March 2010 - Freeradius-Users - lists.freeradius.org

Problem changing secret in clients.conf
by Marta Jiménez García 28 Mar '10

28 Mar '10

Hello! I'm totally new in Linux, as well as in freeradius... I've installed version 2.1.8 in Linuxmint 7. I think everything in installation went ok... I succeed doing: $ radtest user password 127.0.0.1 10 testing123 with user/password the ones that I use to login in my computer. I get a response Access-Accept (I had some problems here because I wasn't able to get an accept using localhost instead of 127.0.0.1 ...) I'm now in the next step. I want to change the secret in clients.conf, so I made the change: #secret = testing123 secret = abracadabra I stopped radiusd and started again. $ radtest user password 127.0.0.1 10 abracadabra doesn't work any more... and I don't understand why... because I'm using the same word. *rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=146, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.)* I get this log: rad_recv: Access-Request packet from host 127.0.0.1 port 34217, id=146, length=60 User-Name = "mjimenez" User-Password = "\353\036\355h\203l\217\362\252\003\203P\270\223\342\231" NAS-IP-Address = 127.0.1.1 NAS-Port = 10 Sat Mar 27 18:59:31 2010 : Info: +- entering group authorize {...} Sat Mar 27 18:59:31 2010 : Info: ++[preprocess] returns ok Sat Mar 27 18:59:31 2010 : Info: ++[chap] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[mschap] returns noop Sat Mar 27 18:59:31 2010 : Info: [suffix] No '@' in User-Name = "mjimenez", looking up realm NULL Sat Mar 27 18:59:31 2010 : Info: [suffix] No such realm "NULL" Sat Mar 27 18:59:31 2010 : Info: ++[suffix] returns noop Sat Mar 27 18:59:31 2010 : Info: [eap] No EAP-Message, not doing EAP Sat Mar 27 18:59:31 2010 : Info: ++[eap] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[unix] returns updated Sat Mar 27 18:59:31 2010 : Info: ++[files] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[expiration] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[logintime] returns noop Sat Mar 27 18:59:31 2010 : Info: ++[pap] returns updated Sat Mar 27 18:59:31 2010 : Info: Found Auth-Type = PAP Sat Mar 27 18:59:31 2010 : Info: +- entering group PAP {...} Sat Mar 27 18:59:31 2010 : Info: [pap] login attempt with password "�?�h?l?��??P�?�?" Sat Mar 27 18:59:31 2010 : Info: [pap] Using CRYPT encryption. Sat Mar 27 18:59:31 2010 : Info: [pap] Passwords don't match Sat Mar 27 18:59:31 2010 : Info: ++[pap] returns reject Sat Mar 27 18:59:31 2010 : Info: Failed to authenticate the user. Sat Mar 27 18:59:31 2010 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Sat Mar 27 18:59:31 2010 : Info: Using Post-Auth-Type Reject Sat Mar 27 18:59:31 2010 : Info: +- entering group REJECT {...} Sat Mar 27 18:59:31 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> mjimenez Sat Mar 27 18:59:31 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Mar 27 18:59:31 2010 : Info: ++[attr_filter.access_reject] returns updated Sat Mar 27 18:59:31 2010 : Info: Delaying reject of request 0 for 1 seconds Sat Mar 27 18:59:31 2010 : Debug: Going to the next request Sat Mar 27 18:59:31 2010 : Debug: Waking up in 0.9 seconds. Sat Mar 27 18:59:32 2010 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 146 to 127.0.0.1 port 34217 Sat Mar 27 18:59:32 2010 : Debug: Waking up in 4.9 seconds. Sat Mar 27 18:59:37 2010 : Info: Cleaning up request 0 ID 146 with timestamp +9 When I had testing123 as secret, in User-Password I could see "my real password" and not "\353\036\355h\203l\217\362\252\00..."* * I have checked I have this line in radiusd.conf : $INCLUDE clients.conf * * Maybe is a stupid question and I've to change something more in another conf file. I've not started configuring my NAS yet... I was trying to configure radius first and checking with radtest step by step.* * Thank you in advance for any help you can give me, Marta

4 5

Help with executing accounting!
by Mohamed Abdulla 28 Mar '10

28 Mar '10

Hi All, I am new to using freeradius. I am in the process of integrating freeradius with "ipoque", which is a bandwidth control device. IPOQUE expects to see an accounting request from the radius server with specific attributes embedded, in order to control the bandwidth of the logged-in user. The scenario I am trying to realize is as follows: 1.. For each user wishing to authenticate with freeradius, I have added two attributes in "users.conf" file. The first attribute is "Framed-IP-Address", while the second is a VSA "ipoque-class". 2.. When the user successfully authenticate with the freeradius, and after the freeradius sends Access-Accept, I want the radclient.exe to automatically send Accounting request to ipoque, including the following: User-Name, Framed-IP-Address, Accounting-Status-Type= Start and ipoque-class as configured in users.conf file. This should inform ipoque device about the user IP and the class of that user in order to apply th proper bandwidth rules for that user category. I have started by creating a test user in users.conf as follows: shafzeen Auth-Type := Local, User-Password == "1234" Framed-IP-Address = "192.168.1.12", ipoque-class = "raduser" then I created a text file named "ipoquestart.txt" with the following content: User-Name = "%{User-Name}", Framed-IP-Address = "%{reply:Framed-IP-Address}", Acct-Status-Type = Start, ipoque-class = "%{reply:ipoque-class}" Then in the radiusd.conf, in the modules section I have defined the following (The ipoque device IP is 192.168.0.1, secret "prx"): exec Start { wait = yes program = "${bindir}/radclient.exe -d ${raddbdir} -f ${bindir}/ipoquestart.txt -x -s 192.168.1 acct prx" input_pairs = reply output_pairs = reply packet_type = Access-Accept } and in the instantiate section I have added Start. Also, in the post-auth I have put Start trying to send the radclient acct request towards ipoque. I have started freeradius in debug mode, and I noticed that the radclient is sending Framed-IP-Address as "0.0.0.0", and "ipoque-class"= "", and after that it is sending the reply with the needed values of Framed-IP-Address and "ipoque-class". I know there is some where something wrong I am doing, but I need someone to analyse what is happening and tell me how to correct it! Thanks

4 7

[Exit code]User logging in out from login-time
by rod~ 28 Mar '10

28 Mar '10

Hi all, I'm new to freeradius and I've got this question: What is the exit code for a user trying to authenticate outside the Login-time defined parameters? I need to get this code and then trigger an error message... Any help? Thanks a lot in advance. [ ]'s Rod Elias

2 1

Bug fixes on v2.1.8
by Sergio 27 Mar '10

27 Mar '10

Hi people, and developers, i can see that you finally fixed a bug that i and others like me mentioned at this forum at least one year ago. I'm glad to see it :) To be precise, i'm talking about the fix that "sign client certificates with CA, rather than server certs". And here i was, talking alone one year ago on this thread: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls) In spite of that, i'd like to say that freeradius is a great job, congratulations to its developers. I think is the most configurable server. OCSP would be great!! bye and thanks :) -- Sergio

1 0

Freeradius doesn't accept CoA-ACK or CoA-NAK.
by Rabidinov M.A. 27 Mar '10

27 Mar '10

Hi, Freeradius-users. I have configured Freeradius 2.1.8 to check online users in blocked table. On accept accounting request, freeradius asks a mysql table "blocked" for a login. If TRUE, freeradius server send CoA packet to disconnect PPPoE session. Freeradius server sends CoA packet to NAS, PPPoE session is droped and NAS send CoA-ACK, that pppoe session was droped. But freeradius doesn't recognize CoA-ACK and try more send CoA packet to NAS. NAS replys CoA-NAK, but freeradius doesn't recognize it too, and make 3-4 attempts to send CoA packet to NAS. Configs: iptv:~ # grep -v '#' /etc/raddb/sites-enabled/default .... accounting { detail unix radutmp sql attr_filter.accounting_response if ("%{Acct-Status-Type}" != "Stop") { if ("%{sql: SELECT username from blocked where username = '%{User-Name}'}") { update coa { User-Name = "%{User-Name}" Cisco-Account-Info = "S%{Framed-IP-Address}" Cisco-AVPair = "subscriber:command=account-logoff" } } } } .... iptv:~ # grep -v '#' /etc/raddb/sites-enabled/cisco7206 home_server cisco7206 { type = coa ipaddr = xx.xx.64.94 port = 1700 secret = xxxx retry_count = 1 coa { irt = 1 mrt = 1 mrc = 10 mrd = 5 } } home_server_pool coa { type = fail-over home_server = cisco7206 } iptv:~ # grep -v '#' /etc/raddb/clients.conf client xx.xx.64.94 { secret = xxxxx nastype = cisco coa_server = cisco7206 } ***************************************** Debug: Sending CoA-Request of id 10 to xx.xx.64.94 port 1700 User-Name = "tuxper" Cisco-Account-Info = "Syy.yy.30.2" Cisco-AVPair = "subscriber:command=account-logoff" Finished request 8. Cleaning up request 8 ID 98 with timestamp +248 Going to the next request Waking up in 2.1 seconds. rad_recv: CoA-ACK packet from host xx.xx.64.94 port 1700, id=10, length=82 Ignoring proxy reply that arrived after we sent a reply to the NAS Waking up in 2.1 seconds. rad_recv: Accounting-Request packet from host xx.xx.64.94 port 1646, id=102, length=467 Acct-Session-Id = "000001A2" Framed-Protocol = PPP Framed-Route = "yy.yy.26.196 255.255.255.252 0.0.0.0 12" Framed-Route = "yy.yy.30.100 255.255.255.252 0.0.0.0 12" Framed-IP-Address = yy.yy.30.2 Cisco-AVPair = "ppp-disconnect-cause=Lower Layer disconnected" User-Name = "tuxper" Acct-Authentic = RADIUS Cisco-AVPair = "connect-progress=LAN Ses Up" Cisco-AVPair = "nas-tx-speed=1000000000" Cisco-AVPair = "nas-rx-speed=1000000000" Acct-Session-Time = 57 Acct-Input-Octets = 1411 Acct-Output-Octets = 208 Acct-Input-Packets = 17 Acct-Output-Packets = 11 Acct-Terminate-Cause = User-Request Cisco-AVPair = "disc-cause-ext=TS User Exit" Acct-Status-Type = Stop Calling-Station-Id = "00-26-b6-11-7b-84" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/2/25" Cisco-AVPair = "client-mac-address=0026.b611.7b84" Service-Type = Framed-User NAS-IP-Address = xx.xx.64.94 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = xx.xx.64.94,NAS-IP-Address = xx.xx.64.94,Acct-Session-Id = "000001A2",User-Name = "tuxper"' [acct_unique] Acct-Unique-Session-ID = "139952617a244d89". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "tuxper", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/xx.xx.64.94/detail-20100325 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/xx.xx.64.94/detail-20100325 [detail] expand: %t -> Thu Mar 25 10:03:51 2010 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> tuxper ++[radutmp] returns ok [sql] expand: %{User-Name} -> tuxper [sql] sql_set_user escaped user --> 'tuxper' [sql] expand: %{Acct-Input-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Input-Octets} -> 1411 [sql] expand: %{Acct-Output-Gigawords} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Output-Octets} -> 208 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2010-03-25 10:03:51', acctsessiontime = '57', acctinputoctets = '0' << 32 | '1411', acctoutputoctets = '0' << 32 | rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> tuxper attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated ++? if ("%{Acct-Status-Type}" != "Stop") expand: %{Acct-Status-Type} -> Stop ? Evaluating ("%{Acct-Status-Type}" != "Stop") -> FALSE ++? if ("%{Acct-Status-Type}" != "Stop") -> FALSE Sending Accounting-Response of id 102 to xx.xx.64.94 port 1646 Finished request 9. Cleaning up request 9 ID 102 with timestamp +248 Going to the next request Waking up in 2.1 seconds. Sending CoA-Request of id 10 to xx.xx.64.94 port 1700 User-Name = "tuxper" Cisco-Account-Info = "Syy.yy.30.2" Cisco-AVPair = "subscriber:command=account-logoff" Waking up in 4.0 seconds. rad_recv: CoA-NAK packet from host xx.xx.64.94 port 1700, id=10, length=57 No outstanding request was found for reply from host xx.xx.64.94 port 1700 - ID 10 Waking up in 4.0 seconds. Sending CoA-Request of id 10 to xx.xx.64.94 port 1700 User-Name = "tuxper" Cisco-Account-Info = "Syy.yy.30.2" Cisco-AVPair = "subscriber:command=account-logoff" Waking up in 8.2 seconds. rad_recv: CoA-NAK packet from host xx.xx.64.94 port 1700, id=10, length=57 No outstanding request was found for reply from host xx.xx.64.94 port 1700 - ID 10 Waking up in 8.2 seconds. Sending CoA-Request of id 10 to xx.xx.64.94 port 1700 User-Name = "tuxper" Cisco-Account-Info = "Syy.yy.30.2" Cisco-AVPair = "subscriber:command=account-logoff" Waking up in 15.5 seconds. rad_recv: CoA-NAK packet from host xx.xx.64.94 port 1700, id=10, length=57 No outstanding request was found for reply from host xx.xx.64.94 port 1700 - ID 10 Waking up in 15.4 seconds. No response to CoA request sent to xx.xx.64.94 Finished request 8. Cleaning up request 8 ID 98 with timestamp +248 Ready to process requests. P.S. If send Disconnect Packet to NAS, Freeradius doesn't recognize Disconnect-ACK and Disconnect-NAK from NAS too. -- С уважением, Rabidinov mailto:tuxper@mail.ru

2 3

Using Groups to Limit Authentication to Network Devices
by Doug Warner 27 Mar '10

27 Mar '10

I'm trying to setup freeradius to authenticate users via LDAP but pull group information via MySQL. I currently only need radius for authentication to network devices (switches, PDUs, etc) but want to make sure I set it up so that I don't shoot myself in the foot later. In trying to get the correct attributes assigned to a group I've noticed that I need to set Fall-Through on each group that a user belongs to in order to have later groups evaluated. Is there a better way that I can say something like, "this client should check for access from these groups" so that I only need to set Fall-Through on certain groups instead of all? -Doug

3 3

Insert Realm in mysql
by Rabidinov M.A. 27 Mar '10

27 Mar '10

Hello, Freeradius-users. I use freeradius 2.1.8 with MySQL. Freeradius doesn't insert realm into radacct table. Config: iptv:~ # grep -v '#' /etc/raddb/sql/mysql/dialup.conf ..... accounting_start_query = " \ INSERT INTO ${acct_table1} \ (acctsessionid, acctuniqueid, username, \ realm, nasipaddress, nasportid, \ nasporttype, acctstarttime, acctstoptime, \ acctsessiontime, acctauthentic, connectinfo_start, \ connectinfo_stop, acctinputoctets, acctoutputoctets, \ calledstationid, callingstationid, acctterminatecause, \ servicetype, framedprotocol, framedipaddress, \ acctstartdelay, acctstopdelay, xascendsessionsvrkey, service_info) \ VALUES \ ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', \ '%{NAS-Port-Type}', '%S', NULL, \ '0', '%{Acct-Authentic}', '%{Connect-Info}', \ '', '0', '0', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}','%{Cisco-Service-Info}')" ..... iptv:~ # grep -v '#' /etc/raddb/sites-enabled/default authorize { preprocess chap mschap suffix sql expiration logintime pap } ############################################# Debug: ......... rad_recv: Accounting-Request packet from host xx.xx.64.94 port 1646, id=219, length=191 Acct-Session-Id = "0000029D" Framed-Protocol = PPP User-Name = "tuxper@un" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS Acct-Status-Type = Start Calling-Station-Id = "00-26-b6-11-7b-84" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/2/25" Cisco-AVPair = "client-mac-address=0026.b611.7b84" Service-Type = Framed-User NAS-IP-Address = xx.xx.64.94 Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 0,Client-IP-Address = xx.xx.64.94,NAS-IP-Address = xx.xx.64.94,Acct-Session-Id = "0000029D",User-Name = "tuxper@un"' [acct_unique] Acct-Unique-Session-ID = "cb3670aee40aafa5". ++[acct_unique] returns ok [suffix] Looking up realm "un" for User-Name = "tuxper@un" [suffix] No such realm "un" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "tuxper@un", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/xx.xx.64.94/detail-20100327 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/xx.xx.64.94/detail-20100327 [detail] expand: %t -> Sat Mar 27 12:08:37 2010 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> tuxper@un ++[radutmp] returns ok [sql] expand: %{User-Name} -> tuxper@un [sql] sql_set_user escaped user --> 'tuxper@un' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey, service_info) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey, service_info) VALUES ('0000029D', 'cb3670aee40aafa5', 'tuxper@un', '', 'xx.xx.64.94', '0/0/2/25', 'Virtual', '2010-03-27 12:08:37', NULL, '0', 'RADIUS', '', '', '0', '0', '', '00-26-b6-11-7b-84', '', 'Framed-User', 'PPP', '', '0', '0', '','') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok .... As seen, there is no any data in %{Realm}. -- С уважением, Rabidinov mailto:tuxper@mail.ru

2 1

Howto ignore phase1 identity EAP-PEAP +mschapv2+openldap
by Fred MAISON 26 Mar '10

26 Mar '10

Hello freeradius-users, I search a way to ignore phase1 identity and avoid ldap access during phase1 for EAP-PEAP/mschapv2 I try to migrate a freeradius V1 eap + ldap instance to freeradius V2.1.8. (+1200 NAS, many kind of AP mostly Cisco, all sort of supplicants on XPSP2/SP3, MacOSX, unknown cash registers and so on all around the world ...) As I understand starting from V1 configs is always a BAD idea, I started from a default 2.1.8, with sites-enables as default and inner-tunnel, with ldap. authorize must check user has some radiusgroup-name attribute in ldap authenticate user in ldap. According to customer : For phase 1 (outter) : * no check has to be done on phase 1 (ignore outer identity, etc ...) * a huntgroup hotspot is assigned during outer preprocess For phase 2 (inner) : use inner identity to check if user has correct radiusgroup-name attribute use inner identity to validate user/password, mostly using eap-peap with mschapv2 without ntlm_auth from samba installed. I have a basic setup which seems to work (eapol-test compiled from hostapd sources), but generate a lot of logs and ldap access during phase1. It also fails if outter identity is unknown in ldap (anonymous or other fancy id encoutered in customer's freeradius v1 production auth_logs ...) I have eapol_test log and freeradius -X available. Would you have some guideline to achieve this ? Best regards Fred

2 1

EAP-PEAP - MSCHAPV2 option not working
by dev nath 26 Mar '10

26 Mar '10

Hi, I am trying to authenticate my xsupplicant with freeradius using PEAP option, but seems to fail with the below error message. Complete debug message is attached to the email. [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for peerless with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject I have tried following in my users file David User-Password=="freeradius" ---also David Auth-Type=Local, Password = "freeradius" Both does not seem to work. Please help me. Regards, Dev

4 4

freeradius 2.1.8 dies Error: ASSERT FAILED event.c[1084]: home->ev != NULL
by fab junkmail 25 Mar '10

25 Mar '10

I recently upgraded our freeradius servers to 2.1.8 and over the past month it has died on one of the servers two times (spaced about two weeks apart I think). So fairly infrequently. A bit of background, We use this server predominantly to proxy requests. Every day for about 15 minutes, the two main home servers we proxy to stop responding (they are doing backups or maintenance during this time) so for those 15 minutes our clients (LNS/NAS) would be sending a very large number of accounting interim packets and some stop packets and would be resending these while the home servers are down. Some relevant proxy home server settings we currently use for the main home servers we proxy to: response_window = 14 zombie_period = 40 status_check = status-server check_interval = 30 num_answers_to_alive = 3 The times that freeradius has died has been near the end of the 15 minutes of the home servers downtime. The last time this happened, I noticed logs in the attached file. Ones that sound relevant as follows: Sun Mar 14 17:30:15 2010 : Proxy: Marking home server 10.0.1.48 port 1646 as zombie (it looks like it is dead). Sun Mar 14 17:30:16 2010 : Proxy: Marking home server 10.0.1.47 port 1646 as zombie (it looks like it is dead). Sun Mar 14 17:30:19 2010 : Proxy: Marking home server 10.0.1.47 port 1645 as zombie (it looks like it is dead). Sun Mar 14 17:30:19 2010 : Error: No response to status check 903535 for home server 10.0.1.48 port 1646 Sun Mar 14 17:30:20 2010 : Error: No response to status check 903536 for home server 10.0.1.47 port 1646 ... Sun Mar 14 17:30:32 2010 : Error: Internal sanity check failed for child state ... Fri Mar 19 17:30:54 2010 : Proxy: Failed to create a new socket for proxying requests. Fri Mar 19 17:30:54 2010 : Proxy: Failed to create a new socket for proxying requests. Fri Mar 19 17:30:54 2010 : Proxy: Failed to create a new socket for proxying requests. ... Fri Mar 19 17:30:56 2010 : Error: ASSERT FAILED event.c[1084]: home->ev != NULL That last one is where it dies I think. That last error seems a bit similar (but a bit different) to the following thread: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg58052.… ">Re: ASSERT FAILED event.c in 2.1.7 >Alan DeKok >Fri, 25 Sep 2009 01:19:40 -0700 > >Maja Wolniewicz wrote: >> After the upgrade from 2.1.6 to 2.1.7 my two servers died 3-4 times >> daily with the following error: >> >> Thu Sep 24 19:07:13 2009 : Error: Received conflicting packet from >> client AP-8 port 32777 - ID: 240 due to unfinished request 2396. Giving >> up on old request. >> Thu Sep 24 19:07:13 2009 : Error: ASSERT FAILED event.c[2682]: >> request->ev != NULL >> >> I have to return to 2.1.6, which works smoothly. > > The simplest thing to do in the short term is to delete the assertion. > > Alan DeKok. " That one was found to be a bug and was fixed - I don't know if my case is a bug though. Another thread that sounds useful for this is: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg59985.… "... >Until then, configuring status-checks && local detail files will >definitely help. I would recommend doing that *anyways* for network >stability. > >Alan DeKok." I don't currently use the robust proxy accounting that that thread suggests. I expect that would probably work around the issue of freeradius crashing in this case and I will give that a go. Just posting this to let you know that it _might_ be a bug and to ask for advice about whether you think this is a bug or not, and if I should follow up on that, or if you think it is just my configuration that needs some changes and what areas I should concentrate on if that is the case? Regards, Anthony

2 3