November 2009 - Freeradius-Users - lists.freeradius.org

RE: RE: Problems to do an SSID based authentication(tnt@kalik.net)
by Peter Carlstedt 17 Nov '09

17 Nov '09

> Hi Ivan! It worked! Woho! ^^ Thank you very much for your help =), of course alan to =) Now I will probably get a ton of more problems in my walk towards a good setup. =) Best regards/ Peter Carlstedt > >

1 0

Multiple forests
by John 17 Nov '09

17 Nov '09

Hi, We are using freeRADIUS-1.1.6 talk to active-directory (multiple DOMAINs: "A.com" and "sub.A.com"). We use rlm_ldap module Global catalog port to get attributes from ADs. It works fine. Now a forest(e.g. "B.com", "sub.B.com" ...) that is trust with domain "A.com". I can not get attributes from forest "B.com". How to get attribute from forest "B.com" ? Any commnet is welcome. Thanks. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 2

freeradius and openser
by toqeer ali 16 Nov '09

16 Nov '09

I am configuring Freeradius server with openser... By default there is openser dictionary file that the path of that file should be included in freeradius master dictionary file... now i am confuse that command $INCLUDE {path of the openser dictioanry file} how will i include that over the network in dictionary file of Freeradius... if i copy the openser dictionary to the same system of Freeradius and then include path then still it gives error . Bsically my openser and Freeradius are on diffrent systems Any clue ? -- Toqeer Ali Syed Red Hat Certified Engineer mob: +92 321 9059916

1 0

RE: RE: Problems to do an SSID based authentication
by Peter Carlstedt 16 Nov '09

16 Nov '09

> ------------------------------ > > Message: 3 > Date: Mon, 16 Nov 2009 10:03:22 +0000 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: Problems to do an SSID based authentication > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20091116100322.GB5662(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I am trying to do an SSID based authentication per user. > > What I mean is that i try in the users.conf file to check for which SSID the users is trying to use to login and if it is wrong it shall do an reject for that user. > > > > The problem is that i dont succeed with this so I thought it does not hurt to ask the ones who knows. > > My users.conf file looks like this: > > > Peter Cleartext-Password := "kaffe" , Called-Station-Id == "04-0B-6B-33-62-35:raket" > > Jens Cleartext-Password := "kaffe" , Called-Station-Id == "02-0B-6B-33-62-35:3" > > so Peter can only connect from 04-0B-6B-33-62-35:raket and > Jens can only get on from 02-0B-6B-33-62-35:3 ? > > okay - where is your log from 'radiusd -X' ? > > alan > > Hi Alan! The logs from my radius -X is following: rad_recv: Access-Request packet from host 192.168.118.10 port 42531, id=97, length=194 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x02020009014a656e73 Message-Authenticator = 0x12ec684d2cb511be9cf431ceeae1a5c8 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry Jens at line 92 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 97 to 192.168.118.10 port 42531 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b5e336db4711a92c3e7dc829 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 46429, id=98, length=316 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b5e336db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x0203007119800000006716030100620100005e03014b01325d9b7522753ffde3bdcb960b88f167535ca9ec96ffa88e3f5577fc7b4c000018002f00350005000ac013c014c009c00a00320038001300040100001d0000000900070000046a656e73000a0006000400170018000b00020100 Message-Authenticator = 0xbb5e04e25bd1a69911623d1fa6fc555e NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 113 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 103 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0062], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 98 to 192.168.118.10 port 46429 EAP-Message = 0x0104040019c00000089b160301002a0200002603014b013261232f65081c0647ecdd136d4ba6d37a900ca54c63b1b42d0f9f08ec7a00002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039313131313133323535335a170d3130313131313133323535335a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d5187e7bc255b26ddc283d48c5dcada8d45ed681856a7f9964de908c976390f87aae337b8f13cb67c519e95fbc0236cb71ce6cf1a0053a679a2fae47334b EAP-Message = 0xea63f5d29523c2f790377a0f7cb808d1074d9dfd6eb6edb07b4244089b2c50ffb516d69ad94a252aa72af8fa371165337209dd7a5bc0701ca910f54d0de7e8cf202bae28ebdf3b68682b2f1de412b1b59152b1b747187c9a2d97fcea02d853f59e0c311bc87629914ce11a408218ff0cf921a48bc972da546c99ebf0a566e3604700c2315631113c160eb770f7632f47ccec74feefeede6352656ad5c918b7ea13eb6f6e11fbe331be19d787a2f5e9b2a1cea1a353190c6b3736a45051e2be8bb0910203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010029d7cb5c38650e56d0 EAP-Message = 0xe1db3d87bb0b9a1a034fd23fdc928795988fae1c3b2d262a84fa06284b4a506ba315d584b6a6eed742d6e3e92f2df7194fa8b1c5f53a5d2f18f595eab97e219a024b5753a6ea48eabe8106c5c28ffb2b124c02bd19f56771f35014de4569e7f720951ded3033591943c853049bb4a245cef1270593e844e6e0a4d442023fa1cb17874b4f734963a6eece8ca51d5d253e539027eb5ef96eecb0c4d6163045767728dac1a444712e50bdba71ab058c09b35fbade6d3d30c779acfccca0e260cde86d2d15c4bffe47584863ad94965d3584805bce24d9228198b5c78b761fd3d6b89b25a2430c731ee485840ecbac95171a03f2b0d77346c40004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b4e436db4711a92c3e7dc829 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41440, id=99, length=209 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b4e436db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x020400061900 Message-Authenticator = 0xc16a7984a9f721ee6d94d31f7659a249 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 99 to 192.168.118.10 port 41440 EAP-Message = 0x010503fc194000a95ceefb4e6190af300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039313131313133323535335a170d3130313131313133323535335a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100a5e320972e46e5b85513eac3a27f6505180668b395d4ffdebbe5458f615bb40d7ee9ae7c614be07ef57a43ec1127f128b45d58221b60d1838612c614bb26c99fdbb8c08c2cc4ecaae11df4f657241eb6b8e7a8d0317d7e00f45f2f5bc50ce9e835d3b61101a0fbe8c989d012bf8d7b EAP-Message = 0x8cf31f35ca2bdc11512934f57fb4a9eb7e95b35e47b609b98a818fdeb8df415bd2574b9a907497521a446fd14969b20de542ae7abc809b56cf0e927b54b2a5519708125a38067897ffa35428799384416cb9028c0e777c6268009f696e67f2c747f9a7c09ef0cb3873ce6e22b148d43f0ad28018311d625f85820115d75358d0c7f79c534fff1552d8cde0e514b9b7554b0203010001a381fb3081f8301d0603551d0e041604148a192d95e8fb6f6ba1f6554ccf4e2bd534ff14143081c80603551d230481c03081bd80148a192d95e8fb6f6ba1f6554ccf4e2bd534ff1414a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a95ceefb4e6190af300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100a3ccd6974415ace1b6b6cce8b3c02dde0d00a6aee049f97c5a5e460849a40ef10e697d8a27e1b7c4bbe6122d145c9a7202d059a831c1563e973e76edb22c927d276199b16bba81a5a8301119debfc3957d9d EAP-Message = 0xba5e475db5bc4553 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b7e536db4711a92c3e7dc829 Finished request 3. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 40388, id=100, length=209 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b7e536db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x020500061900 Message-Authenticator = 0xde1528468a95c4082d87b885c07692c0 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 100 to 192.168.118.10 port 40388 EAP-Message = 0x010600b519003ed1cdfb8ce78c8b13e8c9d49553950dba115cafd7a3d3b93b0811bcc48f642f85e57b50ef7e8b45884e991ed7d0c7c69974877b6a931e94e2b1c18241af3f56e898cdb6bf5694cf634aaed5728ab48884f93efe217772425cb71b9be6cf27aaea718f270d33593165e215533f99daf1e5a542c9052a6ecb35ccfcdd4a4c02d7d8d6d2baa96840f6498c506d054bd3023a6c1f719d133364e1eeea225c9724dc6dba0de411f816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b6e636db4711a92c3e7dc829 Finished request 4. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 49250, id=101, length=541 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b6e636db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x02060150198000000146160301010610000102010010da40c2277f97a716be9418364b5d036b2a1a438427372a3179fcb8f45d4f59e8f81cc24e5c03785cdd6e7e33b9472c294099bb429c2c07045b19bbff7ae2743f3ed3fa2a34a011e574d64f397990cc9cb3e308d556f4120545fd635471309e8f45b67549279c41e73bb92e817d67172a6b15b0c8da5118469fa5bcd4539916582b4dd8e678da06deeddf6bcede7de238449c9601f1efce3f23e9534c68e2a897d705e32f388f7ea3412ab5b90e85c6b508d2f04eb257e22b5c39f7fafef009a921184fbf1193c173fcb3c656cc93ee6f668c60f2fedb92897e0d558f49d8d656c76acd0a28a5a9 EAP-Message = 0x7a95a196ccf65f220a7130f1a338a8509b848359491e67d11403010001011603010030c85bc66fdd1fc7aef16588704d5a25cdca879ac3585be0e73d728e1aa18bb4cb2b6a5f030a417088af50b29ab56d3fc5 Message-Authenticator = 0xc3a9938ec998ab0398c5709115ad2bdf NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 101 to 192.168.118.10 port 49250 EAP-Message = 0x0107004119001403010001011603010030f5dceab2b5b355a2312fe20092d891872280be1ba05a477e51657ccadb327d91249380718ec8a006eb278245f449ed2d Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b1e736db4711a92c3e7dc829 Finished request 5. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41427, id=102, length=209 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b1e736db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x020700061900 Message-Authenticator = 0x77f82d817673e2f1d72bdf70771fe83d NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 102 to 192.168.118.10 port 41427 EAP-Message = 0x0108002b1900170301002006e1b5d62349a17609d76b94114fff9f2c956820f402a63434ebe33c0ab23254 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b0e836db4711a92c3e7dc829 Finished request 6. Going to the next request Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 46562, id=103, length=246 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b0e836db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x0208002b19001703010020cbfe496129842adde6abe7771cdf82d089fab1b8692359688c355d1abd7fe18d Message-Authenticator = 0x51bd0d083ea0991de4ba0666c3bf3f7d NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - Jens [peap] Got tunneled request EAP-Message = 0x02080009014a656e73 server { PEAP: Got tunneled identity of Jens PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to Jens Sending tunneled request EAP-Message = 0x02080009014a656e73 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Jens" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 222 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Reject Auth-Type = Reject, rejecting user Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 103 to 192.168.118.10 port 46562 EAP-Message = 0x0109002b19001703010020f22961f4b8fc8ef302e9d02a6ff60318dc7009c8c6b95edda5d0b74179b60ba9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb5e02fd1b3e936db4711a92c3e7dc829 Finished request 7. Going to the next request Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41030, id=104, length=246 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0xb5e02fd1b3e936db4711a92c3e7dc829 Acct-Session-Id = "82200128" Acct-Multi-Session-Id = "02-0B-6B-33-62-35-00-26-BB-14-50-CF-82-20-00-00-00-00-01-10" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x0209002b1900170301002049d78ce8e977e9c3a54ef1cb5206e2f30a857981ca29de1d574ae788718f8397 Message-Authenticator = 0x10d7ce191f17a6482ce049589e279cd0 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Jens attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41030, id=104, length=246 Waiting to send Access-Reject to client 192.168.118.0/24 port 41030 - ID: 104 Waking up in 0.6 seconds. rad_recv: Access-Request packet from host 192.168.118.10 port 41030, id=104, length=246 Waiting to send Access-Reject to client 192.168.118.0/24 port 41030 - ID: 104 Waking up in 0.3 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 104 to 192.168.118.10 port 41030 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.0 seconds. Cleaning up request 1 ID 97 with timestamp +46 Cleaning up request 2 ID 98 with timestamp +46 Waking up in 0.1 seconds. Cleaning up request 3 ID 99 with timestamp +46 Waking up in 0.2 seconds. Cleaning up request 4 ID 100 with timestamp +47 Waking up in 0.1 seconds. Cleaning up request 5 ID 101 with timestamp +47 Waking up in 0.1 seconds. Cleaning up request 6 ID 102 with timestamp +47 Cleaning up request 7 ID 103 with timestamp +47 Waking up in 1.0 seconds. To be able to get the log from start I had to stop the radius server while the windows machine tried to do to a authorization a second time since it does it three times before it accepts the fact it can't authorize. Best regards/ Peter > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 55, Issue 68 > ************************************************ _________________________________________________________________ Windows Live: Keep your friends up to date with what you do online. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

Re: FreeRADIUS + Postgresql dies unexpectedly
by Duarte Fonseca 16 Nov '09

16 Nov '09

Hi Alan, Thanks for the advice, I've tried the same test with radiusd -f and here are the results Some runs just produce this: # radiusd -f Segmentation fault Others produce a more verbose output, hope it helps: # radiusd -f *** glibc detected *** radiusd: double free or corruption (fasttop): 0x09143220 *** ======= Backtrace: ========= /lib/libc.so.6[0x3c50f1] /lib/libc.so.6(cfree+0x90)[0x3c8bc0] /lib/libcrypto.so.6(CRYPTO_free+0x3a)[0x2a7a5a] /lib/libcrypto.so.6(X509_VERIFY_PARAM_free+0x29)[0x26c029] /lib/libssl.so.6(SSL_free+0x64)[0x13b8b4] /usr/lib/libpq.so.4[0xfdc4e9] /usr/lib/libpq.so.4(pqReadData+0x1da)[0xfd46ba] /usr/lib/libpq.so.4(PQgetResult+0xa0)[0xfd3180] /usr/lib/libpq.so.4[0xfd3348] /usr/lib/libpq.so.4(PQexec+0x27)[0xfd35e7] /usr/lib/freeradius/rlm_sql_postgresql.so[0x18e7bf] /usr/lib/freeradius/rlm_sql.so(rlm_sql_query+0x52)[0xa6b2e2] /usr/lib/freeradius/rlm_sql.so[0xa68a96] radiusd(modcall+0x94e)[0x8062dfe] radiusd(indexed_modcall+0xa5)[0x805fa65] radiusd(module_accounting+0x2c)[0x805fd4c] radiusd(rad_accounting+0xab)[0x804df9b] radiusd(radius_handle_request+0x65)[0x806e4d5] radiusd[0x8066065] /lib/libpthread.so.0[0xd1949b] /lib/libc.so.6(clone+0x5e)[0x42d42e] ======= Memory map: ======== 00110000-00153000 r-xp 00000000 08:02 6291673 /lib/libssl.so.0.9.8e 00153000-00157000 rwxp 00042000 08:02 6291673 /lib/libssl.so.0.9.8e 00157000-00183000 r-xp 00000000 08:02 8986736 /usr/lib/libgssapi_krb5.so.2.2 00183000-00184000 rwxp 0002c000 08:02 8986736 /usr/lib/libgssapi_krb5.so.2.2 00184000-00186000 r-xp 00000000 08:02 6291658 /lib/libcom_err.so.2.1 00186000-00187000 rwxp 00001000 08:02 6291658 /lib/libcom_err.so.2.1 00187000-00189000 r-xp 00000000 08:02 6291546 /lib/libkeyutils-1.2.so 00189000-0018a000 rwxp 00001000 08:02 6291546 /lib/libkeyutils-1.2.so 0018a000-0018c000 r-xp 00000000 08:02 9085015 /usr/lib/freeradius/rlm_acct_unique-2.1.7.so 0018c000-0018d000 rwxp 00001000 08:02 9085015 /usr/lib/freeradius/rlm_acct_unique-2.1.7.so 0018d000-00191000 r-xp 00000000 08:02 9085105 /usr/lib/freeradius/rlm_sql_postgresql-2.1.7.so 00191000-00192000 rwxp 00004000 08:02 9085105 /usr/lib/freeradius/rlm_sql_postgresql-2.1.7.so 00194000-0019d000 r-xp 00000000 08:02 6291484 /lib/libcrypt-2.5.so 0019d000-0019e000 r-xp 00008000 08:02 6291484 /lib/libcrypt-2.5.so 0019e000-0019f000 rwxp 00009000 08:02 6291484 /lib/libcrypt-2.5.so 0019f000-001c6000 rwxp 0019f000 00:00 0 001d4000-001d5000 r-xp 001d4000 00:00 0 [vdso] 001d5000-002ff000 r-xp 00000000 08:02 6291671 /lib/libcrypto.so.0.9.8e 002ff000-00312000 rwxp 00129000 08:02 6291671 /lib/libcrypto.so.0.9.8e 00312000-00316000 rwxp 00312000 00:00 0 00316000-00328000 r-xp 00000000 08:02 8984623 /usr/lib/libz.so.1.2.3 00328000-00329000 rwxp 00011000 08:02 8984623 /usr/lib/libz.so.1.2.3 00345000-00358000 r-xp 00000000 08:02 6291490 /lib/libnsl-2.5.so 00358000-00359000 r-xp 00012000 08:02 6291490 /lib/libnsl-2.5.so 00359000-0035a000 rwxp 00013000 08:02 6291490 /lib/libnsl-2.5.so 0035a000-0035c000 rwxp 0035a000 00:00 0 0035c000-0049a000 r-xp 00000000 08:02 6291480 /lib/libc-2.5.so 0049a000-0049c000 r-xp 0013e000 08:02 6291480 /lib/libc-2.5.so 0049c000-0049d000 rwxp 00140000 08:02 6291480 /lib/libc-2.5.so 0049d000-004a0000 rwxp 0049d000 00:00 0 004a0000-00533000 r-xp 00000000 08:02 8986750 /usr/lib/libkrb5.so.3.3 00533000-00536000 rwxp 00092000 08:02 8986750 /usr/lib/libkrb5.so.3.3 00640000-0065a000 r-xp 00000000 08:02 6291473 /lib/ld-2.5.so 0065a000-0065b000 r-xp 00019000 08:02 6291473 /lib/ld-2.5.so 0065b000-0065c000 rwxp 0001a000 08:02 6291473 /lib/ld-2.5.so 006b9000-006c8000 r-xp 00000000 08:02 6291506 /lib/libresolv-2.5.so 006c8000-006c9000 r-xp 0000e000 08:02 6291506 /lib/libresolv-2.5.so 006c9000-006ca000 rwxp 0000f000 08:02 6291506 /lib/libresolv-2.5.so 006ca000-006cc000 rwxp 006ca000 00:00 0 006f4000-006f6000 r-xp 00000000 08:02 9085067 /usr/lib/freeradius/rlm_files-2.1.7.so 006f6000-006f7000 rwxp 00001000 08:02 9085067 /usr/lib/freeradius/rlm_files-2.1.7.so 00753000-00769000 r-xp 00000000 08:02 6291646 /lib/libselinux.so.1 00769000-0076b000 rwxp 00015000 08:02 6291646 /lib/libselinux.so.1 00787000-00792000 r-xp 00000000 08:02 6291458 Aborted # radiusd -f *** glibc detected *** radiusd: double free or corruption (fasttop): 0x0993eeb0 *** ======= Backtrace: ========= /lib/libc.so.6[0x1790f1] /lib/libc.so.6(cfree+0x90)[0x17cbc0] /lib/libcrypto.so.6(CRYPTO_free+0x3a)[0x483a5a] /lib/libcrypto.so.6(X509_VERIFY_PARAM_free+0x29)[0x448029] /lib/libssl.so.6(SSL_free+0x64)[0xede8b4] /usr/lib/libpq.so.4[0x3a14e9] /usr/lib/libpq.so.4(pqReadData+0x1da)[0x3996ba] /usr/lib/libpq.so.4(PQgetResult+0xa0)[0x398180] /usr/lib/libpq.so.4[0x39828c] /usr/lib/freeradius/rlm_sql_postgresql.so[0x3887bf] /usr/lib/freeradius/rlm_sql.so(rlm_sql_query+0x52)[0x9e82e2] /usr/lib/freeradius/rlm_sql.so[0x9e5c3b] radiusd(modcall+0x94e)[0x8062dfe] radiusd(indexed_modcall+0xa5)[0x805fa65] radiusd(module_accounting+0x2c)[0x805fd4c] radiusd(rad_accounting+0xab)[0x804df9b] radiusd(radius_handle_request+0x65)[0x806e4d5] radiusd[0x8066065] /lib/libpthread.so.0[0xdc449b] /lib/libc.so.6(clone+0x5e)[0x1e142e] ======= Memory map: ======== 00110000-0024e000 r-xp 00000000 08:02 6291480 /lib/libc-2.5.so 0024e000-00250000 r-xp 0013e000 08:02 6291480 /lib/libc-2.5.so 00250000-00251000 rwxp 00140000 08:02 6291480 /lib/libc-2.5.so 00251000-00254000 rwxp 00251000 00:00 0 00254000-00279000 r-xp 00000000 08:02 8986740 /usr/lib/libk5crypto.so.3.1 00279000-0027a000 rwxp 00025000 08:02 8986740 /usr/lib/libk5crypto.so.3.1 0027a000-00290000 r-xp 00000000 08:02 6291646 /lib/libselinux.so.1 00290000-00292000 rwxp 00015000 08:02 6291646 /lib/libselinux.so.1 00292000-00294000 r-xp 00000000 08:02 9085067 /usr/lib/freeradius/rlm_files-2.1.7.so 00294000-00295000 rwxp 00001000 08:02 9085067 /usr/lib/freeradius/rlm_files-2.1.7.so 00298000-002a7000 r-xp 00000000 08:02 6291506 /lib/libresolv-2.5.so 002a7000-002a8000 r-xp 0000e000 08:02 6291506 /lib/libresolv-2.5.so 002a8000-002a9000 rwxp 0000f000 08:02 6291506 /lib/libresolv-2.5.so 002a9000-002ab000 rwxp 002a9000 00:00 0 002ab000-0033e000 r-xp 00000000 08:02 8986750 /usr/lib/libkrb5.so.3.3 0033e000-00341000 rwxp 00092000 08:02 8986750 /usr/lib/libkrb5.so.3.3 00341000-0037c000 r-xp 00000000 08:02 6291555 /lib/libsepol.so.1 0037c000-0037d000 rwxp 0003a000 08:02 6291555 /lib/libsepol.so.1 0037d000-00387000 rwxp 0037d000 00:00 0 00387000-0038b000 r-xp 00000000 08:02 9085105 /usr/lib/freeradius/rlm_sql_postgresql-2.1.7.so 0038b000-0038c000 rwxp 00004000 08:02 9085105 /usr/lib/freeradius/rlm_sql_postgresql-2.1.7.so 0038c000-003ab000 r-xp 00000000 08:02 8986821 /usr/lib/libpq.so.4.1 003ab000-003ac000 rwxp 0001f000 08:02 8986821 /usr/lib/libpq.so.4.1 003b1000-004db000 r-xp 00000000 08:02 6291671 /lib/libcrypto.so.0.9.8e 004db000-004ee000 rwxp 00129000 08:02 6291671 /lib/libcrypto.so.0.9.8e 004ee000-004f2000 rwxp 004ee000 00:00 0 004f2000-004fd000 r-xp 00000000 08:02 6291458 /lib/libgcc_s-4.1.2-20080825.so.1 004fd000-004fe000 rwxp 0000a000 08:02 6291458 /lib/libgcc_s-4.1.2-20080825.so.1 0050a000-00510000 r-xp 00000000 08:02 8985722 /usr/lib/libltdl.so.3.1.4 00510000-00511000 rwxp 00005000 08:02 8985722 /usr/lib/libltdl.so.3.1.4 00527000-00539000 r-xp 00000000 08:02 8984623 /usr/lib/libz.so.1.2.3 00539000-0053a000 rwxp 00011000 08:02 8984623 /usr/lib/libz.so.1.2.3 005bd000-005c5000 r-xp 00000000 08:02 8986752 /usr/lib/libkrb5support.so.0.1 005c5000-005c6000 rwxp 00007000 08:02 8986752 /usr/lib/libkrb5support.so.0.1 00769000-00772000 r-xp 00000000 08:02 6291484 /lib/libcrypt-2.5.so 00772000-00773000 r-xp 00008000 08:02 6291484 /lib/libcrypt-2.5.so 00773000-00774000 rwxp 00009000 08:02 6291484 /lib/libcrypt-2.5.so 00774000-0079b000 rwxp 00774000 00:00 0 0081d000-0081f000 r-xp 00000000 08:02 9085095 /usr/lib/freeradius/rlm_sql_log-2.1.7.so 0081f000-00820000 rwxp 00001000 08:02 9085095 /usr/lib/freeradius/rlm_sql_log-2.1.7.so 0083c000-0083d000 r-xp 0083c000 00:00 0 [vdso] 00868000-00894000 r-xp 00000000 08:02 8986736 /usr/lib/libgssapi_krb5.so.2.2 00894000-00895000 rwxp 0002c000 08:02 8986736 /usr/lib/libgssapi_krb5.so.2.2 009c2000-009d5000 r-xp 00000000 08:02 6291490 /lib/libnsl-2.5.so 009d5000-009d6000 r-xp 00012000 08:02 6291490 /lib/libnsl-2.5.so 009d6000-009d7000 rwxp 00013000 08:02 6291490 /lib/libnsl-2.5.so 009d7000-009d9000 rwxp 009d7000 00:00 0 009e3000-009eb000 r-xp 00000000 08:02 9085093 /usr/lib/freeradius/rlm_sql-2.1.7.so 009eb000-009ec000 rwxp 00007000 08:02 9085093 /usr/lib/freeradius/rlm_sql-2.1.7.so 00b28000-00b2a000 r-xp 00000000 08:02 6291546 /lib/libkeyutils-1.2.so 00b2a000-00b2b000 rwxp 00001000 08:02 6291546 /lib/libkeyutils-1.2.so 00c42000-00c44000 r-xp 00000000 08:02 9085059 /usr/lib/freeradius/rlm_exec-2.1.7.so 00c44000-00c45000 rwxp 00001000 08:02 9085059 /usr/lib/freeradius/rlm_exec-2.1.7.so 00c89000-00c8b000 r-xp 00000000 08:02 6291486 /lib/libdl-2.5.so 00c8b000-00c8c000 r-xp 00001000 08:02 6291486 /lib/libdl-2.5.so 00c8c000-00c8d000 rwxp 00002000 08:02 6291486 /lib/libdl-2.5.so 00caf000-00cc9000 r-xp 00000000 08:02 6291473 /lib/ld-2.5.so 00cc9000-00cca000 r-xp 00019000 08:02 6291473 /lib/ld-2.5.so 00cca000-00ccb000 rwxp 0001a000 08:02 6291473 /lib/ld-2.5.so 00cfd000-00cff000 r-xp 00000000 08:02 9085015 /usr/lib/freeradius/rlm_acct_unique-2.1.7.so 00cff000-00d00000 rwxp 00001000 08:02 9085015 /usr/lib/freeradius/rlm_acct_unique-2.1.7.so 00d5a000-00d63000 r-xp 00000000 08:02 6291496 /lib/libnss_files-2.5.so 00d63000-00d64000 r-xp 00008000 08:02 6291496 /lib/libnss_files-2.5.so 00d64000-00d65000 rwxp 00009000 08:02 6291496 /lib/libnss_files-2.5.so 00dbf000-00dd2000 r-xp 00000000 08:02 6291504 /lib/libpthread-2.5.so 00dd2000-00dd3000 r-xp 00012000 08:02 6291504 /lib/libpthread-2.5.so 00dd3000-00dd4000 rwxp 00013000 08:02 6291504 /lib/libpthread-2.5.so 00dd4000-00dd6000 rwxp 00dd4000 00:00 0 00e6d000-00e8d000 r-xp 00000000 08:02 9080245 /usr/lib/freeradius/libfreeradius-radius-2.1.7.so 00e8d000-00e8e000 rwxp 00020000 08:02 9080245 /usr/lib/freeradius/libfreeradius-radius-2.1.7.so 00e8e000-00e8f000 rwxp 00e8e000 00:00 0 00eb3000-00ef6000 r-xp 00000000 08:02 6291673 /lib/libssl.so.0.9.8e 00ef6000-00efa000 rwxp 00042000 08:02 6291673 /lib/libssl.so.0.9.8e 00f94000-00f96000 r-xp 00000000 08:02 6291658 /lib/libcom_err.so.2.1 00f96000-00f97000 rwxp 00001000 08:02 6291658 /lib/libcom_err.so.2.1 08048000-08085000 r-xp 00000000 08:02 8988421 /usr/sbin/radiusd 08085000-08087000 rw-p 0003d000 08:02 8988421 /usr/sbin/radiusd 08087000-08088000 rw-p 08087000 00:00 0 0978e000-0a07d000 rw-p 0978e000 00:00 0 [heap] b19fb000-b19fc000 ---p b19fb000 00:00 0 b19fc000-b23fc000 rw-p b19fc000 00:00 0 b23fc000-b23fd000 ---p b23fc000 00:00 0 b23fd000-b2dfd000 rw-p b23fd000 00:00 0 b2dfd000-b2dfe000 ---p b2dfd000 00:00 0 b2dfe000-b37fe000 rw-p b2dfe000 00:00 0 b37fe000-b37ff000 ---p b37fe000 00:00 0 b37ff000-b41ff000 rw-p b37ff000 00:00 0 b41ff000-b4200000 ---p b41ff000 00:00 0 b4200000-b4c22000 rw-p b4200000 00:00 0 b4c22000-b4d00000 ---p b4c22000 00:00 0 b4dd9000-b4dda000 ---p b4dd9000 00:00 0 b4dda000-b57da000 rw-p b4dda000 00:00 0 b57da000-b57db000 ---p b57da000 00:00 0 b57db000-b61db000 rw-p b57db000 00:00 0 b61db000-b61dc000 ---p b61db000 00:00 0 b61dc000-b6bdc000 rw-p b61dc000 00:00 0 b6bdc000-b6bdd000 ---p b6bdc000 00:00 0 b6bdd000-b75dd000 rw-p b6bdd000 00:00 0 b75dd000-b75de000 ---p b75dd000 00:00 0 b75de000-b7fe3000 rw-p b75de000 00:00 0 b7fe7000-b7fe8000 rw-p b7fe7000 00:00 0 bf842000-bf858000 rw-p bffe9000 00:00 0 [stack] Aborted Also in my postgresql log i see the following when radiusd dies <2009-10-23 11:01:40.167 BST> LOG: SSL error: wrong version number <2009-10-23 11:01:40.167 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.167 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.169 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.169 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.169 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.169 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.170 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.170 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.170 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.170 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.175 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.175 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.175 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.175 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.176 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.176 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.176 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.176 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.175 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.177 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.177 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.177 BST> LOG: unexpected EOF on client connection <2009-10-23 11:01:40.178 BST> LOG: could not receive data from client: Connection reset by peer <2009-10-23 11:01:40.178 BST> LOG: unexpected EOF on client connection The message regarding SSL seems to alternate between the follwoing: LOG: SSL error: wrong version number LOG: could not accept SSL connection: EOF detected LOG: SSL error: decryption failed or bad record mac LOG: SSL error: block cipher pad is wrong In my radius.log i've noticed a couple of times there are some postgresql errors Fri Oct 23 11:18:08 2009 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Fri Oct 23 11:18:08 2009 : Info: rlm_sql (sql): Attempting to connect to postgres@localhost:/gapdb Fri Oct 23 11:18:08 2009 : Info: Loaded virtual server <default> Fri Oct 23 11:18:08 2009 : Info: Ready to process requests. Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'JoePublic7', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: rlm_sql_postgresql: PostgreSQL Query failed Error: Fri Oct 23 11:18:16 2009 : Error: rlm_sql_postgresql: Socket not connected Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:18:16 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:02 2009 : Info: rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Fri Oct 23 11:19:02 2009 : Info: rlm_sql (sql): Attempting to connect to postgres@localhost:/gapdb Fri Oct 23 11:19:02 2009 : Info: Loaded virtual server <default> Fri Oct 23 11:19:02 2009 : Info: Ready to process requests. Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'JoePublic7', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user '001f3b887d19', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user '001f3b887d19', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: [sql] stop packet with zero session length. [user 'admin', nas '172.20.200.226'] Fri Oct 23 11:19:05 2009 : Error: rlm_sql_postgresql: PostgreSQL Query failed Error: SSL SYSCALL error: Resource temporarily unavailable I've also setup a sql_log module to capture the sql queries being performed and later ran that sql succesfully with the command: # psql -h 127.0.0.1 -U postgres gapdb < /var/log/radius/radacct/sql-relay Again thank you for the help, hope this helps. Cheers, Duarte On 22/10/2009 18:17, "Alan DeKok" <aland(a)deployingradius.com> wrote: > Duarte Fonseca wrote: >> I've got a freeRadius (v2.1.7) install running on CentOs using >> postgresql to store accounting data and have noticed that occasionally >> freeRadius seems to die unexpectedly. > > See doc/bugs. You can run the server in foreground mode (radiusd -f), > too. > > If it dies after a few packets, the problem should be pretty simple to > find && fix. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

4 18

Re: FR2.1.3+LDAP+802.1x+PEAP
by Caius 16 Nov '09

16 Nov '09

Hi Alan, thank you for your answer, that page/table was awesome regarding your tips: a) i dont wanna do, maybe if i have no other choice, ill have 2 password attributes SSHA+NTLM, but its a clear no to clear-text, and a maybe to NT hash b) need it, so not gonna happen so, as i need to proceed further with my investigation, what are my options really? :D i was thinking at the following: to do the normal user authentication in LDAP, based on the provided realm, and if no realm present authenticate the users in users file. Users which use 802.1x will be saved in clear-text in users file and users used for authentication for other stuff, will be checked in LDAP (@mydomain.com) or can i switch this around? a user: myuser(a)dot1x.com will be based on the real authenticated in users file for 802.1x and a user with no realm will be authenticated in LDAP? please tell me your opinion on this, is it possible? Thanks & Best Regards, Caius Pargar

4 13

Problems to do an SSID based authentication
by Peter Carlstedt 16 Nov '09

16 Nov '09

Hello everyone! I am trying to do an SSID based authentication per user. What I mean is that i try in the users.conf file to check for which SSID the users is trying to use to login and if it is wrong it shall do an reject for that user. The problem is that i dont succeed with this so I thought it does not hurt to ask the ones who knows. My users.conf file looks like this: #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # #steve Cleartext-Password := "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP Peter Cleartext-Password := "kaffe" , Called-Station-Id == "04-0B-6B-33-62-35:raket" # Tunnel-Type = VLAN, # Tunnel-Medium-Type = IEEE-802, # Tunnel-Private-Group-Id = 2 Jens Cleartext-Password := "kaffe" , Called-Station-Id == "02-0B-6B-33-62-35:3" # Tunnel-Type = VLAN, # Tunnel-Medium-Type = IEEE-802, # Tunnel-Private-Group-Id = 3 # NAS-Port-Id == "wlan1" Mattias user-password := "kaffe" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 1 # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # #"John Doe" Cleartext-Password := "hello" # Reply-Message = "Hello, %{User-Name}" # # Dial user back and telnet to the default host for that port # #Deg Cleartext-Password := "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Cleartext-Password := "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # using the default method, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell" # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Sample defaults for all framed connections. # #DEFAULT Service-Type == Framed-User # Framed-IP-Address = 255.255.255.254, # Framed-MTU = 576, # Service-Type = Framed-User, # Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Administrative-User # On no match, the user is denied access. DEFAULT Auth-Type := Reject Is there any wrong with my users file? What happens when I try to authenticate with an Windows machine? i get rejected and it dont matter which SSID im logging into. What happens when I try to authenticate with an Mac OSX machine? I get rejected but succeed anyway in getting into the network. Best regards/ Peter > From: freeradius-users-request(a)lists.freeradius.org > Subject: Freeradius-Users Digest, Vol 55, Issue 65 > To: freeradius-users(a)lists.freeradius.org > Date: Mon, 16 Nov 2009 09:40:46 +0100 > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: usergroup and radgroupcheck problem! (Hamid Reza Hasani) > 2. Re: DHCP in FR (Alan DeKok) > 3. Re: DHCP in FR (Kassai Istvan) > 4. Re: DHCP in FR (Alan DeKok) > 5. Re: Crash due to fr_packet_cmp (Alan DeKok) > 6. Re: DHCP in FR (Kassai Istvan) > 7. Co-existing of tls and ttls configuration (Koichi Yagishita) > 8. Re: Co-existing of tls and ttls configuration (Alan DeKok) > 9. Re: Problem with template.conf in proxy.conf (Ana Gallardo) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 15 Nov 2009 16:14:45 +0330 > From: Hamid Reza Hasani <hr.hasani(a)gmail.com> > Subject: Re: usergroup and radgroupcheck problem! > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <33b9c8d70911150444vd250018h6c51b5cbe8e58617(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hi,(salaam) > Thanks for your help, But I solved the problem and I changed the > radgroupcheck query so it get groupname from usergroup table and then > compare it! I think I have a better solution, isn't it? > > BTW thank for your help, please inform me if you know why this problem > exist? is it a bug? > > Ya Ali > Hamid Reza Hasani >

2 1

Re: Freeradius-Users Digest, Vol 55, Issue 65
by Gilbert Lo 16 Nov '09

16 Nov '09

Thank you for your message. I am away until Nov 19th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

Problem with template.conf in proxy.conf
by Ana Gallardo 16 Nov '09

16 Nov '09

Hello I'm using Freeradius 2.04-3 in Debian. I'm using a home-server template defined in template.conf: ### /etc/freeradius/templates.conf templates { home_server { response_window = 20 zombie_period = 40 revive_interval = 120 } home_server tld-rediris { type = auth+acct port = 1812 secret = XXX response_window = 20 zombie_period = 40 revive_interval = 60 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } } ### /etc/freeradius/proxy.conf home_server tld-rediris1 { template = tld-rediris ipaddr = ZZZ } home_server tld-rediris2 { template = tld-rediris ipaddr = YYY } But Freeradius doesn't run: /etc/freeradius# freeradius -X Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/templates.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/ldap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary ... home_server tld-rediris1 { ipaddr = ZZZ port = 0 response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } /etc/freeradius/proxy.conf[27]: No port, or invalid port defined for home server tld-rediris1. Thank you very much. -- ____________________ Ana Gallardo Gómez ____________________

2 4

Co-existing of tls and ttls configuration
by Koichi Yagishita 16 Nov '09

16 Nov '09

Dear All, Can I coexist eap tls and ttls configuration in a freeradius? If yes, please let me know of the configuration. Regards, Yagishita

2 1