May 2010 - Freeradius-Users - lists.freeradius.org

radiusd: segmentation fault
by Коньков Евгений 11 May '10

11 May '10

Help pls to resolve problem why radiusd segfault or give clue kes# radiusd -v radiusd: FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.1, built on Jan 6 2009 at 10:52:08 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. kes# uname -a FreeBSD kes.net.ua 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Sat Jan 3 01:15:39 EET 2009 kes@in.lan:/usr/obj/usr/src/sys/KES_KERN_v7 i386 I did not find any radiusd.core files in the system =( if any other infomation may usefull I can send Thank you

3 2

RE: framedipaddress
by Paweł Pogorzelski 11 May '10

11 May '10

Meru Networks Support replied me that "...Framed-IP-Address is not one of the attributes that we support." Is there anything that I can do? -- Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

3 2

Re: The client does not connect _*_*_*_
by hafthanhf 11 May '10

11 May '10

Alan DeKok-2 wrote: > > Martin Silvero wrote: >> Thu Sep 25 12:49:16 2008 : Debug: Ignoring request to authentication >> address * port 1812 from unknown client 10.0.42.250 > > Well... did you add that IP as a client in raddb/clients.conf? > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > hi Alan, I have the same problem with Martin, plz help me.. I added something in the raddb/clients.conf file as follow: client ipipgw { ipaddr = 192.168.6.201 secret = testing123 shortname = c3725 nastype = cisco login = user password = userpass } -- View this message in context: http://old.nabble.com/The-client-does-not-connect-_*_*_*_-tp19672841p284688… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 9

Freeradius 2.1.6: Store Cisco device "enable" password in Postgresql DB
by Difan Zhao 11 May '10

11 May '10

Hey guys, This should be a quick one. When I "enable" on a Cisco device, it sends a request with username "$enab15$". rad_recv: Access-Request packet from host 172.17.254.100 port 1645, id=92, length=84 NAS-IP-Address = 172.17.254.100 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "$enab15$" Calling-Station-Id = "172.17.1.1" User-Password = "password" Service-Type = Administrative-User I used to store the username and password in the "users" file and it was working fine: $enab15$ Cleartext-Password := "password" Now I am trying to move this user from the file to the postgresql DB and my "radcheck" table looks like: radius=# select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+----------- 1 | $enab15$ | Cleartext-Password | := | password And it doesn't work. Then I am checking the debug and I found that the "$" in the username was interpreted to something like "=24": [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '=24enab15=24' ORDER BY id Then I changed the username to this "=24enab15=24" and now it works. I am just curious how freeradius or %{SQL-User-Name} treats special characters in "username"... Is there a way to treat them AS-IS? Thank you! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. www.guest-tek.com Email: difan.zhao(a)guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514

3 5

radius not recieving username from cisco
by Athiqur Rahman 11 May '10

11 May '10

Hi, I have an as5300 IOS Version 12.2 and FreeRADIUS Version 2.1.8 When I open ppp connection to from windows xp laptop to my as5300 it is not sending the login credentials to the FreeRadius. FeeRadius says the username attribute was not found below is the snippet of debug output rad_recv: Accounting-Request packet from host 192.168.0.57 port 1646, id=211, length=97 NAS-IP-Address = 192.168.0.57 NAS-Port = 182 NAS-Port-Type = Async Called-Station-Id = "02081131234" Calling-Station-Id = "2075176623" Acct-Status-Type = Start Service-Type = Framed-User Acct-Session-Id = "0000006E" Framed-Protocol = PPP Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok *[acct_unique] WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistent * [acct_unique] Hashing 'NAS-Port = 182,Client-IP-Address = 217.73.64.57,NAS-IP-Address = 217.73.64.57,Acct-Session-Id = "0000006E",' [acct_unique] Acct-Unique-Session-ID = "93340c227b9a5bca". ++[acct_unique] returns ok [suffix] Proxy reply, or no User-Name. Ignoring. ++[suffix] returns ok ++[files] returns noop below is my aaa configuration. I just want to contact the radius for ppp connections aaa new-model aaa authentication login default local aaa authentication ppp default group radius aaa authorization network default none aaa accounting send stop-record authentication failure aaa accounting network default start-stop group radius

2 1

want client but not localhost
by dorra aa 10 May '10

10 May '10

Hello. I installed the radius on a computer and finally the test is successful locally. Now I want to do the test on another computer client.Should i install the Radius on this computer I'm writing ?or just in the terminal powered the second command: radtest .... But this does not work.because even if I install I get two Radius servers. I still do not understand this idea. Thank you for the enlightenment _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

1 0

2.1.8 doesn't include the certs/ directory for the debian package build
by liran tal 10 May '10

10 May '10

Hey Alan, Just a heads up for the next release. The 2.1.8 version doesn't include the certs/ directory files when building the debian package. Would be cool if you could push this change in the repo for the time being. Regards, Liran.

2 1

FreeRADIUS 1.1.7 and exec modules
by liran tal 10 May '10

10 May '10

Hey, Just to be sure I'm not banging my head around this - is it a known issue where for a defined exec module which is later used in the authorize { } section, if it returns -1 to reject the user then freeradius doesn't return an access-reject and the request simply times out? Debug log: rad_recv: Access-Request packet from host x.x.x.x:54545, id=150, length=59 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Thu May 6 18:45:00 2010 : Debug: Processing the authorize section of radiusd.conf Thu May 6 18:45:00 2010 : Debug: modcall: entering group authorize for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "preprocess" returns ok for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "chap" returns noop for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "mschap" returns noop for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 9 Thu May 6 18:45:00 2010 : Debug: rlm_realm: No '@' in User-Name = "test", looking up realm NULL Thu May 6 18:45:00 2010 : Debug: rlm_realm: No such realm "NULL" Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "suffix" returns noop for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling files (rlm_files) for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "files" returns notfound for request 9 Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: calling auth-script (rlm_exec) for request 9 Thu May 6 18:45:00 2010 : Debug: Exec-Program output: Access-Reject Thu May 6 18:45:00 2010 : Debug: Exec-Program-Wait: plaintext: Access-Reject Thu May 6 18:45:00 2010 : Debug: Exec-Program: returned: 255 Thu May 6 18:45:00 2010 : Error: rlm_exec (auth-script): External script failed Thu May 6 18:45:00 2010 : Debug: modsingle[authorize]: returned from auth-script (rlm_exec) for request 9 Thu May 6 18:45:00 2010 : Debug: modcall[authorize]: module "auth-script" returns fail for request 9 Thu May 6 18:45:00 2010 : Debug: modcall: leaving group authorize (returns fail) for request 9 Thu May 6 18:45:00 2010 : Debug: Finished request 9 Thu May 6 18:45:00 2010 : Debug: Going to the next request Thu May 6 18:45:00 2010 : Debug: --- Walking the entire request list --- Regards, Liran.

2 4

Log IP address (Calling-Station-Id?) of failed authentication attempts
by Matt Hite 10 May '10

10 May '10

Hello. I would like to log the client IP of failed & successful authentications to my RADIUS-enabled switches. Right now failed/success show up like this: radiusd[13877]: Login incorrect: [xyzzy] (from client SW-2745-C1.sv4 port 0) radiusd[13877]: Login OK: [plugh] (from client SW-2745-C1.sv4 port 0) It looks like I can possibly enable auth_badpass and auth_goodpass in radiusd.conf and then set: msg_goodpass = "%{Calling-Station-Id}" msg_badpass = "%{Calling-Station-Id}" Is this going about it the right way? Also, I really don't want the failed passwords to get logged. (I don't want to see my colleagues plain-text passwords.) If I do use the aforementioned technique, am I also going to see passwords? I'm guessing yes. Thanks for your help and insight. -M

2 2

RE: freenibs
by Mark 09 May '10

09 May '10

Hello list, I'd like to find out if anyone has had the experience installing freenibs onto an existing freeradius installation on fedora. The documentation that comes with the package is sorely lacking on the installation of the package onto an existing freeradius install and the google doesn't seem to be turning up anything. Feel free to drop me an email off list regarding this issue. Thanks in adv. Mark

2 2