April 2010 - Freeradius-Users - lists.freeradius.org

Segmentation fault
by Kristoffer Milligan 28 Apr '10

28 Apr '10

Hello again list, Thanks for the prompt reply on my previous inquiry regarding the compiling error. Worked perfectly with a new checkout. A new problem has arrived though. I am trying to do some authentication on the WiMAX platform. radiusd: FreeRADIUS Version 2.2.0, for host x86_64-unknown-linux-gnu, built on Apr 27 2010 at 08:06:03 Everything seems to be working fine. Client sends access request. server sends challenge. This happens back and forth as it should, the user is identified and the final challenges are ment to be exchanged: Wed Apr 28 09:04:01 2010 : Info: (6) [ttls] Got tunneled Access-Accept Wed Apr 28 09:04:01 2010 : Info: (6) [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. Followed by Sending Access-Challenge of id 39 to 192.168.106.11 port 1812 EAP-Message = 0x0107005f15800000005517030100503aaea6b28c1d5d90e71ec96d69f5846508965193166f92b750af976df6b0363867e15725dfc8a2370622601bc3e9487f6aa9843bf2e469cc773c7e9815c52e15755de3a962215e0674d1368fbab98f24 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x912a18ab942d0dffd8d9c931385c748e Wed Apr 28 09:04:01 2010 : Info: (6) Finished request 6. Wed Apr 28 09:04:01 2010 : Debug: Going to the next request Wed Apr 28 09:04:01 2010 : Debug: Waking up in 3.9 seconds. rad_recv: Access-Request packet from host 192.168.106.11 port 1812, id=40, length=194 User-Name = "{am=1}15a251baf3194e3ca5681323e82848a0(a)domain.tld" EAP-Message = 0x020700061500 Message-Authenticator = 0xfbce37cd2ed55658b94dbf0312e430fb NAS-Identifier = "AAALAB" NAS-IP-Address = 192.168.106.11 Calling-Station-Id = "00-12-CF-C7-4D-A8" WiMAX-BS-Id = 0x002f01010101 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 State = 0x912a18ab942d0dffd8d9c931385c748e Wed Apr 28 09:04:01 2010 : Info: (7) +- entering group authorize {...} Wed Apr 28 09:04:01 2010 : Info: (7) ++[preprocess] returns ok Wed Apr 28 09:04:01 2010 : Info: (7) ++[wimax] returns ok Wed Apr 28 09:04:01 2010 : Info: (7) ++[chap] returns noop Wed Apr 28 09:04:01 2010 : Info: (7) ++[mschap] returns noop Wed Apr 28 09:04:01 2010 : Info: (7) [suffix] Looking up realm domain.tld for User-Name = "{am=1}15a251baf3194e3ca5681323e82848a0(a)domain.tld" Wed Apr 28 09:04:01 2010 : Info: (7) [suffix] Found realm "domain.tld" Wed Apr 28 09:04:01 2010 : Info: (7) [suffix] Adding Stripped-User-Name = "{am=1}15a251baf3194e3ca5681323e82848a0" Wed Apr 28 09:04:01 2010 : Info: (7) [suffix] Adding Realm = "nextnet.no" Wed Apr 28 09:04:01 2010 : Info: (7) [suffix] Authentication realm is LOCAL. Wed Apr 28 09:04:01 2010 : Info: (7) ++[suffix] returns ok Wed Apr 28 09:04:01 2010 : Info: (7) [eap] EAP packet type response id 7 length 6 Wed Apr 28 09:04:01 2010 : Info: (7) [eap] Continuing tunnel setup. Wed Apr 28 09:04:01 2010 : Info: (7) ++[eap] returns ok Wed Apr 28 09:04:01 2010 : Info: (7) Found Auth-Type = EAP Wed Apr 28 09:04:01 2010 : Info: (7) +- entering group authenticate {...} Wed Apr 28 09:04:01 2010 : Info: (7) [eap] Request found, released from the list Wed Apr 28 09:04:01 2010 : Info: (7) [eap] EAP/ttls Wed Apr 28 09:04:01 2010 : Info: (7) [eap] processing type ttls Wed Apr 28 09:04:01 2010 : Info: (7) [ttls] Authenticate Wed Apr 28 09:04:01 2010 : Info: (7) [ttls] processing EAP-TLS Wed Apr 28 09:04:01 2010 : Info: (7) [ttls] Received TLS ACK Wed Apr 28 09:04:01 2010 : Info: (7) [ttls] ACK handshake is finished Wed Apr 28 09:04:01 2010 : Info: (7) [ttls] eaptls_verify returned 3 Wed Apr 28 09:04:01 2010 : Info: (7) [ttls] eaptls_process returned 3 Segmentation fault Any ideas why radiusd is segfaulting?

2 1

No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by Johnny R 27 Apr '10

27 Apr '10

Dear All, I am about deploying an AAA services: All authentication is centralized on my freeradius-server (on debian lenny), in the green zone behind ipcop in which I installed ipcop addons called copspot ( like chilispot) for the captive portal. The authentication worked well locally against openldap (in the same server). When an user try to connect to internet in the Blue Zone (WLAN), it generates the following error in the radius-server. I am really stuck here, any help will be welcome. Thu Apr 22 14:14:51 2010 : Debug: } Thu Apr 22 14:14:51 2010 : Debug: Listening on authentication address * port 1812 Thu Apr 22 14:14:51 2010 : Debug: Listening on accounting address * port 1813 Thu Apr 22 14:14:51 2010 : Debug: Listening on proxy address * port 1814 Thu Apr 22 14:14:51 2010 : Info: Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.1 port 32790, id=0, length=216 User-Name = "kkigor14" CHAP-Challenge = 0xd12e07a5f57980aa86a4aa049fc7bb40 CHAP-Password = 0x0005cff525e5508c82bc3ebb315c0b09e5 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.4.7 Calling-Station-Id = "00-21-63-6B-C8-40" Called-Station-Id = "00-08-74-D4-7A-F5" NAS-Identifier = "nas01" Acct-Session-Id = "4bd058be00000003" NAS-Port-Type = Wireless-802.11 NAS-Port = 3 Message-Authenticator = 0x5d8d6302e9684a55c2db247bdafc022e WISPr-Logoff-URL = "http://192.168.4.1:3990/logoff" Thu Apr 22 14:17:59 2010 : Info: +- entering group authorize {...} Thu Apr 22 14:17:59 2010 : Info: ++[preprocess] returns ok Thu Apr 22 14:17:59 2010 : Info: [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.2.1/auth-detail-20100422 Thu Apr 22 14:17:59 2010 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.2.1/auth-detail-20100422 Thu Apr 22 14:17:59 2010 : Info: [auth_log] expand: %t -> Thu Apr 22 14:17:59 2010 Thu Apr 22 14:17:59 2010 : Info: ++[auth_log] returns ok Thu Apr 22 14:17:59 2010 : Info: [suffix] No '@' in User-Name = "kkigor14", looking up realm NULL Thu Apr 22 14:17:59 2010 : Info: [suffix] No such realm "NULL" Thu Apr 22 14:17:59 2010 : Info: ++[suffix] returns noop Thu Apr 22 14:17:59 2010 : Info: [eap] No EAP-Message, not doing EAP Thu Apr 22 14:17:59 2010 : Info: ++[eap] returns noop Thu Apr 22 14:17:59 2010 : Info: ++[unix] returns notfound Thu Apr 22 14:17:59 2010 : Info: [ldap] performing user authorization for kkigor14 Thu Apr 22 14:17:59 2010 : Info: [ldap] expand: %{Stripped-User-Name} -> Thu Apr 22 14:17:59 2010 : Info: [ldap] ... expanding second conditional Thu Apr 22 14:17:59 2010 : Info: [ldap] expand: %{User-Name} -> kkigor14 Thu Apr 22 14:17:59 2010 : Info: [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=kkigor14) Thu Apr 22 14:17:59 2010 : Info: [ldap] expand: dc=csimaroc, dc=lan -> dc=csimaroc, dc=lan Thu Apr 22 14:17:59 2010 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Thu Apr 22 14:17:59 2010 : Debug: [ldap] ldap_get_conn: Got Id: 0 Thu Apr 22 14:17:59 2010 : Debug: [ldap] attempting LDAP reconnection Thu Apr 22 14:17:59 2010 : Debug: [ldap] (re)connect to 127.0.0.1:389, authentication 0 Thu Apr 22 14:17:59 2010 : Debug: [ldap] bind as / to 127.0.0.1:389 Thu Apr 22 14:17:59 2010 : Debug: [ldap] waiting for bind result ... Thu Apr 22 14:17:59 2010 : Debug: [ldap] Bind was successful Thu Apr 22 14:17:59 2010 : Debug: [ldap] performing search in dc=csimaroc, dc=lan, with filter (uid=kkigor14) Thu Apr 22 14:17:59 2010 : Info: [ldap] No default NMAS login sequence Thu Apr 22 14:17:59 2010 : Info: [ldap] looking for check items in directory... Thu Apr 22 14:17:59 2010 : Debug: [ldap] sambaNtPassword -> NT-Password == 0x4535334337353245323438413034353342353531353646383131303237453139 Thu Apr 22 14:17:59 2010 : Debug: [ldap] sambaLmPassword -> LM-Password == 0x4432433038394334374245444535364641414433423433354235313430344545 Thu Apr 22 14:17:59 2010 : Info: [ldap] looking for reply items in directory... Thu Apr 22 14:17:59 2010 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Thu Apr 22 14:17:59 2010 : Info: [ldap] user kkigor14 authorized to use remote access Thu Apr 22 14:17:59 2010 : Debug: [ldap] ldap_release_conn: Release Id: 0 Thu Apr 22 14:17:59 2010 : Info: ++[ldap] returns ok Thu Apr 22 14:17:59 2010 : Info: ++[expiration] returns noop Thu Apr 22 14:17:59 2010 : Info: ++[logintime] returns noop Thu Apr 22 14:17:59 2010 : Info: [pap] Normalizing NT-Password from hex encoding Thu Apr 22 14:17:59 2010 : Info: [pap] Normalizing LM-Password from hex encoding Thu Apr 22 14:17:59 2010 : Info: [pap] No clear-text password in the request. Not performing PAP. Thu Apr 22 14:17:59 2010 : Info: ++[pap] returns noop Thu Apr 22 14:17:59 2010 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Thu Apr 22 14:17:59 2010 : Info: Failed to authenticate the user. Thu Apr 22 14:17:59 2010 : Info: Using Post-Auth-Type Reject Thu Apr 22 14:17:59 2010 : Info: +- entering group REJECT {...} Thu Apr 22 14:17:59 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> kkigor14 Thu Apr 22 14:17:59 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Apr 22 14:17:59 2010 : Info: ++[attr_filter.access_reject] returns updated Thu Apr 22 14:17:59 2010 : Info: Delaying reject of request 0 for 1 seconds Thu Apr 22 14:17:59 2010 : Debug: Going to the next request Thu Apr 22 14:17:59 2010 : Debug: Waking up in 0.9 seconds. Thu Apr 22 14:18:00 2010 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 0 to 192.168.2.1 port 32790 Thu Apr 22 14:18:00 2010 : Debug: Waking up in 4.9 seconds. Thu Apr 22 14:18:05 2010 : Info: Cleaning up request 0 ID 0 with timestamp +188 Thu Apr 22 14:18:05 2010 : Info: Ready to process requests. All the Best -- ----------------------------------------------------------------- |JJohnny RANDRIAMAMPIONONA | | Phone: +212663682554 | | National School of Applied Sciences | | 1818 TANGIER 90000 | |----------------------------------------------------------------|

3 6

proxy based on number of numeric char.
by Agent Smith 27 Apr '10

27 Apr '10

I'd like to have a radius proxy setup where it can proxy users based on number of numeric characters in the userid. so for example, if the userid is abc123 (with 3 numeric char. at the end) it should proxy to an instance of radius running on the same box and if the user id is abcxxx it should proxy the request to a different instance of radius running on the same box, is this doable or did I miss something in the documentation?

2 2

Redundant Audit logs
by Natr Brazell 27 Apr '10

27 Apr '10

I have 3 geographically distributed Radius servers. I'd like all audit logs to go to a central log server. What is the best way? How do you all accomplish this? Please provide valid feedback or references. Thanks, N

2 1

accounting packets
by VU VAN HUNG 27 Apr '10

27 Apr '10

Hi all, I'm trying to implement radius accounting. I want to ask how I can know whether accounting packets are sent and received ? Hung,

2 4

Proxy EAP-TLS as non-EAP
by Alok Shingala 27 Apr '10

27 Apr '10

I am trying to setup FreeRadius server to handle EAP-TLS authentication with a WiMAX ASN GW. I have another Radius server which does not support EAP-TLS but stores the WiMAX QoS attribute values that need to be assigned to the user (user is identified by Calling-Station-ID). I have been going through all post archive for few days but have NOT been able to find a thread that directly answers my question. 1. How can I proxy the EAP-TLS request to a radius server which does not support EAP ? (I only need the Radius Attributes in the outer tunnel) 2. How can I add QoS attributes from the proxy-radius response to the outer-tunnel of the EAP-TLS response ? Highly appreciate any help from the community. Thanks and Regards, Alok

2 1

More complex Proxying
by Rosario Lumia 27 Apr '10

27 Apr '10

Hi to all, I'm not sure how can I configure freeradius to have this kind of configuration: try to account to home_server1; if fails try home_server2; else fail; A kind of failover but not exactly; my goal is to have one @realm for more authentication server. I read the "more complex configuration" but I'm not sure that I can apply this rule in proxy.conf and how. Thanks in advance. -- Rosario L.

2 3

Remote MySQL backend encryption
by Eric.Hernandez＠allegiantair.com 27 Apr '10

27 Apr '10

I see thats what I thought, I also confirmed its all clear text with tcpdump. If I were to switch my backend to an ldap system would I have encrypted traffic for user authentication with freeradius remote ldap/backend setup? Also is there a nas/radacct table equivalent in the ldap solution or is it strictly for user authentication? Message: 9 Date: Mon, 26 Apr 2010 15:04:17 -0400 From: John Dennis <jdennis(a)redhat.com> Subject: Re: Remote MySQL backend encryption To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4BD5E3B1.8060706(a)redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed On 04/26/2010 01:57 PM, Eric.Hernandez(a)allegiantair.com wrote: > Hi, > > I am trying to figure out if need to encrypt my traffic from a > FreeRadius server to a remote MySQL backend. > > I have the following setup. > > FreeRadius/MySQL (Server1) > > FreeRadius/MySQL (Server2) Both Server1 and Server2 are doing MySQL > Master to Master (ssl) Replication > > Now I want to add a third FreeRadius server without a local MySQL Backend. > > So this third server will point to either Server1 or Server2 which runs > MySQL but will these request be sent to the remote MySQL Servers in > clear text? This has nothing to do with how many MySQL servers you've got or how you're doing replication, encryption occurs on a per connection basis (e.g. connections established via rlm_sql_mysql). rlm_sql_mysql never opens an encrypted session with it's server because rlm_sql_mysql does not have an option to set SSL/TLS transport (e.g. does not call mysql_ssl_set()). That probably would be a good feature to add. -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Dynamic VLAN with AD/LDAP - Best Practice / preferred option?
by Gary Gatten 26 Apr '10

26 Apr '10

Hello all, I currently have FR v2.1.6 (Yes, I'll upgrade...) running on RHEL5. I'm authenticating VPN users and Ci$co device shell access using SAMBA/ntlm_auth integration. "Everything" is working fine. My next task is assigning Dynamic VLAN ID's. I have some test accounts/ports working using the "users" file, but I'm ready to take the next step to deploy DVLANs company wide, and want to assign the ID based on an AD/LDAP attribute. I prefer not to extend the schema and ideally would be able to assign the VLAN ID based on a "Group" attribute - so I don't have to go back and populate some attribute for a couple thousand users. Anyway, there are numerous posts about this issue / similar issues. I'm wondering if there is a "Best Practice" method or "Preferred" method to accomplish this? A method known to work better than another or works as well as anything but is "easy" to implement, etc. Or, is this one of those things where there is a dozen right answers and I just need to pick one and do it? Any thoughts appreciated! TIA! Gary

2 1

Freeradius against NAS Cisco 7206-VXR
by Wagner Pereira 26 Apr '10

26 Apr '10

Hi, all. Is there a How-To explaining how to implement Radius in this NAS? The IOS version is 12.2 Thanks. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Tel. (11) 3091-8901

2 2