November 2009 - Freeradius-Users - lists.freeradius.org

Process radiusd won't start after installation (Solaris 10)
by Nereida Bernal 26 Nov '09

26 Nov '09

SO: Solaris 10 Version: 2.1.7 Hi all! I installed freeradius on my server following the instructions in the INSTALL file. After the "make install" I tried to start the radiusd process in debug mode but I got the following error: bash-3.00# /usr/local/sbin/radiusd -X ld.so.1: radiusd: fatal: libgcc_s.so.1: open failed: No such file or directory Killed I looked for the missing file in the server but none of them worked bash-3.00# find / -name libgcc_s.so.1 /usr/lib/AdobeReader/Adobe/Reader8/Reader/sparcsolaris/lib/libgcc_s.so.1 /usr/sfw/lib/sparcv9/libgcc_s.so.1 /usr/sfw/lib/libgcc_s.so.1 /usr/local/lib/libgcc_s.so.1 /usr/local/lib/sparcv9/libgcc_s.so.1 If you need the installation logs please let me know, I am new with the freeRADIUS I hope you can help me with this. Regards

1 1

Unexpected "Exiting normally" 2.1.8?
by Craig Campbell 26 Nov '09

26 Nov '09

I'm running an unreleased '"development?" version of freeradius (2.1.8?). So far it is working well, but it is terminating for reasons I cannot determine. The log contains the following, Mon Oct 26 15:48:57 2009 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Oct 26 15:48:57 2009 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:/radius Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Oct 26 15:48:57 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Oct 26 15:48:57 2009 : Info: Loaded virtual server inner-tunnel Mon Oct 26 15:48:57 2009 : Info: Loaded virtual server copy-acct-to-home-server Mon Oct 26 15:48:57 2009 : Info: Loaded virtual server copy-acct-to-radius-c Mon Oct 26 15:48:57 2009 : Info: Loaded virtual server <default> Mon Oct 26 15:48:57 2009 : Info: Ready to process requests. Mon Oct 26 17:57:33 2009 : Error: PROXY: Marking home server 192.168.1.226 port 1813 as zombie (it looks like it is dead). Mon Oct 26 17:58:13 2009 : Info: PROXY: Marking home server 192.168.1.226 port 1813 as dead. Mon Oct 26 20:05:36 2009 : Info: Exiting normally. The zombie messages are suspicious, since neither host is experiencing any significant load. (The zombie server is also 2.1.8. There is a 2.1.7 server as well NOT being zombied..) The exit message is much later, but no hint as to WHY it is exiting normally. Any hints would be greatly appreciated. Thanks, -craig -------------------------------------------------------------------------------- Craig Campbell craig.campbell(a)ccraft.ca CampbellCraft Consulting Inc 2 Kenny Court Whitby, Ontario Canada L1R 2L8 905 922-2789 __________ Information from ESET Smart Security, version of virus signature database 4546 (20091027) __________ The message was checked by ESET Smart Security. http://www.eset.com

4 40

Force CA validation
by Fernando Calvelo Vazquez 26 Nov '09

26 Nov '09

How can I force the CA validation on a EAP-TTLS configuration. If in my Windows-Supplicant software I select the CA validation, it works. But if remove it, and I use only the User-Credentials Authentication part... it works also. I would like to force that the CA certification Authentication part must be mandatory also. (I'm using windows-supplicant software with EAP-TTLS method) Thanks in advance, Swatzy.

4 3

Re: Exec and ntlm_auth
by freeradius＠corwyn.net 26 Nov '09

26 Nov '09

At 02:54 PM 11/25/2009, you wrote: >Just make it anothe file in the modules directory (like all the others). >Any file placed in that directory is authomatically included as a module. Can you provide an example of that file? Also, on the web page for AD config it has: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" the "-" is bolded in the NT-Domain such that it indicates that it should be replaced, but should it be --domain=%{mschap:NT-Domain:example.com} or --domain=%{mschap:NT-Domain:-example.com} Rick

5 8

DHCP-Relay-Agent-Information in reply
by Alexandr Sviridov 26 Nov '09

26 Nov '09

Hello I'm playing with freeradius dhcp support, and get the following problem. Freeradius 2.1.7, option 82, for dhcp snooping to work I have not only get DHCP-Relay-Agent-Information (option 82) in request but send it back to dhcp relay. Just test examle (radiusd in debug mode): DHCP-Discover: DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet ...skip... DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Relay-Agent-Information = 0x010600040001000202080006001e589e836f DHCP-Offer: Sending DHCP-Offer of id 69dd544f from 1.1.1.1:67 to 1.1.1.2:67 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet ...skip... DHCP-IP-Address-Lease-Time = 3600 DHCP-Relay-Agent-Information = 0x010600040001000202080006001e589e836f So far, so good, but tcpdump shows me: DHCP-Discover: Agent-Information Option 82, length 18: Circuit-ID SubOption 1, length 6: \000\004\000\001\000\002 Unknown SubOption 2, length 8: 0x0000: 0006 001e 589e 836f DHCP-Offer: Agent-Information Option 82, length 20: Unknown SubOption 0, length 18: So as I can see option 82 length is 20 instead of 18. Why? -- Alexandr Sviridov

2 2

Acct-Unique-Session-Id not unique!
by Vega Freeradius 26 Nov '09

26 Nov '09

Hi! Forgive me for by bad English. I've some problem with acctuniqueid. I use two freeradius server with two node mysql cluster. My freeradius version is "2.0.5". On both server threre is the same config. The modules/acct_unique content on both server is set to default: acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } But servers generate two different "uniqueid" from the same data! this is the START record (issued by first server) Thu Nov 26 15:00:45 2009 Acct-Status-Type = Start User-Name = "studioss(a)d.gbnetc.it" NAS-Identifier = "r-nl035" Acct-Session-Id = "erx atm 1/3.10083:1.83:0148107119" NAS-IP-Address = 217.141.253.49 Framed-IP-Address = 79.34.44.195 NAS-Port = 318832723 NAS-Port-Id = "atm 1/3.10083:1.83" Acct-Unique-Session-Id = "40f5c1e75a777864" this is the STOP record (issued by second server) Thu Nov 26 15:39:00 2009 Acct-Status-Type = Stop User-Name = "studioss(a)d.gbnetc.it" NAS-Identifier = "r-nl035" Acct-Session-Id = "erx atm 1/3.10083:1.83:0148107119" NAS-IP-Address = 217.141.253.49 Framed-IP-Address = 79.34.44.195 NAS-Port = 318832723 NAS-Port-Id = "atm 1/3.10083:1.83" Acct-Unique-Session-Id = "fb963455e99b780c" I delete some data before post it here. I see that User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port ar the same on both record. But Acct-Unique-Session-Id is different!!!! How this could be ? Thanks in advance Marco

2 1

Tie up user to specific NAS
by Deepak 26 Nov '09

26 Nov '09

Hi, How do I tie up user to specific NAS so that they can log in from that location only? I have different hotspots in different locations and using dynamic-clients? After a quick search, I found "NAS-Identifier" attribute. Is this the solution? If yes NAS-Identifier = ? (IP, MAC, Name) Thanks Deepak -- ============================== Registered Linux User #460714 Currently Using Fedora 10, CentOS 5.3 ==============================

3 3

how to decode CHAP and MS-CHAP passwords
by shivashankar 26 Nov '09

26 Nov '09

hi, i want to decode both(CHAP and MS-CHAP) passwords. why i want to do this is? i am sending username and password to java file to test authentication.there it is unable to understand that chap and ms-cahp encrypted data. before going to java file i will decode and convert to plain-text .so that java file can understand. plz help me -- View this message in context: http://old.nabble.com/how-to-decode-CHAP-and-MS-CHAP-passwords-tp26525242p2… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Exec and ntlm_auth
by Leighton Man 26 Nov '09

26 Nov '09

Hi Help again please! I've read the doc at http://deployingradius.com/documents/configuration/active_directory.html and I'm now confused again. I'm running version 2.1.7 so module configurations are now in a separate directory rather than modules.conf. I have an access request packet containing User-name and User-Password. Where do I configure the ntlm_auth command so I can authenticate against Active Directory (which, by the way, is giving me more pain than anything else I've dealt with for quite a while!!) Thanks, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 3

Re: Exec and ntlm_auth
by freeradius＠corwyn.net 25 Nov '09

25 Nov '09

At 10:45 AM 11/25/2009, Alan DeKok wrote: > What part of the instructions is not working for you? well for me at least, I have authentication working. radtest account password localhost 0 m3H1hc4Z1OtpNC2ZLX3A works fine. rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=164, length=20 However, when I try the same thing from the Cisco client, I get Authorization failed back from the cisco. Better, because I originally got back Authentication Failed, so I figure I'm one step farther. If I disable Authorization on the Cisco, or change it back over to my old tacacs+ server, I can log in successfully, so my problem is somewhere in the authorization process, which isn't really (to me) in that document. Yet the results from the log show freeradius sending back Sending Access-Accept of id 121 to 10.100.0.8 port 1812 rad_recv: Access-Request packet from host 10.100.0.8 port 1812, id=121, length=79 NAS-IP-Address = 10.100.0.8 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "username" Calling-Station-Id = "10.20.31.17" User-Password = "password" server server_cisco { +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "username", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=username [ntlm_auth] expand: --password=%{User-Password} -> --password=password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok Login OK: [rsteeves] (from client Cisco port 1 cli 10.20.31.17) +- entering group post-auth {...} ++[exec] returns noop } # server server_cisco Sending Access-Accept of id 121 to 10.100.0.8 port 1812 Rick

2 1