May 2008 - Freeradius-Users - lists.freeradius.org

radiusd process vanishes on higher load
by Christian Hofstädtler 13 May '08

13 May '08

Hello! I'm using a FreeRadius setup (V 1.1.3-3 from Debian etch) with the MySQL Backend for authorize and accounting. RADIUS packets are coming from another company, which /probably/ has a Proxy for their delivery front-end servers. This setup usually works fine, but on some days I see spikes in the log, and the radiusd process vanishes; needing a restart. I've set: max_request_time = 5 cleanup_delay = 5 max_requests = 4096 sql.conf: num_sql_socks = 256 nas: nastype = other Usually, there will be a few 'stop packet with zero session length' log lines, about 1 per second or fewer. At problem/spike time, I see a lot more of these 'stop packet with zero session length' stuff (about 30 per second); and this too: Info: The maximum number of threads (256) are active, cannot spawn new thread to handle request Additionally, one of these things happen: 1) radiusd process vanishes without a log entry. 2) Error: Dropping request (4097 is too many): from client nasname:57426 - ID: 174 Info: WARNING: Please check the radiusd.conf file. ?The value for 'max_requests' is probably set too low. 3) Error: Internal error processing module entry And radiusd usually vanishes after this. With Option 3 I usually also see MySQL DB connection problems, but not all the time, and they are not always fatal (?). So - am I missing something? Is this just a very long spike (can take 10 minutes to a few hours); Are there any counters in FR that I could track? (like packets per second, etc.) Thanks, Christian -- Christian Hofstädtler InQnet GmbH Praterstraße 31 A-1020 Wien Tel.: +43 1 212 7650 523 Fax.: +43 1 212 7650 610

2 1

Re: Freeraius in debug mode
by A.L.M.Buxey＠lboro.ac.uk 13 May '08

13 May '08

Hi, > Hi! > > Is it possible to run freeradius in debug mode to have all > debug (clients request) information in log file. It is not usable to have > open console with freeradius -Xf command. redirect the output to a log file instead then... eg radiusd -X >/var/log/radius-special.log 2>&1 alan

1 0

Thank you kalik
by johnson elangbam 13 May '08

13 May '08

hi kalik, After a long pause, I've successfully done my authorization of my radius server by using digest and perl authentication in mixed mode, as per your advice I put the digest entry first before the perl authentication in the default file, and after that I've put a line of perl code RAD_CHECK{'Cleartext-Password'} = $mypassword, where the password is fetch from the database. And finally the server starts reading the cleartext password and starts calculating the md5 encryption and sucessfully authorized a user. Lastly, I thank to all the members of this forum who are dedicated here to help solving the complex problem in a complicated environment, especially Evan Kalik who is much envolved, regarding my problems of not getting my digest attributes. Thanking you for your valuable time and consideration. With Regards, Johnson Elangbam

1 0

0 Session Length, radrelay or Freeradius causing issues
by Etienne Pretorius 13 May '08

13 May '08

Hello List, I have asked this before (http://readlist.com/lists/lists.freeradius.org/freeradius-users/1/7788.html) and Alan DeKok did say that I should place those accounting packets in a different Acct-Type, but that was when I did not wish to log the information but I now need to log the information and replicate to all radius servers. I need to know why the radrelay application stops replacation when it comes across a 0 session length packet. This morning I found a 40Mb backlog file for each server and realised that it was the 0 session-length packet again. I know FreeRadius does complain about it but it still logs this accounting packet into the sql database. So is it because FreeRadius indicates that an error (0 Session Length?). If so could I not just somehow tell FreeRadius to stop complaining and just accept the stupid packet. (As I am passing configurable triggers via 0 session length radius packets). -- Kind Regards Etienne Pretorius

3 3

Freeraius in debug mode
by Alexey Eronko 13 May '08

13 May '08

Hi! Is it possible to run freeradius in debug mode to have all debug (clients request) information in log file. It is not usable to have open console with freeradius -Xf command. Thanks Alexey

1 0

OT: java radius client libraries?
by Alex French 13 May '08

13 May '08

Hi guys, Sorry if this is slightly OT but I'm hoping someone can advise on an open-source radius client library in Java for integration with another project that will be talking to a freeradius server. I have found two, jradius and tinyradius, but jradius does not seem to be in active development. Has anyone used either of these or something else, preferably with a freeradius server? Thanks, Alex

3 3

Referencing Ldap-Group in unlang
by Jason Alderfer 13 May '08

13 May '08

Hi all, I would like to convert the following users file entry to unlang code in 2.0.4. DEFAULT Ldap-Group == "cn=not_student,ou=n,o=emu" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = 6 But after reading the unlang man page and trying it several ways, I can't figure out how to duplicate this functionality. The above users file entry causes this in the debug output: rlm_ldap: Entering ldap_groupcmp() expand: o=emu -> o=emu expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=cn\3dalderfjh\2cou\3dis\2cou\3dn\2co\3demu))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=not_student,ou=n,o=emu, with filter (|(&(objectClass=GroupOfNames)(member=cn\3dalderfjh\2cou\3dis\2cou\3dn\2co\3demu))) request done: ld 0x81a5118 msgid 29 rlm_ldap::ldap_groupcmp: User found in group cn=not_student,ou=n,o=emu But so far none of the syntax below has invoked ldap_groupcmp(). if ( Ldap-Group == "cn=not_student,ou=n,o=emu" ) { if ( control:Ldap-Group == "cn=not_student,ou=n,o=emu" ) { if ( "%{Ldap-Group}" == "cn=not_student,ou=n,o=emu" ) { if ( "%{ldap:Ldap-Group}" == "cn=not_student,ou=n,o=emu" ) { Jason

2 3

Multiple BaseDN's - How Do I Do This?
by Rob VanDusen 12 May '08

12 May '08

I'm very new to both Linux and FreeRadius, so please excuse me if this is too easy a question. After a couple weeks of fighting, reading, testing and reconfiguring - I finally managed to get FreeRadius 2.x working with my Novell eDirectory. Right now my eDir tree is made up of 6 "O's" - one for each building in the organization. It looks something like this: ISDTREE | CTC | ESB | MTC | SPS | OAC | JSC My current config will check via LDAP against a NetWare box and authorize anyone in the ESB container - but I can't get it to look at any of the other containers. I tried doing multiple instances of the LDAP module - but that resulted in the server not authorizing anyone. How would I set this up so I can add the other O's as Base DN's? I'd really appreciate any instructions that a slightly dim bulb could follow. -Rob

4 6

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce'.
by johnson elangbam 12 May '08

12 May '08

>You are (again) sending a request without Digest-Attributes. Try sending >one with them. >Ivan Kalik >Kalik Informatika ISP hi, I check all the clients attributes and start sending the Digest attributes.. now the problem is I can't get those attributes in my perl code by accessing using RAD_REQUEST or RAD_CHECK, so that I can calculate my ha1, ha2 for md5 encryption. Please help. Output log file when run in debug mode by using radiusd -X rad_recv: Access-Request packet from host 192.168.1.227 port 32817, id=222, length=262 User-Name = "john(a)192.168.1.227" Digest-Attributes = "\n\006john" Digest-Attributes = "\001\017192.168.1.227" Digest-Attributes = "\002*48281f56caacb6aa62fc3bb31ec98146efeaae15" Digest-Attributes = "\004\023sip:192.168.1.227" Digest-Attributes = "\003\nREGISTER" Digest-Response = "9ae01536efc46358e61f2fe362552af4" Service-Type = SIP Sip-URI-User = "john" Cisco-AVPair = "call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x8d08568 asigned new request. Handled so far: 1 found interpetator at address 0x8d08568 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 9ae01536efc46358e61f2fe362552af4 rlm_perl: RAD_REQUEST: Service-Type = SIP rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: Sip-URI-User = john rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: Digest-Attributes = ARRAY(0x8df353c) rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 9ae01536efc46358e61f2fe362552af4 rlm_perl: Added pair Service-Type = SIP rlm_perl: Added pair Cisco-AVPair = call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair Sip-URI-User = john rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair Digest-Attributes = \n\006john rlm_perl: Added pair Digest-Attributes = \001\017192.168.1.227 rlm_perl: Added pair Digest-Attributes = \002*48281f56caacb6aa62fc3bb31ec98146efeaae15 rlm_perl: Added pair Digest-Attributes = \004\023sip:192.168.1.227 rlm_perl: Added pair Digest-Attributes = \003\nREGISTER rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x8d08568 ++[perl] returns ok rlm_digest: Adding Auth-Type = DIGEST ++[digest] returns ok rlm_realm: Looking up realm "192.168.1.227" for User-Name = " john(a)192.168.1.227" rlm_realm: No such realm "192.168.1.227" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Cleartext-Password or Digest-HA1 is required for authentication. ++[digest] returns invalid auth: Failed to validate the user. Login incorrect: [john(a)192.168.1.227/<via Auth-Type = DIGEST>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.227 port 32818, id=223, length=262 User-Name = "john(a)192.168.1.227" Digest-Attributes = "\n\006john" Digest-Attributes = "\001\017192.168.1.227" Digest-Attributes = "\002*48281f56caacb6aa62fc3bb31ec98146efeaae15" Digest-Attributes = "\004\023sip:192.168.1.227" Digest-Attributes = "\003\nREGISTER" Digest-Response = "9ae01536efc46358e61f2fe362552af4" Service-Type = SIP Sip-URI-User = "john" Cisco-AVPair = "call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x8e67348 asigned new request. Handled so far: 1 found interpetator at address 0x8e67348 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 9ae01536efc46358e61f2fe362552af4 rlm_perl: RAD_REQUEST: Service-Type = SIP rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: Sip-URI-User = john rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: Digest-Attributes = ARRAY(0x8efce0c) rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 9ae01536efc46358e61f2fe362552af4 rlm_perl: Added pair Service-Type = SIP rlm_perl: Added pair Cisco-AVPair = call-id= 8717e9ec07014e138298c43a5dcdd370(a)192.168.1.193 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair Sip-URI-User = john rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair Digest-Attributes = \n\006john rlm_perl: Added pair Digest-Attributes = \001\017192.168.1.227 rlm_perl: Added pair Digest-Attributes = \002*48281f56caacb6aa62fc3bb31ec98146efeaae15 rlm_perl: Added pair Digest-Attributes = \004\023sip:192.168.1.227 rlm_perl: Added pair Digest-Attributes = \003\nREGISTER rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x8e67348 ++[perl] returns ok rlm_digest: Adding Auth-Type = DIGEST ++[digest] returns ok rlm_realm: Looking up realm "192.168.1.227" for User-Name = " john(a)192.168.1.227" rlm_realm: No such realm "192.168.1.227" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Cleartext-Password or Digest-HA1 is required for authentication. ++[digest] returns invalid auth: Failed to validate the user. Login incorrect: [john(a)192.168.1.227/<via Auth-Type = DIGEST>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 222 to 192.168.1.227 port 32817 Reply-Message = "Incorrect Password" Waking up in 0.4 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 223 to 192.168.1.227 port 32818 Reply-Message = "Incorrect Password" Waking up in 4.5 seconds. Cleaning up request 0 ID 222 with timestamp +3 Waking up in 0.4 seconds. Cleaning up request 1 ID 223 with timestamp +3 Ready to process requests. Thanks and Regards, Elangbam Johnson

3 2

reply-attributes are not set in the ACCES-ACCEPT
by Alex Mija 12 May '08

12 May '08

Hello, I try to authenticate (using freeradius 102)to a freeradius server . My user entry in the users file looks like this: user2 User-Password := "alcatel" Session-Timeout = 3600, Termination-Action = 1, # Class = 0x1234567890, # User-Name = "accounting", Service-Flow-Descriptor = 0x000104008302040083040303050304060301070383080384, QoS-Descriptor += 0x000103830403020606000F40000c0302, QoS-Descriptor += 0x000103840403020606001F40000c0302 When I use TTLS with CHAP it works fine. BUT When I use TTLS with MSCHAPv2 in ACCESS-ACCEPT message I can't see any of the attributes I set in the reply list of items from the users file. Here is the ACCESS-ACCEPT I get for TTLS with CHAP: Sending Access-Accept of id 5 to 10.10.10.30:36608 Session-Timeout = 3600 Termination-Action = RADIUS-Request Service-Flow-Descriptor = 0x000104008302040083040303050304060301070383080384 QoS-Descriptor += 0x000103830403020606000f40000c0302 QoS-Descriptor += 0x000103840403020606001f40000c0302 MS-MPPE-Recv-Key = 0x8a3b613e1d64e0a0336d2e60e2fb0632b6a43cc6b3d5d2b4e5567d1a96192ce4 MS-MPPE-Send-Key = 0x6e80df49b3c1508922184f681e1ce50d92c8be285caffd8ade63819b62a39f71 EAP-Message = 0x03b80004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" State = 0x2c1b82994bd0419cabdcaf1926213bd5 Finished request 4 And here is the ACCESS-ACCEPT I get for TTLS with MSCHAPv2: Sending Access-Accept of id 5 to 10.10.10.40:42816 MS-MPPE-Recv-Key = 0x1da9c1c1e531f3196e83dfc1916b5b3a86b495ab8e2af29713c599be4bdfbbfd MS-MPPE-Send-Key = 0xe1059cf8c3c43acb40917d40d11f75b38d3ebcdd7ff3c8ce50555cfed46e286b EAP-Message = 0x03c20004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" State = 0x84615d95aae822404e0a3e27f174ea81 Finished request 4 Could anyone tell me why in the second case the reply attributes are not included in ACCESS-ACCEPT? Regards, Alex

2 3