September 2009 - Freeradius-Users - lists.freeradius.org

Pre-release of 2.1.7
by Alan DeKok 08 Sep '09

08 Sep '09

It's been a while since 2.1.6, and it's getting close to time for 2.1.7. In order to ensure the stability of the software, we need your help. Please download the "pre" release of 2.1.7 from: http://git.freeradius.org/pre/ Build it, install it, and see if there are issues. The directory also includes Debian packages for Ubuntu 8.0.4. If there are no issues, we can release 2.1.7 this week. Alan DeKok.

12 30

mix user storage
by Rakotomandimby Mihamina 08 Sep '09

08 Sep '09

Hi all Using freeradius 2.x for AAA, is it possible to mix LDAP and xxxSQL? I mean one of those cases (the only difference is about the "credit"): case #1: LDAP: - username - password - MAC Address - NAS (the user is tied to that NAS) - credit (credit left) SQL - radacct case #2: LDAP: - username - password - MAC Address - NAS (the user is tied to that NAS) SQL - radacct - credit (credit left) Generally, written often data will be stored in SQL, what is left will be stored in the LDAP. Will it be very hard to setup? Any configuration hint? Thank you. -- Architecte Informatique chez Blueline/Gulfsat: Administration Systeme, Recherche & Developpement +261 34 29 155 34

2 1

Freeradius possible memory leak
by Szymon Roczniak 08 Sep '09

08 Sep '09

Hi, This could be related to a similar problem reported a couple of weeks ago. We have a FreeRADIUS 2.1.6 installation running on 64bit CentOS 5.3. The radiusd process is allocating more and more memory with time (around 0.5GB a day). There are only around 5-6 requests/s and other than chewing all memory the server doesn't seem to be doing much work. This radius instance has only one sql module (rlm_sql_mysql) in the authorize section and another one - sql_log (writing to a local file) in the post-auth section. The detail module is listed in accounting{} section but it's not used on this box (nothing is set to send accounting information to this server) All other sections in the default site are empty (the box only does auth) I've followed the advise from the previous thread and run radiusd under valgrind for around 10-15 minutes with some generated traffic and the output is: valgrind --tool=memcheck --leak-check=full /usr/sbin/radiusd -f [..] ==11730== LEAK SUMMARY: ==11730== definitely lost: 8,705,168 bytes in 27,890 blocks. ==11730== indirectly lost: 8,351,440 bytes in 26,598 blocks. ==11730== possibly lost: 17,072 bytes in 56 blocks. ==11730== still reachable: 118,598 bytes in 2,467 blocks. ==11730== suppressed: 0 bytes in 0 blocks. ==11730== Reachable blocks (those to which a pointer was found) are not shown. Is there anything else I can do to track it down and possibly fix the problem? Would setting up max_request_per_server to something else than 0 be a good workaround for it in the meantime? -- szymon roczniak simon(a)dischaos.com

2 7

Freeradius + MySQL At System Boot = Freeradius Failure
by James Duffy 08 Sep '09

08 Sep '09

Hi, Am having problems using freeradius and mysql. Basically they are both set to start at system boot but as MySQL takes longer to get going freeradius bombs out with Mysql error 'Can't connect to local MySQL server through socket '/var/run/mysql/mysql.sock' (2)' type errors. I can 'fix' this by adding a time delay in rc.local between the mysql startup and radiusd startup but this does not seem like the right way to fix this. Anyone else with this problem? Malcolm

6 9

freeradius + monit
by Sokvantha Youk 08 Sep '09

08 Sep '09

Dear All, I am new to Freeradius server. I wish to get it restart automatically when its process is hang by using monit. I have no idea how to get monit restart freeradius server automatically. Please kindly advice me. --- Best Regards, sokvantha __________________________________________________________________________________ Get more done like never before with Yahoo!7 Mail. Learn more: http://au.overview.mail.yahoo.com/

4 3

MAC Address Validation for phones
by Matthieu Lazaro 08 Sep '09

08 Sep '09

Hello list, I need some help on some unlang portion (if this is the right solution). Here is context: I need to do 802.1x on Ethernet switch for dynamic VLAN assignment for PCs . The problem is I have some phones connected between the PC and the switch. I don't want the users to login 802.1X with the phones so I have set them up to do MAC address user name and password without annoying the user over CHAP. Using users files works perfectly for my phones, as the ldap back end is for PC users. However, I have 300 phones that can be replaced if they are broken and I don't want to store all the info by hand in the users file. I tried to put this in the users file: if ( "%{User-Name}" =~ "00030BCA[0-9A-F]+" ) { "%{Cleartext-Password}" == "%{User-Name}" } Put it doesn't work because CHAP cannot find the user and his clear text password. So I guess I have put it in the wrong section AND/OR have done something wrong with my if but I can't find a way of checking as radius seems not to bother about it. I also tried to put it in the authentication section without success. I have read this http://wiki.freeradius.org/Mac-Auth but it seems too advanced for what I want to do as I don't need to rewrite anything. This guided me to try and put the script somewhere else. Thanks for your precious help. Best Regards, Matt

4 4

noresetcounter + NULL radacct records (First Connection)
by Neville 08 Sep '09

08 Sep '09

Hi, On occasions sqlcounter does not seem to work correctly, especially for NEW User that have no radacct details. After doing some digging, I've identified the issue only to happen on the first ever connect of the user in a new account. As you will see from the sql below, if no integer is returned (NULL), then Max-All-Sessions and the correct setting of is ignored and Session-Timeout is skipped. How can I address the NULL response for newly created accounts? rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> 6cmy75HS [noresetcounter] sql_set_user escaped user --> '6cmy75HS' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' rlm_sql (sql): Reserving sql socket id: 3 [noresetcounter] row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS'} -> rlm_sqlcounter: No integer found in string "" The ABOVE line is the problem, due to the SELECT returning a NULL ++[noresetcounter] returns noop Sending Access-Accept of id 177 to XX.XX.XX.XX port 54355 Idle-Timeout := 1800 Framed-MTU = 1488 Framed-Protocol = PPP Service-Type = Framed-User Acct-Interim-Interval := 300 Session-Timeout = 603484 MS-CHAP2-Success = 0xd2533d31333338414131333436353632453637323542433941374634463245413639444346343943333938 MS-MPPE-Recv-Key = 0xaab9e0a9c6918c64dfa042b3d84e808e MS-MPPE-Send-Key = 0xd2411e9ea8653fd25e550e5cbdbfa3e3 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 192.168.0.27 Framed-IP-Netmask = 255.255.255.0 After connecting and disconnecting in order to create some entrys for this user in radacct table, success as session-timeout is set correctly. rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> 6cmy75HS [noresetcounter] sql_set_user escaped user --> '6cmy75HS' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS' rlm_sql (sql): Reserving sql socket id: 2 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 2 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='6cmy75HS'} -> 23 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user 6cmy75HS, check_item=3600, counter=23 rlm_sqlcounter: Sent Reply-Item for user 6cmy75HS, Type=Session-Timeout, value=3577 ++[noresetcounter] returns ok Sending Access-Accept of id 180 to XX.XX.XX.XX port 60642 Idle-Timeout := 1800 Framed-MTU = 1488 Framed-Protocol = PPP Service-Type = Framed-User Acct-Interim-Interval := 300 Session-Timeout = 3577 MS-CHAP2-Success = 0x21533d37374337313930393839303834464630413633303846464535443634343243314435313930373942 MS-MPPE-Recv-Key = 0xd1fff368e638b09b9960d9dba58f08cc MS-MPPE-Send-Key = 0x2df743dda88067b995ffc736a5345f71 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Framed-IP-Address = 192.168.0.137 Framed-IP-Netmask = 255.255.255.0 Finished request 10. Best Regards Nev

2 1

Freeradius using binary perl module
by Leon 08 Sep '09

08 Sep '09

Hi, am new with freeradius. would like to know, if i use a binary perl module? ie, in raddb/modules/perl: perl { module = ${confdir}/some_binary.pl } i a currently using: ~# radiusd -v radiusd: FreeRADIUS Version 2.1.6, for host x86_64-unknown-linux-gnu, built on Aug 6 2009 at 13:50:41 compiled from tar.gz thanks. Leon

2 1

Re: Deployment
by tech.subscriptions＠shepherdhill.biz 08 Sep '09

08 Sep '09

tech.subscriptions(a)shepherdhill.biz wrote: >> I am trying to move to the production server after due tests. I >> installed version 2.1.6 on CentOS 5.2. Funnily I am getting Segmentation >> fault error when my hints file is to be loaded. The debug message is: ... >> Segmentation fault >> My Hints file gives error when this is inserted: >> >> DEFAULT User-Name =~ '^([^@]+)(@zmobile.com)?$', NAS-IP-Address == >> "10.76.100.69" >> User-Name := "%{1}" Alan DeKok wrote: > Please see "doc/bugs" > It's not a problem on any system I have access to. I have done the gdb and valgrind dumps. They are on: http://www.leadservers.com/gdb-radiusd.log & http://www.leadservers.com/valgrind-radiusd.log Kindly assist. Cheers, Chris.

2 1

RE: intel Proset/wireless -> OK // windows zero config -> KO
by Jaulin Bernard 07 Sep '09

07 Sep '09

Hi Norman, My Windows clients run XP SP3 ! And no problems with WEP/WPA + TKIP on this laptops. But, thanks for your help. Bernard. ------------------------------ Message: 3 Date: Mon, 7 Sep 2009 22:59:49 +1000 From: "Norman Goh" <normangoh(a)exemail.com.au> Subject: RE: intel Proset/wireless -> OK // windows zero config wireless -> KO To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <004601ca2fbb$154602a0$c801a8c0@Novacula> Content-Type: text/plain; charset="iso-8859-1" Hi Bernard, Based upon the provided information I would believe that this would be a driver problem, but without knowing what you have tried, your actual Intel Hardware and a proper wireless capture this is the best I can offer. To me if the Intel and Thinkpad wireless apps work with your current setup and is stable then the problem does not appear to be with Radius at all. If you are using XP with Service Pack 2 then you need the following two patches for WPA2 comms. WindowsXP-KB893357-v2-x86-ENU.exe WindowsXP-KB917021-v3-x86-ENU.exe These two provide extra code for the WPA2 Enterprise authentication methods you are using so that the Windows Zero config wireless can work properly. Service Pack 3 for XP is supposed to have these two patches but I would add them in anyway. For Linux, again this is a driver/module issue and you need to ensure that you have a couple of things running first before you attempt to connect to the AP, modules such as the wpa_supplicant and wpa_supplicant-gui (if you are using a desktop interface) are necessary, and the ieee80211 module if it is required. It also depends on your Intel Hardware and Firmware code that you have installed. I am assuming that you have Intel chipsets here and not Atheros chipsets, there is a big difference. This website will point you in the right direction even though the information maybe out of date by a couple of years, it may highlight a bug in your configuration files especially in linux. http://ipw2100.sourceforge.net/index.php You may already have tried the following suggestion ? work your way up from the lowest security wireless comms to the highest, (Ad-Hoc with no key, WEP, WPA-PSK, WPA-TKIP, WPA2-PSK, WPA2-TKIP, WPA2-EAP\TLS) to try an pin point the issue and confirm that the wireless works, at least for the less secure comms. The XP Sp2 without the patches will work up until WPA-PSK but due to the cryptography changes in WPA2 it won?t work without the patches. The Intel Proset and Thinkvantage tools would already have this extra code written in. If you are running a FAT Cisco AP and not the LWAP version, you can configure multiple profiles on the same gear so you can try the above without messing up your working wireless comms. Else you have to do the profiles in the WLAN controller software. Cheers Norman

1 0