July 2009 - Freeradius-Users - lists.freeradius.org

Error: rlm_eap: Failed to store handler
by Rokkhan 06 Aug '09

06 Aug '09

Hi, im new on the freeradius world but very curious. Sorry but my english is not very good. I have a working Freedius 1.0.5 server since year 2005 and i want to improve it, migrating a Freeradius 2.1.1-6 version, the latest version i have found for my Sles10 Sp2 server. This server its allowed to authenticate users by EAP-PEAP Mschapv2 and EAP-LEAP against Files and Ldap. In the new server moved all users in user's file to mysql server. All users in mysql are stored with Cleartext-Password. When i run server on debug mode for doing tests the server works without problems, and validate's users using both types of EAP and both Authorization types (Ldap and Mysql). But when i run as daemon and i introduce it in production validating about 2000 of users, freeradius 2.1.1-6 crashes in a few minutes and shows this error "Error: rlm_eap: Failed to store handler". I have only one server called default on sites-enabled configured like this. (The accounting is configured in another virtual server and works fine ) - Default Server - listen { ipaddr = * port = 1832 type = auth } authorize { preprocess eap { ok = return } sql ldap } # Authentication authenticate { Auth-Type MS-CHAP { mschap } # Allow EAP authentication. eap } session { sql } # Post-Authentication post-auth { Post-Auth-Type REJECT { attr_filter.access_reject sql } } pre-proxy { } post-proxy { eap } And Eap.conf is configured like this: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 300 # Cisco LEAP leap { } ## EAP-TLS tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = secret private_key_file = ${certdir}/cert-srv.pem certificate_file = ${certdir}/cert-srv.pem CA_file = ${cadir}/cacert.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no } mschapv2 { } } The debug log shows this. rad_recv: Access-Request packet from host 10.50.31.201 port 1645, id=48, length=120 User-Name = "25" Framed-MTU = 1400 Called-Station-Id = "000d.ed77.db21" Calling-Station-Id = "000b.6b1e.7177" Message-Authenticator = 0xf1247640d8918729e0c58f0f88dc5a8a EAP-Message = 0x02010007013235 NAS-Port-Type = Virtual NAS-Port = 358 NAS-IP-Address = 10.50.31.201 NAS-Identifier = "sar76010001" Mon Jul 27 17:16:25 2009 : Info: +- entering group authorize {...} Mon Jul 27 17:16:25 2009 : Info: ++[preprocess] returns ok Mon Jul 27 17:16:25 2009 : Info: [eap] EAP packet type response id 1 length 7 Mon Jul 27 17:16:25 2009 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Jul 27 17:16:25 2009 : Info: ++[eap] returns updated Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Info: [sql] sql_set_user escaped user --> '25' Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 6 Mon Jul 27 17:16:25 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '25' ORDER BY id Mon Jul 27 17:16:25 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '25' ORDER BY priority Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Released sql socket id: 6 Mon Jul 27 17:16:25 2009 : Info: [sql] User 25 not found Mon Jul 27 17:16:25 2009 : Info: ++[sql] returns notfound Mon Jul 27 17:16:25 2009 : Info: [ldap] performing user authorization for 25 Mon Jul 27 17:16:25 2009 : Info: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Mon Jul 27 17:16:25 2009 : Info: [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=25) Mon Jul 27 17:16:25 2009 : Info: [ldap] expand: o=eroskiusers -> o=eroskiusers Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: performing search in o=eroskiusers, with filter (uid=25) Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: object not found or got ambiguous search result Mon Jul 27 17:16:25 2009 : Info: [ldap] search failed Mon Jul 27 17:16:25 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Jul 27 17:16:25 2009 : Info: ++[ldap] returns notfound Mon Jul 27 17:16:25 2009 : Info: Found Auth-Type = EAP Mon Jul 27 17:16:25 2009 : Info: +- entering group authenticate {...} Mon Jul 27 17:16:25 2009 : Info: [eap] EAP Identity Mon Jul 27 17:16:25 2009 : Info: [eap] processing type tls Mon Jul 27 17:16:25 2009 : Info: [tls] Initiate Mon Jul 27 17:16:25 2009 : Info: [tls] Start returned 1 Mon Jul 27 17:16:25 2009 : Error: rlm_eap: Failed to store handler Mon Jul 27 17:16:25 2009 : Info: ++[eap] returns fail Mon Jul 27 17:16:25 2009 : Info: Failed to authenticate the user. Mon Jul 27 17:16:25 2009 : Auth: Login incorrect (rlm_ldap: User not found): [25/<via Auth-Type = EAP>] (from client wifiap_arenal port 358 cli 000b.6b1e.7177) Mon Jul 27 17:16:25 2009 : Info: Using Post-Auth-Type Reject Mon Jul 27 17:16:25 2009 : Info: +- entering group REJECT {...} Mon Jul 27 17:16:25 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Jul 27 17:16:25 2009 : Info: ++[attr_filter.access_reject] returns updated Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Name} -> 25 Mon Jul 27 17:16:25 2009 : Info: [sql] sql_set_user escaped user --> '25' Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{User-Password} -> Mon Jul 27 17:16:25 2009 : Info: [sql] expand: %{Chap-Password} -> Mon Jul 27 17:16:25 2009 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '25', '', 'Access-Reject', '2009-07-27 17:16:25') Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '25', '', 'Access-Reject', '2009-07-27 17:16:25') Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 5 Mon Jul 27 17:16:25 2009 : Debug: rlm_sql (sql): Released sql socket id: 5 Mon Jul 27 17:16:25 2009 : Info: ++[sql] returns ok Mon Jul 27 17:16:25 2009 : Info: Delaying reject of request 1045 for 1 seconds Mon Jul 27 17:16:25 2009 : Debug: Going to the next request Mon Jul 27 17:16:25 2009 : Info: Cleaning up request 994 ID 190 with timestamp +39 Mon Jul 27 17:16:25 2009 : Info: Sending delayed reject for request 1040 I looked to machine resources and CPU is 90% idle and has 1Gb of free ram when crashes so i dont think that could be a memory or cpu load problem. Anyone can help me, what im a doing wrong?. The configuration is very similar to the freeradius 1.0.5 server that works well. Thanks for all.

3 5

EAP errors in 2.1.1
by Wegener, Norbert 06 Aug '09

06 Aug '09

We are seeing an increasing number of eap error messages: Error: rlm_eap: No EAP session matching the State variable As mentioned in the Changelog in later version an eap error has been detected and fixed in 2.1.4 Fix EAP-TLS bug. Patch from Arnaud Ebalard Is this bug-fix related to the error messageabove so that upgrading alone would help? Norbert Wegener

4 5

Version 2.1.0 has been released.
by Alan DeKok 05 Aug '09

05 Aug '09

We are happy to announce the release of Version 2.1.0 of the FreeRADIUS server, with some major new features. Highlights include improved SNMP support, dynamically-defined clients, much more flexible (and readable) debugging mode, WiMAX support, fast reauthentication for PEAP and TTLS, and a command-line tool to administer a running server. The administration tool can stop the server, HUP it, or in limited cases, change the configuration of a running server, and cause just one module to reload it's configuration. Alan DeKok. Detailed change log: FreeRADIUS 2.1.0 Fri Sep 5 13:20:01 CEST 2008; , urgency=medium Feature improvements * Clients may now be defined dynamically, based on IP address. See raddb/sites-available/dynamic-clients. * SNMP support is now available through an experimental Perl script. See scripts/snmp-proxy/README * SNMP statistics are available through Status-Server packets. See raddb/sites-available/status * Added more Microsoft attributes from bug #568. * The "linelog" module has more functionality and flexibility. See raddb/modules/linelog. * The debugging output has been sanitized. It should be much more readable. * Debug logs can now be turned on/off while the server is running, for a user, group, realm, etc. See the "log" section of radiusd.conf. * Added support for WiMAX Forum attributes. The dynamic keys are not yet calculated. See share/dictionary.wimax * Added session resumption for PEAP and TTLS. See raddb/eap.conf, "cache" sub-section. * Added "radmin" command-line tool for administering a running server. See "man radmin" and raddb/sites-available/control-socket. Bug fixes * Double escaping of '\\' in the "users" (and some other) files has been fixed. If you have '\\' in the "users" file, your configuration WILL NEED TO BE CHECKED, AND FIXED! * Parse "security" section in radiusd.conf. This was accidentally deleted in 2.0.5. Closes bug #566. * Bind to interface before IP, which allows DHCP sockets to listen on "*" for multiple interfaces. * Fix handling of giaddr in DHCP responses. * Corrected parsing of status_check in home_server so that it works. * Fix hints so that "Puser" works again. * Removed length restrictions on attribute names in the dictionaries. * Update socket code to avoid C compiler optimizations.

6 14

Freeradius and memory usage
by Roy Kartadinata 05 Aug '09

05 Aug '09

Hello, Our radius server is currently having some memory issue where its memory usage would increase by 1% every 30-45 minutes. Eventually the server will crash and restart because of out of memory. We've been using freeradius for a couple of years and this just started on Thursday so I upgraded our radius to the latest 2.1.6 from 2.1.5 but the problem still there. Has anyone ever experiencing this issue before? Cheers, Roy Kartadinata

4 17

rlm_ldap: ldap_search() failed: Operations error
by Alba 03 Aug '09

03 Aug '09

Hello all, I'm receiving this message: rlm_ldap: ldap_search() failed: Operations error and I found in the list archives ( http://www.nabble.com/FreeRadius-cannot-Authenticate-to-Windows-AD-td196909…) this information: > rlm_ldap: ldap_search() failed: Operations error > http://bugs.freeradius.org/show_bug.cgi?id=183 > You're running into two issues: > > - the OpenLDAP client libraries don't use the >authentication credentials they're given when following references. > > - Active Directory is following references because your domain >controller has two domains, and the user isn't found in one, so it's >being referred to the other domain. > >The patch might help, but your LDAP queries should be made more specific. > Alan DeKok. But I can't see the bug information ("Page not found"). Does anyone know were I can find this information or other information about what this message means? Thanks in advance for your help. Regards, Alba

3 6

RE: Unknown attribute "Max-All-Session"
by boroba -- 01 Aug '09

01 Aug '09

From: flache4(a)hotmail.com To: flache4(a)hotmail.com Subject: RE: Unknown attribute "Max-All-Session" Date: Fri, 31 Jul 2009 15:56:03 +0000 thanks for reply i have install freeradius2 and configure it like http://wiki.freeradius.org/Rlm_sqlcounter and i get error when i start it. Fri Jul 31 15:55:36 2009 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Jul 31 15:55:36 2009 : Info: rlm_sql (sql): Attempting to connect to root@localhost:/radius Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Fri Jul 31 15:55:36 2009 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri Jul 31 15:55:36 2009 : Error: /etc/raddb/users[204]: Parse error (check) for entry test0001: Invalid octet string "540" for attribute name "Max-All-Session" Fri Jul 31 15:55:36 2009 : Error: Errors reading /etc/raddb/users Fri Jul 31 15:55:36 2009 : Error: /etc/raddb/modules/files[7]: Instantiation failed for module "files" Fri Jul 31 15:55:36 2009 : Error: /etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". Fri Jul 31 15:55:36 2009 : Error: /etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Fri Jul 31 15:55:36 2009 : Error: Failed to load virtual server inner-tunnel Fri Jul 31 15:55:36 2009 : Error: Errors initializing modules thanks in advance Avec Windows Live, vous organisez, retouchez et partagez vos photos. _________________________________________________________________ Sur Windows Live Ideas, découvrez en exclusivité de nouveaux services en ligne... si nouveaux qu'ils ne sont pas encore sortis officiellement sur le marché ! http://ideas.live.com

3 4

Re: Restart radiusd after new user added
by Alexandre Chapellon 31 Jul '09

31 Jul '09

Please reply to the list. Le vendredi 31 juillet 2009 à 16:17 -0500, Paul Blalock a écrit : > I tried the radmin> hup files, command, with no luck. The command was > accepted, but it did nothing. > > What version of freeradius are you runing? If you have 2.1.1 or greater, just activate the control socket as a virtual server (see in /etc/freeradius/sites-available) by linking it to /etc/freeradius/sites-enabled/ Check that the soket is in read/write mode (mode =rw) and it has correct uid/gid. Restart freeradius (yeah I know that's what we want to avoid :p) Then run radmin (as root), and try "hup files" This works properly on my setup... > > -- > Paul

1 0

Restart radiusd after new user added
by Blalock, Paul (NCC) 31 Jul '09

31 Jul '09

I am setting up freeradius, and am having issues with adding users and having to restart radiusd to pick up the new users. Is sql the only other way to go, or is there a way to point the users file to another directory? Also, is there a way to have username passwords formatted as (user pass) or (user, pass)?

2 1

load-balance behavior
by Alexandre Chapellon 31 Jul '09

31 Jul '09

Hello the list, Does the "load-balance" type in home_server_pool can handle when one the home_server of the pool is down? Does it loose tickets in such a situation or can i consider it as a "fail-over" pool too? thx

2 1

Unknown attribute "Max-All-Session"
by boroba -- 31 Jul '09

31 Jul '09

hi all ; i have installed freeradius on centos 5.2 he are packege installed: freeradius-1.1.3-1.4.el5 freeradius-mysql-1.1.3-1.4.el5 and i follow the document http://wiki.freeradius.org/Rlm_sqlcounter and when i start radius i get error [root@squid raddb]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files /etc/raddb/users[107]: Parse error (check) for entry test0001: Unknown attribute "Max-All-Session" Errors reading /etc/raddb/users radiusd.conf[1062]: files: Module instantiation failed. radiusd.conf[1840] Unknown module "files". radiusd.conf[1776] Failed to parse authorize section. thanks in advance _________________________________________________________________ Avec Windows Live, vous organisez, retouchez et partagez vos photos. http://www.microsoft.com/northafrica/windows/windowslive/products/photo-gal…

2 1