October 2009 - Freeradius-Users - lists.freeradius.org

rlm_sql: usergroup lookup if User-Profile is defined
by Bjørn Mork 25 Oct '09

25 Oct '09

Hello, I am wondering if I'm the only one who finds the following default behaviour a bit confusing: Given a user defined like this: user1 Cleartext-Password := "foo", User-Profile := "profile1" I would expect "profile1" to always be looked up in the the usergroup table for this user. However, this won't happen if "user1" is defined in that table without Fall-Through. rlm_sql will lookup "user1" first and only lookup "profile1" if either "user1" is not found or Fall-Through is set vy the "user1" groups. Bjørn

1 1

Re: dialup-admin problem
by liran tal 25 Oct '09

25 Oct '09

There is also daloRADIUS available which is a web platform to manage freeradius based on mysql. On Mon, Sep 21, 2009 at 5:16 PM, Franz X. Maier <franz.x.maier(a)inode.at>wrote: > I have the same problem: installed freeradius on Suse Linux 11.2 and got > the dialupadmin partially working, but the web-interface only shows the > dialup-admin Page with no main menu on the left side – only white. I get no > errors in the logs, but I also had to remove the two lines > > > > >> # Scott Added for freeradius dialup-admin > > >> #LoadModule php4_module libexec/libphp4.so > > >> #AddModule mod_php4.c > > > > or it didn’t work at all. > > > > Any help? > > > > Franz X. Maier > > IT-Berater > > Promenadegasse 11-13/2/1 > > 1170 Wien > > Tel.: 01-8904222 > > Mobil: 0664-1004513 > > eMail: franz.x.maier(a)inode.at > > Mobile eMail: franzxmaier(a)mobileemail.vodafone.at > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Status X User
by Sergio Belkin 24 Oct '09

24 Oct '09

Hi, Is there a way to get the las time that user got Accept-Accept and Accept-Reject, of course I can parse log files but I wonder if there a radius tool that can do it. Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 3

cannot upgrade 2.1.6 to 2.1.7
by kachin Agarwal 23 Oct '09

23 Oct '09

Hi, If i dont ve pthread.h in my system.. then how did the 2.1.6 build work.? but i remove the line callback=wait_for_child_to_die; there is no error. can i remove this line and build or is there any other solution to fix it Thanx & Regards, kachin Keep up with people you care about with Yahoo! India Mail. Learn how. http://in.overview.mail.yahoo.com/connectmore

2 1

cannot upgrade 2.1.6 to 2.1.7
by kachin Agarwal 22 Oct '09

22 Oct '09

Hi, i m trying to upgrade my radius server from 2.1.6 to 2.1.7 but when ever i try to make the build i m getting the following error xlat.c:548: warning: passing argument 3 of 'xlat_register' discards qualifiers from pointer target type xlat.c:557: warning: passing argument 3 of 'xlat_register' discards qualifiers from pointer target type xlat.c:569: warning: passing argument 3 of 'xlat_register' discards qualifiers from pointer target type xlat.c:577: warning: passing argument 3 of 'xlat_register' discards qualifiers from pointer target type xlat.c:582: warning: passing argument 3 of 'xlat_register' discards qualifiers from pointer target type event.c: In function 'wait_a_bit': event.c:1166: warning: implicit declaration of function 'pthread_equal' event.c:1177: error: 'wait_for_child_to_die' undeclared (first use in this function) event.c:1177: error: (Each undeclared identifier is reported only once event.c:1177: error: for each function it appears in.) event.c: In function 'radius_event_init': event.c:3441: warning: unused variable 'attr' make[5]: *** [event.lo] Error 1 make[4]: *** [common] Error 2 make[3]: *** [all] Error 2 make[2]: *** [common] Error 2 make[1]: *** [all] Error 2 make: *** [*/*/*/*/*/*/freeradius-server-2.1.7/src/main/radiusd] Error 2 plz help me. where should i declare it?? Thanx & Regards, Kachin Try the new Yahoo! India Homepage. Click here. http://in.yahoo.com/trynew

3 2

FreeRADIUS + Postgresql dies unexpectedly
by Duarte Fonseca 22 Oct '09

22 Oct '09

Hi, I've got a freeRadius (v2.1.7) install running on CentOs using postgresql to store accounting data and have noticed that occasionally freeRadius seems to die unexpectedly. After some time investigating this and going over the logs I can now reproduce this behavior easily by following these steps: 1 - In my sql configuration file (/etc/raddb/postgresql.conf) I specify server = "localhost" (freeRADIUS connects to the database through TCP/IP) 2 - Restart radiusd 3 - Use radclient to send several accounting requests without an Acct-session-Time attribute (radclient -p 200 -f 1.txt 10.1.60.141:1813 acct secret) After a few requests radiusd dies. If i change my sql configuration file (/etc/raddb/postgresql.conf) so server = "" (freeRADIUS connects to DB using Unix-domain socket) radiusd doesn't die. If i run radiusd in debug mode it doesn't die. If i send accounting requests with the Acct-Session-Time set to a positive integer radiusd doesn't die. The following are extracts from the freeRADIUS log and Postgresql log during a test where the radiusd dies extract from radius.log # cat /var/log/radius/radius.log Thu Oct 22 16:20:30 2009 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Thu Oct 22 16:20:30 2009 : Info: rlm_sql (sql): Attempting to connect to postgres@localhost:/gapdb Thu Oct 22 16:20:30 2009 : Info: Loaded virtual server <default> Thu Oct 22 16:20:30 2009 : Info: Ready to process requests. Thu Oct 22 16:20:51 2009 : Error: [sql] stop packet with zero session length. [user '0017f24eff31', nas '172.20.200.66'] Thu Oct 22 16:20:51 2009 : Error: [sql] stop packet with zero session length. [user '0012f0aac218', nas '172.20.200.66'] Thu Oct 22 16:20:55 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Thu Oct 22 16:20:55 2009 : Error: [sql] stop packet with zero session length. [user 'JoePublic7', nas '172.20.200.226'] Thu Oct 22 16:20:55 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Thu Oct 22 16:20:55 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] extract from postgresql log <2009-10-22 16:20:55.095 BST> LOG: SSL error: sslv3 alert bad record mac <2009-10-22 16:20:55.095 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.095 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.097 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.097 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.097 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.097 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.098 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.098 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.098 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.098 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.098 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.098 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.103 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.103 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.103 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.103 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.103 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.103 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.103 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.104 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.105 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.105 BST> LOG: unexpected EOF on client connection <2009-10-22 16:20:55.111 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-22 16:20:55.111 BST> LOG: unexpected EOF on client connection # radiusd -v radiusd: FreeRADIUS Version 2.1.7, for host i386-redhat-linux-gnu, built on Sep 18 2009 at 10:59:17 How would you guys advise me to proceed with resolving this issue, is it a bug, is it something wrong in my configuration? Thank you, Duarte -- Duarte Fonseca ------------------------------ Mobile: +44 753 4262674 E-mail: fonseca.duarte(a)gmail.com

2 1

mysql freeradius "rlm_pap: empty password supplied"
by serre 22 Oct '09

22 Oct '09

Hello, After some hours of googling my problem, i come. I hope somebody will be able to help me! I set up a mac based authentication, with users in mysql database. It is working properly when users are difined in the users file, but did not work with empty Cleartext-Password in the database. Any idea? It is the only problem I've found when following this EXELLENT howto page: http://wiki.freeradius.org/SQL_HOWTO Thanks in advance I show you to of my test users, one with password, the other without (hope i'm clear): Sory, this post post is bigest that wath i was think. Mysql tables: mysql> select * from radcheck; +----+----------+--------------------+----+----------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 7 | seb | Cleartext-Password | := | password | | 8 | chris | Cleartext-Password | := | | mysql> select * from radreply -> ; +----+----------+-----------+----+--------+ | id | username | attribute | op | value | +----+----------+-----------+----+--------+ | 5 | seb | Auth-Type | := | Accept | | 6 | chris | Auth-Type | := | Accept | RADTEST whith user seb: radius:/etc/freeradius# radtest seb password localhost 1812 testing123 Sending Access-Request of id 70 to 127.0.0.1 port 1812 User-Name = "seb" User-Password = "password" NAS-IP-Address = 172.18.100.19 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=70, length=20 DEBUG OUTPUT: ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "password" rlm_pap: Using clear text password "password" rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [seb/password] (from client localhost port 1812) +- entering group post-auth RADTEST WITH user tof: radius:/etc/freeradius# radtest tof "" localhost 1812 testing123 Sending Access-Request of id 220 to 127.0.0.1 port 1812 User-Name = "tof" User-Password = "" NAS-IP-Address = 172.18.100.19 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=220, length=20 DEBUG OUTPUT: ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP ++[pap] returns invalid auth: Failed to validate the user. Login incorrect (rlm_pap: empty password supplied): [tof/] (from client localhost port 1812) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> tof attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated

1 1

PEAP + EAP-TLS: client certificates
by Vieri 22 Oct '09

22 Oct '09

Hi, Sorry for the trivial questions but here I go: I think I configured freeradius correctly for EAP-TLS and PEAP with ms-chap with authenticates using the ntlm_auth helper application. If I try to connect from a Windows client via a wireless AP "WIFIAP1" with Active Directory "user1" I see this in the log: Thu Oct 22 10:05:49 2009 : Auth: Login OK: [user1/<via Auth-Type = EAP>] (from client WIFIAP1 port 0 via TLS tunnel) Thu Oct 22 10:05:49 2009 : Auth: Login OK: [user1/<via Auth-Type = EAP>] (from client WIFIAP1 port 48 cli 001a73f7f0f7) Dumb question: does this mean the client used PEAP to connect? Can I deduce this from "Auth-Type = EAP" and from "via TLS tunnel"? If connected via PEAP, authentication is "secure". However, I'd like to know if the data exchanged between the clients and the rest of the LAN via the Access Point is also encrypted and "cannot be sniffed". Does this "data encryption" depend only on the AP's encryption settings (eg. AES) and does FreeRadius get out of this equation after authentication? If I install a self-signed certificate on another Windows client and connect via EAP-TLS then I can connect without having to use an Active Directory user, as expected. I'm wondering if I can *require* both a certificate on the client machine AND an AD user authentication. In other words, how can I *require* PEAP-EAP-TLS? (currently, my freeradius configuration seems to require PEAP OR EAP-TLS) Freeradius version: 2.0.5 Thanks, Vieri

2 5

problem with default configuration in 2.0.4-3 version
by Ana Gallardo 22 Oct '09

22 Oct '09

Hello, I have installed debian lenny with freeradius 2.0.4-3: /etc/freeradius# dpkg -l | grep freeradius hi freeradius 2.0.4-3 a high-performance and highly configurable RADIUS server hi freeradius-common 2.0.4-3 FreeRadius common files hi freeradius-ldap 2.0.4-3 LDAP module for FreeRADIUS server hi freeradius-mysql 2.0.4-3 MySQL module for FreeRADIUS server hi freeradius-utils 2.0.4-3 FreeRadius client utilities hi libfreeradius-dev 2.0.4-3 FreeRADIUS shared library development files hi libfreeradius2 2.0.4-3 FreeRADIUS shared library and I can't run the default configuration following this instructions http://deployingradius.com/documents/configuration/pap.html Here is my debug information: /etc/freeradius# freeradius -X FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Oct 20 2009 at 11:45:11 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 53599, id=186, length=55 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [bob/hello] (from client localhost port 0) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 186 to 127.0.0.1 port 53599 Waking up in 4.9 seconds. Cleaning up request 0 ID 186 with timestamp +4 Ready to process requests. My request: $ radtest bob hello localhost 0 testing123 Sending Access-Request of id 186 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=186, length=20 Thankyou very much and sorry for my english -- ____________________ Ana Gallardo Gómez ____________________

2 2

mschap problem
by Paolo Barbato 22 Oct '09

22 Oct '09

I've configured freeradius to authenticate local users with our AD. When I use simple username "barbato" it works perfectly, but if I use barbato(a)igi.cnr.it it fails. From log it seems that it's not stripped the realm/domain part after @: [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for barbato(a)igi.cnr.it with NT-Password [mschap] expand: --username=%{mschap:User-Name} -> --username=barbato(a)igi.cnr.it [mschap] mschap2: b9 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> -- challenge=4e0cb755e2e70d10 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt- response=a0e03bda2615311436749b892e3a741d7a8605a1037fcce1 Exec-Program output: Logon failure (0xc000006d) I use this line for radius.conf : ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=% {mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=% {mschap:NT-Response:-00}" and in proxy.conf realm igi.cnr.it { type = radius authhost = LOCAL accthost = LOCAL strip } Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

2 3