October 2010 - Freeradius-Users - lists.freeradius.org

plpgsql freeradius authentication function
by Kafui Akyea 25 Oct '10

25 Oct '10

Hi I have a plpgsql function being called from freeradius to do authentication but i keep getting Access-Reject from radius although when i run the function without freeradius it works fine. Please find below the function and how i call it CREATE OR REPLACE FUNCTION try (your_name TEXT, tiger TEXT) RETURNS RECORD AS $$ DECLARE users_rec RECORD; BEGIN if tiger = '0000' then SELECT INTO users_rec * FROM aniradcheck WHERE username = your_name; else SELECT INTO users_rec * FROM radcheck WHERE username = your_name; end if; RETURN users_rec.username; END; $$ LANGUAGE plpgsql; SELECT id,username,attribute,op,value FROM try('7140944444','0000') as(id integer,username varchar,attribute varchar,op character,value varchar); Appreciate if you can help Thanks

4 11

Problems -- rad_verify: invalid signature (err=2)！（shared secret is incorrect）
by Xiaochen 25 Oct '10

25 Oct '10

Hi all, I am using Fedora 12 and Freeradius 1.2.9 to do some COA test. When AAA sends Disconnect-request to my AGW, the AGW reply with a Disconnect-ACK, and my MS disconnects. But the rad_verify says: ----------------------------------------------------------------------- Received Disconnect-ACK packet from clinet 100.1.6.4 port 3799 with invalid signature (err=2)! (shared secret is incorrect. ----------------------------------------------------------------------- In fact the shared secret is correct!!! My disconnect packt.txt is like: ----------------------------------------------------------------------- Acct-Session-Id="00000001" Calling-Station-Id="001E310008CC" User-Name="wimax(a)zte.com" X-Ascend-Session-Svr-Key="0123456789" NAS-IP-Address=100.1.6.4 NAS-Identifier=CATR WiMAX-DM-Action-Code="0xffff" WiMAX-AAA-Session-Id="00000002" ----------------------------------------------------------------------- I don’t know how to solve this problem, can you please give any suggestions? Thanks a lot! Xiaochen @ a WiMAX Lab

3 2

FR 2.1.11git, Dead home server status server reply - possible minor bug
by James J J Hooper 25 Oct '10

25 Oct '10

Hi Alan et al, {Running FR from GIT upto commit b42665d4475835f38fe71ef749e39cd22587bcfa, Sat Oct 9 17:52} Doing: /bin/echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 131, FreeRADIUS-Stats-Server-IP-Address = ".....", FreeRADIUS-Stats-Server-Port = 1812" | /usr/local/bin/radclient localhost:18120 status secret when the homeserver is "dead" I get back: Received response ID 178, code 2, length = 200 FreeRADIUS-Stats-Server-IP-Address = ..... FreeRADIUS-Stats-Server-Port = 1812 FreeRADIUS-Stats-Server-Outstanding-Requests = 0 FreeRADIUS-Stats-Server-State = Dead FreeRADIUS-Stats-Server-Time-Of-Death = "Jan 6 1970 18:54:00 UTC" FreeRADIUS-Total-Proxy-Access-Requests = 1651 FreeRADIUS-Total-Proxy-Access-Accepts = 122 FreeRADIUS-Total-Proxy-Access-Rejects = 60 FreeRADIUS-Total-Proxy-Access-Challenges = 1345 FreeRADIUS-Total-Proxy-Auth-Responses = 1527 FreeRADIUS-Total-Proxy-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Unknown-Types = 0 The date (Time-Of-Death) seems a little odd. I poked around in the code and got as far as the below, which looks possibly wrong, but I don't understand C enough to work out what to do with it from the surrounding code: /src/main/event.c: /* * Enable the zombie period when we notice that the home * server hasn't responded for a while. We back-date the * zombie period to when we last received a response from * the home server. */ home->state = HOME_STATE_ZOMBIE; home->zombie_period_start.tv_sec = home->last_packet; home->zombie_period_start.tv_sec = USEC / 2; {Apologies if I'm totally going in the wrong direction} Regards, James -- James J J Hooper Network Specialist Information Services University of Bristol http://www.wireless.bristol.ac.uk --

2 1

RE: How to raise numbers of request/sec in Freeradius
by Robin 25 Oct '10

25 Oct '10

Hi Alan, Thanks your reply firstly. I use Mysql to authentication. When I use a PPPOE client to call FreeRADIUS one time,that’s all ok. I create 200 pppoe accounts as dialing client in Mikrotik server. When I use them to call FreeRADIUS at the same time, I find only about 5-20 successful logins by sec. I don’t know how to increase the numbers? If you have any details information, I can provide to you. Expect to your help. Thank you very much! Robin -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Friday, October 22, 2010 5:18 PM To: FreeRadius users mailing list Subject: Re: How to raise numbers of request/sec in Freeradius Robin wrote: > I use the tools of Evolynx Radius Load Test to test number of request by > second. I find only max 20-25 requests/sec in Freeradius. > > > > Can I raise the number via editing configuration files? When authentication is from the "users" file, the server can do 10K requests/s. The issue isn't FreeRADIUS. It's something else. So... what are you doing with the authentication requests? Alan DeKok.

2 1

www.freeradius.org url link error
by Omer Faruk SEN 25 Oct '10

25 Oct '10

Hi, At http://freeradius.org/ for release 2.1.10 there is a clause Added RFCs 5607, 5904, and 5997. For 5607 http://ietf.org/rfc/rfc5607.txt But for others: http://ietf.org/rfc/rfc5904 and http://ietf.org/rfc/rfc5997 was used.They should be: http://ietf.org/rfc/rfc5904.txt http://ietf.org/rfc/rfc5997.txt No big deal. Just wanted to inform. Regards.

2 1

Re: freeradius proxy can't recognize Delegated-IPv6-Prefix attribute
by ichiro tanaka 24 Oct '10

24 Oct '10

thanks Alan. (i couldn't get your reply to my mailbox. so, i made a new mail. sorry...) > Fix the proxy so that it's using the dictionaries from 2.1.10. The >debug *claims* it's 2.1.10, but the Delegated-IPv6-Prefix attribute *is* >defined in the dictionaries for 2.1.10. > > Alan DeKok. My freeradius proxy already includes "dictionary.rfc4818". Do I need something? [[ radiusd -X ]] including configuration file /tmp/radius/etc/raddb/sites-enabled/default including configuration file /tmp/radius/etc/raddb/sites-enabled/inner-tunnel including dictionary file /tmp/radius/etc/raddb/dictionary main { prefix = "/tmp/radius" localstatedir = "/tmp/radius/var" [[ /tmp/radius/etc/raddb/dictionary ]] $INCLUDE /tmp/radius/share/freeradius/dictionary [[ /tmp/radius/share/freeradius/dictionary ]] $INCLUDE dictionary.rfc4679 $INCLUDE dictionary.rfc4818 ~~~~~~~~~~~~~~~~~~~~~~~~~~~ $INCLUDE dictionary.rfc4849 [[ dictionary.rfc4818 ]] ATTRIBUTE Delegated-IPv6-Prefix 123 ipv6prefix

3 5

LDAP authentication failed
by snowman5840 22 Oct '10

22 Oct '10

Hi i have some problems with LDAP authentication. If I login on my windows xp sp3 client i want to check die login credentials against my LDAP service. But the xp client uses doubleslashs in the username!! I think this will be the problem!? If I test with radtest it works. What can i do to succecsful login? Debug log: rad_recv: Access-Request packet from host 192.168.0.2 port 1812, id=62, length=240 NAS-IP-Address = 192.168.0.2 NAS-Port = 50009 NAS-Port-Type = Ethernet User-Name = "FIRMA1\\usera" Called-Station-Id = "00-15-F9-D8-7C-C9" Calling-Station-Id = "00-1A-4B-63-69-0B" Service-Type = Framed-User Framed-MTU = 1500 State = 0xc5fe953bc3f98c0b9575e677705364e2 EAP-Message = 0x0207006119001703010056b327be51594f6985d1854f17199fefe7151d57481c244787051f7067a50a0056a15e0a831a3aa3661a61aeed66e3c7dc85cd3315301bfd825c786fd60e0110f5124e76e2d543c9a6fd99371be7f1a9637b8ce527669f Message-Authenticator = 0xad6e1b5107c7af4b9a5ba3e648d65859 +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "FIRMA1\usera", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 74 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for FIRMA1\usera [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> FIRMA1\5cusera [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=FIRMA1\5cusera) [ldap] expand: dc=firma1,dc=de -> dc=firma1,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=firma1,dc=de, with filter (uid=FIRMA1\5cusera) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound Configuration part of LDAP module: ldap { server = "192.168.0.5" identity = "cn=admin,dc=firma1,dc=de" password = "xxxx" basedn = "dc=firma1,dc=de" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ...... } -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-authentication-failed-tp321786… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Activate LDAP group membership checking
by mic nightic 22 Oct '10

22 Oct '10

Hi, I'm trying to activate the LDAP group membership checking in FreeRadius. In my radiusd.conf i've modified the group checking section: groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = ou By looking in my openldap logs, freeradius is not even trying to search for the group. Do i have to activate something else to enable group checking? Thank you

2 2

How to raise numbers of request/sec in Freeradius
by Robin 22 Oct '10

22 Oct '10

Hi, I use Freeradius2 to authenticate user login. I use the tools of Evolynx Radius Load Test to test number of request by second. I find only max 20-25 requests/sec in Freeradius. Can I raise the number via editing configuration files? Thanks. Robin Lu

2 1

freeradius with NTLM authentication
by Ramzi Abdallah 22 Oct '10

22 Oct '10

I have configured freeradius version 2.1.9 with mySQL backend and Active Directory integration (NTLM) for the purpose of using it to authenticate users against firewall protected policies. So far it’s all working. When a user hits a firewall protected policy he is prompted to authenticate after which the radius query the AD for the username and password. If the user credentials are correct access is granted. The bit that I cannot figure out is how to let the Radius use NTLM to check if the user is already logged in the domain controller and if so not to prompt him for his username and password via the firewall captive portal. Is that doable or I missed the idea behind the Active Directory integration? thank you Ramzi

2 3