December 2009 - Freeradius-Users - lists.freeradius.org

Password in Radius Debug
by Cody Jarrett 17 Mar '10

17 Mar '10

I notice the password during supplicant connects to the radius server are displayed in plain text. Is there a way to disable this? -- Cody Jarrett IT Freedom cody.jarrett(a)itfreedom.com Office: 512.419.0070 Fax: 512.419.0080

5 5

Re: Re: rlm_perl behavior
by Borislav Dimitrov 03 Mar '10

03 Mar '10

Hello, I just subscribed so I won't be able to quote properly but I hope at least the message is associated with the right thread (I found it on the web archive of the mailing list). I've been using FreeRADIUS for about 4 year now and it is a wonderful product - there's no question why you're No 1! For the past years of using and developing rlm_perl modules for FreeRADIUS, I've only been astonished and happy because of the new functionalities etc that the development team have been adding to the new releases. This all ended with this crippling

6 20

get attributes from multiple AD domains
by John 29 Jan '10

29 Jan '10

I follow up this link to set up freeRADIUS talk to AD, http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO It can work and can get VLAN attribute from AD through LDAP module (ldap_search). But we need to support 2 AD domains. NTLM_auth can work in multiple domains. But we can not get attributes from multiple domains. Anyone can give me some advice? Thanks. John. ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

3 3

Re: Decoupled accounting
by Devinder Singh 20 Jan '10

20 Jan '10

Hi Ivan Ok i managed to install ca.der and client.p12 on my XP When i run radiusd -X i get rad_recv: Access-Request packet from host 203.121.4.59 port 6001, id=30, length=216 User-Name = "devinder(a)palettemm.com" NAS-IP-Address = 203.121.4.59 Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" Calling-Station-Id = "00-04-23-7b-56-b9" NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" State = 0xf30ae66df60debd09c91249e7b82f0a9 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207002c0d000116030100205a6f866d20eb642ddc9f404f90d8650422eb751e7bb0199a016bb14e384df6fa Message-Authenticator = 0x06206416bbe520db012eb924f72ba75e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "palettemm.com" for User-Name = "devinder(a)palettemm.com" [suffix] No such realm "palettemm.com" ++[suffix] returns noop [eap] EAP packet type response id 7 length 44 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry devinder(a)palettemm.com at line 94 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 30 to 203.121.4.59 port 6001 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 24 with timestamp +83 Cleaning up request 1 ID 25 with timestamp +83 Cleaning up request 2 ID 26 with timestamp +83 Cleaning up request 3 ID 27 with timestamp +83 Cleaning up request 4 ID 28 with timestamp +83 Cleaning up request 5 ID 29 with timestamp +83 Waking up in 1.0 seconds. Cleaning up request 6 ID 30 with timestamp +83 Ready to process requests. Users File "devinder(a)palettemm.com" Auth-Type := EAP DEFAULT Auth-Type := Reject Reply-Message = "Authentication Failed" 2009/8/3 Ivan Kalik <tnt(a)kalik.net>: >> Do i copy this file to the XP and install ca.der >> >> ca.der and client.p12 > > Yes. > > Ivan Kalik > Kalik Informatika ISP > > -- Devinder

1 5

Can't start radiusd -X ?
by Zhang Shukun 18 Jan '10

18 Jan '10

hi, when i want to start radius in debug mode. error happened. Failed binding to authentication address * port 1812: Address already in use /usr/local/etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 Could you tell me what's wrong? Thanks! -- Regards, Sucan

5 9

Design question considering 802.1x + edirectory + Active Directory
by Ric2009 09 Jan '10

09 Jan '10

Hello, I would like to know if anyone could help me with the design of this implementation : Requirements : - 802.1x Authentication for wired and wireless clients ( Windows XP with Novell Client ) - Single sign on login to Novell eDirectory and Active Directory - Radius Authentication should run over FreeRadius or IAS but not both, if it's possible. - High Availability is required for Radius service - Virtualization of the Radius servers is recommended Questions : - I have been looking at multi-platform 802.1x clients like Juniper Networks Odyssey Access Client ( OAC ) for multiplaform 802.1x login. But I don't know if it's possible to do the same without it. - Is there any downloadable Freeradius + LDAP virtual machine for testing ?? Thanks a lot !!!!! Ric2009 -- View this message in context: http://old.nabble.com/Design-question-considering-802.1x-%2B-edirectory-%2B… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Radiusd process exited without notice
by Dinh Pham Cong 07 Jan '10

07 Jan '10

Hi all, I noticed that my radiusd process exited silently this morning without any notice before I must start it manually at Mon Dec 21 10:42:23 2009 as you can see in the below log messages. Besides, no crash is recorded in /var/log/messages. Any recommendation to troubleshoot this problem is appreciated. Sun Dec 20 21:37:51 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.34.22', nas '10.0.41.137'] Sun Dec 20 21:39:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.70.57', nas '10.0.41.138'] Sun Dec 20 22:00:52 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.36.222', nas '10.0.41.138'] Sun Dec 20 22:04:04 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.115.184', nas '10.0.41.138'] Sun Dec 20 22:15:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.66.205', nas '10.0.41.138'] Sun Dec 20 22:33:15 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.36.99', nas '10.0.41.138'] Sun Dec 20 22:51:12 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.49.23', nas '10.0.41.137'] Sun Dec 20 23:30:07 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.108.156', nas '10.0.41.138'] Sun Dec 20 23:35:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.64.196', nas '10.0.41.137'] Mon Dec 21 00:35:44 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.52.91', nas '10.0.41.137'] Mon Dec 21 01:44:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.16.35', nas '10.0.41.138'] Mon Dec 21 03:28:49 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.63', nas '10.0.41.138'] Mon Dec 21 03:55:37 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.182', nas '10.0.41.137'] Mon Dec 21 04:27:51 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.33.43', nas '10.0.41.137'] Mon Dec 21 05:45:55 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.32.232', nas '10.0.41.138'] Mon Dec 21 05:55:46 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.204', nas '10.0.41.138'] Mon Dec 21 06:51:41 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.247', nas '10.0.41.137'] Mon Dec 21 06:56:50 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.24.21', nas '10.0.41.138'] Mon Dec 21 08:27:47 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.85', nas '10.0.41.138'] Mon Dec 21 08:36:01 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.138.176', nas '10.0.41.137'] Mon Dec 21 08:42:41 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.68.198', nas '10.0.41.137'] Mon Dec 21 08:46:53 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.233', nas '10.0.41.137'] Mon Dec 21 09:07:01 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.110.49', nas '10.0.41.137'] Mon Dec 21 09:14:04 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.35.224', nas '10.0.41.137'] Mon Dec 21 09:36:55 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.65.233', nas '10.0.41.138'] Mon Dec 21 09:41:02 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.39.177', nas '10.0.41.138'] Mon Dec 21 10:04:22 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.71', nas '10.0.41.137'] Mon Dec 21 10:04:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.52.107', nas '10.0.41.137'] Mon Dec 21 10:04:23 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.82.155', nas '10.0.41.137'] Mon Dec 21 10:04:24 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.14.240', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.31.29', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.24.30', nas '10.0.41.137'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.25.245', nas '10.0.41.138'] Mon Dec 21 10:04:26 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.25.49', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.35.84', nas '10.0.41.137'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.51.7', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.8.155', nas '10.0.41.137'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.39.232', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.37.42', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.183', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.28.249', nas '10.0.41.138'] Mon Dec 21 10:04:27 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.247', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.49.162', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.116', nas '10.0.41.137'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.154', nas '10.0.41.138'] Mon Dec 21 10:04:28 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.93', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.34.116', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.110.54', nas '10.0.41.138'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.27.8', nas '10.0.41.137'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.105.31', nas '10.0.41.137'] Mon Dec 21 10:04:29 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.0.44', nas '10.0.41.138'] Mon Dec 21 10:04:30 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Dec 21 10:04:30 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.38.21', nas '10.0.41.138'] Mon Dec 21 10:04:30 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.67.0', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.81.41', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.26.205', nas '10.0.41.137'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.112.205', nas '10.0.41.138'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.53.225', nas '10.0.41.138'] Mon Dec 21 10:04:31 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.38.170', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.13.15', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.58.157', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.48.134', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.69.19', nas '10.0.41.137'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.54.41', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.109.253', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.91.90', nas '10.0.41.138'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.87.73', nas '10.0.41.137'] Mon Dec 21 10:04:32 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.29.105', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: Received conflicting packet from client vt-ggsn3-sg port 51682 - ID: 192 due to unfinished request 20099379. Giving up on old request. Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.95.191', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.40.108', nas '10.0.41.138'] Mon Dec 21 10:04:33 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.12.148', nas '10.0.41.137'] Mon Dec 21 10:04:33 2009 : Error: Received conflicting packet from client vt-ggsn8-tt port 57385 - ID: 143 due to unfinished request 20099602. Giving up on old request. Mon Dec 21 10:04:33 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #71 Mon Dec 21 10:42:23 2009 : Info: Loaded virtual server inner-tunnel Mon Dec 21 10:42:23 2009 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Dec 21 10:42:23 2009 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #5 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #6 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #7 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #8 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #9 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #10 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #11 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #12 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #13 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #14 Mon Dec 21 10:42:23 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #15 Regards, Dinh

5 14

Managing the RADIUS database
by Steve Bertrand 06 Jan '10

06 Jan '10

Hi all, I'm curious to know what you use to manage your RADIUS database, particularly the accounting tables. For quite some time, I was using severely hacked versions of the dialup_admin scripts. Since then, I've written (ie. been writing) an ISP mgmt/accounting system that relies very heavily on the RADIUS accounting information for billing and statistics, but only after the data has been aggregated. During this project, I've also written a basic object-oriented RADIUS module that now houses the aggregation functionality, including being able to go back in time to re-aggregate and re-archive. Because I need to make some functional changes to it, I thought I'd ask here if others would be interested in such a Perl module (and its scripts), and if so, I'll extend it with further functionality after updating the code with the stuff I just didn't know then ;) Currently, it uses plain DBI and only supports MySQL, but I'm going to incorporate much from my other work whereby DBIx::Class is used (to more easily support multiple dbs), expand on the config file, the installer and the documentation. Is using RADIUS accounting stats for billing/logging even done anymore? Steve

4 10

MAC authentication bypass --- How am I supposed to edit the users file to include multiple MAC addresses??
by Difan Zhao 05 Jan '10

05 Jan '10

Hey experts!! I am having another dilemma here. I am trying to configure MAC authentication bypass feature on my Cisco 3750 switch to authenticate some devices which don't support 802.1x. The way how it works is that (I figured it out by running debug on the switch and by using wireshark), if the supplicant device doesn't support 802.1x, the switch (172.17.254.100) sends a access request to the freeradius server (172.17.1.1) with username and password both are the MAC address of the device! That brings my dilemma! I have like 200 devices like this. I don't want to edit my users file with each of the MAC address as the UN/PW. Is there an easy way to write a script like thing to include all of them? The mac addresses are all start with "00:a0:08". I want a logic like: If a request is for a user with first 3 octets like the above one, use its MAC address (in this case will be also its username) as the password and grant the access. Is it possible to do it in FreeRadius 2.1.6?? I have attached the output of a success authentication for a device with MAC: 00a0080806bd. Of course I manually added this user in my users file. My users file looks like: 00a0080806bd Cleartext-Password := "00a0080806bd" I appreciate any advice!! Thank you guys!! Difan Zhao, CCNP Network Engineer difan.zhao(a)guest-tek.com www.guest-tek.com <http://www.guest-tek.com/> Office: 403-509-1010 ext 3048 Cell: 403-689-7514

6 23

two user authentication groups for one AS
by Eric 02 Jan '10

02 Jan '10

Hi There is one VPN server that I want to authenticate some of its users with ldap-1 and others with ldap-2. how should I differ them? I defined: DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-1, Autz-Type := Vpn DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-2, Autz-Type := Vpn but it only sees first line.

3 8