December 2009 - Freeradius-Users - lists.freeradius.org

rlm_perl
by Коньков Евгений 16 Dec '09

16 Dec '09

Hello, Freeradius-users. How to send multiple parametrs with perl like next: > 1) $RAD_REPLY{'mpd-table-static'}= "14=192.168.1.7 2"; > 2) $RAD_REPLY{'mpd-table-static'}= "15=192.168.1.7 3"; now 1 is overriden with 2. -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 1

FreeRadius won't start with my configs
by J Brandon Polley 16 Dec '09

16 Dec '09

I can't get FreeRadius to start. No other instance of FreeRadius is running when I try to start FreeRadius. I'm using FreeRadius 1.1.7-21.4.47 Here is my debug info when I enter radiusd -x Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess rlm_preprocess: Error reading /etc/raddb/huntgroups (didnt change anything in this file) radiusd.conf[1019]: preprocess: Module instantiation failed. radiusd.conf[1800] Unknown module "preprocess". radiusd.conf[1790] Failed to parse authorize section. radius:~ # Here is line 1019: preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints # This hack changes Ascend's wierd port numberings # to standard 0-??? port numbers so that the "+" works # for IP address assignments. with_ascend_hack = no ascend_channels_per_line = 23 # Windows NT machines often authenticate themselves as # NT_DOMAIN\username # # If this is set to 'yes', then the NT_DOMAIN portion # of the user-name is silently discarded. # # This configuration entry SHOULD NOT be used. # See the "realms" module for a better way to handle # NT domains. with_ntdomain_hack = no # Specialix Jetstream 8500 24 port access server. # # If the user name is 10 characters or longer, a "/" # and the excess characters after the 10th are # appended to the user name. # # If you're not running that NAS, you don't need # this hack. with_specialix_jetstream_hack = no # Cisco (and Quintum in Cisco mode) sends it's VSA attributes # with the attribute name *again* in the string, like: # # H323-Attribute = "h323-attribute=value". # # If this configuration item is set to 'yes', then # the redundant data in the the attribute text is stripped # out. The result is: # # H323-Attribute = "value" # # If you're not running a Cisco or Quintum NAS, you don't # need this hack. with_cisco_vsa_hack = no } Here is line 1800: preprocess # # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' # section, above. #auth_log #attr_filter # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. mschap # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authenticate' section. #digest # # Look for IPASS style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. #IPASS # # If you are using multiple kinds of realms, you probably # want to set "ignore_null = yes" for all of them. # Otherwise, when the first style of realm doesn't match, # the other styles won't be checked. # suffix #ntdomain Here is line 1790: authorize { # # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. # # It also adds the %{Client-IP-Address} attribute to the request.

2 1

Re: Freeradius db.ippool is FULL Error : rlm_ippool: No available ip addresses in pool.
by tnt＠kalik.net 16 Dec '09

16 Dec '09

> Note: I test Cisco Secure ACS, no problem. But freeradius not release pool > ips. Thank you. Because it will not release IPs without notification that user is offline (accounting stop packet). If you want limited lifespan of assigned IP address don't use ippool - use dhcp. Ivan Kalik

1 0

Problem with EAP TLS authentication in Freeradius
by senthil kumar 16 Dec '09

16 Dec '09

Hi, Iam using Freeeadius 2.1.0. The setup is working fine with EAP-TTLS, PEAP method.But for EAP TLS, it gives the below error.. Please let me know how to solve.. [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Regards Senthil

4 11

windows domain\user change to user@domain
by green green 16 Dec '09

16 Dec '09

can advise how to rewrite the username in domain\user to user@domain so that the realm can be done to proxy the radius request to the upstream radius server. or no rewrite of username is need. can the freeradius proxy based on domain\user which domain\ can be use as realm to radius proxy to upstream radius server. please advise and thanks.

3 11

Fwd: Request for directions: WinXP + Samba + LDAP + 802.1x
by Fabiano Caixeta Duarte 16 Dec '09

16 Dec '09

> As you can see, it says that it has stripped realm from username but > it passes it along with username to ldap. How can I fix this? Never mind. ldap filter did the job. Sorry about that. Actually it's not working yet. rad_recv: Access-Request packet from host 192.168.205.29 port 49154, id=0, length=178 Cleaning up request 15 ID 0 with timestamp +1232 NAS-IP-Address = 192.168.205.29 NAS-Port-Type = Ethernet NAS-Port = 2 User-Name = "DOMAIN\\sti" State = 0x9bb6fc759d93e55343410152d73b1dba EAP-Message = 0x0225005b1900170301005046c5a952e0ad6d2ea7d132dd3c00c1a132df2329a23561c760d4a45fb4f02e3bd1a848f5d4d3106ae52d4f442971b4c6aa4d0c157805647 9f03c76d350fc041b659e556368c4a63e30e09849d0aae29a Message-Authenticator = 0xf9700c8c22d81ecdb12a8f6731151a38 +- entering group authorize {...} ++[preprocess] returns ok [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\sti" [ntdomain] Found realm "DOMAIN" [ntdomain] Adding Stripped-User-Name = "sti" [ntdomain] Adding Realm = "DOMAIN" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 37 length 91 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x022500441a0225003f31a156d1579957b003643781fff8636e87000000000000000003367b7948111ad6081798c179995c91c0268edae3409ae30046454152505c737 469 server { PEAP: Setting User-Name to DOMAIN\sti Sending tunneled request EAP-Message = 0x022500441a0225003f31a156d1579957b003643781fff8636e87000000000000000003367b7948111ad6081798c179995c91c0268edae3409ae30046454152505c737 469 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\sti" State = 0x7b5d7eb57b7864abf97396c9fbfa8cb4 server { +- entering group authorize {...} ++[preprocess] returns ok [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\sti" [ntdomain] Found realm "DOMAIN" [ntdomain] Adding Stripped-User-Name = "sti" [ntdomain] Adding Realm = "DOMAIN" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 37 length 68 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 204 ++[files] returns ok [ldap] performing user authorization for sti [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=sti) [ldap] expand: ou=Users,dc=domain,dc=br -> ou=Users,dc=domain,dc=br rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Users,dc=domain,dc=br, with filter (uid=sti) [ldap] checking if remote access for sti is allowed by radiusFilterId [ldap] looking for check items in directory... rlm_ldap: userPassword -> User-Password == "{SMD5}/S4d+fNkBFL3TnpjceYuUiDPd+Q=" rlm_ldap: sambaNtPassword -> NT-Password == 0x4443384142353837303246373432304532443042323537333343453938394634 rlm_ldap: sambaLmPassword -> LM-Password == 0x3245414443463036424438463531344541414433423433354235313430344545 [ldap] looking for reply items in directory... rlm_ldap: radiusFilterId -> Filter-Id = "Enterasys:version=1:policy=Enterprise User" [ldap] user sti authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [DOMAIN\\sti/<via Auth-Type = EAP>] (from client tplink port 0 via TLS tunnel) } # server [peap] Got tunneled reply code 3 Filter-Id = "Enterasys:version=1:policy=Enterprise User" EAP-Message = 0x04250004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 Filter-Id = "Enterasys:version=1:policy=Enterprise User" EAP-Message = 0x04250004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.205.29 port 49154 EAP-Message = 0x012600261900170301001b5cfd418b7da0ea2be30d04270a1403956143966fe487e0870c4b57 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9bb6fc759c90e55343410152d73b1dba Finished request 16. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.205.29 port 49154, id=0, length=125 Cleaning up request 16 ID 0 with timestamp +1232 NAS-IP-Address = 192.168.205.29 NAS-Port-Type = Ethernet NAS-Port = 2 User-Name = "DOMAIN\\sti" State = 0x9bb6fc759c90e55343410152d73b1dba EAP-Message = 0x022600261900170301001b21b51585f6a2a91a76b4b00b320ac2a87db1c24bf9bfa298197bf1 Message-Authenticator = 0x30d1290632d45610b95a3253910ba83b +- entering group authorize {...} ++[preprocess] returns ok [ntdomain] Looking up realm "DOMAIN" for User-Name = "DOMAIN\sti" [ntdomain] Found realm "DOMAIN" [ntdomain] Adding Stripped-User-Name = "sti" [ntdomain] Adding Realm = "DOMAIN" [ntdomain] Authentication realm is LOCAL. ++[ntdomain] returns ok [eap] EAP packet type response id 38 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [DOMAIN\\sti/<via Auth-Type = EAP>] (from client tplink port 2) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> DOMAIN\sti attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 17 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 17 Sending Access-Reject of id 0 to 192.168.205.29 port 49154 EAP-Message = 0x04260004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 17 ID 0 with timestamp +1232 Ready to process requests. > And how can I set XP for it to try authenticate during logon proccess? That first question still remains.... -- Fabiano Caixeta Duarte Especialista em Redes de Computadores Linux User #195299 Ribeirão Preto - SP

3 4

Re: radiusd -X
by kachin Agarwal 16 Dec '09

16 Dec '09

Hey, I am new to this.. wat does this hardware SSL accelerator card do??? where do u get this??? Thanks & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

1 0

Re: radiusd -X
by kachin Agarwal 16 Dec '09

16 Dec '09

Hi, After a lot of investigation, i have found the reason for my low auth-rate. The auth-rate i m gettin now is 3/sec. so approx. 330 ms per authentication. this is a radiusd -X : eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005f], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0278], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled But in this 300 millisec, 200 ms is taken up by the above SSL operation. why does this take more time? how can i reduce this time consumed by SSL? Thanks & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1

Help on debugging Freeradius
by Dinh Pham Cong 16 Dec '09

16 Dec '09

Hi all, My Freeradiusd 2.1.7 got crashed a lot of times today so I decided to run radiusd in gdb /etc/init.d/radiusd stop # gdb /usr/local/sbin/radiusd GNU gdb Fedora (6.8-27.el5) Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu"... (gdb) set logging file gdb-radiusd.log (gdb) set logging on Copying output to gdb-radiusd.log. (gdb) run Starting program: /usr/local/sbin/radiusd [Thread debugging using libthread_db enabled] [New Thread 0x2b34e4b7fe10 (LWP 27411)] [New Thread 0x41c8b940 (LWP 27414)] [Thread 0x41c8b940 (LWP 27414) exited] Detaching after fork from child process 27416. Program exited normally. (gdb) (gdb) (gdb) (gdb) info threads No registers. (gdb) thread apply all bt full No registers. (gdb) info threads No registers. (gdb) bt No stack. I already re-compiled FreeRadius with -enable-developer and set allows_core_dump = yes in the configuration file. But I don't know why I can not get the back trace when the segmentation fault happens Dec 16 13:10:01 MobileTV-6 kernel: radiusd[1639]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aabfeef5180 error 4 Dec 16 15:14:06 MobileTV-6 kernel: radiusd[5486]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aab4b7d6180 error 4 Dec 16 15:14:06 MobileTV-6 kernel: radiusd[11466]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aaf2c785180 error 4 Dec 16 15:27:16 MobileTV-6 kernel: radiusd[16567]: segfault at 0000000000000098 rip 0000003daee530f1 rsp 00002aacc4820180 error 4 Dec 16 15:27:16 MobileTV-6 kernel: radiusd[24913]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aae33d64180 error 4 Dec 16 15:31:42 MobileTV-6 kernel: radiusd[26558]: segfault at 0000000000000002 rip 0000003daee51b35 rsp 00002aab453bb150 error 6 Dec 16 15:31:42 MobileTV-6 kernel: radiusd[27347]: segfault at 0000000000000002 rip 0000003daee51b35 rsp 00002aad3da66150 error 6 Dec 16 15:31:42 MobileTV-6 kernel: radiusd[27322]: segfault at 0000000000000002 rip 0000003daee51b35 rsp 00002aad2e04d150 error 6 Dec 16 15:31:42 MobileTV-6 kernel: radiusd[26487]: segfault at 0000000000000002 rip 0000003daee51b35 rsp 00002aab18d74150 error 6 Dec 16 15:32:21 MobileTV-6 kernel: radiusd[30883]: segfault at 0000000000000002 rip 0000003daee51b35 rsp 00002aabc3896150 error 6 Dec 16 15:32:21 MobileTV-6 kernel: radiusd[31407]: segfault at 0000000000000002 rip 0000003daee51b35 rsp 00002aad1742f150 error 6 Dec 16 15:32:21 MobileTV-6 kernel: radiusd[31156]: segfault at 0000000000000002 rip 0000003daee51b35 rsp 00002aac6e3a7150 error 6 Dec 16 15:32:21 MobileTV-6 kernel: radiusd[31460]: segfault at 0000000000000002 rip 0000003daee51b35 rsp 00002aad38665150 error 6 Dec 16 15:35:53 MobileTV-6 kernel: radiusd[32595]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aab7740b180 error 4 Dec 16 15:43:55 MobileTV-6 kernel: radiusd[4822]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aac53f7c780 error 4 Dec 16 15:44:07 MobileTV-6 kernel: radiusd[14485]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aaecf241180 error 4 Dec 16 15:44:20 MobileTV-6 kernel: radiusd[15346]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aab2ff99180 error 4 Dec 16 15:44:33 MobileTV-6 kernel: radiusd[18676]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aae233e5180 error 4 Dec 16 15:57:44 MobileTV-6 kernel: radiusd[27191]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aae381a2180 error 4 Dec 16 15:57:56 MobileTV-6 kernel: radiusd[31469]: segfault at 00000000000000c8 rip 0000003daee5306b rsp 00002aaacbef9180 error 4 uname -a Linux MobileTV-6 2.6.18-128.el5 #1 SMP Wed Jan 21 10:41:14 EST 2009 x86_64 x86_64 x86_64 GNU/Linux free -m total used free shared buffers cached Mem: 16044 4825 11219 0 158 3332 -/+ buffers/cache: 1334 14710 Swap: 2047 0 2047 ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 137216 max locked memory (kbytes, -l) 32 max memory size (kbytes, -m) unlimited open files (-n) 100000 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 10240 cpu time (seconds, -t) unlimited max user processes (-u) 137216 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited Could you kindly point me the right direction? Thanks, Dinh

1 1

accounting
by rosect190＠yahoo.com 16 Dec '09

16 Dec '09

Two questions that I am seeking answers to. 1. Can freeradius log accounting info in a local file, meaning not to use a sql database? If yes, how to enable that and where the log files will be (configurable?) 2. I loaded freeradius 2.13.fc9.i386. "rpm -qa" shows that freeradius-mysql-2.1.3-1.fc9.i386 is installed. However, "which mysql: shows this command is not available. Do I need to download mysql and install it or does this version of freeradius install mysql automatically? Thanks.

3 2