October 2009 - Freeradius-Users - lists.freeradius.org

Re: Running Multiple Freeradius Instances
by Gary Gatten 27 Oct '09

27 Oct '09

Most likely not, depends if your doing a bunch of sql,perl,etc. Check out virtual servers in 2.x ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org To: freeradius-users(a)lists.freeradius.org Sent: Tue Oct 27 21:47:25 2009 Subject: Running Multiple Freeradius Instances Will there be any performance issues if I run multiple instances of freeradius in the same server? Thanks, Asin <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Running Multiple Freeradius Instances
by Asin Silva 27 Oct '09

27 Oct '09

Will there be any performance issues if I run multiple instances of freeradius in the same server? Thanks, Asin

1 0

how to require client certificate with PEAP
by Vieri 27 Oct '09

27 Oct '09

Hi, If I use EAP-TLS with a self-signed client certificate, I can connect my Windows XP clients to a WLAN. If I use PEAP alone, then my Windows XP clients connect to a WLAN with an Active Directory username. I'm trying to combine both EAP-TLS and PEAP but since I'm not a radius security guru then I'll rephrase what my goal is: I simply want to *require* that all wifi clients use PEAP *AND* have a self-signed client certificate installed on their system. That way, if I want to, I can revoke the certificates from the server. The Windows native clients are configured to use: Eap type: PEAP and have both root and client certificates installed. However, if I add the "EAP-TLS-Require-Client-Cert = Yes" option then I get this message in the log: rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate How should I configure Windows XP to send the client certificate? Thanks, Vieri PS: Here are the relevant config files and debug log: FreeRADIUS Version 2.0.5, for host x86_64-pc-linux-gnu, built on Oct 1 2008 at 12:36:40 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } } client 10.215.146.83 { require_message_authenticator = no secret = "F5jmE6xA" shortname = "FHMWIFI" } client 10.215.146.130 { require_message_authenticator = no secret = "F5jmE6x2B1_002369E349C4" shortname = "FHMWIFI_2B1" } client 10.215.146.131 { require_message_authenticator = no secret = "F5jmE6x2B2" shortname = "FHMWIFI_2B2" } client 127.0.0.1 { require_message_authenticator = no secret = "test-secret" shortname = "localhost" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=DOMAIN --require-membership-of=DOMAIN\WIFI_DATA --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/FHM/radius_server_keycert.pem" certificate_file = "/etc/raddb/certs/FHM/radius_server_keycert.pem" CA_file = "/etc/raddb/certs/FHM/cacert.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/FHM/dh" random_file = "/etc/raddb/certs/FHM/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=0, length=149 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000d0176646970616f6c61 Message-Authenticator = 0xf151a5b172038670b96410e980c11a9e +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.215.146.130 port 2048 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd169f2ccd1486a8c87845ad869b9597 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=1, length=234 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202005019800000004616030100410100003d03014ae7044a5ceeabc159f74b8ed2feb126d9d32c4fab44dafe0b77f26644f5948f00001600040005000a000900640062000300060013001200630100 State = 0xcd169f2ccd1486a8c87845ad869b9597 Message-Authenticator = 0x47712f21f13ed9131ab3cc782b6ec2c3 +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0629], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00ae], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 1 to 10.215.146.130 port 2048 EAP-Message = 0x0103040019c000000730160301004a0200004603014ae703ff813c6a8c2753637ca23a92f71584c588bf275c391c3e1daecf66436d204a5386d862ca9653bd2f983f8c5f4b8931bac987724b4b488cb72dcd24395d8b00040016030106290b0006250006220002ef308202eb30820254a003020102020103300d06092a864886f70d010105050030819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906 EAP-Message = 0x092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f7267301e170d3038313030313037333035345a170d3130313030313037333035345a3081c1310b30090603550406130245533111300f0603550408130842616c65617265733110300e060355040713074d616e61636f7231233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d6174696361312530230603550403131c494e462d424c30372e686f73706974616c6d616e61636f722e6f7267312b302906092a864886f70d010901161c76646970616f6c6140686f7370 EAP-Message = 0x6974616c6d616e61636f722e6f726730819f300d06092a864886f70d010101050003818d0030818902818100c175563d62c96736eaf125d1f813b922bbc022bd61752c11bf73aa92281eb0c03880a561acc3b8c5dd3623a2918f679549780fdda4e7412aaa5e939f970605cf97fa804326d9aa721220155f0f1f3f7047475599156eb32d5202ab66ca6507a2b7fd7ff1bcaa05581356e46d419e9c1a521c8acd0d4e8ab904b4c3d88a6430d90203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181008f0fb4808bb59368842a57300b06abeb8aac92c678107975d5eb5b82b17043e0 EAP-Message = 0xdc65b166dabfed56516c165b1ee39682537cb0a77c5e2225221a2d969e6f2bdcba3358385073e6099f05118c871a733e88e51a9099325319940565b66ec0909631170dd06bbfe03d1083410b5e86d4a4fa234673d2adf7ed5e2325875306be9c00032d3082032930820292a003020102020100300d06092a864886f70d010105050030819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906092a864886 EAP-Message = 0xf70d010901161c7664697061 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd169f2ccc1586a8c87845ad869b9597 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=2, length=160 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xcd169f2ccc1586a8c87845ad869b9597 Message-Authenticator = 0x9156d0bbcbb15fb33e2ab3ea4292b2aa +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 10.215.146.130 port 2048 EAP-Message = 0x0104034019006f6c6140686f73706974616c6d616e61636f722e6f7267301e170d3038313030313037313332315a170d3138303932393037313332315a30819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f726730819f300d06092a864886f70d010101050003818d00308189028181009b9f8138ff EAP-Message = 0xa8f822ea55f6b4e0ec4f42bc584ad9c67aca2d792174658401e2279f9dd16b9018064f453bdb56a3ac3f6160867da71487cf6aade8193daea8269810fffb166ad1fb5ee15dc0d76aefcaeaa525846065a830a196695aa50603b0320534c7926c92ee38ab4acc832afb23896a570746d8a0555e1d935e057d937fa90203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041434abcc538614877e3de13e96c731aa1f76906d50301f0603551d2304183016801434abcc538614877e3de13e96c731aa1f76906d50 EAP-Message = 0x300d06092a864886f70d0101050500038181008aee00f10f00d5dbd26e076782f2c09f839fd98b4d6d700d367f9f7c60c08b5d90602b8365589cf26a68db72966ee76835f228e36f98f32cad38f3a945a7c28bc8e563e978f4812fac4393fe76b5f7e1f2605a487a8df1a28ca43570adf299af5c51895efca84555b4c5802fee568d1ec71f9e28d64a3682ce9d926f6e1680d316030100ae0d0000a60301024000a0009e30819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d EAP-Message = 0x61746963613111300f06035504031308494e462d424c3037312b302906092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f72670e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd169f2ccf1286a8c87845ad869b9597 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=3, length=353 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400c71980000000bd160301008d0b0000030000001000008200802b539bad48666ea42c7831663cf5933ecbf28567c7b0a6dd5546470f60a6afba31d8042deaf6ef3820b058a630e8bf4a8644f2abdde5f2f0957503a0e3f8eef6b12a03570c09a5d582860c93f617105c2d3256451a5860498cdd76af186b1ed799345d2c3e80edc1a7ca02cb910d3e7993a98281a8f3b3b668378f0091e656a914030100010116030100207701a054ddd92000a60ccaa64e4fbd791a8b2f09677288423ca07033b01da0b2 State = 0xcd169f2ccf1286a8c87845ad869b9597 Message-Authenticator = 0x44fe2e774d0214f2cecff86caa3dc9cb +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 199 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 189 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0007], Certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [vdipaola/<via Auth-Type = EAP>] (from client FHMWIFI_2B1 port 0 cli 00-22-43-13-64-79) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> vdipaola attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 3 to 10.215.146.130 port 2048 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=4, length=149 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000d0176646970616f6c61 Message-Authenticator = 0xcb4b80f73ec67467832bdbf7fa3864a3 +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 4 to 10.215.146.130 port 2048 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3d11bdae3d3023b4dfe620935ea5874 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=5, length=234 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202005019800000004616030100410100003d03014ae7044aec15815e7b9e4ca16b10a876ee07a70d2c8b92e422fce359110efaeb00001600040005000a000900640062000300060013001200630100 State = 0xe3d11bdae3d3023b4dfe620935ea5874 Message-Authenticator = 0x53dd06ca2395384a2e23443de4cb550b +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0629], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00ae], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 5 to 10.215.146.130 port 2048 EAP-Message = 0x0103040019c000000730160301004a0200004603014ae704006bdac32802e3c809fc1e365b897171ed1beac6a6c1530a305b2019132081d81e2272840e4325ab2d1575e7d58672f021706c34a6d97ae9c1410a05b8ec00040016030106290b0006250006220002ef308202eb30820254a003020102020103300d06092a864886f70d010105050030819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906 EAP-Message = 0x092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f7267301e170d3038313030313037333035345a170d3130313030313037333035345a3081c1310b30090603550406130245533111300f0603550408130842616c65617265733110300e060355040713074d616e61636f7231233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d6174696361312530230603550403131c494e462d424c30372e686f73706974616c6d616e61636f722e6f7267312b302906092a864886f70d010901161c76646970616f6c6140686f7370 EAP-Message = 0x6974616c6d616e61636f722e6f726730819f300d06092a864886f70d010101050003818d0030818902818100c175563d62c96736eaf125d1f813b922bbc022bd61752c11bf73aa92281eb0c03880a561acc3b8c5dd3623a2918f679549780fdda4e7412aaa5e939f970605cf97fa804326d9aa721220155f0f1f3f7047475599156eb32d5202ab66ca6507a2b7fd7ff1bcaa05581356e46d419e9c1a521c8acd0d4e8ab904b4c3d88a6430d90203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101050500038181008f0fb4808bb59368842a57300b06abeb8aac92c678107975d5eb5b82b17043e0 EAP-Message = 0xdc65b166dabfed56516c165b1ee39682537cb0a77c5e2225221a2d969e6f2bdcba3358385073e6099f05118c871a733e88e51a9099325319940565b66ec0909631170dd06bbfe03d1083410b5e86d4a4fa234673d2adf7ed5e2325875306be9c00032d3082032930820292a003020102020100300d06092a864886f70d010105050030819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906092a864886 EAP-Message = 0xf70d010901161c7664697061 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3d11bdae2d2023b4dfe620935ea5874 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=6, length=160 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xe3d11bdae2d2023b4dfe620935ea5874 Message-Authenticator = 0xead1abea82985363d3d2e666620d5a8f +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 6 to 10.215.146.130 port 2048 EAP-Message = 0x0104034019006f6c6140686f73706974616c6d616e61636f722e6f7267301e170d3038313030313037313332315a170d3138303932393037313332315a30819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d61746963613111300f06035504031308494e462d424c3037312b302906092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f726730819f300d06092a864886f70d010101050003818d00308189028181009b9f8138ff EAP-Message = 0xa8f822ea55f6b4e0ec4f42bc584ad9c67aca2d792174658401e2279f9dd16b9018064f453bdb56a3ac3f6160867da71487cf6aade8193daea8269810fffb166ad1fb5ee15dc0d76aefcaeaa525846065a830a196695aa50603b0320534c7926c92ee38ab4acc832afb23896a570746d8a0555e1d935e057d937fa90203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e0416041434abcc538614877e3de13e96c731aa1f76906d50301f0603551d2304183016801434abcc538614877e3de13e96c731aa1f76906d50 EAP-Message = 0x300d06092a864886f70d0101050500038181008aee00f10f00d5dbd26e076782f2c09f839fd98b4d6d700d367f9f7c60c08b5d90602b8365589cf26a68db72966ee76835f228e36f98f32cad38f3a945a7c28bc8e563e978f4812fac4393fe76b5f7e1f2605a487a8df1a28ca43570adf299af5c51895efca84555b4c5802fee568d1ec71f9e28d64a3682ce9d926f6e1680d316030100ae0d0000a60301024000a0009e30819b310b30090603550406130245533111300f0603550408130842616c656172657331233021060355040a131a46756e646163696f6e20486f73706974616c204d616e61636f7231143012060355040b130b496e666f726d EAP-Message = 0x61746963613111300f06035504031308494e462d424c3037312b302906092a864886f70d010901161c76646970616f6c6140686f73706974616c6d616e61636f722e6f72670e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe3d11bdae1d5023b4dfe620935ea5874 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.215.146.130 port 2048, id=7, length=353 User-Name = "vdipaola" NAS-IP-Address = 10.215.146.130 NAS-Port = 0 Called-Station-Id = "00-23-69-E3-49-C0" Calling-Station-Id = "00-22-43-13-64-79" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400c71980000000bd160301008d0b000003000000100000820080507cda85493484789c84370b5f0ab6091ef3a32cd4adda122205be6f29b3dbc55a8a281c3366846d23b5c27d14ffc452d122b2474d68ab81b164cf232838cb99771d84abe0b10ed60eea32dafdb9669a3b91ca31ded6f782d51e269742bb990a65a9c48c4dd355c1df95634bd4c9f11bcd0e1bf49d9c81815930bec1d5468f671403010001011603010020088e08e9edfbf9b497197799a0d5cbac5cf19d8ccd39f06fddd39925627ed407 State = 0xe3d11bdae1d5023b4dfe620935ea5874 Message-Authenticator = 0xe7b1ae9786830318a972d990204a5dc4 +- entering group authorize ++[preprocess] returns ok ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "vdipaola", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 199 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS TLS Length 189 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0007], Certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal handshake_failure TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [vdipaola/<via Auth-Type = EAP>] (from client FHMWIFI_2B1 port 0 cli 00-22-43-13-64-79) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> vdipaola attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 7 to 10.215.146.130 port 2048 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 0 with timestamp +23 Cleaning up request 1 ID 1 with timestamp +23 Cleaning up request 2 ID 2 with timestamp +23 Cleaning up request 3 ID 3 with timestamp +23 Cleaning up request 4 ID 4 with timestamp +24 Cleaning up request 5 ID 5 with timestamp +24 Cleaning up request 6 ID 6 with timestamp +24 Cleaning up request 7 ID 7 with timestamp +24 Ready to process requests. ---- default config file: authorize { preprocess update control { EAP-TLS-Require-Client-Cert = Yes } chap mschap suffix eap { ok = return } unix files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } ----- eap.conf config file: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/FHM/radius_server_keycert.pem certificate_file = ${certdir}/FHM/radius_server_keycert.pem CA_file = ${cadir}/FHM/cacert.pem dh_file = ${certdir}/FHM/dh random_file = ${certdir}/FHM/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } ----- mschap config file: mschap { with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=DOMAIN --require-membership-of=DOMAIN\\WIFI_DATA --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" }

2 1

Cisco AVpair(client-mac-address) and Calling-Station-Id attribute
by Egi Konomi 27 Oct '09

27 Oct '09

Hello, I am using freeradius 1.1.8 with a Cisco7301 router as a NAS, but the NAS does not send the Calling-Station-Id attribute, insted it uses "Cisco-AVPair = "client-mac-address=000f.ea20.e1ad"" They have changed this attribute in modern IOS versions. I want to know if there is a possibility to rewrite the : Cisco-AVPair = "client-mac-address=000f.ea20.e1ad" to "Calling-Station-Id = 000f.ea20.e1ad" Also, i am using some other NASes that use the standart Calling-Station-Id, with the same radius. Thank You! Egi

2 1

radacct and db handles
by Ademir Klauck 27 Oct '09

27 Oct '09

HI, I'm installed freeradius with daloradius in a FC11 box, everything new. After some corrections everything is working, but in radius.log I receive constantly the error message below: Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 I checked my radius db and radacct table and there are many indexed and nothing I could found is the problem. It only append when I enable radius accounting in SQL. Any help would bee appreciated. Tks, Ademir

4 5

(no subject)
by jon jon 26 Oct '09

26 Oct '09

Hi, I want to have one computer just do mac authentication, instead of matching username and password. Can I just add this mac address to the mysql database. I am running chillispot also, I believe all I have to do is uncomment a line in the chilli.conf file to have it do mac authentication. Would this be the right way to do this? thanks

3 3

separate log file and access list config
by Yagnesh Dave 26 Oct '09

26 Oct '09

Hi All, How can we use separate flies for logging authentication and accouting information. Also wanted to know does free radius configure the access list on the interface, similar to the ip address. One more quick question, how can we set timeout for different users, so if the connection is ideal for say 4 hrs, it should get disconnected. Regards, Yagnesh

2 1

custom script for access
by d.tom.schmitt＠L-3com.com 26 Oct '09

26 Oct '09

I have an Asterisk (PBX-in-a-Flash) system running freeRADIUS version 1.1.3 i686-redhat-linux-gnu. Running on CentOS 5.2 - soon to be upgraded to 5.3. I need to setup an account on the freeradius server that can be accessed by another system as a radius server - not the problem. I then need to have freeradius call a script that checks additional credentials before allowing the user to be accepted or rejected access to the system they are on. This check can take a few seconds to complete. This could be similar to someone using an RSA or other token - but it is not a token. So basically I need to have freeradius after verifying login/password, call the script and depending upon the outcome either allow or deny the user access. The script for testing could be as simple as: If minute is EVEN = allow in and say an appropriate message If minute is ODD = do not allow access and say an appropriate message I have read most of the .conf files but am still confused. Is there a HOW-TO that shows a simple example? Thanks, Tom Schmitt Senior IT Staff - R&D Phone (801) 594-3030

1 0

Segmentation fault in rlm_sql_postgresql
by Olivn 26 Oct '09

26 Oct '09

Hi all radiusd crashes when Postgresql returns PGRES_FATAL_ERROR. Olivier -------- environment ----------- OS: Centos 5.3 Freeradius : 2.1.7 (also occurred in 2.1.6) packages are from http://people.redhat.com/jdennis/freeradius-rhel-centos/i386/ Postgresql : 8.1 <http://people.redhat.com/jdennis/freeradius-rhel-centos/i386/freeradius2-2.…> ------- debug output ----------- radius -X output: ... } rlm_sql (sql_secondary): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked rlm_sql (sql_secondary): Attempting to connect to radius@100.100.100.131:5432/radius rlm_sql (sql_secondary): starting 0 rlm_sql (sql_secondary): Attempting to connect rlm_sql_postgresql #0 rlm_sql (sql_secondary): Connected new DB handle, #0 rlm_sql (sql_secondary): starting 1 rlm_sql (sql_secondary): Attempting to connect rlm_sql_postgresql #1 rlm_sql (sql_secondary): Connected new DB handle, #1 rlm_sql (sql_secondary): starting 2 rlm_sql (sql_secondary): Attempting to connect rlm_sql_postgresql #2 rlm_sql (sql_secondary): Connected new DB handle, #2 rlm_sql (sql_secondary): starting 3 rlm_sql (sql_secondary): Attempting to connect rlm_sql_postgresql #3 rlm_sql (sql_secondary): Connected new DB handle, #3 rlm_sql (sql_secondary): starting 4 rlm_sql (sql_secondary): Attempting to connect rlm_sql_postgresql #4 rlm_sql (sql_secondary): Connected new DB handle, #4 Module: Checking post-proxy {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 100.100.100.2 port 12048, id=38, length=116 NAS-Identifier = "XXXXXX" User-Name = "U0123456" User-Password = "XXXXXXX" NAS-IP-Address = 100.100.100.2 NAS-Port = 0 Acct-Session-Id = "XXXXXXX(ZZZ)\"Sun Oct 25 10:16:45 2009\"HcSrdUv5" +- entering group authorize {...} [suffix] No '@' in User-Name = "U0123456", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "U0123456" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user U0123456 to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] returns updated ++- entering policy redundant {...} [sql_primary] expand: %{User-Name} -> U0123456 [sql_primary] sql_set_user escaped user --> 'U0123456' rlm_sql (sql_primary): Reserving sql socket id: 4 [sql_primary] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribud rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error (null) Program received signal SIGSEGV, Segmentation fault. 0x00c6040a in strcmp () from /lib/libc.so.6 (gdb) info threads * 1 Thread 0xb7fcead0 (LWP 30560) 0x00c6040a in strcmp () from /lib/libc.so.6 (gdb) thread apply all bt full Thread 1 (Thread 0xb7fcead0 (LWP 30560)): #0 0x00c6040a in strcmp () from /lib/libc.so.6 No symbol table info available. #1 0x006c790f in sql_query (sqlsocket=0x867a968, config=0x8657cf8, querystr=0xbfc78fdc "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'U0123456' ORDER BY id") at sql_postgresql.c:118 status =<value optimized out> pg_sock =<value optimized out> numfields =<value optimized out> errorcode = 0x0 errormsg =<value optimized out> #2 0x008911e2 in rlm_sql_select_query (sqlsocket=0x867a968, inst=0x8657cc0, query=0xbfc78fdc "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'U0123456' ORDER BY id") at sql.c:559 ret =<value optimized out> #3 0x00891782 in sql_getvpdata (inst=0x8657cc0, sqlsocket=0x867a968, pair=0xbfc78fd8, query=0xbfc78fdc "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'U0123456' ORDER BY id") at sql.c:606 row =<value optimized out> rows = 0 #4 0x0088efae in rlm_sql_authorize (instance=0x8657cc0, request=0x86b2048) at rlm_sql.c:1007 check_tmp = (VALUE_PAIR *) 0x0 reply_tmp = (VALUE_PAIR *) 0x0 user_profile =<value optimized out> found =<value optimized out> dofallthrough = 1 rows =<value optimized out> sqlsocket = (SQLSOCK *) 0x867a968 inst =<value optimized out> querystr = "SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'U0123456' ORDER BY id\000o/'\006?o/'X?o/'?\017?\000\b\222o/'|\220o/'h\221o/'5b?\000|\220o/'A?\. sqlusername = "U0123456", '\0'<repeats 38 times>, " ?o/'(xe\b??\210\000\214+\000\000\000\000\000u<?o/'X?o/'_N\006O\t\000\000\000\200?\210\000H?\210\000^N\006O\000\000\000\000\r\. profileusername = "@?\021\000?*k\b?*k\b\000i$q0%Z\000@rd\b\000\000\000\000\210?o/'&\205Y\000?*k\b?\202W\b?*\000\000\001\000\000\000\230,X\000\200\n\022\000?(k\b?\202W\b?*k\b?. #5 0x08062dfe in modcall (component=1, c=0x8657570, request=0x86b2048) at modcall.c:292 myresult = 1 stack = {pointer = -1, priority = {0, 4, 0, -1077435628, 13600512, 140868088, 0, 0, 2, 0, 0, 12952177, -1077435732, 140861472, 140861480, 140861476, -1208162612, -1077435192, 140867624, 0, -1208147968, 12509120, 12508320, 140861464, -1077435560, 12509760, 12455465, 12572564, 1172048, 12936180, 12952177, 20}, result = {6, 8, 6, 12940957, -1077435604, -1077435316, -1077435061, -1077435032, 13832180, -1077435316, -1077435604, -1077435368, 13460021, -1077435604, 134726134, -1077435032, -1077435316, 0, -1077435444, 255, -72515583, -1077435316, -1077435316, -1077435316, -1077435316, -1077435289, -1077435061, -1077435316, -1077435061, 0, 0, 0}, children = {0x8657570, 0x86575c0, 0x8683280, 0x4, 0xbedfc0, 0x0, 0x0, 0xbfc7a414, 0xbfc7a33c, 0xbe0e29, 0xd32140, 0x0, 0x8656fc8, 0x101, 0xffffffff, 0xd832ca, 0xd18918, 0x86577a8, 0x8655dc8, 0xbfc7a3c8, 0xd832ca, 0x8656fc8, 0x101, 0xd80f9b, 0xd8575c, 0xd30940, 0x0, 0xbfc7a3f8, 0xd81470, 0x0, 0xd30ff4, 0x71246900}, start = {0x8085e9c, 0x8657518, 0x8683280, 0xbfc7a418, 0x805d2ae, 0x1, 0x80786f1, 0xbfc7a428, 0x0, 0x0, 0xc5769d, 0xbfc7a448, 0x8085e9c, 0xbfc7a428, 0x8085e9c, 0xbfc7a558, 0x80519bd, 0x1, 0x80786f1, 0xbfc7a44c, 0x100, 0x807c1f6, 0xbfc7a568, 0xbfc7a8b8, 0x0, 0xc5a271, 0xff, 0xbfc7a568, 0x74736e49, 0x69746e61, 0x6e697461, 0x71732067}} parent = (modcallable *) 0x86575c0 child = (modcallable *) 0x8683280 if_taken = 0 was_if = 0 #6 0x0805fa65 in indexed_modcall (comp=1, idx=0, request=0x86b2048) at modules.c:691 rcode =<value optimized out> list = (modcallable *) 0x8657570 server =<value optimized out> #7 0x0805fe0c in module_authorize (autz_type=0, request=0x86b2048) at modules.c:1453 No locals. #8 0x0804e678 in rad_authenticate (request=0x86b2048) at auth.c:565 namepair =<value optimized out> check_item =<value optimized out> auth_item = (VALUE_PAIR *) 0x86b23e0 module_msg =<value optimized out> tmp =<value optimized out> result = 12 autz_retry = 0 '\0' autz_type = 7112497 #9 0x0806e4d5 in radius_handle_request (request=0x86b2048, fun=0x804e550 <rad_authenticate>) at event.c:3693 No locals. #10 0x08065a5c in thread_pool_addrequest (request=0x86b2048, fun=0x804e550<rad_authenticate>) at threads.c:841 now = 1256462126 #11 0x0806aef2 in event_socket_handler (xel=0x86ae3e0, fd=18, ctx=0x86b1e58) at event.c:3317 fun = (RAD_REQUEST_FUNP) 0x804e550<rad_authenticate> request = (REQUEST *) 0x86b2048 #12 0x0059ad15 in fr_event_loop (el=<value optimized out>) at event.c:400 ef = (fr_event_fd_t *) 0x86ae490 i =<value optimized out> rcode = 1 when = Could not find the frame base for "fr_event_loop". -------------sql_postgresql.c code -------------------- freeradius-server-2.1.7/src/modules/rlm_sql/drivers/rlm_sql_postgresql/sql_postgresql.c static int check_fatal_error (char *errorcode) { int x = 0; /* Check the error code to see if we should reconnect or not Error Code table taken from http://www.postgresql.org/docs/8.1/interactive/errcodes-appendix.html */ while(errorcodes[x].errorcode != NULL){ line 118--> if (strcmp(errorcodes[x].errorcode, errorcode) == 0){ radlog(L_DBG, "rlm_sql_postgresql: Postgresql Fatal Error: [%s: %s] Occurred!!", errorcode, errorcodes[x]. meaning); if (errorcodes[x].shouldreconnect == 1) return SQL_DOWN; else return -1; } x++; } radlog(L_DBG, "rlm_sql_postgresql: Postgresql Fatal Error: [%s] Occurred!!", errorcode); /* We don't seem to have a matching error class/code */ return -1; }

1 0

Failed to initialize type tls
by Francisco Javier Valdera Garcia 26 Oct '09

26 Oct '09

Hi, I'm installing a 2.1.7 radius server, using a configuration developed in a test environment. The configuration worked great in th test environment, but I'm finding some problems in the production environment. The output from radiusd -CX is as follows: Module: Instantiating eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = yes max_sessions = 2048 } Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/servicios.key" certificate_file = "/etc/raddb/certs/servicios.pem" CA_file = "/etc/raddb/certs/ca_globalsign.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no } rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error loading randomness rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[293]: Failed to find module "eap". /etc/raddb/sites-enabled/default[240]: Errors parsing authenticate section. Can anyone help me? Thanks a lot. Francisco Javier Valdera.

2 5