September 2009 - Freeradius-Users - lists.freeradius.org

sqlippool
by tseveendorj 30 Sep '09

30 Sep '09

Dear all, I'm trying to use rlm_sqlippool with mysql. User can get IP address from pool with Pool-Name attribute but all users get same IP address. How to solve this ? Best regards, Tseveendorj TunamalCom LLC

2 2

Re: Dictionary problem preventing startup..(AudioCodes)
by mark smith 29 Sep '09

29 Sep '09

That was actually not what was really in the users file. I had changed that to the Cleartext syntax. I copied that straight out of the manual, so I'm starting to wonder if they wrote their docs for an old version of freeradius. But the dictionary still seems to be causing a stop. #Line 36 # AudioCodes VSA dictionary BEGIN-VENDOR AudioCodes ATTRIBUTE ACL-Auth-Level 35 integer VALUE ACL-Auth-Level ACL-Auth-UserLevel 50 VALUE ACL-Auth-Level ACL-Auth-AdminLevel 100 VALUE ACL-Auth-Level ACL-Auth-SecurityAdminLevel 200 END-VENDOR AudioCodes Errors reading dictionary: dict_init: /opt/local/etc/raddb/dictionary[37]: unknown vendor AudioCodes ---------- Original Message ---------------------------------- From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Date: Tue, 29 Sep 2009 22:01:05 +0100 >Hi, > >> john Auth-Type := Local, User-Password == "qwerty" > >delete the Auth-Type part, change User-Password == to Cleartext-Password := > >- this is clearly documented in the users file and the WIKI > >Ivan has already corrected your dictionary entry :-) > >alan >

2 1

Dictionary problem preventing startup..(AudioCodes)
by mark smith 29 Sep '09

29 Sep '09

Hello. Trying to set up some new devices (AudioCodes MP118) to authenticate, but the dictionary entries the mfr. says is for FreeRadius doesn't quite work. Using FreeRadius v. 2.1.6 on Mac OS X The users entries they say to try looks like this: john Auth-Type := Local, User-Password == "qwerty" Service-Type = Login-User, ACL-Auth-Level = ACL-Auth-SecurityAdminLevel or on another user, it's set lower as: ACL-Auth-Level = ACL-Auth-UserLevel #AudioCodes VSA dictionary VENDOR AudioCodes 5003 ATTRIBUTE ACL-Auth-Level 35 integer AudioCodes VALUE ACL-Auth-Level ACL-Auth-UserLevel 50 VALUE ACL-Auth-Level ACL-Auth-AdminLevel 100 VALUE ACL-Auth-Level ACL-Auth-SecurityAdminLevel 200 But that above entry causes this: Errors reading dictionary: dict_init: /opt/local/etc/raddb/dictionary[39]: unknown option "AudioCodes" For kicks, I have tried leaving the dictionary entry out and tried Login-User by itself (doesn't authenticate) as well as Administrative-User for Service Type but all that does is authenticate, but at a level too low to do anything. Needless to say, commenting out the dictionary entries just cause the daemon to choke on the users file... And vice versa. http://www.audiocodes.com/filehandler.ashx?fileid=36358 is the guide I was using for reference. Thanks in advance for any pointers. Mark

3 3

Logging configuration
by leopold 29 Sep '09

29 Sep '09

Hello, Could someone please recommend the way to configure a very simple logging in FreeRadius 2.1.7? As you know there are many sections like Authorize,Authenticate,Post-Auth and there is some logic in unlang so depending on if/else statements and flow regardless if authentication passed Access-Reject/Access-Accept can be send. What we need is logging all the real FINAL messages that RADIUS sends to the client Access-Rejects/Access-Accept in one line with simple detail about NAS and UserName: Something like: Time,Access-Reject(or Accept),NAS-IP-Address,User-Name I looked into "modules/detail.log" module and I have a couple of questions because apparently I have problem using it: 1. In post-auth I need to put it many places depending on unlang logic I had to add it in REJECT post-auth { .... person can get rejected Post-Auth-Type REJECT { ---> reply_log attr_filter.access_reject } .. } Is there a way to put logging in one final place so it will be invoked regardless of UNLANG flow? 2. In post-auth reply_log does not log "User-Name" for PAP requests with Kerberos authentication In my case I have something like that Tue Sep 29 13:38:46 2009 Packet-Type = Access-Accept Attr1 = Val1 Attr2 = Val2 But User-Name is not logged. Is the a way to log it? For EAP-TLS apparently "User-Name" is part of reply attributes and it logs it correctly 3) If I do not want to use a separate file for every Client-Ip-Address detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d Is there a way to force it to log Client-IP-Address/NAS-Ip address into one file as prt of log message line? detailfile = ${radacctdir}/auth-detail-%Y%m%d It is just difficult to manage so many files for every NAS device Thanks a lot for you help. -- View this message in context: http://www.nabble.com/Logging-configuration-tp25668034p25668034.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

EAP with a non EAP Radius server
by Jacques FOUCHER 29 Sep '09

29 Sep '09

Hi, I want to use eap to authenticate Wireless users on an radius server wich don't know EAP protocol. It seems that is possible to do that using a proxy freeradius. The architecture should be : Access Point as a NAS Freeradius as a proxy Radius server without EAP 192.168.0.250 192.168.0.64 192.168.0.252 <-------------------------------EAP-----------------------------------------> <-----------------------------------MS-CHAP v2 or other--------------------------------------------------------------------> The idea is to convert an EAP Response/Identity to a radius Access-Request without EAP inside As the first radius i use freeradius Version 2.0.4 As the second one, i use IAS (just to test, but in the final configuration, it will not) When i configure IAS with EAP method in Remote access Policy, it works. When I remove EAP method from IAS, it's not. The problem is that freeradius is acting as a proxy without removing EAP and it is not what i want. This is the modifications i did on configuration files, ask me if you need more proxy.conf : realm DEFAULT { authhost = 192.168.0.252:1812 accthost = 192.168.0.252:1813 secret = secret } eap.conf : ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } On wireless, i tried TTLS and PEAP with same unsuccessfull result. That is freeradius log : Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.250 port 32769, id=30, length=229 Acct-Session-Id = "8b0b0795-0000009c" NAS-Port = 157 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP1" NAS-IP-Address = 192.168.0.250 Framed-MTU = 1496 User-Name = "test" Calling-Station-Id = "00-13-02-C4-80-4C" Called-Station-Id = "00-0F-61-FE-EF-D2" Service-Type = Framed-User EAP-Message = 0x021a00090174657374 Colubris-AVPair = "ssid=test2" Colubris-AVPair = "vsc-unique-id=3" Colubris-AVPair = "phytype=IEEE802dot11g" Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x0ed85e6e5c0765e5390b037233c60d73 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: Found realm "DEFAULT" rlm_realm: Adding Stripped-User-Name = "test" rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Proxying request from user test to realm DEFAULT rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated rlm_eap: Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 224 to 192.168.0.252 port 1812 Acct-Session-Id = "8b0b0795-0000009c" NAS-Port = 157 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP1" NAS-IP-Address = 192.168.0.250 Framed-MTU = 1496 User-Name = "test" Calling-Station-Id = "00-13-02-C4-80-4C" Called-Station-Id = "00-0F-61-FE-EF-D2" Service-Type = Framed-User EAP-Message = 0x021a00090174657374 Colubris-AVPair = "ssid=test2" Colubris-AVPair = "vsc-unique-id=3" Colubris-AVPair = "phytype=IEEE802dot11g" Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3330 Proxying request 1 to home server 192.168.0.252 port 1812 Sending Access-Request of id 224 to 192.168.0.252 port 1812 Acct-Session-Id = "8b0b0795-0000009c" NAS-Port = 157 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AP1" NAS-IP-Address = 192.168.0.250 Framed-MTU = 1496 User-Name = "test" Calling-Station-Id = "00-13-02-C4-80-4C" Called-Station-Id = "00-0F-61-FE-EF-D2" Service-Type = Framed-User EAP-Message = 0x021a00090174657374 Colubris-AVPair = "ssid=test2" Colubris-AVPair = "vsc-unique-id=3" Colubris-AVPair = "phytype=IEEE802dot11g" Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3330 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 192.168.0.252 port 1812, id=224, length=24 Proxy-State = 0x3330 +- entering group post-proxy rlm_eap: No pre-existing handler found ++[eap] returns noop Login incorrect (Home Server says so): [test/<no User-Password attribute>] (from client AP1 port 157 cli 00-13-02-C4-80-4C) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 30 to 192.168.0.250 port 32769 Waking up in 4.9 seconds. On IAS Server, this is the error message (Sorry it is a french version, but the idea is IAS receive EAP message) L'accès a été refusé à l'utilisateur test. Nom-Complet-Utilisateur = jacques.net/Users/test Adresse-IP-NAS = 192.168.0.250 Identificateur-NAS = AP1 Identificateur-Station-Appelée = 00-0F-61-FE-EF-D2 Identificateur-Station-Appelante = 00-13-02-C4-80-4C Nom-Convivial-Client = freeradius Adresse-IP-Client = 192.168.0.64 Type-Port-NAS = Wireless - IEEE 802.11 Port-NAS = 107 Proxy-Policy-Name = test Authentication-Provider = Windows Authentication-Server = <non déterminé> Policy-Name = test Authentication-Type = EAP EAP-Type = <non déterminé> Reason-Code = 66 Reason = L'utilisateur a essayé d'utiliser une méthode d'authentification qui n'est pas activée sur la stratégie d'accès à distance correspondante. Le nom de la stratégie d'accès à distance correspondante. Pour plus d'informations, consultez le centre Aide et support à l'adresse http://go.microsoft.com/fwlink/events.asp. I hope you could help me. -- Jacques

4 10

Re: New install does not respond to requests
by Alex M 29 Sep '09

29 Sep '09

So i dont even see any access to my database at all, i see that SQL config is loaded but no request Do i have to add any parameters when compiling the code so that we have support of network functionality? TNX a lot! On Mon, Sep 28, 2009 at 7:26 PM, Alex M <freeradius(a)lrcommunications.net>wrote: > tee worked =) tnx > still no lack, not even errors, i mean i got output dump, but there is no > trace of requesting MySQL or having an error loading my sql.... > belo is the output. > > PS: im not good in linux or freeradius but the only way to become bbeter is > try it and ask question otherwise i keep sucking =) > ============================================ > > > > FreeRADIUS Version 2.1.7, for host i686-pc-linux-gnu, built on Sep 26 2009 > at 17:24:15 > Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > including configuration file /usr/local/etc/raddb/radiusd.conf > including configuration file /usr/local/etc/raddb/proxy.conf > including configuration file /usr/local/etc/raddb/clients.conf > including files in directory /usr/local/etc/raddb/modules/ > including configuration file /usr/local/etc/raddb/modules/acct_unique > including configuration file /usr/local/etc/raddb/modules/expiration > including configuration file /usr/local/etc/raddb/modules/krb5 > including configuration file /usr/local/etc/raddb/modules/echo > including configuration file /usr/local/etc/raddb/modules/otp > including configuration file /usr/local/etc/raddb/modules/realm > including configuration file /usr/local/etc/raddb/modules/sradutmp > including configuration file /usr/local/etc/raddb/modules/digest > including configuration file /usr/local/etc/raddb/modules/ldap > including configuration file /usr/local/etc/raddb/modules/chap > including configuration file /usr/local/etc/raddb/modules/always > including configuration file /usr/local/etc/raddb/modules/mac2vlan > including configuration file /usr/local/etc/raddb/modules/expr > including configuration file /usr/local/etc/raddb/modules/preprocess > including configuration file /usr/local/etc/raddb/modules/mschap > including configuration file /usr/local/etc/raddb/modules/policy > including configuration file /usr/local/etc/raddb/modules/ > detail.example.com > including configuration file /usr/local/etc/raddb/modules/detail > including configuration file /usr/local/etc/raddb/modules/inner-eap > including configuration file /usr/local/etc/raddb/modules/exec > including configuration file > /usr/local/etc/raddb/modules/sqlcounter_expire_on_login > including configuration file /usr/local/etc/raddb/modules/mac2ip > including configuration file /usr/local/etc/raddb/modules/radutmp > including configuration file /usr/local/etc/raddb/modules/logintime > including configuration file /usr/local/etc/raddb/modules/smbpasswd > including configuration file /usr/local/etc/raddb/modules/files > including configuration file /usr/local/etc/raddb/modules/passwd > including configuration file /usr/local/etc/raddb/modules/wimax > including configuration file /usr/local/etc/raddb/modules/sql_log > including configuration file /usr/local/etc/raddb/modules/pam > including configuration file /usr/local/etc/raddb/modules/smsotp > including configuration file /usr/local/etc/raddb/modules/perl > including configuration file /usr/local/etc/raddb/modules/ippool > including configuration file /usr/local/etc/raddb/modules/counter > including configuration file /usr/local/etc/raddb/modules/pap > including configuration file /usr/local/etc/raddb/modules/unix > including configuration file /usr/local/etc/raddb/modules/cui > including configuration file /usr/local/etc/raddb/modules/linelog > including configuration file /usr/local/etc/raddb/modules/attr_rewrite > including configuration file /usr/local/etc/raddb/modules/detail.log > including configuration file /usr/local/etc/raddb/modules/etc_group > including configuration file /usr/local/etc/raddb/modules/attr_filter > including configuration file /usr/local/etc/raddb/modules/checkval > including configuration file /usr/local/etc/raddb/eap.conf > including configuration file /usr/local/etc/raddb/sql.conf > including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf > including configuration file /usr/local/etc/raddb/policy.conf > including files in directory /usr/local/etc/raddb/sites-enabled/ > including configuration file > /usr/local/etc/raddb/sites-enabled/inner-tunnel > including configuration file /usr/local/etc/raddb/sites-enabled/default > including configuration file > /usr/local/etc/raddb/sites-enabled/control-socket > including dictionary file /usr/local/etc/raddb/dictionary > main { > prefix = "/usr/local" > localstatedir = "/usr/local/var" > logdir = "/usr/local/var/log/radius" > libdir = "/usr/local/lib" > radacctdir = "/usr/local/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > max_requests = 1024 > allow_core_dumps = no > pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > checkrad = "/usr/local/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > Module: Linked to module rlm_expiration > Module: Instantiating expiration > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server inner-tunnel { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > Module: Instantiating pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/usr/local/var/log/radius/radwtmp" > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 2048 > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/usr/local/etc/raddb/certs/server.pem" > certificate_file = "/usr/local/etc/raddb/certs/server.pem" > CA_file = "/usr/local/etc/raddb/certs/ca.pem" > private_key_password = "whatever" > dh_file = "/usr/local/etc/raddb/certs/dh" > random_file = "/usr/local/etc/raddb/certs/random" > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" > cache { > enable = no > lifetime = 24 > max_entries = 255 > } > } > Module: Linked to sub-module rlm_eap_ttls > Module: Instantiating eap-ttls > ttls { > default_eap_type = "md5" > copy_request_to_tunnel = no > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > } > Module: Linked to sub-module rlm_eap_peap > Module: Instantiating eap-peap > peap { > default_eap_type = "mschapv2" > copy_request_to_tunnel = no > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > } > Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no > } > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_realm > Module: Instantiating suffix > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > Module: Linked to module rlm_files > Module: Instantiating files > files { > usersfile = "/usr/local/etc/raddb/users" > acctusersfile = "/usr/local/etc/raddb/acct_users" > preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > compat = "no" > } > Module: Checking session {...} for more modules to load > Module: Linked to module rlm_radutmp > Module: Instantiating radutmp > radutmp { > filename = "/usr/local/var/log/radius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > perm = 384 > callerid = yes > } > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > Module: Linked to module rlm_attr_filter > Module: Instantiating attr_filter.access_reject > attr_filter attr_filter.access_reject { > attrsfile = "/usr/local/etc/raddb/attrs.access_reject" > key = "%{User-Name}" > } > } # modules > } # server > server { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Checking authorize {...} for more modules to load > Module: Linked to module rlm_preprocess > Module: Instantiating preprocess > preprocess { > huntgroups = "/usr/local/etc/raddb/huntgroups" > hints = "/usr/local/etc/raddb/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > Module: Checking preacct {...} for more modules to load > Module: Linked to module rlm_acct_unique > Module: Instantiating acct_unique > acct_unique { > key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, > NAS-Port" > } > Module: Checking accounting {...} for more modules to load > Module: Linked to module rlm_detail > Module: Instantiating detail > detail { > detailfile = > "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > header = "%t" > detailperm = 384 > dirperm = 493 > locking = no > log_packet_header = no > } > Module: Instantiating attr_filter.accounting_response > attr_filter attr_filter.accounting_response { > attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" > key = "%{User-Name}" > } > Module: Checking session {...} for more modules to load > Module: Checking post-proxy {...} for more modules to load > Module: Checking post-auth {...} for more modules to load > } # modules > } # server > radiusd: #### Opening IP addresses and Ports #### > listen { > type = "auth" > ipaddr = * > port = 0 > } > listen { > type = "acct" > ipaddr = * > port = 0 > } > listen { > type = "control" > listen { > socket = "/usr/local/var/run/radiusd/radiusd.sock" > } > } > Listening on authentication address * port 1812 > Listening on accounting address * port 1813 > Listening on command file /usr/local/var/run/radiusd/radiusd.sock > Listening on proxy address * port 1814 > Ready to process requests. > > > > > > ============================================= > [end of dump] > > > On Mon, Sep 28, 2009 at 7:02 PM, Ivan Kalik <tnt(a)kalik.net> wrote: > >> > Ok readclients was not enabled :( >> > Still enabling that did not help. (I did restart the server after >> enabling >> > it ;-) >> > >> > How do I output screen to file? I tried radiusd -X >radius_log.txt but >> > that >> > just didnt execure anything :( >> >> It did. If it looks like it didn't you probably need to do updatedb or >> such to see the file. >> >> You shold learn some basic Linux admin before trying to run things like >> freeradius. See what this "magic" does (read first what that tee thing >> does): >> >> radiusd -X | tee mylog.txt >> >> Ivan Kalik >> Kalik Informatika ISP >> >> >

3 5

Error: WARNING: Unresponsive child
by muffin sk 29 Sep '09

29 Sep '09

Hello all, I am continuously getting this error message on my /var/log/radius/radius.log file: Mon Sep 28 18:26:55 2009 : Error: WARNING: Unresponsive child (id 1094719808) for request 24026 (in component accounting module rlm_exec) In effect, I got a timeout on account start and stop which resulted that even the user is able to authenticate and authorize, accounting side fails. I have attached my /etc/raddb/radiusd.conf for more information. My RADIUS machine has the following information: # cat /etc/redhat-release CentOS release 5.2 (Final) # rpm -qa | grep freeradius freeradius-1.1.7-2 # free -m total used free shared buffers cached Mem: 1536 1388 147 0 166 882 -/+ buffers/cache: 338 1197 Swap: 2008 13 1994 # iostat -x Linux 2.6.18-53.el5xen (radius-1) 09/28/2009 /etc/sysconfig/sysstat.ioconf: Malformed 0 field record: --- avg-cpu: %user %nice %system %iowait %steal %idle 8.04 0.00 13.89 0.00 0.00 78.07 Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq-sz avgqu-sz await svctm %util xvda 0.00 6.24 0.00 3.15 0.16 75.15 23.86 0.00 0.24 0.07 0.02 # cat /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1994.999 cache size : 6144 KB physical id : 0 siblings : 1 core id : 0 cpu cores : 1 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu tsc msr pae mce cx8 apic mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 4994.09 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 1 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1994.999 cache size : 6144 KB physical id : 1 siblings : 1 core id : 0 cpu cores : 1 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu tsc msr pae mce cx8 apic mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 4994.09 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 2 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1994.999 cache size : 6144 KB physical id : 2 siblings : 1 core id : 0 cpu cores : 1 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu tsc msr pae mce cx8 apic mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 4994.09 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 3 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1994.999 cache size : 6144 KB physical id : 3 siblings : 1 core id : 0 cpu cores : 1 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu tsc msr pae mce cx8 apic mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 4994.09 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: On my database machine, I have the following information: # cat /etc/redhat-release CentOS release 5 (Final) # rpm -qa | grep MySQL MySQL-shared-community-5.0.67-0.rhel5 MySQL-client-community-5.0.67-0.rhel5 MySQL-server-community-5.0.67-0.rhel5 # free -m total used free shared buffers cached Mem: 3948 3619 328 0 451 2760 -/+ buffers/cache: 406 3541 Swap: 8189 0 8189 # iostat -x Linux 2.6.18-92.1.6.el5 (database-1) 09/28/2009 /etc/sysconfig/sysstat.ioconf: Malformed 0 field record: --- avg-cpu: %user %nice %system %iowait %steal %idle 0.82 0.00 0.06 0.01 0.00 99.10 Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq-sz avgqu-sz await svctm %util sda 0.02 10.52 0.04 3.93 3.30 117.51 30.44 0.00 0.55 0.21 0.08 dm-0 0.00 0.00 0.00 0.00 0.00 0.00 1.12 0.00 1.91 1.85 0.00 dm-1 0.00 0.00 0.05 13.98 3.11 113.82 8.33 0.01 0.95 0.05 0.08 drbd0 0.00 0.00 0.02 12.63 0.87 101.04 8.06 0.09 6.98 0.13 0.16 # cat /proc/cpuinfo processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1995.005 cache size : 6144 KB physical id : 0 siblings : 4 core id : 0 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3992.90 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 1 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1995.005 cache size : 6144 KB physical id : 1 siblings : 4 core id : 0 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3990.02 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 2 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1995.005 cache size : 6144 KB physical id : 0 siblings : 4 core id : 2 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3990.00 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 3 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1995.005 cache size : 6144 KB physical id : 1 siblings : 4 core id : 2 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3990.04 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 4 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1995.005 cache size : 6144 KB physical id : 0 siblings : 4 core id : 1 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3990.06 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 5 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1995.005 cache size : 6144 KB physical id : 1 siblings : 4 core id : 1 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3989.98 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 6 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1995.005 cache size : 6144 KB physical id : 0 siblings : 4 core id : 3 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3990.05 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: processor : 7 vendor_id : GenuineIntel cpu family : 6 model : 23 model name : Intel(R) Xeon(R) CPU E5405 @ 2.00GHz stepping : 6 cpu MHz : 1995.005 cache size : 6144 KB physical id : 1 siblings : 4 core id : 3 cpu cores : 4 fpu : yes fpu_exception : yes cpuid level : 10 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm syscall nx lm constant_tsc pni monitor ds_cpl vmx tm2 cx16 xtpr lahf_lm bogomips : 3990.02 clflush size : 64 cache_alignment : 64 address sizes : 38 bits physical, 48 bits virtual power management: And the output of my "show full processlist" on my MySQL server and the "lsof -ni -P | grep mysql | wc -l" says I have 100 rows. The header output of my mytop command says: MySQL on 192.168.123.25 (5.0.67-community) up 4+16:02:36 [18:27:02] Queries: 2.9M qps: 8 Slow: 0.0 Se/In/Up/De(%): 11/00/00/00 qps now: 7 Slow qps: 0.0 Threads: 104 ( 2/ 89) 30/00/00/00 Key Efficiency: 99.7% Bps in/out: 0.0/ 0.3 Now in/out: 8.4/ 2.5k Thank you in advance for your time. Regards, Muffin

4 11

Re: Start Freeradius at boot
by Paul.Blalock＠gmail.com 29 Sep '09

29 Sep '09

I appreciate your insight, and I might have to go with a pre-built package after all. But I did go ahead and issue the commands, and when I run chkconfig --list radiusd This is what I get. radiusd 0:off 1:off 2:on 3:on 4:on 5:on 6:off According to the links that you sent me, this is what it is supposed to say, but the radiusd service still does not start at boot time, it still requires me to log on to the gnome desktop as root before the service will start.

3 2

DHCP routing bug (FreeRadius DHCP reply to Default Gateway)
by Pavel Malev 29 Sep '09

29 Sep '09

Hello! I have Freeradius 2.1.6 on freebsd6.2. Freebsd have Default Gateway: Destination Gateway Flags Refs Use Netif Expire default 192.168.2.150 UGS 0 7922 rl1 Default Gateway have mac-address: ? (192.168.2.150) at 00:30:48:35:31:32 on rl1 [ethernet] Freeradius receive DHCP-Discover: [tcpdump] 02:28:25.754215 00:0c:f1:4e:42:36 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 348: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:0c:f1:4e:42:36, length: 306 After authorization Freeradius send reply to Default Gateway(!), not to clinet: [tcpdump] 02:28:25.766341 00:30:4f:21:b4:73 > 00:30:48:35:31:32, ethertype IPv4 (0x0800), length 342: 192.168.2.252.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length: 300 If I delete Default Gateway - FreeRadius dont send anything. If I put "interface = rl1" in the listen{} section, I get error: /usr/local/etc/raddb/radiusd.conf[56]: System does not support binding to interfaces. Delete this line from the configuration file. FreeRadiusd debug messages: Received DHCP-Discover of id 2083766121 from 0.0.0.0:68 to 0.0.0.0:67 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 2083766121 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:0c:f1:4e:42:36 DHCP-Message-Type = DHCP-Discover DHCP-Auto-Config = 1 DHCP-Client-Identifier = 00:0c:f1:4e:42:36 DHCP-Requested-IP-Address = 169.254.184.172 DHCP-Hostname = "computer-4cacfb" DHCP-Vendor-Class-Identifier = "MSFT 5.0" DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery DHCP-Parameter-Request-List = DHCP-Static-Routes DHCP-Parameter-Request-List = 249 DHCP-Parameter-Request-List = DHCP-Vendor DHCP-Vendor = 0xdc00 Trying sub-section dhcp DHCP-Discover {...} +- entering group DHCP-Discover {...} expand: %{Packet-Dst-IP-Address} -> 0.0.0.0 ++[reply] returns noop rlm_perl: mac: 00:0c:f1:4e:42:36 rlm_perl: DB result: 192.168.2.1 rlm_perl: Added pair DHCP-Your-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Message-Type = DHCP-Discover rlm_perl: Added pair DHCP-Vendor-Class-Identifier = MSFT 5.0 rlm_perl: Added pair DHCP-Hop-Count = 0 rlm_perl: Added pair DHCP-Number-of-Seconds = 0 rlm_perl: Added pair DHCP-Client-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Gateway-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Hardware-Type = Ethernet rlm_perl: Added pair DHCP-Flags = 0 rlm_perl: Added pair DHCP-Hardware-Address-Length = 6 rlm_perl: Added pair DHCP-Hostname = computer-4cacfb rlm_perl: Added pair DHCP-Opcode = Client-Message rlm_perl: Added pair DHCP-Transaction-Id = 2083766121 rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Subnet-Mask rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Name rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Router-Address rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Domain-Name-Server rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS-Node-Type rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-NETBIOS rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Perform-Router-Discovery rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Static-Routes rlm_perl: Added pair DHCP-Parameter-Request-List = 249 rlm_perl: Added pair DHCP-Parameter-Request-List = DHCP-Vendor rlm_perl: Added pair DHCP-Client-Hardware-Address = 00:0c:f1:4e:42:36 rlm_perl: Added pair DHCP-Server-IP-Address = 0.0.0.0 rlm_perl: Added pair DHCP-Requested-IP-Address = 169.254.184.172 rlm_perl: Added pair DHCP-Auto-Config = 1 rlm_perl: Added pair DHCP-Vendor = 0xdc00 rlm_perl: Added pair DHCP-Client-Identifier = 00:0c:f1:4e:42:36 rlm_perl: Added pair DHCP-Your-IP-Address = 192.168.2.1 rlm_perl: Added pair DHCP-DHCP-Server-Identifier = 192.168.2.252 rlm_perl: Added pair DHCP-Subnet-Mask = 255.255.255.0 rlm_perl: Added pair DHCP-Gateway-IP-Address = 192.168.2.150 rlm_perl: Added pair DHCP-IP-Address-Lease-Time = 86400 rlm_perl: Added pair DHCP-Router-Address = 192.168.2.150 ++[perl] returns ok ++? if (ok) ? Evaluating (ok) -> TRUE ++? if (ok) -> TRUE ++- entering if (ok) {...} +++[reply] returns ok ++- if (ok) returns ok ++ ... skipping else for request 0: Preceding "if" was taken ++[ok] returns ok Sending -1022 of id 2083766121 from 0.0.0.0:67 to 0.0.0.0:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 2083766121 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 192.168.2.1 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = 00:0c:f1:4e:42:36 DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.2.150 DHCP-NTP-Servers = 192.168.2.150 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.2.252 Finished request 0. Cleaning up request 0 ID 2083766121 with timestamp +18 Going to the next request Ready to process requests. radiusd.conf: prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { ipaddr = * port = 67 type = dhcp # interface = rl1 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { <skiped> } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = no thread pool { <skiped> } client any { ipaddr = 0.0.0.0 netmask = 0 dhcp = yes } dhcp DHCP-Discover { update reply { DHCP-DHCP-Server-Identifier = "%{Packet-Dst-IP-Address}" } perl if (ok) { update reply { DHCP-Message-Type = DHCP-Offer DHCP-NTP-Servers = 193.111.126.2 } } else { update reply { DHCP-Message-Type = 0 } } ok } dhcp DHCP-Request { update reply { DHCP-DHCP-Server-Identifier = "%{Packet-Dst-IP-Address}" } perl if (ok) { update reply { DHCP-Message-Type = DHCP-ACK DHCP-NTP-Servers = 1.1.1.1 } } elsif (notfound) { update reply { DHCP-Message-Type = DHCP-NAK } } else { update reply { DHCP-Message-Type = 0 } } linelog ok } dhcp DHCP-Release { handled } dhcp DHCP-Inform { handled } dhcp { handled } modules { perl { module = ${raddbdir}/check.pl } $INCLUDE ${confdir}/modules/ } Is it possible to fix? Thank you, sorry for my English. Best regards, Pavel Malev

2 1

New install does not respond to requests
by Alex M 29 Sep '09

29 Sep '09

hey all we just upgraded from 1.x.x to latest version of FreeRadius unfortunately its aint working :( well i see config files have changed dramatically so maybe i did something wrong. What we did we installed everything, unquoted SQL module in dadiusd.config add proper MySQL info When i start in -X mode i don't see any errors but the half of the log is cut off (i guess output is too long) When I send request i'm getting response that client is unknown. (I did add nas info in the nas table) I fugue that SQL statements are not executed but how can i debug that? In sql config i enabled detailed output but it still does not show anything. I guess i'm doing something wrong and I hope i can get some help here? Thanks a lot!

4 5