August 2008 - Freeradius-Users - lists.freeradius.org

SQL connection dropped
by leopold 20 Aug '08

20 Aug '08

Hi, I am facing a problem with SQL module that drops connections after some period of time and I have to bounce FreeRadius process in order to establish db connection again. When I am doing netstat I see open connections to DB and then after some time sockets are closed and all radius requests are rejected. I am using the latest Freeradius 2.0.5 with DB2 backend. Thanks for your reply -- View this message in context: http://www.nabble.com/SQL-connection-dropped-tp19034366p19034366.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

2.0.5 on Solaris with openssl 0.9.8h
by Rafiqul Ahsan 20 Aug '08

20 Aug '08

Alan, and all , I am facing some challenges on building Freeradius 2.0.5 (Solaris OS) with openssl version 0.9.8h. The Solaris 10 come with prebuilt openssl version, and found at /usr/sfw/bin/openssl, version 0.9.7d. Prior to building freeradius I built newer version openssl (v.0.9.8h) located in /usr/local/ssl. here are the two openssl version now I have in my Solaris. bash-3.00# openssl version OpenSSL 0.9.8h 28 May 2008 bash-3.00# /usr/sfw/bin/openssl version OpenSSL 0.9.7d 17 Mar 2004 (+ security patches to 2006-09-29) When I built Freeradius 2.0.5 (I simply executed three comands, ./configure make and make install) , I was expecting that it would build with my desired openssl version. Aparantly, I found that certain has algorithm (sha256) is not supporting when I work with freeradius (I mean with SSL version that it was built with). However openssl version 0.9.8h should support this. I sent openssl community this question, they wanted me to verify whether I actualy built the freeradius with this new openssl version. I am not able to understand what library it is actually built with, because I could not figure out from build log, nor the configure. But if I use the configure options as below, I see a rolling error (that telling me that I must not have built the freeradius with openssl 0.9.8h ?) : ....... (see portion of my out when I executed make, after ./configure ./configure \ --prefix=/usr/local/freeradius \ --with-openssl=yes \ --with-openssl-dir=/usr/local/ssl \ --with-openssl-includes=/usr/local/ssl/include \ --with-openssl-libraries=/usr/local/ssl/lib ) RB5 -c peap.c -o peap.o >/dev/null 2>&1 /export/home/dev/freeradius-server-2.0.5/libtool --mode=link gcc -release 2.0.5 \ -module -export-dynamic -o rlm_eap_peap.la \ -rpath /usr/local/lib rlm_eap_peap.lo peap.lo rlm_eap_peap.c peap.c /export/home/dev/f radius-server-2.0.5/src/lib/libfreeradius-radius.la ../../libeap/libfreeradius-eap.la usr/local/ssl/lib -lcrypto -lssl -lcrypto -ldl -lnsl -lresolv -lsocket -lposix4 -lpth d gcc -shared -Wl,-h -Wl,rlm_eap_peap-2.0.5.so -o .libs/rlm_eap_peap-2.0.5.so .libs/rlm p_peap.o .libs/peap.o -R/export/home/dev/freeradius-server-2.0.5/src/lib/.libs -R/exp /home/dev/freeradius-server-2.0.5/src/modules/rlm_eap/libeap/.libs -R/usr/local/lib -L port/home/dev/freeradius-server-2.0.5/src/lib/.libs /export/home/dev/freeradius-server 0.5/src/lib/.libs/libfreeradius-radius.so ../../libeap/.libs/libfreeradius-eap.so -L/u local/ssl/lib -lssl -lcrypto -ldl -lnsl -lresolv -lsocket -lposix4 -lpthread -lc Text relocation remains referenced against symbol offset in file <unknown> 0x0 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x4 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x8 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0xc /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x10 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x14 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x18 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x1c /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x20 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x24 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x28 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x2c /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x30 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x34 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x38 /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x3c /usr/local/ssl/lib/libssl.a(ssl_lib.o) <unknown> 0x40 /usr/local/ssl/lib/libssl.a(ssl_lib.o) On 8/7/08, Rafiqul Ahsan <rafiqul.ahsan(a)gmail.com> wrote: > I changed the Makefile for random file creation step (as a fix for my > earlier posted error)... > > This is what I found at Makefile : > > random: > @if [ -e /dev/urandom ] ; then \ > dd if=/dev/urandom of=./random count=10 >/dev/null 2>&1; \ > else \ > date > ./random; \ > fi > > I Changed to ... > > random > date > ./random; > > That solved my earlier problem, and now my server is listening. > > Thanks, > Rafi > > > > > > > > On 8/7/08, Rafiqul Ahsan <rafiqul.ahsan(a)gmail.com> wrote: > > I see below error when I execute bootstrap > > > > bash-3.00# /usr/local/etc/raddb/certs/bootstrap > > ............................................... > > make: Nothing to be done for `ca'. > > make: Nothing to be done for `server'. > > make: `dh' is up to date. > > /bin/sh: test: argument expected > > make: *** [random] Error 1 > > > > On 8/7/08, Alan DeKok <aland(a)deployingradius.com> wrote: > > > Rafiqul Ahsan wrote: > > > > Thanks, I was able to build freeradius 2.0.5 on Solaris 10. However, > > > > server is not running, and I see below error when I run "radiusd -X". > > > > Here is the output. > > > ... > > > > make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" > > > > } > > > > Exec-Program output: > > > > > > It's trying to run the bootstrap command. It's not working. > > > > > > Run the bootstrap command by hand, and then re-start the server. > > > > > > Alan DeKok. > > > - > > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > > > > -- > > Rafiqul Ahsan > > > > > -- > Rafiqul Ahsan > -- Rafiqul Ahsan

5 21

I've started to put the book online
by Alan DeKok 19 Aug '08

19 Aug '08

http://deployingradius.com/book/ Only parts of the first chapter are online. It covers the basic concepts behind RADIUS, and should hopefully address a number of common misunderstandings about how it all works. Keep checking the site. More will be coming later. Alan DeKok.

4 3

Re: NAS-Post in Netgear Accounting-Packet
by Stefan Puch 19 Aug '08

19 Aug '08

> In the "Start"-Packets and "Interim-Update"-Packets it seems to be right. > > But ALL the "Stop"-Packets have 0 as NAS-Port. > > So, you agree that this is a bug of the Access-Point? > > Thank you for your reply. > > Wolfgang Burger Hello, I've got three WG102 Access Points from Netgear. I'm using the latest firmware Version 4.0.27 because it should "Fixed the issue that 802.1x Authentication does not work with machine authentication" But I can confirm that the accounting it still NOT working everytime. Looking into my logfiles I can see that the cases which worked fine everytime the same port is used. Here are two examples, the first one worked fine, the Session-Id is always the same: Wed Aug 13 20:05:14 2008 Service-Type = Framed-User Acct-Status-Type = Start User-Name = "test1" Framed-MTU = 1488 Acct-Session-Id = " 1" Acct-Authentic = RADIUS Acct-Delay-Time = 0 Called-Station-Id = "00184DC8XXXX:Network" Calling-Station-Id = "001A73XXXXXX" NAS-Identifier = "APBuero" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 NAS-Port-Id = "STA port # 1" Acct-Unique-Session-Id = "866e0c5655a05a0b" Timestamp = 1218650714 Request-Authenticator = Verified Wed Aug 13 20:10:13 2008 Service-Type = Framed-User Acct-Status-Type = Interim-Update User-Name = "test1" Framed-MTU = 1488 Acct-Session-Id = " 1" Acct-Authentic = RADIUS Acct-Session-Time = 299 Acct-Delay-Time = 0 Called-Station-Id = "00184DC8XXXX:Network" Calling-Station-Id = "001A73XXXXXX" NAS-Identifier = "APBuero" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 NAS-Port-Id = "STA port # 1" Acct-Unique-Session-Id = "866e0c5655a05a0b" Timestamp = 1218651013 Request-Authenticator = Verified Wed Aug 13 20:34:33 2008 Service-Type = Framed-User Acct-Status-Type = Stop User-Name = "test1" Framed-MTU = 1488 Acct-Session-Id = " 1" Acct-Authentic = RADIUS Acct-Session-Time = 1758 Acct-Terminate-Cause = User-Request Acct-Delay-Time = 0 Called-Station-Id = "00184DC8XXXX:Network" Calling-Station-Id = "001A73XXXXXX" NAS-Identifier = "APBuero" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 NAS-Port-Id = "STA port # 1" Acct-Unique-Session-Id = "866e0c5655a05a0b" Timestamp = 1218652473 Request-Authenticator = Verified ------------------------------------------------------------------------------------ But this second one from today fails with the error: Tue Aug 19 18:11:30 2008 : Auth: Login OK: [test2 /<via Auth-Type = EAP>] (from client AP-Halle1 port 1 cli 001302BEXXXX) Tue Aug 19 18:12:30 2008 : Error: rlm_radutmp: Logout for NAS AP-Halle1 port 0, but no Login record When looking into detail log I can also see, that the Session-Id and the port changed and I don't know why Tue Aug 19 18:11:30 2008 Service-Type = Framed-User Acct-Status-Type = Start User-Name = "test2" Framed-MTU = 1488 Acct-Session-Id = " 6" Acct-Authentic = RADIUS Acct-Delay-Time = 0 Called-Station-Id = "000000000000:Network" Calling-Station-Id = "001302BEXXXX" NAS-Identifier = "AP-Halle1" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.xx.xx NAS-Port = 1 NAS-Port-Id = "STA port # 1" Acct-Unique-Session-Id = "11f6ee9422434136" Timestamp = 1219162290 Request-Authenticator = Verified Tue Aug 19 18:12:30 2008 Service-Type = Framed-User Acct-Status-Type = Stop User-Name = "test2" Framed-MTU = 1488 Acct-Session-Id = " 6" Acct-Authentic = RADIUS Acct-Session-Time = 60 Acct-Terminate-Cause = User-Request Acct-Delay-Time = 0 Called-Station-Id = "000000000000:Network" Calling-Station-Id = "001302BEXXXX" NAS-Identifier = "AP-Halle1" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" NAS-IP-Address = 192.168.xx.xx NAS-Port = 0 NAS-Port-Id = "STA port # 0" Acct-Unique-Session-Id = "9c44efbf7672967b" Timestamp = 1219162350 Request-Authenticator = Verified --------------------------------------------------------------------------- Obviously the netgear access point uses port 1 on start but port 0 on stop. Also the user is definitely NOT connected anymore but radwho shows the following: # radwho -R User-Name = "test2" Acct-Session-Id = " 6" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 Service-type = Login-User Framed-IP-Address = Acct-Session-Time = 10255 Calling-Station-Id = "001302BEXXXX" User-Name = "test2" Acct-Session-Id = " 16" NAS-IP-Address = 192.168.XX.XX NAS-Port = 1 Service-type = Login-User Framed-IP-Address = Acct-Session-Time = 8170 Calling-Station-Id = "001302BEXXXX" # It's shows that the user is still connected... Does anyone know how this is possible? Best regards Stefan Puch

2 1

Question regarding rlm_perl and Access-Challenge
by Harry J Walsh 19 Aug '08

19 Aug '08

Hi, I want to develop some test cases for a radius client I am developing and I would like to be able to use rlm_perl to simulate various scenarios. The one I am having major problems with is Access-Challenge. I really like rlm_perl and the flexibility it provides and I would like to be able to specify the reply type. I've looked through documentation and the rlm_perl code for any hints on how to do this and at this stage I'm thinking I'll have to create a new interface to allow my perl script to specify the correct reply type to rlm_perl. Do any of you know of an existing way to do this? -- Harry J Walsh

2 4

convert steel-belt radius .dct to freeradius dictionary
by S Adrian 19 Aug '08

19 Aug '08

Hi everybody, I got a file that looks like this (utstarcom.dct) which would need to be translated to freeradius .. anyone can help? >>start of file<< # utstarcom.dct - Radius dictionary for UTStarcom BBS1000 @radius.dct # # UTStarcom specific parameters # MACRO UTStarcom-VSA(t,s) 26 [vid=7064 type1=%t% len1=+2 data=%s%] ATTRIBUTE Utstarcom-VLAN-ID Utstarcom-VSA(140, integer) r ATTRIBUTE Utstarcom-CommittedBandwidth Utstarcom-VSA(142, integer) r ATTRIBUTE Utstarcom-MaxBandwidth Utstarcom-VSA(143, integer) r ATTRIBUTE Utstarcom-Priority Utstarcom-VSA(145, integer) r ATTRIBUTE Utstarcom-Error-Reason Utstarcom-VSA(147, integer) r ATTRIBUTE Utstarcom-PrimaryDNS Utstarcom-VSA(152, integer) r ATTRIBUTE Utstarcom-SecondaryDNS Utstarcom-VSA(153, integer) r ATTRIBUTE Utstarcom-MaxBurstSize Utstarcom-VSA(161, integer) r ATTRIBUTE Utstarcom-MaxDelay Utstarcom-VSA(162, integer) r ATTRIBUTE Utstarcom-MaxJitter Utstarcom-VSA(163, integer) r ATTRIBUTE Utstarcom-DeviceId Utstarcom-VSA(165, string) cr ATTRIBUTE Utstarcom-Module-Id Utstarcom-VSA(166, integer) cr ATTRIBUTE Utstarcom-Port-No Utstarcom-VSA(167, integer) cr ATTRIBUTE Utstarcom-Logical-Port-No Utstarcom-VSA(168, integer) r ATTRIBUTE Utstarcom-UNI-MAX-MAC Utstarcom-VSA(169, integer) r ATTRIBUTE Utstarcom-Default-Gateway Utstarcom-VSA(170, integer) r ATTRIBUTE Utstarcom-CLI-Access-Level Utstarcom-VSA(171, integer) r ATTRIBUTE Utstarcom-Act-Input-Octets Utstarcom-VSA(180, string) r ATTRIBUTE Utstarcom-Act-Output-Octets Utstarcom-VSA(181, string) r ATTRIBUTE Utstarcom-Act-Input-Frames Utstarcom-VSA(182, string) r ATTRIBUTE Utstarcom-Act-Output-Frames Utstarcom-VSA(183, string) r ATTRIBUTE Utstarcom-Onu-MC-Filter-Enable Utstarcom-VSA(184, integer) r ATTRIBUTE Utstarcom-UNI-Auto-Negotiation Utstarcom-VSA(185, integer) r ATTRIBUTE Utstarcom-UNI-Speed Utstarcom-VSA(186, integer) r ATTRIBUTE Utstarcom-UNI-Duplex Utstarcom-VSA(187, integer) r ATTRIBUTE Utstarcom-ONU-Admin_status Utstarcom-VSA(188, integer) r ATTRIBUTE Utstarcom-ONU-FW-SC-Upgrade Utstarcom-VSA(189, integer) r >>EOF<<

3 3

web based certificate management
by Tomoki Taniguchi 19 Aug '08

19 Aug '08

is there a good web based certificate management system that users of freeradius recommend? i need something that will apply the needed xpextensions and generate the necessary .p12 and .der certificates for a windows xp client. i am looking into editing the ebox-ca to generate the additional certificates, but would perfer not to have to go through the trouble if possible. TIA, Tomoki

2 1

final question about client certs using eap-tls (was: cert bootstrap bug?)
by Sergio 19 Aug '08

19 Aug '08

Hi, also was so many others. At this time i have got one eap module which authenticates users under a PKI. My client certs are issued by root ca (ca.pem) and everything works. I can manage the crl, because it is public, and authenticate any user against any server. So my question is, what's the final goal of signing certificates with server's? The only difference (i think) is about the crl managing, because in my case, the authority should provide the crl to the server administrators. I don't see any more difference. Thanks

1 1

Crash on x64?
by Alex Balashov 19 Aug '08

19 Aug '08

Greetings, I am running a very high-volume FreeRADIUS installation on RHEL 5 (not my choice), and noticed that FreeRADIUS was periodically dying after instantiating a great many worker servers. I looked at the output in GDB and got: Continuing. [New LWP 11400] [tcsetpgrp failed in terminal_inferior: Operation not permitted] (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread 47272748113904 (LWP 11350)] [New Thread 1328978240 (LWP 11441)] [New Thread 1318488384 (LWP 11439)] [New Thread 1370937664 (LWP 11438)] [New Thread 1307998528 (LWP 11437)] [New Thread 1360447808 (LWP 11436)] [New Thread 1140160832 (LWP 11435)] [New Thread 1297508672 (LWP 11434)] [New Thread 1287018816 (LWP 11433)] [New Thread 1276528960 (LWP 11432)] [New Thread 1266039104 (LWP 11431)] [New Thread 1119181120 (LWP 11430)] [New Thread 1255549248 (LWP 11429)] [New Thread 1245059392 (LWP 11428)] [New Thread 1234569536 (LWP 11427)] [New Thread 1129670976 (LWP 11423)] [New Thread 1203099968 (LWP 11422)] [New Thread 1339468096 (LWP 11421)] [New Thread 1108691264 (LWP 11420)] [New Thread 1349957952 (LWP 11419)] [New Thread 1213589824 (LWP 11412)] [New Thread 1224079680 (LWP 11411)] [New Thread 1094392128 (LWP 11410)] [New Thread 1538775360 (LWP 11406)] [New Thread 1528285504 (LWP 11405)] [New Thread 1517795648 (LWP 11404)] [New Thread 1192610112 (LWP 11403)] [New Thread 1507305792 (LWP 11402)] [New Thread 1496815936 (LWP 11401)] [New Thread 1486326080 (LWP 11400)] [New Thread 1475836224 (LWP 11399)] [New Thread 1465346368 (LWP 11398)] [New Thread 1454856512 (LWP 11397)] [New Thread 1444366656 (LWP 11396)] [New Thread 1433876800 (LWP 11395)] [New Thread 1423386944 (LWP 11394)] [New Thread 1412897088 (LWP 11393)] [New Thread 1161140544 (LWP 11392)] Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to Thread 1486326080 (LWP 11400)] 0x00002afe89997d19 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2 (gdb) Continuing. Program received signal SIGABRT, Aborted. 0x00002afe8ad3d155 in raise () from /lib64/libc.so.6 Is this a bug in the x64 libdl? -- Alex -- Alex Balashov Evariste Systems Web : http://www.evaristesys.com/ Tel : (+1) (678) 954-0670 Direct : (+1) (678) 954-0671 Mobile : (+1) (706) 338-8599

4 10

Realms and proxying
by Dean, Barry 19 Aug '08

19 Aug '08

I currently have a realm defined: realm liv.ac.uk { type = radius authhost = LOCAL accthost = LOCAL } I now have one of my departments, which for various complex reasons, has been allowed to have its own user accounts. They have the subdomain name "csc.liv.ac.uk". I want to proxy RADIUS to their server. If I add: realm csc.liv.ac.uk { type = radius authhost = server.csc.liv.ac.uk:1812 accthost = server.csc.liv.ac.uk:1813 } Is this position dependant? Does it have to appear before the liv.ac.uk realm to prevent "user(a)csc.liv.ac.uk" being caught by the first realm? I have: realm suffix { format = suffix delimiter = "@" } in radius.conf. --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

2 1