April 2010 - Freeradius-Users - lists.freeradius.org

Using Nas IP Adress as client "key"
by Johan Meiring 23 Apr '10

23 Apr '10

Hi all, The radius spec currently identifies a Nas (client) by the Nas's IP address (Packet-Src-Ip-Addres?). That is how radius works. We have a bunch of hotspots out in the field which could be behind any kind of internet connection. Broadband/Dynamic IP, natted, etc. Because we have no idea where a spesific Nas's traffic might come from we've implemented dynamic-clients. Using rlm_raw we use the Nas-Identifier to lookup the shared secret in a database, and the client gets dynamically created. (Thanks Alan for the help with this one!!) This works very well, but has a few irritating (not showstopping) side effects. 1) Sometimes we have more than one Nas behind the same natted connection. This means that they all have to have the same shared secret. 2) Also it happens that a different Nas ends up behind a previous Nas's IP (dynamically assigned broadband IP) and then the shared secret is again rejected. Within a corporate/large telco's network, the Nas's (802.11x switches or Dslams) are generally behind fixed IPs, but for the hotspot world any Nas source IP goes. Is it not a maybe a good idea to start considering a different "key" to identify the Nas by. In clients.conf (or for dynamic clients) a paramter ("nas-key") that could be Src-IP or Nas-Id. i.e. you can choose the "key" that identifies a spesific Nas/client and therefore the shared secret. Does it sound like a bad idea? How difficult would such a change in Freeradius be? (I've not read the source code yet, just throwing an idea out there). Opinions? PS: I realise that tunneling the radius traffic is a different solution to the same problem, but in our case not always easy to implement. (The only extra "layer" I would love to see is RadSec.) -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

3 2

Users file or mysql database; radpostauth table
by David Seira 23 Apr '10

23 Apr '10

Hi all! I'm trying to implement a freeradius server and I have several questions. The freeradius version used is 2.1.8. First of all, I want to put a freeradius to manage a net with about 400~500 users. I don't know which method for manage users choose; users file or mysql database? I think manage users with a file is faster but the management is worse and mysql database is easily management but I think is slower than other. What do you think about? Which is the best option? Another question is referent a freeradius + mysql. I do a test and save the users passwords with SHA1 in the radcheck table. Then I activated the radpostauth logging table. The problem is in this table (when a user is logged in) the pass is stored in plain-text, without encryption. Is possible to store the pass encrypted with SHA1 in radpostauth table? Thanks for all. Regards, David Seira

3 3

rlm_sql error, can't expand User-Password and Chap-Password, help me !
by VU VAN HUNG 23 Apr '10

23 Apr '10

Hi all, This is my first post. I'm trying to make a AAA server based on freeRadius and MySQL. After I configure radius server and run server in debug mode, I get some problem with rlm_sql about User-Password and Chap-Password. It seems that the server can't expand User-Password and Chap-Password. I don't know what's the problem. I hope that someones will give me advices. Here's my output from Radiusd -X command. rad_recv: Access-Request packet from host 192.168.0.6 port 1026, id=32, length=205 Sending duplicate reply to client RDLAB port 1026 - ID: 32 Sending Access-Challenge of id 32 to 192.168.0.6 port 1026 Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.0.6 port 1026, id=33, length=205 User-Name = "hung" NAS-IP-Address = 192.168.0.6 NAS-Port = 0 Called-Station-Id = "00-02-6F-59-85-C7:RADIUS_TEST" Calling-Station-Id = "00-17-C4-8C-2C-C8" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020a002b19001703010020abe3291179889948f4ed41e6b8102d58aae4dc0f8400550f1d2d2fe050cc2dcb State = 0x296e680f21647160f77444525cb5459d Message-Authenticator = 0xe4889cb8f5e0e5104d92e7d3b13eef2a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [hung] (from client RDLAB port 0 cli 00-17-C4-8C-2C-C8) +- entering group post-auth {...} [sql] expand: %{Stripped-User-Name} -> [sql] expand: %{User-Name} -> hung [sql] expand: %{%{User-Name}:-DEFAULT} -> hung [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> hung [sql] sql_set_user escaped user --> 'hung' [*sql] expand: %{User-Password} -> [sql] expand: %{Chap-Password} -> * [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'hung', '', 'Access-Accept', '2010-04-21 20:22:27') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'hung', '', 'Access-Accept', '2010-04-21 20:22:27') *rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: MYSQL check_error: 1054 received rlm_sql (sql) in sql_postauth: Database query error - Unknown column 'username' in 'field list'* rlm_sql (sql): Released sql socket id: 2 ++[sql] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> hung attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.0.6 port 1026, id=33, length=205 Waiting to send Access-Reject to client RDLAB port 1026 - ID: 33 Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 33 to 192.168.0.6 port 1026 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. Best, Vu Hung,

3 7

Radius Attribute --> Authenticator IP Adress
by _Stefan_H 22 Apr '10

22 Apr '10

Hi, I thought that my Access-Point is able to handle VLAN-Attributes like my Switch but I was wrong. I don't want to tell the whole story. Is there an attribute which returns the authenticator IP-Address? For instance: The Access-Point has the IP-Adress 192.168.10.254 and the default rule in the users-file looks like this: DEFAULT Authenticator-Adress == 192.168.10.254 Auth-Type = Accept I know thats nonsens but thats only an example to show you what I mean. I looked at this site: http://freeradius.org/rfc/rfc2865.html http://freeradius.org/rfc/rfc2865.html but the NAS-IP is not the right thing and i don't unterstand the explanation of http://freeradius.org/rfc/rfc2865.html#Login-IP-Host Login-IP-Host Please help me and I know that my english is not the best -- View this message in context: http://old.nabble.com/Radius-Attribute---%3E-Authenticator-IP-Adress-tp2830… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

RE: radiusd does not logging while debug
by Harry Hoffman 22 Apr '10

22 Apr '10

Well, stderr in a foreground process is normally stdout. -----Original Message----- From: Johan Meiring <jmeiring(a)pcservices.co.za> Sent: Thursday, April 22, 2010 1:09 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: radiusd does not logging while debug On 2010/04/22 06:45 PM, Alan DeKok wrote: > kes-kes(a)yandex.ru wrote: >> Hi, FreeRadius. >> >> How to force radiusd -X to do logging to log file too? > > $ radiusd -X> /var/log/radius/radius.log 2>&1 > Or for both file and console. radiusd -X 2>&1 | tee /var/log/radius/radius.log -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: radiusd does not logging while debug
by Harry Hoffman 22 Apr '10

22 Apr '10

Maybe (so you both see and log): Radiusd -X | tee -a /var/log/radius/radius-debug.log -----Original Message----- From: Alan DeKok <aland(a)deployingradius.com> Sent: Thursday, April 22, 2010 12:45 PM To: ??????? ??????? <kes-kes(a)yandex.ru>; FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: radiusd does not logging while debug kes-kes(a)yandex.ru wrote: > Hi, FreeRadius. > > How to force radiusd -X to do logging to log file too? $ radiusd -X > /var/log/radius/radius.log 2>&1 Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Zombie Infestation of Log file
by Benjamin Marvin 22 Apr '10

22 Apr '10

Good day, I'm trying to figure out why my servers continue to be marked zombie, even though they continue to handle traffic. There appears to be no impact, just seemingly erroneous - or at least unexplained - log entries. I have three 2.1.8 servers that feeds accounting to a 4th server (via copy_acct_to_homeserver), running 1.1.7. The primary servers also sends some auth (via proxy) and lots of acct (some via proxy, but also via copy_acct_to_homeserver) to a pair of Cisco ACS servers. The radius.log file for the primary servers show they are marking the 4th and Cisco (upstream) servers as zombie quite regularly (but not simultaneously); they thankfully never get marked dead. All of these servers are attached to the same Ethernet Switch with a slight detour through a Router that does VLAN routing between them; The Cisco servers also proxy to various other servers outside my network. I have a debug output from one of the servers that I have studied at length; I recorded the debug for 6 minutes or so before one of the servers was marked zombie. This is from a production machine with a fair amount of traffic, so the debug file is 9MBs. I'm not sure if it would be appropriate to post it to the mailing list. I'd be happy to post it. Do you want specific excerpts, or the whole thing? I've set the response_window to as high as 60 seconds in the clients.conf file and I keep the zombie_period at 20 seconds. I've also turned off the status_check feature as 1.1.7 and Cisco ACS do not appear to support it. The clients.conf file says that after the response_window is up (so 60 seconds) and "a" response is not received, that the server is marked Zombie. Based on what I see, I'm interpreting this as meaning that if one response is not seen in 60 seconds, even if hundreds of other responses were successfully sent and received during those 60 seconds, then the server is marked Zombie. At this point the Zombie_Period kicks in, and the moment "any" successful response is received the server is marked as completely alive. In my case the Zombie_Period is canceled immediately (though sadly the log does not seem to show when Zombie ends.) Odd to me is that occasionally a primary server will mark the same upstream server as Zombie multiple times over a handful of seconds, but the other two primary servers rarely mark upstream servers dead near the same time. I cannot find in the debug, or in packet captures, where a response went missing for a full minute, so I'm trying to find out what is happening. My upstream servers do not appear taxed or unresponsive. Perhaps there is some sort of malformed response I should be looking for? I also get radutmp errors about a wrong NAS ID, though on brief analysis it doesn't appear related. Any suggestions to help track this down and eliminate the error messages is greatly appreciated. -Benjamin

4 5

Dynamic Vlan assigment 802.1x with cisco
by Guillermo Borrallo 22 Apr '10

22 Apr '10

Hi, I have a problem to change vlan on a Catalyst 2950 switch using the 802.1x protocol. The problem is that no changes to the vlan you specified. The authentication and validation of the user is correct, but does not change vlan. Freeradius User Configuration: steve Cleartext-Password := "testing" Service-Type = Framed-User, Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 2 Switch 2950 configuration: aaa new-model aaa authentication login default local aaa authentication dot1x default group radius enable secret 5 $1$Hpyf$/AA8F3lVYES7KUq0abTqy. interface FastEthernet0/3 switchport mode access no ip address dot1x port-control auto interface Vlan1 ip address 192.168.250.250 255.255.255.0 no ip route-cache ip http server ip radius source-interface FastEthernet0/2 radius-server host 192.168.250.200 auth-port 1812 acct-port 1813 key password radius-server retransmit 3 no radius-server attribute nas-port privilege exec level 0 line show Right now, this created the vlan 1 and vlan 2 Thanks.Guillermo _________________________________________________________________ ¡Citas! ¡Ligues! ¿Salimos? ¿Cómo es tu pareja ideal? Búscala en el sitio nº1… ¡Regístrate ya! http://contactos.es.msn.com/?mtcmk=015352

3 4

DHCP with FreeRADIUS
by Jesús Jiménez 22 Apr '10

22 Apr '10

Hi, I'm having problems to configure the dhcp with freeradius (this is the first time :$) I have compiled it with the --with-dhcp option, and linked dhcp in sites-available. My dhcp server is 10.88.3.25 and the router is 10.88.3.1. I have only modified the dhcp configuration and the mac2ip file. This is the dhcp configuration: ______________________________________________ server dhcp { listen { ipaddr = * port = 67 type = "dhcp" interface = eth0 } dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } update reply { DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 } mac2ip ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } update reply { DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 DHCP-Gateway-IP-Address = 10.88.3.1 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } _________________________________________________ I put the mac adress in mac2ip and it works, here is the file: fa:b3:77:de:25:6b,10.88.3.20 When I launch it in debug mode I have this exit: _________________________________________________ # freeradius -XX Tue Apr 20 13:26:13 2010 : Info: FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Apr 20 2010 at 13:19:48 Tue Apr 20 13:26:13 2010 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Tue Apr 20 13:26:13 2010 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Apr 20 13:26:13 2010 : Info: PARTICULAR PURPOSE. Tue Apr 20 13:26:13 2010 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Apr 20 13:26:13 2010 : Info: GNU General Public License v2. Tue Apr 20 13:26:13 2010 : Info: Starting - reading configuration files ... Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/radiusd.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/proxy.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/clients.conf Tue Apr 20 13:26:13 2010 : Debug: including files in directory /etc/freeradius/modules/ Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/krb5 Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/always Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/realm Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/radutmp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/digest Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/perl Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/checkval Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sradutmp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ldap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/expiration Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ntlm_auth Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/preprocess Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/exec Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/pam Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/passwd Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/echo Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/chap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/inner-eap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/policy Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/counter Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail.log Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/unix Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mschap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/etc_group Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/files Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/smsotp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/wimax Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/acct_unique Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/cui Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/linelog Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/detail Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/sql_log Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/otp Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/pap Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/mac2ip Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/ippool Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/expr Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/attr_filter Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/modules/logintime Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/eap.conf Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/policy.conf Tue Apr 20 13:26:13 2010 : Debug: including files in directory /etc/freeradius/sites-enabled/ Tue Apr 20 13:26:13 2010 : Debug: including configuration file /etc/freeradius/sites-enabled/dhcp Tue Apr 20 13:26:13 2010 : Debug: main { Tue Apr 20 13:26:13 2010 : Debug: user = "freerad" Tue Apr 20 13:26:13 2010 : Debug: group = "freerad" Tue Apr 20 13:26:13 2010 : Debug: allow_core_dumps = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: including dictionary file /etc/freeradius/dictionary Tue Apr 20 13:26:13 2010 : Debug: main { Tue Apr 20 13:26:13 2010 : Debug: prefix = "/usr" Tue Apr 20 13:26:13 2010 : Debug: localstatedir = "/var" Tue Apr 20 13:26:13 2010 : Debug: logdir = "/var/log/freeradius" Tue Apr 20 13:26:13 2010 : Debug: libdir = "/usr/lib/freeradius" Tue Apr 20 13:26:13 2010 : Debug: radacctdir = "/var/log/freeradius/radacct" Tue Apr 20 13:26:13 2010 : Debug: hostname_lookups = no Tue Apr 20 13:26:13 2010 : Debug: max_request_time = 30 Tue Apr 20 13:26:13 2010 : Debug: cleanup_delay = 5 Tue Apr 20 13:26:13 2010 : Debug: max_requests = 1024 Tue Apr 20 13:26:13 2010 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Tue Apr 20 13:26:13 2010 : Debug: checkrad = "/usr/sbin/checkrad" Tue Apr 20 13:26:13 2010 : Debug: debug_level = 0 Tue Apr 20 13:26:13 2010 : Debug: proxy_requests = yes Tue Apr 20 13:26:13 2010 : Debug: log { Tue Apr 20 13:26:13 2010 : Debug: stripped_names = no Tue Apr 20 13:26:13 2010 : Debug: auth = no Tue Apr 20 13:26:13 2010 : Debug: auth_badpass = no Tue Apr 20 13:26:13 2010 : Debug: auth_goodpass = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: security { Tue Apr 20 13:26:13 2010 : Debug: max_attributes = 200 Tue Apr 20 13:26:13 2010 : Debug: reject_delay = 1 Tue Apr 20 13:26:13 2010 : Debug: status_server = yes Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue Apr 20 13:26:13 2010 : Debug: proxy server { Tue Apr 20 13:26:13 2010 : Debug: retry_delay = 5 Tue Apr 20 13:26:13 2010 : Debug: retry_count = 3 Tue Apr 20 13:26:13 2010 : Debug: default_fallback = no Tue Apr 20 13:26:13 2010 : Debug: dead_time = 120 Tue Apr 20 13:26:13 2010 : Debug: wake_all_if_all_dead = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: home_server localhost { Tue Apr 20 13:26:13 2010 : Debug: ipaddr = 127.0.0.1 Tue Apr 20 13:26:13 2010 : Debug: port = 1812 Tue Apr 20 13:26:13 2010 : Debug: type = "auth" Tue Apr 20 13:26:13 2010 : Debug: secret = "testing123" Tue Apr 20 13:26:13 2010 : Debug: response_window = 20 Tue Apr 20 13:26:13 2010 : Debug: max_outstanding = 65536 Tue Apr 20 13:26:13 2010 : Debug: require_message_authenticator = no Tue Apr 20 13:26:13 2010 : Debug: zombie_period = 40 Tue Apr 20 13:26:13 2010 : Debug: status_check = "status-server" Tue Apr 20 13:26:13 2010 : Debug: ping_interval = 30 Tue Apr 20 13:26:13 2010 : Debug: check_interval = 30 Tue Apr 20 13:26:13 2010 : Debug: num_answers_to_alive = 3 Tue Apr 20 13:26:13 2010 : Debug: num_pings_to_alive = 3 Tue Apr 20 13:26:13 2010 : Debug: revive_interval = 120 Tue Apr 20 13:26:13 2010 : Debug: status_check_timeout = 4 Tue Apr 20 13:26:13 2010 : Debug: irt = 2 Tue Apr 20 13:26:13 2010 : Debug: mrt = 16 Tue Apr 20 13:26:13 2010 : Debug: mrc = 5 Tue Apr 20 13:26:13 2010 : Debug: mrd = 30 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: home_server_pool my_auth_failover { Tue Apr 20 13:26:13 2010 : Debug: type = fail-over Tue Apr 20 13:26:13 2010 : Debug: home_server = localhost Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: realm example.com { Tue Apr 20 13:26:13 2010 : Debug: auth_pool = my_auth_failover Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: realm LOCAL { Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Clients #### Tue Apr 20 13:26:13 2010 : Debug: client localhost { Tue Apr 20 13:26:13 2010 : Debug: ipaddr = 127.0.0.1 Tue Apr 20 13:26:13 2010 : Debug: require_message_authenticator = no Tue Apr 20 13:26:13 2010 : Debug: secret = "testing123" Tue Apr 20 13:26:13 2010 : Debug: nastype = "other" Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Instantiating modules #### Tue Apr 20 13:26:13 2010 : Debug: instantiate { Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_exec Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating exec Tue Apr 20 13:26:13 2010 : Debug: exec { Tue Apr 20 13:26:13 2010 : Debug: wait = no Tue Apr 20 13:26:13 2010 : Debug: input_pairs = "request" Tue Apr 20 13:26:13 2010 : Debug: shell_escape = yes Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_expr, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_expr Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating expr Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_expiration, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_expiration Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating expiration Tue Apr 20 13:26:13 2010 : Debug: expiration { Tue Apr 20 13:26:13 2010 : Debug: reply-message = "Password Has Expired " Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_logintime, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_logintime Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating logintime Tue Apr 20 13:26:13 2010 : Debug: logintime { Tue Apr 20 13:26:13 2010 : Debug: reply-message = "You are calling outside your allowed timespan " Tue Apr 20 13:26:13 2010 : Debug: minimum-timeout = 60 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Loading Virtual Servers #### Tue Apr 20 13:26:13 2010 : Debug: server dhcp { Tue Apr 20 13:26:13 2010 : Debug: modules { Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp DHCP-Discover {...} for more modules to load Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_passwd, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_passwd Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating mac2ip Tue Apr 20 13:26:13 2010 : Debug: passwd mac2ip { Tue Apr 20 13:26:13 2010 : Debug: filename = "/etc/freeradius/mac2ip" Tue Apr 20 13:26:13 2010 : Debug: format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" Tue Apr 20 13:26:13 2010 : Debug: delimiter = "," Tue Apr 20 13:26:13 2010 : Debug: ignorenislike = yes Tue Apr 20 13:26:13 2010 : Debug: ignoreempty = yes Tue Apr 20 13:26:13 2010 : Debug: allowmultiplekeys = no Tue Apr 20 13:26:13 2010 : Debug: hashsize = 100 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no Tue Apr 20 13:26:13 2010 : Debug: (Loaded rlm_always, checking if it's valid) Tue Apr 20 13:26:13 2010 : Debug: Module: Linked to module rlm_always Tue Apr 20 13:26:13 2010 : Debug: Module: Instantiating ok Tue Apr 20 13:26:13 2010 : Debug: always ok { Tue Apr 20 13:26:13 2010 : Debug: rcode = "ok" Tue Apr 20 13:26:13 2010 : Debug: simulcount = 0 Tue Apr 20 13:26:13 2010 : Debug: mpp = no Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp DHCP-Request {...} for more modules to load Tue Apr 20 13:26:13 2010 : Debug: Module: Checking dhcp (null) {...} for more modules to load Tue Apr 20 13:26:13 2010 : Error: /etc/freeradius/sites-enabled/dhcp[49]: No name specified for Post-Auth-Type block Tue Apr 20 13:26:13 2010 : Debug: } # modules Tue Apr 20 13:26:13 2010 : Debug: } # server Tue Apr 20 13:26:13 2010 : Debug: server { Tue Apr 20 13:26:13 2010 : Debug: modules { Tue Apr 20 13:26:13 2010 : Debug: } # modules Tue Apr 20 13:26:13 2010 : Debug: } # server Tue Apr 20 13:26:13 2010 : Debug: radiusd: #### Opening IP addresses and Ports #### Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "auth" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 0 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "acct" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 0 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: listen { Tue Apr 20 13:26:13 2010 : Debug: type = "dhcp" Tue Apr 20 13:26:13 2010 : Debug: ipaddr = * Tue Apr 20 13:26:13 2010 : Debug: port = 67 Tue Apr 20 13:26:13 2010 : Debug: } Tue Apr 20 13:26:13 2010 : Debug: Listening on authentication address * port 1812 Tue Apr 20 13:26:13 2010 : Debug: Listening on accounting address * port 1813 Tue Apr 20 13:26:13 2010 : Debug: Listening on dhcp interface eth0 address * port 67 as server dhcp Tue Apr 20 13:26:13 2010 : Debug: Listening on proxy address * port 1814 Tue Apr 20 13:26:13 2010 : Info: Ready to process requests. ____________________________________________________ and when I receive a dhcp-discover I have this: ____________________________________________________ Received DHCP-Discover of id 2b60f030 from 0.0.0.0:68 to 255.255.255.255:67 0: 01 01 06 00 2b 60 f0 30 00 00 00 00 00 00 00 00 16: 00 00 00 00 00 00 00 00 00 00 00 00 fa b3 77 de 32: 25 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 01 37 0c 01 1c 02 03 0f 06 77 0c 2c 2f 1a 256: 79 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 272: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 DHCP-Opcode = Client-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 727773232 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 0.0.0.0 DHCP-Server-IP-Address = 0.0.0.0 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = fa:b3:77:de:25:6b DHCP-Message-Type = DHCP-Discover DHCP-Parameter-Request-List = DHCP-Subnet-Mask DHCP-Parameter-Request-List = DHCP-Broadcast-Address DHCP-Parameter-Request-List = DHCP-Time-Offset DHCP-Parameter-Request-List = DHCP-Router-Address DHCP-Parameter-Request-List = DHCP-Domain-Name DHCP-Parameter-Request-List = DHCP-Domain-Name-Server DHCP-Parameter-Request-List = DHCP-Domain-Search DHCP-Parameter-Request-List = DHCP-Hostname DHCP-Parameter-Request-List = DHCP-NETBIOS-Name-Servers DHCP-Parameter-Request-List = DHCP-NETBIOS DHCP-Parameter-Request-List = DHCP-Interface-MTU-Size DHCP-Parameter-Request-List = DHCP-Classless-Static-Route Tue Apr 20 13:29:27 2010 : Info: server dhcp { Tue Apr 20 13:29:27 2010 : Debug: Trying sub-section dhcp DHCP-Discover {...} Tue Apr 20 13:29:27 2010 : Info: +- entering group DHCP-Discover {...} Tue Apr 20 13:29:27 2010 : Info: ++[reply] returns noop Tue Apr 20 13:29:27 2010 : Info: ++[reply] returns noop Tue Apr 20 13:29:27 2010 : Info: [mac2ip] Added DHCP-Your-IP-Address: '10.88.3.20' to reply_items Tue Apr 20 13:29:27 2010 : Info: ++[mac2ip] returns ok Tue Apr 20 13:29:27 2010 : Info: ++[ok] returns ok Tue Apr 20 13:29:27 2010 : Info: } # server dhcp Sending DHCP-Offer of id 2b60f030 from 0.0.0.0:67 to 255.255.255.255:68 DHCP-Opcode = Server-Message DHCP-Hardware-Type = Ethernet DHCP-Hardware-Address-Length = 6 DHCP-Hop-Count = 0 DHCP-Transaction-Id = 727773232 DHCP-Number-of-Seconds = 0 DHCP-Flags = 0 DHCP-Client-IP-Address = 0.0.0.0 DHCP-Your-IP-Address = 10.88.3.20 DHCP-Server-IP-Address = 10.88.3.25 DHCP-Gateway-IP-Address = 0.0.0.0 DHCP-Client-Hardware-Address = fa:b3:77:de:25:6b DHCP-Server-Host-Name = "" DHCP-Boot-Filename = "" DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 10.88.3.1 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-Domain-Name-Server = 80.58.0.33 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 10.88.3.25 0: 02 01 06 00 2b 60 f0 30 00 00 00 00 00 00 00 00 16: 0a 58 03 14 0a 58 03 19 00 00 00 00 fa b3 77 de 32: 25 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 112: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 128: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 144: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 176: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 192: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 208: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 224: 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 240: 35 01 02 01 04 ff ff ff 00 03 04 0a 58 03 01 06 256: 08 50 3a 00 21 50 3a 00 21 33 04 00 01 51 80 36 272: 04 0a 58 03 19 ff 00 00 00 00 00 00 00 00 00 00 288: 00 00 00 00 00 00 00 00 00 00 00 00 Error on call sendmsg: Invalid argument errno = 22. _____________________________________________________ It looks like it's sending the dhcp response but with tcpdump I can't see anything (of the response), the I decided to see the code and went to the call sendmsg in src/lib/udpfromto.c and change this: << return sendmsg(s, &msgh, flags); << >> int res = sendmsg(s, &msgh, flags); if (res == -1){ perror("Error on call sendmsg"); printf("errno = %d. \n", errno); exit(1); } return res; >> I think its something of the configuration. I someone can help me I'll be really grateful. Sorry for my english :D Jewi.

2 2

Re: Zombie Infestation of Log file‏
by Benjamin Marvin 22 Apr '10

22 Apr '10

> usually because the remote server is not listening on its accounting > port or not configured for accounting - the proxy in the middle > doesn't get a response so cant respond to you - hence zombie. I don't believe this is my problem. The debug and packet captures show all of the accounting packets are replied to within the Response_Window and Max_Request_Time frames. (5-10 seconds being at the extreme high end of response times.) -Benjamin

2 1