December 2009 - Freeradius-Users - lists.freeradius.org

Dynamic VLAN assignment works on EAP-MD5, but not EAP-PEAP!!!
by Difan Zhao 19 Dec '09

19 Dec '09

Good afternoon, I am very frustrated to get it work. I appreciate any advice! I have a very simple test environment. Laptop (WinXPpro) --------------------------- Cisco3750SW ------------------------------- Radius server (RHEL 4 with FreeRADIUS Version 2.1.6) 172.17.254.100/16 172.17.1.1/16 I have figured out how to configure attributes. Here is my "user" file: test Cleartext-Password := "test" Tunnel-Type = 16777229, Tunnel-Medium-Type = 16777222, Tunnel-Private-Group-ID = 3 When I use MD5-Challenge, I got put in the right vlan I wanted. However if I choose PEAP, I can be authenticated but the vlan thing won't work. I checked the Radius -X output very carefully and I don't see the server is sending any attributes, as it did when the MD5 is used... I chose different types of authentication on the windows box. It seems I don't have to change any configuration on the radius server for both authentications to work. I will attach both radius -X output for both types. I actually don't know if it's proper to ask questions in this email group... If I am asking at a wrong place, please tell me where I should go for asking questions like this... Thank you!! Difan

2 3

order of realm processing
by green green 19 Dec '09

19 Dec '09

i have domain1\user1 and this get radius proxy correctly to the radius1 server (11.11.11.11) based on ntdomain prefix have also set the ignore_null = yes i have user1@domain1 and this get radius proxy correctly to the radius1 server (11.11.11.11) based on suffix have also set the ignore_null = yes *under /modules/realm * realm ntdomain { format = prefix delimiter = "\\" ignore_default = yes ignore_null = yes } realm suffix { format = suffix delimiter = "@" ignore_default = yes ignore_null = yes } *Under proxy.conf* realm domain1 { type = radius nostrip authhost = 11.11.11.11:1812 accthost = 11.11.11.11:1813 secret = secret1 } realm NULL { type = auth authhost = 22.22.22.22:1812 accthost = 22.22.22.22:1813 secret = secret1 } *Debug * *[ntdomain] No '\' in User-Name = "user2", skipping NULL due to config. ++[ntdomain] returns noop [suffix] No '@' in User-Name = "user2", skipping NULL due to config. ++[suffix] returns noop* [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user2 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 211 to 3.3.3.3 port 1645 Waking up in 1.0 seconds. Cleaning up request 2 ID 210 with timestamp +14 Waking up in 3.9 seconds. Cleaning up request 3 ID 211 with timestamp +17 Ready to process requests. i have user2 (without domain) and this get rejected, i want it to send to radius2 server (22.22.22.22) as defined in the NULL domain as defined in the proxy.conf. Can advise how to do this?

3 5

rlm_perl: exited on signal 11 or 10
by Коньков Евгений 19 Dec '09

19 Dec '09

Hi, Freeradius-users. When I start radiusd with rlm_perl. I got: Nov 13 20:44:51 kes kernel: pid 91607 (radiusd), uid 133: exited on signal 11 Nov 13 20:44:55 kes monitord: restarted "radiusd" using "/usr/local/etc/rc.d/radiusd restart" Nov 13 20:46:41 kes kernel: pid 92168 (radiusd), uid 133: exited on signal 10 Nov 13 20:46:45 kes monitord: restarted "radiusd" using "/usr/local/etc/rc.d/radiusd restart" Nov 13 20:51:00 kes kernel: pid 92309 (radiusd), uid 133: exited on signal 11 Nov 13 20:51:08 kes monitord: restarted "radiusd" using "/usr/local/etc/rc.d/radiusd restart" Nov 13 20:56:00 kes kernel: pid 92599 (radiusd), uid 133: exited on signal 11 Nov 13 20:56:10 kes monitord: restarted "radiusd" using "/usr/local/etc/rc.d/radiusd restart" Nov 13 21:01:00 kes kernel: pid 92906 (radiusd), uid 133: exited on signal 11 Nov 13 21:01:02 kes monitord: restarted "radiusd" using "/usr/local/etc/rc.d/radiusd restart" Nov 13 21:01:42 kes kernel: pid 93219 (radiusd), uid 133: exited on signal 11 but when I run radiusd -X it works weeks, month... When I CTRL+C on radiusd -X it also may core dump. It says that core dumpe, but no core found on system (or I look at wrong place???) How to deal with that? -- С уважением, Коньков mailto:kes-kes@yandex.ru

2 3

rewrite or unlang problem
by Libor Astalos 18 Dec '09

18 Dec '09

Hi I'm trying to change access-request: rad_recv: Access-Request packet from host 192.168.3.171 port 39838, id=98, length=142 NAS-Port-Type = Ethernet NAS-Port = 2200961369 Calling-Station-Id = "1:0:24:81:44:41:1f" Called-Station-Id = "dhcp1" User-Name = "00:24:81:44:41:1F" User-Password = "" Agent-Remote-Id = "\000\006\000\025w\262\234\260" Agent-Circuit-Id = "\000\004\000\001\001\013" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.3.171 I need to change User-Name similar to this statement: update request { User-Name := %{request:Agent-Remote-Id} } but radiusd prints this: expand: %{User-Name} -> %{request:Agent-Remote-Id} and is searching in sql this string, not correct "\000\006\000\025w\262\234\260" Is there a way to reach this issue in freeradius similar to gnu-radius as shown below? string decode_agent_remote_id() { string agent; string newagent; agent = gsub("%"," ",tohex(%[Agent-Remote-Id])); newagent =field(agent,3)+":"+field(agent,4)+":"+field(agent,5)+":"+field(agent,6)+":"+field(agent,7)+":"+field(agent,8); %[Orig-User-Name] = %[User-Name]; %[User-Name] = newagent+"port:"+field(gsub("%","",tohex(%[Agent-Circuit-Id])),6); return 0; } thanks for advice Libor

3 4

Trying to get tunneling to work
by Mike Bernhardt 18 Dec '09

18 Dec '09

I am trying to set up freeradius to proxy requests 802.11 MSCHAPv2 to an IAS server. The IAS requests are authenticated by a Safeword server, which doesn't support 802.11. So the idea is that freeradius takes the request, proxies it to IAS as if it was a non-802.11 client, IAS passes it to the integrated Safeword server, and everything is happy. My configuration works from a 802.11 supplicant if the user exist locally in freeradius, but no proxying happens when the user doesn't exist locally. It doesn't appear to ever leave radiusd. What I hope is the relevant debug output is below. Please be nice, I am very new to RADIUS! If you could point out the issues you see and where to look for resolution I'd really appreciate it. If you need more info or the contents of any files, just ask. rad_recv: Access-Request packet from host 192.168.7.139 port 1645, id=90, length=253 User-Name = "mbernhardt" Framed-MTU = 1400 Called-Station-Id = "000a.f4e2.2a00" Calling-Station-Id = "0021.6a46.b0cc" Service-Type = Login-User Message-Authenticator = 0x6d0c7d1550b928f2c1e4819363b4c655 EAP-Message = 0x0209006b190017030100605b9dff6664aed05daf847f94f2c5653aeb8bd71c24eb8cb32250 7777f2326709a15aa5cca25c1fd4a80 78736d29db8a366c19e511ead9cd2464eea7d6c7c9ed1d334d140b044029ab54bad420b8a1a6 e09d0d98be53e16ce732e7ae903591d 65 NAS-Port-Type = Wireless-802.11 NAS-Port = 2948 State = 0x7986d88d7f8fc1cc817b41b32920e7cd NAS-IP-Address = 192.168.7.139 NAS-Identifier = "lks15w-ap350" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mbernhardt", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020900451a0209004031d64addabbce8df20ddb2b2bf5f76e1e00000000000000000b3641d 7bbaa84d8e02bd692d2b804b6eb8632 9e81e2c878c006d6265726e6861726474 server { PEAP: Setting User-Name to mbernhardt Sending tunneled request EAP-Message = 0x020900451a0209004031d64addabbce8df20ddb2b2bf5f76e1e00000000000000000b3641d 7bbaa84d8e02bd692d2b804b6eb8632 9e81e2c878c006d6265726e6861726474 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mbernhardt" State = 0xf069bb62f060a15804b7cea0a47025dc Framed-MTU = 1400 Called-Station-Id = "000a.f4e2.2a00" Calling-Station-Id = "0021.6a46.b0cc" Service-Type = Login-User NAS-Port-Type = Wireless-802.11 NAS-Port = 2948 NAS-IP-Address = 192.168.7.139 NAS-Identifier = "lks15w-ap350" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated [suffix] No '@' in User-Name = "mbernhardt", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 69 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 3 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop } # server inner-tunnel [peap] Got tunneled reply code 0 PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Not-EAP proxy set. Not composing EAP ++[eap] returns handled PEAP: Tunneled authentication will be proxied to safeword.eng PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. [eap] Tunneled session will be proxied. Not doing EAP. ++[eap] returns handled WARNING: Empty section. Using default return values. ERROR: Failed to create a new socket for proxying requests. ERROR: Failed inserting request into proxy hash. ERROR: Failed to proxy request 7 There was no response configured: rejecting request 7 Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mbernhardt attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 90 to 192.168.7.139 port 1645

3 9

accepting any login attempt with CHAP (not MS-CHAP)
by Klaas Jan Wierenga 18 Dec '09

18 Dec '09

Hi, I'm trying to accept any login attempt. So far it's working fine with the "Auth-Type := Accept", but now some users use CHAP and I get the following error messages: Thu Dec 17 19:33:16 2009 : Auth: Login incorrect (rlm_chap: Clear text password not available): [******/<CHAP-Password>] (from client **** port *****) ***** for possibly sensitive information I know from http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-October/msg… that it's not possible to accept any password when using MS-CHAP, but is it possible with CHAP? And if so, how can I configure Radius to accept any CHAP password? Your help is much appreciated. Regards, Klaas Jan Wierenga --- I'm using a rather old version of FreeRADIUS: # /usr/sbin/radiusd -v radiusd: FreeRADIUS Version 1.0.4, for host , built on Jul 20 2005 at 08:12:10

2 2

Accounting - Gettting Closer
by David Peterson 18 Dec '09

18 Dec '09

OK i think i am getting closer on my accounting. My radpostauth table is showing: 1 test(a)test.com 0xb1e66f99556e3880a7ac612354db4005a8 Access-Accept 2009-12-16 07:51:57 2 =7Bam=3D1=7D13D1EDD2A8D8EE4B0F7F34FAA87A0D0F(a)test.com Access-Accept 2009-12-16 07:51:57 For every authentication. Is this normal or do I have something duplicated in my configuration. David

1 0

Dropped packet and Radius stats
by Dinh Pham Cong 18 Dec '09

18 Dec '09

Hi all, My Radius server has received a lot of invalid packets. Those packets are dropped but the stats shows that no packet is dropped. Is it a bug? Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.137 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.137 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.137 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.137 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.137 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: [sql] stop packet with zero session length. [ip '10.160.15.191', nas '10.0.41.137'] Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.137 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.137 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Fri Dec 18 17:54:30 2009 : Error: Received Accounting-Request packet from 10.0.41.138 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. [root@radiusd2 mysql]# ./radmin -e "stats client acct" requests 939800 responses 690622 dup 0 invalid 0 malformed 0 bad_signature 0 dropped 0 unknown_types 0

2 1

Hello,
by J Brandon Polley 18 Dec '09

18 Dec '09

Hello, I'm new to this list and have never used one before. Here are my stats: FreeRadius version 1.272 Linux OES2 My problem is when I try and start freeRadius it tells me it can't find the other config files that are in etc/radiusd/ like proxy.confg and clients.config. Here is what the command prompt tells me when I start freeradius using debug mode: radius:~ # radiusd -x Starting - reading configuration files ... /etc/raddb/radiusd.conf[454]: Unable to open file "proxy.conf": No such file or directory Errors reading radiusd.conf Here is what line 454 in radiusd.conf has written: proxy_requests = yes $INCLUDE proxy.conf I know the FAQ might talk about this under the question: It says "Could not link...File not found",what do I do? I'm not sure if this is specifically talking about MySQL or they are only using it as an example. If this is my answer maybe somone could explain it a little more simpler to me? I have not yet got this to start. Can anyone help me figure out why it can't find proxy.conf?

7 10

Warning "stop packet with zero session length" and the difference between number of Radius requests and responses
by Dinh Pham Cong 18 Dec '09

18 Dec '09

Hi all, I set up a FreeRadius server to receive accounting start/stop packet from GGSN. Then FreeRadius will save the information into MySQL database. However, I see that there is a different between the number of received packets and the Radius response to GGSN [root@radiusd2 sbin]# ./radmin -e "stats client acct" requests 422959 responses 412155 dup 0 invalid 0 malformed 0 bad_signature 0 dropped 0 unknown_types 0 I understand that if GGSN sends an accounting start packet to Radius, it should make a corespondent response or GGSN will resend the packet. So I don't know why there is such a difference. Meanwhile, radius.log is filled with a lot of messages like those: Fri Dec 18 16:55:17 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.55.236', nas '10.0.40.145'] Fri Dec 18 16:55:17 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.61.79', nas '10.0.40.145'] Fri Dec 18 16:55:19 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.67.5', nas '10.0.40.146'] Fri Dec 18 16:55:19 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.93.207', nas '10.0.40.145'] Fri Dec 18 16:55:20 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.136.106', nas '10.0.40.145'] Fri Dec 18 16:55:20 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.56.0', nas '10.0.40.145'] Fri Dec 18 16:55:20 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.81.206', nas '10.0.40.146'] Fri Dec 18 16:55:22 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.35.166', nas '10.0.40.146'] Fri Dec 18 16:55:23 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.55.236', nas '10.0.40.145'] Fri Dec 18 16:55:23 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.61.79', nas '10.0.40.145'] Fri Dec 18 16:55:24 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.51.252', nas '10.0.40.145'] Fri Dec 18 16:55:25 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.93.207', nas '10.0.40.145'] Fri Dec 18 16:55:25 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.67.5', nas '10.0.40.146'] Fri Dec 18 16:55:26 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.56.0', nas '10.0.40.145'] Fri Dec 18 16:55:28 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.35.166', nas '10.0.40.146'] Fri Dec 18 16:55:30 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.51.252', nas '10.0.40.145'] Fri Dec 18 16:55:31 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.93.207', nas '10.0.40.145'] Fri Dec 18 16:55:32 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.49.191', nas '10.0.40.146'] Fri Dec 18 16:55:32 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.56.0', nas '10.0.40.145'] Fri Dec 18 16:55:32 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.75.195', nas '10.0.40.145'] Fri Dec 18 16:55:35 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.91.184', nas '10.0.40.146'] Fri Dec 18 16:55:36 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.113.243', nas '10.0.40.146'] Fri Dec 18 16:55:36 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.95.3', nas '10.0.40.145'] Fri Dec 18 16:55:37 2009 : Error: [sql] stop packet with zero session length. [ip '117.5.51.252', nas '10.0.40.145'] Any suggestion would be appreciated. Regards, Dinh

1 0