December 2009 - Freeradius-Users - lists.freeradius.org

lose 2 WARNING messages when compiling
by Alan Buxey 08 Dec '09

08 Dec '09

hi, 2 trivial (maybe too trivial? side-effects?) patches to stop the two extraneous WARNING messages during compilation on FreeRADIUS --- freeradius-server/Make.inc.in 2009-12-08 13:16:28.000000000 +0000 +++ freeradius-server-new/Make.inc.in 2009-12-08 12:46:20.000000000 +0000 @@ -22,6 +22,7 @@ radacctdir = @radacctdir@ top_builddir = @abs_top_builddir@ top_srcdir = @abs_top_srcdir@ +datarootdir = @datarootdir@ MAKE = @MAKE@ CC = @CC@ --- freeradius-server/src/include/build-radpaths-h.in 2009-12-08 13:16:28.000000000 +0000 +++ freeradius-server-new/src/include/build-radpaths-h.in 2009-12-08 12:46:36.000000000 +0000 @@ -21,6 +21,7 @@ logdir=@logdir@ raddbdir=@raddbdir@ radacctdir=@radacctdir@ +datarootdir=@datarootdir@ cat <<EOF > radpaths.h /* Automatically generated by "build-radpaths-h" */ sorry - having a little battle with GIT locally and my trees/paths are horribly screwed up right now :-| alan

1 0

Almost there... Radiusclient not sending password with MSChapv2
by Wim De Hul 08 Dec '09

08 Dec '09

Dear list members, I almost have a working Radius setup... Well almost, because when I try to setup a pptp tunnel with my Windows XP, I see the following om my radius server: Packet number 1 has just been sniffed From: 127.0.0.1:54717 To: 127.0.0.1:1812 Type: Access-Request Service-Type = Framed-User Framed-Protocol = PPP User-Name = "wim" MS-CHAP-Challenge = 0x75a4e7aeb06f3c93be685de0afae4cc2 MS-CHAP2-Response = 0x60007f150b2e344755f9e0462ded8d7d68520000000000000000cf323d8cd21faeb820272ccadd6b188a8ae287bd7481f1c4 Calling-Station-Id = "8.08" NAS-IP-Address = XX.XX.XX.XX NAS-Port = 0 Packet number 2 has just been sniffed From: 127.0.0.1:1812 To: 127.0.0.1:54717 Type: Access-Accept Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.2.10 Framed-IP-Netmask = 255.255.255.0 MS-CHAP2-Success = 0x60533d45314438443736334142433330343132383837384533434639323534413541373639313346443535 MS-MPPE-Recv-Key = 0x97fc624e0e2ff930716882df647c7ec4fc8a2d9c946e54d2befdc26d5292aec3562a MS-MPPE-Send-Key = 0x9ca67e3969c47454af91493d646e4cdf8fd93dcf3435868ffd42fb3c6c992fb5b989 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 My XP tells me that the username/password is invalid (Error 961). I suspect the password attibute to be empty.. Can anyone give me a hint? -- Wim

2 3

clear-terxt password vs user-password
by rosect190＠yahoo.com 08 Dec '09

08 Dec '09

In user account setup, you can use either Cleartext-Password or User-Password. What is the difference? Thanks.

2 1

RE: Re: Problems with PEAP
by Peter Carlstedt 08 Dec '09

08 Dec '09

> > Message: 6 > Date: Mon, 7 Dec 2009 23:00:02 -0000 (UTC) > From: tnt(a)kalik.net > Subject: Re: Problems with PEAP > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <50214.87.194.16.13.1260226802.squirrel(a)www.kalik.net> > Content-Type: text/plain;charset=iso-8859-1 > > > > > Hello everyone, > > I know that it is something I have forgot to configure but I cant for my > > life remember what it is. > > What I want to do is to authenticate a user from a windows machine using > > PEAP. > > > > Things I?ve have configured in raddb and in raddb/modules is: > > > > 1. Added a user called Jens with Cleartext-Password := "kaffe" > > No, you haven't: > > > ++[files] returns noop > > There is no entry for that user in users file. At least not the one server > is using. If you have multiple installations make sure that you are > configuring fioles belonging to the instance you are running. Have a look > at the debug of the server startup - it will tell you where users file is > (when files module is instantiated). > > Ivan Kalik Hi Ivan Kalik, Yes I do have an input for Jens with Cleartext-Password := "kaffe" in the users file. Also I do not have several installations of Freeradius on the same installation of Ubuntu Desktop 9.04. This one was newly installed yesterday so there is only one installation. Also I could login using a different user which was a row above the user Jens. My users file have two users: peter Cleartext-Password := "kaffe" jens Cleartext-Password := "kaffe" After I logged in with the user peter I could login using jens. Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live: Friends get your Flickr, Yelp, and Digg updates when they e-mail you. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

1 0

Cisco-AVPair Accounting
by Bryan Campbell 07 Dec '09

07 Dec '09

Afternoon - We use Freeradius/MySQL with Cisco-AVPair entries to send radreplies and radgroupreplies that specify speeds and such with great success. However, we are having a bit of difficulty sorting out how to sort out Cisco-AVPair accounting entries so that we can insert them into the database. We have read through some list discussions about rewriting things, the cisco vsa hack, and ulang. But, in the end, we are still left needing some assistance, examples, or even a howto. We get two Cisco-AVPair accounting responses in each start record and five in each stop record. What is the best way to sort them out and get them inserted into the radacct table? Thanks! Bryan - bbc(a)misn.com

2 2

"ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32" error while running make
by Nereida Bernal 07 Dec '09

07 Dec '09

Hi all! I want to install FreeRADIUS 2.1.7, but while running "make" I get the error "ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32" Version: FreeRADIUS 2.1.7 Host SUN Sparc Netra-210 OS: Solaris2.10 MySQL Pkg: mysql-5.0.88-solaris10-sparc-64bit.pkg.gz Where can I find the 64 bit libraries? I thought I had them but apparently I don't, since I am getting the ELFCLASS32 error See the log below make[10]: Entering directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules/rlm_sql/drivers/rlm_sql_iodbc' make[10]: Nothing to be done for `all'. make[10]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules/rlm_sql/drivers/rlm_sql_iodbc' Making all in rlm_sql_mysql... make[10]: Entering directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules/rlm_sql/drivers/rlm_sql_mysql' /opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/libtool --mode=link gcc -release 2.1.7 \ -module -export-dynamic -o rlm_sql_mysql.la \ -rpath /usr/local/lib sql_mysql.lo -m64 -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lpthread -lthread -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread gcc -shared -Wl,-h -Wl,rlm_sql_mysql-2.1.7.so -o .libs/rlm_sql_mysql-2.1.7.so .libs/sql_mysql.o -L/opt/mysql/mysql/lib -lmysqlclient_r -lz -lposix4 -lresolv -lgen -lsocket -lnsl -lm -lpthread -lthread -lc -m64 ld: fatal: file .libs/sql_mysql.o: wrong ELF class: ELFCLASS32 ld: fatal: File processing errors. No output written to .libs/rlm_sql_mysql-2.1.7.so collect2: ld returned 1 exit status make[10]: *** [rlm_sql_mysql.la] Error 1 make[10]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules/rlm_sql/drivers/rlm_sql_mysql' make[9]: *** [common] Error 2 make[9]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules/rlm_sql/drivers' make[8]: *** [all] Error 2 make[8]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules/rlm_sql/drivers' make[7]: *** [common] Error 2 make[7]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules/rlm_sql' make[6]: *** [build-module] Error 2 make[6]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules/rlm_sql' make[5]: *** [common] Error 2 make[5]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/opt/RADUIS/FreeRADIUSv2/freeradius/freeradius-server-2.1.7' make: *** [all] Error 2 Could you help me please? Regards Nere

2 1

freeradius postgresql sql query glitch
by Josip Rodin 07 Dec '09

07 Dec '09

Hi, I've observed an SQL logging problem with FreeRADIUS (2.x) and PostgreSQL (8.1), on several different installations I occasionally get these errors: Mon Dec 7 13:19:01 2009 : Error: [ourlittle_sql] Couldn't update SQL accounting STOP record - ERROR: invalid input syntax for integer: "" sql trace log indicates that this is the offending query: UPDATE radacct SET AcctStopTime = ('2009-12-07 13:19:01'::timestamp - '6'::interval), AcctSessionTime = CASE WHEN '' = '' THEN (EXTRACT(EPOCH FROM ('2009-12-07 13:19:01'::TIMESTAMP WITH TIME ZONE - AcctStartTime::TIMESTAMP WITH TIME ZONE - '6'::INTERVAL)))::BIGINT ELSE '' END, AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint), AcctTerminateCause = 'User-Request', AcctStopDelay = 0, FramedIPAddress = NULLIF('4.3.2.1', '')::inet, ConnectInfo_stop = '' WHERE AcctSessionId = '57fc9e4821466d86' AND UserName = 'our(a)user.name' AND NASIPAddress = '1.2.3.4' AND AcctStopTime IS NULL; I'm using the default unchanged sql/postgresql/dialup.conf setting: accounting_stop_query = "UPDATE ${acct_table2} \ SET AcctStopTime = ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), \ AcctSessionTime = CASE WHEN '%{Acct-Session-Time}' = '' THEN \ (EXTRACT(EPOCH FROM ('%S'::TIMESTAMP WITH TIME ZONE - AcctStartTime::TIMESTAMP WITH TIME ZONE \ - '%{%{Acct-Delay-Time}:-0}'::INTERVAL)))::BIGINT ELSE '%{Acct-Session-Time}' END, \ AcctInputOctets = (('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Input-Octets}:-0}'::bigint), \ AcctOutputOctets = (('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) + '%{%{Acct-Output-Octets}:-0}'::bigint), \ AcctTerminateCause = '%{Acct-Terminate-Cause}', \ AcctStopDelay = 0, \ FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, \ ConnectInfo_stop = '%{Connect-Info}' \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}' \ AND AcctStopTime IS NULL" Looks like the code wants to use CASE to check whether %{Acct-Session-Time} exists among the internal FreeRADIUS variables, while the return value of the whole SQL CASE construct is supposed to be a bigint. This is a reduced failing case: radiustmobile=# select CASE WHEN '' = '' THEN (EXTRACT(EPOCH FROM ('2009-12-07 13:19:01'::TIMESTAMP WITH TIME ZONE - AcctStartTime::TIMESTAMP WITH TIME ZONE - '6'::INTERVAL)))::BIGINT ELSE '' END from radacct where AcctSessionId = '57fc9e4821466d86'; ERROR: invalid input syntax for integer: "" In the else case, this fallback return value comes into PostgreSQL as just an empty string, which causes it to trip over - it sees that there's a possibility to write an empty string into a bigint field, which provokes the syntax error, even if the problem won't actually happen with this particular setup of input data. I'm not sure what to do... can the query be rewritten in a manner that would allow for both use cases? (Mailing list users, please Cc: responses for those of us who may not be subscribed. TIA.) -- 2. That which causes joy or happiness.

2 2

Problems with PEAP
by Peter Carlstedt 07 Dec '09

07 Dec '09

Hello everyone, I know that it is something I have forgot to configure but I cant for my life remember what it is. What I want to do is to authenticate a user from a windows machine using PEAP. The error I get in the output is: rad_recv: Access-Request packet from host 192.168.118.10 port 35923, id=92, length=230 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "Jens" State = 0x99a8723d9faf6be067d44ee908d21fb0 NAS-Port-Id = "wlan2" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" EAP-Message = 0x0207005b19001703010050ff6dcfaa2e20081def82599ed160a801cb8b3e047fe0408eca8f0ed5bf985a4594dbf7056245f7ff06e823be7ba31220fb494d61db652b3f05bf75b3767bbfcce4d3c8e706312e385afb35dd2fe6f8f9 Message-Authenticator = 0x0ba6d2c1daab0232a5b4bd95fac8dc78 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 91 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0207003f1a0207003a31f7f5bfb93119478c28430861f7428ecc000000000000000006883db97ed65677dadd8058359801947d67a7f575431297004a656e73 server { PEAP: Setting User-Name to Jens Sending tunneled request EAP-Message = 0x0207003f1a0207003a31f7f5bfb93119478c28430861f7428ecc000000000000000006883db97ed65677dadd8058359801947d67a7f575431297004a656e73 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Jens" State = 0xdb1b00f8db1c1ab8275dfb2a6c0e04ae Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan2" Calling-Station-Id = "00-26-BB-14-50-CF" Called-Station-Id = "02-0B-6B-33-62-35:3" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.118.10 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "Jens", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 63 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for Jens with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 92 to 192.168.118.10 port 35923 EAP-Message = 0x0108002b19001703010020e9867cd0d691777dff28957e278ff9ee7618f8d26722621a3472801821e637a5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x99a8723d9ea06be067d44ee908d21fb0 Finished request 197. Things I´ve have configured in raddb and in raddb/modules is: 1. Added a user called Jens with Cleartext-Password := "kaffe" 2. Added two NAS in clients.conf 3. set "default_eap_type = peap", "copy_request_to_tunnel = yes" and under the peap section also "default_eap_type = mschapv2" in eap.conf 4. set & uncommented "use_mppe = yes" and set "require_encryption" = yes, "require_strong = yes" in mschap in the directory modules. is there anything else I need to do that I have forgot so I can use peap? Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail®. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

3 2

Handling proxied accounting updates that have been delayed
by Patric 07 Dec '09

07 Dec '09

Hi everyone, I have an interesting dilemma that I would like to share with the list, perhaps someone can shed some light on how they handle this kind of thing. I have 2 freeradius 2.1.7 servers that receive accounting updates from multiple clients, and proxy these accounting updates to eachother. Sometimes (due to a number of reasons) the proxying is delayed. When the proxied updates are eventually processed, they are written into my account logs mysql table. The acct_start_time is written as the current date and time, and the acct_delay_time holds the difference between the actual time of the accounting update and now. As closely as I can tell, this is what I have had happen: At 08h00 Server A receives a start record. This is put in the detail file to go to Server B. This is also written to the local accounting table with: acct_start_time = 2009-12-04 08:00:00 The proxy is delayed for 2 hours due to a network issue between Server A and Server B. At 09h00 Server B receives the next update stating that user 1 has used 7 input octets. This is put in the detail file to go to Server A. This is also written to the local accounting table with: acct_start_time = 2009-12-04 09:00:00 acct_input_octets = 7 This is because the record did not exist so the accounting_update_query_alt was called which inserts instead of updating. At 10h00 Server A and Server B can talk to each other, so Server A sends its proxied start record to Server B. The db record on Server B now reflects: acct_start_time = 2009-12-04 10:00:00 acct_input_octets = 7 acct_delay_time = 3600 (delayed 2 hours) Server B also sends its proxied update to server A, and now server A reflects the following: acct_start_time = 2009-12-04 08:00:00 acct_input_octets = 7 So what happened is that server A got the start record and created a new db entry at 08h00. Server B then got an interim update and since the record did not yet exist (proxied start record was delayed), it created its own record at 09h00. Proxying then started again, and server B received the start record and updated the start time to the current time, 10h00. Now server A says that the session started at 08h00 and server B says the sessions tarted at 10h00 This is because the entry already existed on server B, so the alternate start query was used, which is currently: accounting_start_query_alt = "UPDATE ${acct_table_new} \ SET \ acct_start_time = '%S', \ acct_delay_time = '%{Acct-Delay-Time}', \ connect_info = '%{Connect-Info}' \ WHERE \ acct_session_id = '%{Acct-Session-Id}' \ AND \ user_name = '%{SQL-User-Name}' \ AND \ nas_ip_address = '%{NAS-IP-Address}'" Currently my reporting software does not take into account the acct_delay time, it just uses acct_start_time and acct_end_time to calculate usage etc. So if the above situation occurs over midnight or over the end of the month, my 2 servers reflect different daily/monthly usage... What do you guys do with situations such as these? Do you take into account the acct_delay_time when reporting? I have been toying with the idea of updating the accounting_start_query_alt not to update the acct_start_time, so basically if the record already exists then leave that as the start time? But as I type it now I realise this will break the delay time calculation so there will be no way to calculate the real start time... Any advise or experiences would be much appreciated! Many thanks Patric

3 3

Re: FreeRadius with ntlm_auth
by charles＠copel.com 07 Dec '09

07 Dec '09

Hi, Allan: My domain comes through as part of the request. Sorry, but I didn´t understand this: "if so you can simply use the example ntlm_auth to do the substitution". Can you explain it better ? Thanks. Charles. Hi, > > Hi All: > > My name is Charles and I need to "Configure my FreeRadius to use ntlm_auth" to authenticate NT users. > Actually, I am getting to do this for only one NT group, but I need to do this for more NT groups. > > My configuration in "radius.conf" for ntlm_auth for one NT group is: > > exec win_domain { > wait = yes > input_pairs = request > output_pairs = reply > program = "/usr/local/bin/ntlm_auth --request-nt-key --domain=COPEL --username=%{User-Name:-None} --password=%{User-Password} --require-membership-of=COPEL\\Group1" > } > > My environment is: FreeBSD 6.2 + Samba 3.0.26a + freeradius 1.1.7 > > How can I do this configuration for more than one NT group ? Any idea ? > Thanks, > Charles. does the domain come through as part of the request? if so you can simply use the example ntlm_auth to do the substitution . if not...well, you could so a large check table where every auth is tried until one works....and if none work then they get rejected. bit messy but redundant auth statements work okay and are very handy - eg for what you migrate to a new AD system but half of users are still in the old one or in a DB etc. alan

2 1