phil, on 4/21/08 3:00 AM, freeradius-users-request(a)lists.freeradius.org at freeradius-users-request(a)lists.freeradius.org wrote: > Date: Mon, 21 Apr 2008 10:38:24 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: NAS with dynamic IP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <480C6090.2070005(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Jack Murgia wrote: >> Alex, >> >> Is there a command I can run periodically that would flush the dns cache? > > pkill radiusd; /usr/sbin/radiusd > > i.e. restart the server. Otherwise, no. > >> >> I use the NAS table in MySQL rather than clients.conf to register my NAS >> devices. The only problem with NAS devices on PPOE ADSL links is that a >> restart of Freeradius server is required in order to pick up the new IP >> address from DYNDNS.org. >> >> Would this problem be solved by a rlm_nsupdate module (scheduled for future >> release)? I would be willing to donate to the creation of this module. > > How does that help? Not sure what the intention of that module is, but in the roadmap it says " New module: rlm_nsupdate (dyndns). Because dynamic addresses are cruel." Which made me think it might relate to this issue. > > The problem is that the server might have outstanding requests for a > given client record when it's removed. It's a hard problem. > Right- chillispot is web-based- so user's browser will hang for as long as the TCP timeout takes, I think- will have to test. > Does re-starting the server *really* take so long it's a problem for you? Oh it's very fast at restarting. But I'd have to decide how much "downtime" for the authorization process due to NAS ip changes I am willing to tolerate (10 minutes? 5 minutes?) and set my restart intervals accordingly, which seems a bit messy. Especially if someone is trying to login, as noted above. And does it affect open sessions on other NASs (force them to login again, creating simultaneous use issues with orphaned accounting records in MySQL)? Will have to test that as well. I suppose restarting freeradius would be an acceptable workaround for the time being if those two issues above aren't barriers. Jack Murgia

2 1